# SWEED: Exposing years of Agent Tesla campaigns

**[blog.talosintelligence.com/2019/07/sweed-agent-tesla.html](https://blog.talosintelligence.com/2019/07/sweed-agent-tesla.html)**

_By_ _[Edmund Brumaghin and other Cisco Talos researchers.](https://www.blogger.com/profile/10442669663667294759)_

## Executive summary

Cisco Talos recently identified a large number of ongoing malware distribution
campaigns linked to a threat actor we're calling "SWEED," including such notable
malware as Formbook, Lokibot and Agent Tesla. Based on our research, SWEED —
which has been operating since at least 2017 — primarily targets their victims with
stealers and remote access trojans.

SWEED remains consistent across most of their campaigns in their use of spearphishing emails with malicious attachments. While these campaigns have featured a
myriad of different types of malicious documents, the actor primarily tries to infect its
victims with a packed version of Agent Tesla — an information stealer that's been around
since at least 2014. The version of Agent Tesla that SWEED is using differs slightly from
[what we've seen in the past in the way that it is packed, as well as how it infects the](https://blog.talosintelligence.com/2018/10/old-dog-new-tricks-analysing-new-rtf_15.html)
system. In this post, we'll run down each campaign we're able to connect to SWEED,
and talk about some of the actor's tactics, techniques and procedures (TTPs).

## 2017: Steganography

One of the earliest SWEED campaigns Talos identified dates back to 2017. In this attack,
the actors placed droppers inside of ZIP archives, and then attached those ZIPs to


-----

emails. The attachments usually had file names similar to Java_Updater.zip or P-O of
Jun2017.zip". Here's an example of an email associated with this campaign:

The attached ZIP archive contained a packed version of Agent Tesla. The packer uses
.NET and leverages steganography to hide and decode a second .NET executable,
which uses the same technique to retrieve the final Agent Tesla payload. Here's the file
stored in the resource:


-----

And here s the algorithm used to decode the PE stored in that image:

The decoded binary is stored in the array.

## January 2018: Java droppers

In early 2018, we observed that SWEED began leveraging Java-based droppers. Similar
to previous campaigns, the JAR was directly attached to emails and used file names
such as "Order_2018.jar". The purpose of the JAR was to obtain information about the
infected system and facilitate the download of a packed version of Agent Tesla.
Interestingly, only a few months prior to these campaigns, a HackForums user with the
account name "Sweed" actively sought out a Java crypter — but we'll get to that activity
later.

## April 2018: Office exploit (CVE-2017-8759)

In April 2018, SWEED began making use of a previously disclosed Office exploit. One of
the documents featured in these email campaigns was notable because it was a
PowerPoint document (PPXS). Code contained inside one of the slides triggers an
exploit for [CVE-2017-8759, a remote code execution vulnerability in Microsoft .NET](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8759)
framework.


-----

You can see the execution of external content hosted on the attacker-controlled web
server using the file name "chuks.png". As expected, the PNG is not actually an image.
Instead, it is a Soap definition in XML, as seen in the screenshot below:

The purpose of this code is to decode a URL and download a PE32 hosted on an
attacker-controlled web server. The resulting executable is a packed version of Agent
Tesla.

## May 2018: Office exploit (CVE-2017-11882)

In May 2018, campaigns being conducted by SWEED began leveraging another
vulnerability in Microsoft Office: [CVE-2017-11882, a remote code execution bug in](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11882)
Microsoft Office that is commonly observed being leveraged in malicious documents
used in commodity malware distribution.

We see how the vulnerability abuses the Equation Editor in Office when executing the
sample in [ThreatGrid:](https://www.cisco.com/c/en/us/products/security/threat-grid/index.html)


-----

As seen below, the malicious document is designed to appear as if it is an invoice.

As consistent with previous campaigns, the purpose of this malicious document is to
download and execute a packed version of Agent Tesla.

## 2019: Office macros and AutoIT droppers

Beginning in 2019, the campaigns associated with SWEED began leveraging malicious
Office macros. As with previous attacks, they are leveraging spear-phishing emails and
malicious attachments to initiate the infection process.


-----

The attached XLS contains an obfuscated VBA macro, which executes a PowerShell
script using a WMI call. The PowerShell script is also obfuscated using XOR operations
to hide its code. Once decoded, it reveals itself to be .NET.

This .NET code is responsible for performing some checks and downloading another
executable file. The obfuscation scheme used in this code is the same as the one used
in the previously described PowerShell. The downloaded file is then saved and
executed.

_Call graph after WMI execution._

The downloaded binary is an AutoIT-compiled script. The script has a lot of junk code
designed to make the analysis more difficult and time-consuming.


-----

_Extracted AutoIT script._

The strings and some of the commands contained in the AutoIT script have been
obfuscated using XOR operations, as described below.

The decoder receives two hex strings: The first is the string to deobfuscate, while the
second determines the number of rounds of the XOR operation. The XOR operation is
performed on each character against the length of the second parameter. This operation
is then repeated for as many times as the length with the length and the position. If the
length value is one, then the operation is repeated twice using the same key, which
leads to a plaintext hex string.

After performing environment checks, the malware will reconstruct the assembly code
which is obfuscated in a hex string. Using the AutoIT scripting language Dll* family
functions the code is loaded into the current process address space.


-----

_Memory allocation_

Finally, the malware executes the assembly code with two arguments. The first argument
is the path for an executable. This assembly will create a process with the executable
and will inject the payload into this process.

As expected, the final payload in this campaign is another packed version of Agent
Tesla.

## UAC bypass

One of the common characteristics with several of the campaigns associated with
SWEED is the use of various techniques to bypass User Account Control (UAC) on
infected systems. An example of this is present within the campaigns observed in 2019.
When the malware is first executed on systems, it executes "fodhelper.exe", which is a
Windows process running as high integrity. Prior to executing it, the malware sets the
following registry key:

HKCU\Software\Classes\ms-settings\shell\open\command

This registry key points to the location of the malicious executable:

This key is used by "fodhelper.exe" and its value is executed as administrator whenever
fodhelper.exe is executed. This functionality simply allows for the malware to bypass
UAC and is not a privilege escalation vulnerability — the user must already have


-----

administrative access rights on the system. It is used to avoid displaying a UAC prompt
to the user. This second instance of the malware is then executed with administrative
access to the infected system.

## SWEED infrastructure

The various distribution campaigns linked to SWEED feature use of a limited amount of
distribution and C2 infrastructure with the same servers used across many different
campaigns over long periods of time. The majority of the registrants associated with the
domains used by SWEED list the following email addresses:

aaras480@gmail[.]com
sweed.[redacted]@gmail[.]com

The registrant contact information used to register most of the domains is also
consistent:

In April 2018, a security researcher published a [screenshot of an RDP server believed to](https://twitter.com/mrglaive/status/987780707551469569)
have been actively leveraged by SWEED (84.38.134[.]121):


-----

In the screenshot above, the list of user accounts established on the RDP server can be
seen, which includes an account named "sweed." The fact that multiple users are
currently active indicates that this server is being used in a multi-user capacity and
provides a platform on which members of SWEED can function collaboratively. This also
likely indicates a business relationship between multiple individuals responsible for these
ongoing malware distribution campaigns.

We also identified several DDNS domains which were being used to facilitate
connectivity to the shared RDP server that feature many of the same values as the RDP
user accounts:

_sweedoffice[.]duckdns[.]org_
_sweedoffice-olamide[.]duckdns[.]org_
_sweedoffice-chuks[.]duckdns[.]org_
_www.sweedoffice-kc.duckdns[.]org_
_sweedoffice-kc.duckdns[.]org_
_sweedoffice-goodman.duckdns[.]org_
_sweedoffice-bosskobi.duckdns[.]org_
_www.sweedoffice-olamide.duckdns[.]org_
_www.sweedoffice-chuks.duckdns[.]org_

During our analysis of various campaigns associated with SWEED, we identified several
common elements that also reflect the distinct values associated with users of the RDP
server. In many cases, the distribution servers being used to host malicious PE32 being
distributed by SWEED contained a directory structure consisting of multiple directories
containing the binaries being distributed. In many cases, the binary file names used, as
well as the directory names used to host the malicious content reflected the same users
present on the RDP server.

For example, in June 2019, the following URLs were hosting malicious content
associated with these campaigns:


-----

_hxxp://aelna[.]com/file/chuks.exe_
_hxxp://aelna[.]com/file/sweed.exe_
_hxxp://aelna[.]com/file/duke.exe_

Likewise, when investigating samples associated with known domains used to exfiltrate
sensitive information from infected systems, we can see the following binary file names
being used repeatedly across campaigns over a long period of time:

_dadi.exe_
_kelly.exe_
_chuks.exe_
_olamide.exe_
_sweed.exe_
_kc.exe_
_hero.exe_
_goodman.exe_
_duke.exe_
_hipkid.exe_

In several cases, the directory structure present on the distribution servers contained
multiple directories hosting malicious files, an example listing below using the domain
sodismodisfrance[.]cf:

_sodimodisfrance[.]cf/2/chuks.exe_
_sodimodisfrance[.]cf/6/chuks.exe_
_sodimodisfrance[.]cf/5/goodman.exe_
_sodimodisfrance[.]cf/1/chuks.exe_
_sodimodisfrance[.]cf/1/hipkid.exe_
_sodimodisfrance[.]cf/5/sweed.exe_
_sodimodisfrance[.]cf/2/duke.boys.exe_

These appear to match the handles used by actors known to be associated with
SWEED. Another known domain used to exfiltrate sensitive information collected by
Agent Tesla is sweeddehacklord[.]us. Analysis of known malware seen communicating
with this domain shows similar patterns of operations.

In analyzing the malware activity associated with SWEED, we also investigated the use
of interesting paths in the hosting of the administration panels associated with the
various RATs and stealers being distributed by this group. Indeed, on a single C2 server,
we identified several panel with the following URLs:

_sweed-office.comie[.]ru/goodman/panel_
_sweed-office.comie[.]ru/kc/panel/_
_wlttraco[.]com/sweed-office/omee/panel/login.php_
_wlttraco[.]com/sweed-client/humble1/panel/post.php_
_wlttraco[.]com/sweed-client/sima/panel/post.php_
_wlttraco[.]com/sweed-office/omee/panel/post.php_
_wlttraco[.]com/sweed-office/kc/panel/post.php_
_wlttraco[.]com/sweed-office/olamide/panel/post.php_
_wlttraco[.]com/sweed-office/jamil/panel/post.php_
_wlttraco[.]com/sweed-client/niggab/panel/post.php_


-----

_wlttraco[.]com/sweed-client/humble2/panel/post.php_
_wlttraco[.]com/sweed-office/harry/panel/post.php_

Based on our research, as well as the panel-hosting locations, we believe that wiki,
olamide, chuks, kc, goodman, bosskobi, dadi, hipkid, and others are SWEED customers
or business associates. Using the binary file names, directory structures, and other
artifacts, we have been able to identify interesting online behavior and interests exhibited
across various hacking forums, IRC servers, etc. that appear to link some of these users
with various elements of the malware distribution campaigns.

There are several other domains that can be linked to SWEED that appear to be
associated with various malware families and distribution campaigns. These have been
observed to resolve to the IP associated with the aforementioned RDP server, as well.

_sweeddehacklord[.]us_
_sweed-office.comie[.]ru_
_sweed-viki[.]ru_

### Use of typosquatting

Another interesting element of many of the campaigns associated with SWEED is the
use of typosquatting for the domains used to host the packed Agent Tesla binaries that
have been distributed over the past few years.

_Victims' geographic dispersion._

Looking at the victimology from a country point of view it is clear that there is no
geographic focus, when choosing their target. SWEED target companies all over the
world.


-----

_Breakdown of victim's activity by industry._

The breakdown by activity however does show a clear tendency for manufacturing and
logistics companies.

Here's a rundown of these domains, along with the companies they are supposed to look
like and the industry that the company is associated with. In some cases we were unable
to determine the targeted organization from the typosquatted domain.


-----

In all of the domains listed above, the registrant account information associated with the
domains is consistent with what we have identified as associated with SWEED campaign
activity.

## Operational Security (OPSEC)

We identified various behavior on hacking forums, IRC channels, and other web sites
that appeared consistent with the TTPs we observed with the actor distributing this
malware.

### "SWEE D"


-----

During our analysis, we identified a user on HackForums using the moniker SWEE D.
In most of the online posts associated with this user, their contact information was
included in the post and listed the Skype address "sweed.[redacted]".

In the months leading up to the January 2018 campaigns, we observed this user posting
asking for access to a Java crypter. Typically, crypters are used to help evade antivirus
detection as they "crypt" the contents of the malicious payload being distributed.

The same user posted repeatedly in threads related to Java crypters, and even annoyed
other users with how often they were posting:

The same Skype account listed in the HackForums posts was also used by someone
using the name "Daniel" in 2016 while commenting on a blog related to the creation of
Facebook phishing pages:


-----

This same Skype account was also used in 2015 by someone going by the name "

[redacted] Daniel."

Note: [redacted] is also the name used in the email address associated with the
registrant account for the domain wlttraco[.]com (sweed.[redacted]@gmail.com).

We also located screenshots that were [published on the Twitter account](https://twitter.com/sS55752750/status/983260208091852800/photo/1) [.sS!.! showing](https://twitter.com/sS55752750)
the Discord server "Agent Tesla Live" that listed sweed ([redacted] Daniel) as a member
of the staff.


-----

It is important to note that the avatar used by this Discord user (SWEE D) is the same
avatar that is used by Skype user sweed.[redacted].

We actually contacted SWEE D on Skype and were able to confirm that the same user
operates the Discord and Skype accounts:


-----

During our interaction with SWEE D, they mentioned that they are a student studying
ethical hacking and that they work in the IT departments of various companies to help
remove malware and increase their security.

This is contrary to the following activity which was observed in an IRC transaction where
a user named "sweed" was submitting credit card information to a bot listening in the
channel in an effort to check the validity and usability of presumably stolen credit card
information.

The IRC channel appeared to be created and used solely for this purpose, with a bot
named "chkViadex24" returning information related to the credit card that was submitted:

This is an example demonstrating how stolen credit information is actively being used by
adversaries to determine whether or not they can monetize the information once they
have stolen it from victims.

It's possible that "SWEE D", "sweed" and [redacted] Daniel may be the same person.
We also identified the following LinkedIn profile that listed the same name:


-----

This account lists Nigeria as their location. "[redacted]" is a Nigerian novel. Many of the
details we identified during our analysis of "sweed," such as information in the LinkedIn
profile, the references to "[redacted]," the registrant information used, and the location
listed in the Skype account indicate the individual is likely located in Nigeria. We believe
"sweed" is a key member of the group and that other accounts are likely associated with
customers or business partners.

## Conclusion

SWEED has been active for at least three years — and a user with that name has been
active on various forums, IRC channels and Discord servers since at least 2015.
Currently, SWEED is actively targeting small and medium-sized companies around the
world. Based on the TTPs used by this group, SWEED should be considered a relatively
amateur actor. They use well-known vulnerabilities, commodity stealers and RATs (Pony,
Formbook, UnknownRAT, Agent Tesla, etc.) and appear to rely on kits readily available
on hacking forums. SWEED consistently leverages packing and crypting in order to
minimize detection by anti-malware solutions. We assess that SWEED also does not
have effective operational security, as they used several of the same online accounts for
about five years, allowing for the discovery of a lot of their information, operations and
associates.

At this time, we cannot say with certainty whether the other accounts and associated
individuals associated with SWEED are business associates or customers. However,
they all use the same infrastructure in a coordinated manner across domains, rely on the
same malware and packers, and all operate very similarly. While SWEED is relatively
well-known in the security research community, this research provides insight into how
these cybercriminal organizations operate and evolve over time in an effort to maximize
their ability to generate revenue and evade detection. We expect SWEED to continue to
operate for the foreseeable future and we will continue to monitor their activities to
ensure that customers remain protected.


-----

## Coverage

Ways our customers can detect and block this threat are listed below.

Advanced Malware Protection
[(AMP) is ideally suited to prevent the](https://www.cisco.com/c/en/us/products/security/advanced-malware-protection)
execution of the malware detailed in
this post. Below is a screenshot
showing how AMP can protect
customers from this threat. Try AMP
for free [here.](https://cisco.com/go/tryamp)

[Cisco Cloud Web Security (CWS) or](https://www.cisco.com/c/en/us/products/security/cloud-web-security/index.html)
[Web Security Appliance (WSA) web](https://www.cisco.com/c/en/us/products/security/web-security-appliance/index.html)
scanning prevents access to
malicious websites and detects
malware used in these attacks.

[Email Security can block malicious](https://www.cisco.com/c/en/us/products/security/email-security-appliance/index.html)
emails sent by threat actors as part
of their campaign.

[Network Security appliances such as Next-Generation Firewall (NGFW), Next-](https://www.cisco.com/c/en/us/products/security/firewalls/index.html)
[Generation Intrusion Prevention System (NGIPS), and](https://www.cisco.com/c/en/us/products/security/intrusion-prevention-system-ips/index.html) [Meraki MX can detect malicious](https://meraki.cisco.com/products/appliances)
activity associated with this threat.

[AMP Threat Grid helps identify malicious binaries and build protection into all Cisco](https://www.cisco.com/c/en/us/solutions/enterprise-networks/amp-threat-grid/index.html)
Security products.

[Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious](https://umbrella.cisco.com/)
domains, IPs, and URLs, whether users are on or off the corporate network.

Additional protections with context to your specific environment and threat data are
available from the [Firepower Management Center.](https://www.cisco.com/c/en/us/products/security/firepower-management-center/index.html)

Open Source Snort Subscriber Rule Set customers can stay up to date by downloading
the latest rule pack available for purchase on [Snort.org.](https://www.snort.org/products)

## Indicators of Compromise (IOCs)

The following IOCs have been observed as being associated with malware campaigns
conducted by this group.

### Campaign #1


-----

Java_Updater.zip ->
59b15f6ace090d05ac5f7692ef834433d8504352a7f45e80e7feb05298d9c2dd
P-O of Jun2017.zip ->
e397ba1674a6dc470281c0c83acd70fd4d772bf8dcf23bf2c692db6575f6ab08
Agent Tesla:
8c8f755b427b32e3eb528f5b59805b1532af3f627d690603ac12bf924289f36f

### Campaign #2

Java sample=>
d27a29bdb0492b25bf71e536c8a1fae8373a4b57f01ad7481006f6849b246a97

### Campaign #3

New Order For Quotation.ppsx ->
65bdd250aa4b4809edc32faeba2781864a3fee7e53e1f768b35a2bdedbb1243b

### Campaign #4

SETTLEMENT OF OUTSTANDING.xlsx ->
111e1fff673466cedaed8011218a8d65f84bee48d5ce6d7e8f62cb37df75e671

### Campaign #5

Request and specification of our new order.xls ->
1dd4ac4925b58a2833b5c8969e7c5b5ff5ec590b376d520e6c0a114b941e2075
Agent Tesla ->
fa6557302758bbea203967e70477336ac7a054b1df5a71d2fb6d822884e4e34f

### Domains

sweeddehacklord[.]us
sweed-office.comie[.]ru
sweed-viki[.]ru
sweedoffice.duckdns[.]org
sweedoffice-olamide.duckdns[.]org
sweedoffice-chuks.duckdns[.]org
www.sweedoffice-kc.duckdns[.]org
sweedoffice-kc.duckdns[.]org
sweedoffice-goodman.duckdns[.]org
sweedoffice-bosskobi.duckdns[.]org
www.sweedoffice-olamide.duckdns[.]org
www.sweedoffice-chuks.duckdns[.]org
aelna[.]com
candqre[.]com
spedaqinterfreight[.]com
worldjaquar[.]com
zurieh[.]com


-----

aiaininsurance[.]com
aidanube[.]com
anernostat[.]com
blssleel[.]com
bwayachtng[.]com
cablsol[.]com
catalanoshpping[.]com
cawus-coskunsu[.]com
crosspoiimeri[.]com
dougiasbarwick[.]com
erieil[.]com
etqworld[.]com
evegreen-shipping[.]com
gufageneys[.]com
hybru[.]com
intermodaishipping[.]net
jltqroup[.]com
jyexports[.]com
kayneslnterconnection[.]com
kn-habour[.]com
leocouriercompany[.]com
lnnovalues[.]com
mglt-mea[.]com
mti-transt[.]com
profbuiiders[.]com
quycarp[.]com
regionaitradeinspections[.]com
repotc[.]com
rsaqencies[.]com
samhwansleel[.]com
serec[.]us
snapqata[.]com
sukrltiv[.]com
supe-lab[.]com
usarmy-mill[.]com
virdtech[.]com
willistoweswatson[.]com
xlnya-cn[.]com
zarpac[.]us
Oralbdentaltreatment[.]tk
wlttraco[.]com


-----