04 – Uncovering the Final Stage Payload and Identifying the Malware Family (it’s AgentTesla)

Summary: The video discusses the final stage of a malware analysis series, focusing on a PE file identified as “stage 3” derived from previous exploits. The analysis highlights the process of decompiling the malware using tools like DN Spy and reveals configurations and capabilities of the identified Agent Tesla malware.

Keypoints:

• The series covers the analysis of a malware that uses an RTF document exploit.
• A specific file, referred to as “stage 3. PE,” was extracted using CyberChef.
• Basic analysis revealed that the PE file is a .NET binary, frequently used as a downloader or dropper.
• Strings extracted indicate possible information sent back to a command and control server, such as computer names and IP addresses.
• DN Spy confirms the presence of anti-analysis techniques in the malware’s code.
• Code flattening is noted in the malware, complicating code tracing and understanding the execution flow.
• Key logger capabilities and configuration details pertaining to Agent Tesla malware were discovered during the analysis.
• Open-source tools like VirusTotal and Malware Bazaar were utilized to identify the malware and confirm its classification.
• The video concludes by encouraging viewer interaction and feedback for future analysis topics.