Summary

The Negasteal malware first appeared in 2017 with the same command and control panel and communication protocol features of Agent Tesla which first appeared in 2015.

The current malspam campaign utilizes social engineering in which the email contains product inquiry or purchase order inquiry sent to marketing officers of different companies. A version of Negasteal malware which is compiled by AutoIT was delivered via email to steal credentials and log keystrokes from various Windows applications. The AutoIt is a scripting language intended to automate basic tasks in Windows graphical user interface (GUI), to obfuscate malware binary and evade security detection.

Another version of Negasteal used removable drives as new delivery vector to steal credentials from applications FTPGetter and Becky! Internet Mail. This Trojan-Spyware sends the data it gathers from its victims to the email address of the malware author via Simple Mail Transfer Protocol (SMTP).

This Trojan-Spyware gathers the following data and sends it to its servers:

• Computer information (OS version, computer name, OS version platform, IP address, user name, physical memory size)
• Hardware information (processor name, video card name, video card memory)
• Browser's user names and passwords
• File Transfer Protocol (FTP) clients or file manager software stored account information
• Email credentials of popular mail clients

Capabilities

• Information Theft

Impact

• Violation of user privacy - gathers user credentials, logs keystroke and steals user information

Additional Reference

• Threat Encyclopedia: TrojanSpy.Win32.NEGASTEAL.DOCHF

Infection Chain

MITRE ATT&CK MATRIX

Sample Spam - Purchase order attachment

Detection Coverage

File Reputation

Predictive Machine Learning

Web Reputation

Email Protection

Advance Threat Scan Engine (ATSE)

Network Pattern