Newly discovered AdvisorsBot Malware actively distributing by threat actor TA555 to target Hotels, Restaurants, and Telecommunications departments using a malicious word document.
This Malware spreading in the various form via email with a fake content and trick victims to open it infect the victims and steal the sensitive data.
Researchers observers that the AdvisorsBot Malware spreading in 3 different form, the first one has appeared via email to that target hotels, the second one is targeting restaurant, the third one mimics as a resume with the malicious macro document to attack telecommunications.
All the targeting email contain macros and the attack trick users to enable the macro that executes a PowerShell command to download and execute the AdvisorsBot Malware.
later threat actor shifted the technique that helps to download another PowerShell script when the PowerShell command gets executed which is responsible for net technique AdvisorsBot to execute without writing it to disk.
AdvisorsBot Malware Infection Technique
An AdvisorsBot word derived from its command & control server which is used for receiving the command from malware authors that contain the word “advisors” in many areas.
Attackers using many junk code such as extra instructions, conditional statements, and loops to strengthen the anti-analysis techniques that makes difficult to analyze the malware.
AdvisorsBot malware contains a list of hard code hash value to compare with the running process hash of the system’s volume serial number, name and compare with it if its matches then it terminates the execution.
Attacker paying very close attention to victims to get connected with the C&C server and increase the success ratio, they are implementing an additional anti-analysis check that compared the system’s machine SID to a list of 13 hardcoded values.
According to Proofpoint research, The malware uses HTTPS to communicate with the C&C server. In the requests from the bot to the C&C, URIs contain encoded data that are used to identify a victim.
“More specifically, the data that is encoded in the URI contains the machine SID, CRC32 hash of the computer name, some unknown hardcoded values, and the Windows version.”
Finally, an attacker using fingerprinting module being sent from a C&C server and the command will perform stealing activities such as Takes a screenshot, Extracts Microsoft Outlook account details and other malicious activities.
Also Read:
Android Device With Open ADB Ports Exploited to Spread Satori Variant of Mirai Botnet
