Malware Analysis: Agent Tesla Disguised as invoice_photo.jpg

A static and dynamic analysis of a suspicious email attachment, written from a SOC analyst's point of view.

Full write-up on Medium: https://medium.com/@skizzydera/malware-analysis-11c6a82dced6 Repository: https://github.com/AKINOLASELIM/Malware_Analysis

---

Scenario

A finance employee receives an email with an attachment named invoice_photo.jpg, supposedly a scanned vendor invoice. They open it because "it's just a picture," and afterwards their machine runs slowly. The file is handed to the SOC for analysis.

Tools Used

file · sha256sum · VirusTotal · xxd/hex viewer · strings · capa · ANY.RUN · YARA

---

1. Initial File Identification

The first step is to find out what the file really is. Running file shows it is not an image: it is an executable renamed with a .jpg extension, which is an immediate red flag.

2. Reputation Check

I computed the file's hash and looked it up on VirusTotal to see whether it matches known malware.

SHA-256: fd0d23011657d0185f6e4fb5fe57eb7894c9fc606b9ae5fc6b977efcb2ef1eeb

VirusTotal's popular threat label is Agent Tesla, a well-known information stealer.

Reference: https://www.checkpoint.com/cyber-hub/threat-prevention/what-is-malware/agent-tesla-malware/

Conclusion: this is malware.

3. Magic Byte Analysis

The raw bytes settle it. The file begins with MZ, the signature of DOS/PE executables. A genuine JPEG would begin with FF D8 FF. The file is an executable posing as an image.

4. Extracting Embedded Strings

Agent Tesla is documented as exfiltrating data over FTP, HTTP and SMTP, and as stealing saved credentials from FTP clients, mail clients and VPN clients. I used that to guide my strings searches, splitting findings into exfiltration channels and credential-theft targets.

FTP

Searching for ftp shows the malware looking up the registry keys and file paths where FTP clients store saved logins. Seven clients are targeted:

Client	Location queried
CoreFTP	SOFTWARE\FTPWare\COREFTP\Sites
FTP Navigator	\FTP Navigator\Ftplist.txt
SmartFTP	SmartFTP\Client 2.0\Favorites\Quick Connect
WS_FTP	Ipswitch\WS_FTP\Sites\ws_ftp.ini
FTP Commander Deluxe	\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt
cftp	\cftp\Ftplist.txt
FTPGetter	\FTPGetter\servers.xml

Targeting this many clients shows the malware casts a wide net instead of relying on one application.

A hardcoded exfiltration URL was also found:

ftp[:]//ftp.piovau[.]com

OSINT

A public search for the domain turns up an independent reference linking ftp.piovau.com to Agent Tesla command-and-control infrastructure.

VirusTotal reputation of the domain

The URL is categorised under command and control, spam, phishing and botnet, all consistent with Agent Tesla behaviour.

HTTP

The search returned a few hardcoded strings, including:

• http://ip-api.com/line/?fields=hosting
• https://account.dyn.com/

Alone these look harmless, but in context they matter:

• ip-api.com is an IP geolocation service. Malware uses it to learn the victim's location and as an anti-analysis check: if the IP belongs to a hosting or cloud provider, the sample may be running in a sandbox rather than on a real victim machine.
• dyn.com is a dynamic DNS provider. Attackers use dynamic DNS to change the underlying IP quickly when it gets flagged while keeping the same domain name.

SMTP

A generic smtp search wasn't very revealing, so I narrowed it to specific mail applications whose stored credentials could be stolen.

Outlook

Thunderbird

Other mail clients

This confirms a credential-theft capability.

VPN

Filtering for vpn shows two VPN clients being targeted:

• OpenVPN: Software\OpenVPN-GUI\configs, \OpenVPN\config\
• NordVPN: NordVpn.exe

5. Capability Analysis with capa

capa identifies capabilities in executable files. Running it with the capa-rules ruleset backed up my manual findings.

Capability	ATT&CK ID	What it tells us
Input Capture: Keylogging	T1056.001	Logs keystrokes, beyond stealing saved credentials
Screen Capture	T1113	Takes screenshots
Clipboard Data	T1115	Reads clipboard contents
Virtualization/Sandbox Evasion: System Checks	T1497.001	Matches the ip-api.com sandbox check
Subvert Trust Controls: Mark-of-the-Web Bypass	T1553.005	Tries to avoid the Windows warning on downloaded files, relevant to this scenario
Application Layer Protocol: Web Protocols	T1071.001	Matches the HTTP communication found in strings

6. Dynamic Analysis with ANY.RUN

Detonating the sample in ANY.RUN confirmed malicious behaviour. It was automatically tagged agenttesla, stealer, ip-check, ftp and exfiltration, matching the static findings.

The process tree shows invoice_photo.jpg.exe as the main process, alongside WmiPrvSE.exe, WaaSMedicAgent.exe, conhost.exe and slui.exe. The HTTP Requests tab catches a live call to http://ip-api.com/line/?fields=hosting.

Indicators of Compromise

Type	Value
Domain	ftp.piovau.com
IP	69.57.162.28

Both are flagged malicious, confirming the hardcoded FTP address is a live, actively flagged exfiltration endpoint rather than a dormant string.

The full ANY.RUN PDF report is included in this repository for anyone who wants every indicator in detail.

7. Detection with YARA

Using the IOCs and strings gathered above, I wrote a YARA rule to detect this Agent Tesla sample on a machine.

---

Key Takeaways

• A file extension proves nothing: always check the real file type and magic bytes.
• Static analysis (hashes, strings, capa) and dynamic analysis (sandbox) reinforce each other.
• Hardcoded strings point directly to exfiltration channels and credential-theft targets.
• IOCs from the analysis can be turned into detection rules (YARA).

Author

Akinola Selim: Medium · GitHub