Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email

This threat involves a phishing campaign delivering AgentTesla malware through emails that impersonate business proposal requests. The malicious ZIP attachment contains an executable masquerading as a café management application with Chinese descriptions. The malware employs multiple obfuscation stages, including extracting encrypted data from bitmap resources and XOR decryption, to load successive .NET payloads into memory. The final payload, AgentTesla, is an infostealer that harvests credentials, cookies, and contact data from various applications and exfiltrates this information via FTP to an attacker-controlled server. The campaign demonstrates advanced multi-stage loading and social engineering tactics targeting business users.

AgentTesla infostealer compromises user credentials, cookies, and contact information from browsers, email clients, FTP, and VPN applications. This can lead to unauthorized access to sensitive accounts and systems. Data exfiltration via FTP to a compromised server enables attackers to collect stolen information for further malicious use. The phishing vector and multi-stage obfuscation increase the likelihood of successful infection among targeted business users.

No official patch or fix applies as this is malware delivered via phishing. Mitigation should focus on user awareness to recognize phishing emails, avoiding opening unexpected attachments, and using endpoint protection capable of detecting AgentTesla and its obfuscation techniques. Network monitoring for suspicious FTP traffic to unknown domains may help detect exfiltration attempts. Since no vendor advisory or patch is available, organizations should rely on security controls and user training to reduce risk.