27 C
Jaipur
Thursday, October 29, 2020

Microsoft Warns about New Campaign that Delivers FlawedAmmyy RAT

Must read

iPhone 12 Pro’s Ceramic Shield Is Not as Scratch Resistant as You Might Expect

iPhone 12 series may not have changed a whole lot on the design front. The company, however, adopted a new Ceramic Shield to safeguard...

Gaming On Linux To Get Major Improvements, Thanks To Collabora

Gone are the days when people would criticize Linux for its incapability to run games. Thanks to the vast open source community, gaming on...

Call Of Duty Mobile Season 12 Expected Release Date

A few days back, Call of Duty Mobile released the Season 11 update to celebrate the game’s first anniversary. There’s a lot of amazing...

 

Microsoft uncovered a new campaign with a sophisticated infection chain delivering notorious FlawedAmmyy RAT as a final payload. The attack starts with an email that contains .XLS attachments and the contents of the email in the Korean language.

Previous campaigns that involve FlawedAmmyy RAT are carried out by TA505 threat actors, upon successful execution of backdoor let an attacker to control the machine remotely, manages the files, captures the screen.

How the Infection Occurs

Malicious .XLS file delivered through email, when the file executed it automatically runs a macro function that runs Windows Installer msiexec.exe used for download & installing MSI and MSP packages.

Anomaly detection helped us uncover a new campaign that employs a complex infection chain to download and run the notorious FlawedAmmyy RAT directly in memory. The attack starts with an email and .xls attachment with content in the Korean language. pic.twitter.com/PQ2g7rvDQm

— Microsoft Security Intelligence (@MsftSecIntel) June 21, 2019

The downloaded MSI archive contains a digitally signed executable that is extracted and executed, it decrypts and runs another executable wsus.exe in memory, which in turn decrypts and runs the final payload in the memory.

The final payload that delivered directly in memory is the FlawedAmmyy, according to Microsoft Security Intelligence. The FlawedAmmyy digitally signed using a code signing certificate issued Thawte to the company Dream Body Limited. It appears the rat was signed and timestamped on June 19 and the samples detected on June 22.

The FlawedAmmy RAT functions

  • Remote Desktop control
  • File system manager
  • Proxy support
  • Audio Chat

Earlier this year TA505 distributed FlawedAmmyy RAT via weaponized MS Excel documents with malicious Excel 4.0 macro which is hard to detect by standard security controls.

Last October Cybercriminals used IQY Files to deliver FlawedAmmyy malware and executed the backdoor through PowerShell Process.

IoCs (SHA-256):

0e91e6e17f8c8e2f1ae29e13f116c8611cb7679607695eed355025295fb1999a (.xls),
19d8993c742fc1a7c651ab3dba4d8c7f5e142a8421e22dd0c20c2db2d5dccffd (MSI),
cb114123ca1c33071cf6241c3e5054a39b6f735d374491da0b33dfdaa1f7ea22 (digitally signed executable inside MSI)
c2c6f548fe6832c84c8ab45288363b78959d6dda2dd926100c5885de14c4708b (digitally signed wsus.exe),
6860de46fdea393bd48ca000ecff4047920a56728b7945f95a6ca0801c278097 (FlawedAmmyy RAT)

 

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

iPhone 12 Pro’s Ceramic Shield Is Not as Scratch Resistant as You Might Expect

iPhone 12 series may not have changed a whole lot on the design front. The company, however, adopted a new Ceramic Shield to safeguard...

Gaming On Linux To Get Major Improvements, Thanks To Collabora

Gone are the days when people would criticize Linux for its incapability to run games. Thanks to the vast open source community, gaming on...

Call Of Duty Mobile Season 12 Expected Release Date

A few days back, Call of Duty Mobile released the Season 11 update to celebrate the game’s first anniversary. There’s a lot of amazing...

10 Funniest WiFi Names You Could Possibly Think Of

When it comes to naming their WiFi, people tend to go for something simple such as “Bedroom_Wifi” or something more personal such as “Monica’s...