Saturday, December 2, 2023

AdvisorsBot Malware Attack on Hotels, Restaurants, and Telecommunications Via Weaponized Word Document

Newly discovered AdvisorsBot Malware actively distributing by threat actor TA555 to target Hotels, Restaurants, and Telecommunications departments using a malicious word document.

This Malware spreading in the various form via email with a fake content and trick victims to open it infect the victims and steal the sensitive data.

Researchers observers that the AdvisorsBot Malware spreading in 3 different form, the first one has appeared via email to that target hotels, the second one is targeting restaurant, the third one mimics as a resume with the malicious macro document to attack telecommunications.

Email for Hotels
Email for restaurant
 Email for Telecommunications

All the targeting email contain macros and the attack trick users to enable the macro that executes a PowerShell command to download and execute the AdvisorsBot Malware.

later threat actor shifted the technique that helps to download another PowerShell script when the PowerShell command gets executed which is responsible for net technique  AdvisorsBot to execute without writing it to disk.

AdvisorsBot Malware Infection Technique

An AdvisorsBot word derived from its command & control server which is used for receiving the command from malware authors that contain the word “advisors” in many areas.

Attackers using many junk code such as extra instructions, conditional statements, and loops to strengthen the anti-analysis techniques that makes difficult to analyze the malware.

AdvisorsBot malware contains a list of hard code hash value to compare with the running process hash of the system’s volume serial number, name and compare with it if its matches then it terminates the execution.

Attacker paying very close attention to victims to get connected with the C&C server and increase the success ratio, they are implementing an additional anti-analysis check that compared the system’s machine SID to a list of 13 hardcoded values.

According to Proofpoint research, The malware uses HTTPS to communicate with the C&C server. In the requests from the bot to the C&C, URIs contain encoded data that are used to identify a victim.

“More specifically, the data that is encoded in the URI contains the machine SID, CRC32 hash of the computer name, some unknown hardcoded values, and the Windows version.”

Finally, an attacker using fingerprinting module being sent from a C&C server and the command will perform stealing activities such as Takes a screenshot, Extracts Microsoft Outlook account details and other malicious activities.

Also Read:

Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

Android Device With Open ADB Ports Exploited to Spread Satori Variant of Mirai Botnet

60,000 Android Devices are Infected with Malicious Battery Saver App that Steals Various Sensitive Data


Latest articles

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own...

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense...

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer...

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was...

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical...

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious...

US-Seized Crypto Currency Mixer Used by North Korean Lazarus Hackers

The U.S. Treasury Department sanctioned the famous cryptocurrency mixer Sinbad after it was claimed...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

API Attack Simulation Webinar

Live API Attack Simulation

In the upcoming webinar, Karthik Krishnamoorthy, CTO and Vivek Gopalan, VP of Products at Indusface demonstrate how APIs could be hacked.The session will cover:an exploit of OWASP API Top 10 vulnerability, a brute force account take-over (ATO) attack on API, a DDoS attack on an API, how a WAAP could bolster security over an API gateway

Related Articles