Negasteal, also known as AGENT TESLA is an information stealer malware written in Microsoft’s .NET language with keylogging and remote access Trojan (RAT) capabilities. It was discovered in 2014 and has been used in various malicious campaigns ever since. It has been known to send stolen information either through web panel, file transfer protocol (FTP) or simple mail transfer protocol (SMTP). A previous version of the malware was compiled in AutoIT to obfuscate malware binary and evade security detection, and another version is capable of spreading the malware through the use of removable drives.

In recent malspam campaigns that utilizing social engineering such as COVID-19 themed spam, or email that contains purchase orders or invoices, a new variant of the NEGASTEAL malware was found as an attachment. The executable file usually arrived in an archived or compressed file like ZIP or RAR. This variant, aside from able to steal machine information, data in browsers, email client or FTP credentials and user credentials, it has now a new module for getting the WiFi profile or credential. The stolen information will be sent via email or FTP. With this new feature, the cybercriminals have the ability to spread or create an entry vector through the victim’s network.

Behaviour

• Creates a scheduled task to execute the NEGASTEAL payload
• Disables Task Manager through the registry using reg.exe
• Collects information about the system including FTP clients, browsers, file downloads, machine info (username, computer name, OS name, CPU architecture, RAM)
• Runs a heavily obfuscated executable file designed to collect wireless profile credentials from compromised computers by issuing a netsh command with a wlan show profile argument for listing all available WiFi profiles
• Sends stolen credentials or information via email or remote file transfer

Capabilities

• Information Theft
• Backdoor commands

Impact

• Violation of user privacy - gathers user credentials, logs keystroke and steals user information
• Compromise system security - with backdoor capabilities that can execute malicious commands

Additional Threat Reference Information

• Threat Encyclopedia: TrojanSpy.MSIL.NEGASTEAL.DYSGWI

Sample Spam (Invoice Attachment)

Infection Chain

MITRE ATT&CK Matrix