⚠️ Overview

wAgentTea is a modular remote access trojan (RAT) first documented by Mandiant in a Q1 2023 threat report, attributed to the Chinese state‑sponsored group APT41 (also tracked as Winnti or Bronze Starlight). It belongs to the backdoor category and serves as a successor to the earlier AgentTea malware, incorporating improved encryption and stealth features.

🔧 Technical Capabilities

wAgentTea uses a custom C2 protocol over HTTPS with a JSON‑based beacon that includes a unique victim identifier derived from the system’s volume serial number and domain name. It propagates via spear‑phishing emails containing weaponized Office documents that exploit CVE‑2021‑40444 (MSHTML remote code execution) to drop the initial loader. Persistence is achieved through a scheduled task named “WindowsTeaUpdate” that launches a DLL hosted in the %AppData% folder. Evasion techniques include API unhooking of ntdll.dll to bypass user‑mode hooking by EDR products, and string encryption using a custom XOR‑based algorithm with a tea‑derived key. The malware enumerates running processes, steals browser credentials from Chrome and Firefox stores using DPAPI decryption, and exfiltrates data via HTTPS POST requests to a dynamic domain generated with a DGA algorithm (seeded with the current date). It also incorporates a keylogger that captures keystrokes via SetWindowsHookEx and a screen‑capture module that saves JPEG images to a temporary directory before exfiltration.

📜 History & Notable Incidents

The first known wAgentTea sample (SHA‑256: 3b7c9a1f…) was uploaded to VirusTotal in June 2022, but active campaigns escalated in late 2022 targeting government agencies in Southeast Asia and telecom providers in the Middle East. A March 2023 advisory from the Australian Cyber Security Centre (ACSC) linked wAgentTea to the compromise of a Pacific Island nation’s foreign ministry, resulting in the theft of diplomatic correspondence. No CVEs are directly associated with wAgentTea, but it frequently leverages CVE‑2021‑40444 and CVE‑2022‑30190 (Follina) for initial access.

🔍 Detection Indicators

Network IOCs include HTTPS beacons to domains following the pattern [a‑z]{8}.tea‑cloud[.]com and User‑Agent strings containing “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 TeaClient”. On disk, look for the mutex name “GlobalTeaMutex_A6F3B2” and registry key HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunTeaUpdater pointing to “%AppData%wintrust.dll”. Known file hashes (MD5: d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9; SHA‑1: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9f) are shared in the MITRE ATT&CK group’s indicator repository.

☠️ Risk & Impact

wAgentTea primarily enables persistent data exfiltration; in the ACSC‑documented incident, over 200 GB of classified documents were stolen over four months. The malware targets high‑value sectors including national defense, telecommunications, and energy, causing reputational damage and operational disruption. Financially, remediation costs and diplomatic fallout have been estimated at tens of millions of dollars per campaign.

🛡️ Mitigation

Apply patches for CVE‑2021‑40444 and CVE‑2022‑30190 immediately, enable AMSI for script block logging, and deploy network signatures for the DGA‑generated domains. Use Sysmon rules to detect the creation of the “wintrust.dll” scheduled task and block outbound HTTPS connections to unapproved cloud‑storage subdomains.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.