Multi-Stage Malware Attack Uses .JSE and PowerShell to Deploy Agent Tesla and XLoader

A new multi-stage attack has been observed delivering malware families like Agent Tesla variants, Remcos RAT, and XLoader.

"Attackers increasingly rely on such complex delivery mechanisms to evade detection, bypass traditional sandboxes, and ensure successful payload delivery and execution," Palo Alto Networks Unit 42 researcher Saqib Khanzada said in a technical write-up of the campaign.

The starting point of the attack is a deceptive email that poses as an order request to deliver a malicious 7-zip archive attachment, which contains a JavaScript encoded (.JSE) file.

The phishing email, observed in December 2024, falsely claimed that a payment had been made and urged the recipient to review an attached order file. Launching the JavaScript payload triggers the infection sequence, with the file acting as a downloader for a PowerShell script from an external server.

The script, in turn, houses a Base64-encoded payload that's subsequently deciphered, written to the Windows temporary directory, and executed. Here's where something interesting happens: The attack leads to a next-stage dropper that is either compiled using .NET or AutoIt.

In case of a .NET executable, the encrypted embedded payload – an Agent Tesla variant suspected to be Snake Keylogger or XLoader – is decoded and injected into a running "RegAsm.exe" process, a technique observed in past Agent Tesla campaigns.

The AutoIt compiled executable, on the other hand, introduces an additional layer in an attempt to further complicate analysis efforts. The AutoIt script within the executable incorporates an encrypted payload that's responsible for loading the final shellcode, causing .NET file to be injected into a "RegSvcs.exe" process, ultimately leading to Agent Tesla deployment.

"This suggests that the attacker employs multiple execution paths to increase resilience and evade detection," Khanzada noted. "The attacker's focus remains on a multi-layered attack chain rather than sophisticated obfuscation."

"By stacking simple stages instead of focusing on highly sophisticated techniques, attackers can create resilient attack chains that complicate analysis and detection."

IronHusky Delivers New Version of MysterySnail RAT

The disclosure comes as Kaspersky detailed a campaign that targets government organizations located in Mongolia and Russia with a new version of a malware called MysterySnail RAT. The activity has been attributed to a Chinese-speaking threat actor dubbed IronHusky.

IronHusky, assessed to be active since at least 2017, was previously documented by the Russian cybersecurity company in October 2021 in connection with the zero-day exploitation of CVE-2021-40449, a Win32k privilege escalation flaw, to deliver MysterySnail.

The infections originate from a malicious Microsoft Management Console (MMC) script that mimics a Word document from the National Land Agency of Mongolia ("co-financing letter_alamgac"). The script is designed to retrieve a ZIP archive with a lure document, a legitimate binary ("CiscoCollabHost.exe"), and a malicious DLL ("CiscoSparkLauncher.dll").

It's not exactly known how the MMC script is distributed to targets of interest, although the nature of the lure document suggests that it may have been via a phishing campaign.

As observed in many attacks, "CiscoCollabHost.exe" is used to sideload the DLL, an intermediary backdoor capable of communicating with attacker-controlled infrastructure by taking advantage of the open-source piping-server project.

The backdoor supports capabilities to run command shells, download/upload files, enumerate directory content, delete files, create new processes, and terminate itself. These commands are then used to sideload MysterySnail RAT.

The latest version of the malware is capable of accepting nearly 40 commands, allowing it to perform file management operations, execute commands via cmd.exe, spawn and kill processes, manage services, and connect to network resources via dedicated DLL modules.

Kasperksy said it observed the attackers dropping a "repurposed and more lightweight version" of MysterySnail codenamed MysteryMonoSnail after preventive actions were taken by the affected companies to block the intrusions.

"This version doesn’t have as many capabilities as the version of MysterySnail RAT," the company noted. "It was programmed to have only 13 basic commands, used to list directory contents, write data to files, and launch processes and remote shells."

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.