Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Weaponization of Excel Add-Ins Part 1: Malicious XLL Files and Agent Tesla Case Studies

Summary: Between July 27 and Dec. 1, 2021, Unit 42 observed a surge of Agent Tesla and Dridex samples dropped via Excel add-ins (XLL) and Office 4.0 macros, with XLL droppers delivering both malware families and Excel 4.0 macros mainly delivering Dridex. The XLL files were distributed through emails with price-quote lures sent from an abcovid[.]tech address under the subject "INQUIRY," targeting manufacturing, retail, government, finance, pharmaceuticals, transportation and education organizations across the United States, Europe and Southeast Asia, and some abused the legitimate open-source Excel-DNA framework to load a compressed .NET assembly into memory.

Bottom line: Excel will load and execute an XLL on double-click, and the Excel-DNA samples carry more than 10,000 exported functions against a Yara PE export parsing limit of 8,192, so rules targeting export names above that index will not match. The final Agent Tesla payload exfiltrates browser, mail, FTP, VPN and Windows Vault credentials to phantom1248@yandex[.]com over SMTP.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related