Analyzing the Various Layers of Agent Tesla’s Packing
Summary: Unit 42 analyzed a PE32 AgentTesla sample seen in the wild on August 29 with hash ca29bd44fc1c4ec031eadf89fb2894bbe646bc0cafb6242a7631f7404ef7d15c, tracing its custom packer through a .NET first stage, a decoded rp.dll, a 192x192 PNG whose pixel RGB values carry the next payload, and a final .NET binary. The final stage decrypts strings with AES-CBC using a hardcoded password, salt and IV derived via a modified PBKDF1, and the researcher found the same static values and SMTP credentials across samples hosted on b-f-v[.]info, some created two days after the analyzed sample.
What's compelling: Because the AES key material and IV never change between samples, anyone holding one AgentTesla binary can decrypt the configuration of every other build - and the site hosting fresh variants was publishing new ones within two days of the sample analyzed here.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026