CVE-2017-11882 To Deliver Agent Tesla

Executive summary: The report documents a phishing-driven malware campaign that abuses vulnerable Microsoft Excel files to download an obfuscated VBS which retrieves a steganographically embedded Base64 DLL from a JPG; the DLL is decoded and loaded via PowerShell, uses RegAsm process injection to deliver the Agent Tesla infostealer, and exfiltrates stolen browser, mail, FTP credentials and keystrokes to a Telegram bot.