# AgentTesla Infostealer Distributed via Business Proposal Phishing Emails (Fake Café Management Software)

> AhnLab ASEC reports an active phishing campaign using business-proposal emails with a ZIP attachment containing an executable disguised as café management software. A three-stage .NET loader hides payloads in bitmap resources and deploys AgentTesla, which steals credentials, cookies and contact data from browsers, email clients, FTP programs and VPN programs and exfiltrates over FTP.

- **Published:** 2026-10-14T08:29:12Z
- **Last reviewed:** 2026-10-14T08:29:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3484
- **ID:** TL-2026-3484
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

ASEC (AhnLab Security Intelligence Center) documented an AgentTesla distribution case disguised as a business proposal email. The lure asks the recipient to review an attached product list and reply with feedback on inventory and pricing. The attachment is a ZIP named in the pattern '{Company Name} LIST.ZIP' containing an executable. The executable's assembly description is Chinese-language text describing a program for café operations, menus, orders and ingredient management, so it poses as café management software.

The executable uses a multi-stage loading chain. Stage 1 (the café loader) reads RGB pixel values from a bitmap resource named Resources.Fee, reconstructs a .NET DLL from them and loads it with Assembly.Load. Stage 2 is a DLL labeled as Kingsoft security software; it reads a 471x471-pixel bitmap named HATA and decrypts the data with an XOR key 'yjw'. Stage 3 is disguised as Microsoft PC Manager; it copies the original file to %APPDATA%\AH.Exe and decrypts an embedded resource named 8VXmw2w using the UTF-8 key 'ZIyStAzSE', yielding the AgentTesla payload.

AgentTesla collects credentials, cookies and contact information from web browsers, email clients, FTP programs and VPN programs. It also queries the victim's public IP address and detects hosting-server environments. Stolen data is exfiltrated over FTP to server356.Web-hosting.Com using an attacker-controlled FTP account (credentials appear in the ASEC report and are intentionally not reproduced here). The ASEC report states no CVE, CVSS score or threat-actor attribution. A BeaconBeagle domain-config search for server356.web-hosting.com returned no matches.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1027.003 Steganography
- T1620 Reflective Code Loading
- T1036.005 Match Legitimate Resource Name or Location
- T1140 Deobfuscate/Decode Files or Information
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

## Sources

- [Case of AgentTesla Malware Distribution Disguised as a Business Proposal Email (AhnLab ASEC)](https://asec.ahnlab.com/en/95840/)
- [MITRE ATT&CK - Agent Tesla (S0331)](https://attack.mitre.org/software/S0331/)
- [ManageEngine - Agent Tesla malware profile](https://www.manageengine.com/malware-protection/adversaries/agent-tesla.md)
- [Zscaler - Agent Tesla keylogger delivered using cybersquatting](https://www.zscaler.com/fr/blogs/security-research/agent-tesla-keylogger-delivered-using-cybersquatting)
- [Triage sandbox report - AgentTesla sample (FTP exfiltration config)](https://tria.ge/241124-cx37zswjdm)
- [BeaconBeagle domain config search - server356.web-hosting.com (no matches)](https://beaconbeagle.com/api/v1/configs/search?domain=server356.web-hosting.com)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3484