Infostealer Being Distributed via Spam Email (AgentTesla)

AhnLab Security Emergency response Center (ASEC) spotted the AgentTesla Infostealer being distributed through an email in the form of a malicious BAT file. When the BAT file is executed, it employs the fileless method to run AgentTesla (EXE) without creating the file on the user’s PC. This blog post will provide an explanation of the distribution process, from the spam email to the final binary (AgentTesla), along with related techniques.

Figure 1 shows the body of the spam email distributing …

agenttesla ahnlab asec bat bat file blog blog post center distributed email emergency file fileless infostealer malicious malware analysis response run security spam spam email