Analysis of New Agent Tesla Spyware Variant

Recently, FortiGuard Labs captured a new malware sample that was spread via Microsoft Word documents. After some quick research, I discovered that this was a new variant of the Agent Tesla spyware. I analyzed another sample of this spyware last June and published a blog about it. In this blog, I want to share what’s new in this new variant.

This malware was spread via a Microsoft Word document that contained an embedded exe file. Figure 1 below shows what it looks like when you open the Word document.

Figure 1. Opening the malicious Word document

As you can see, it asks the victim to double click the blue icon to ena…