Wednesday, April 17, 2024

DangerousPassword – Hackers Use New Attack Pattern to Infect Devices With Malware

Recently, it has been observed by JPCERT/CC that threat actors are actively targeting the cryptocurrency exchanges linked to the DangerousPassword attack campaign (aka CryptoMimic or SnatchCrypto), involving the distribution of malware through email shortcuts since June 2019.

Apart from malware distribution through email, various attack patterns are utilized by the attackers to infect targets with malware, with four specific patterns being observed.

Here below we have mentioned those four attack patterns:-

  • Attacks by sending malicious CHM files from LinkedIn
  • Attacks using OneNote files
  • Attacks using virtual hard disk files
  • Attacks targeting macOS

Analysis of Attack Patterns

Here below, we have mentioned the complete analysis of the four attack patterns that are observed:-

Attacks by sending malicious CHM files from LinkedIn

Attackers employ alternative methods of reaching targets by utilizing LinkedIn to send malware, where the compressed RAR file received contains a CHM file that, upon execution, downloads and runs an external MSI file.


Upon execution, the MSI file deploys a PowerShell script to download and execute another MSI file (Administrator-a214051.msi) which, in turn, collects and transmits information about infected hosts via HTTP POST request in Base64 encoded format.

Researchers have confirmed that compromised LinkedIn accounts, posing as job providers, are used to send malware to targets, although the method of compromising social networking accounts by the attackers remains unknown.


Attacks Using OneNote files

The utilization of OneNote file exploitation for malware infection, observed in Emotet and other malware attacks, is increasingly prevalent in email attachment-based infection campaigns.

In line with other malware attacks, DangerousPassword employs a OneNote file containing embedded malware, and opening the file triggers the infection.


The OneNote file contains a malicious MSI file that installs a DLL on the host and executes it, while also possessing the ability to identify AV tools.

Upon detecting specific antivirus software, the malware adjusts its actions by terminating the following things:-

  • It hooks the process to NTDLL to evade monitoring
  • Modifying data in curl commands
  • Altering the method of launching downloaded malware

Here below we have mentioned the AV programs:-

  • Avast
  • Avira
  • Bitdefender
  • Kaspersky
  • Sophos
  • Trend Micro
  • Windows Defender

Attacks using virtual hard disk files

According to the report, Attackers can conceal malware by compressing it in ZIP or RAR formats, incorporating it into an ISO file, or embedding it within a VHD file, which can be mounted on Windows OS by double-clicking and is commonly used for Hyper-V virtualization.

The VHD file includes a decoy PDF, the main malware (DLL), and an executable (EXE) to initiate the DLL. The DLL file operates similarly to the OneNote file’s malware.

Attacks targeting macOS

Attackers are now targeting both Windows and macOS by utilizing an AppleScript that downloads and executes an unauthorized application through the main.scpt file using the curl command.


The executed application displays a window and utilizes XOR decoding to read file contents, downloads a file from the decoded command and control (C2) server, and subsequently executes it.

The persistent APT group DangerousPassword targets cryptocurrency exchanges in Japan, utilizing LinkedIn as a potential contact method, necessitating caution when engaging with social media platforms. 

Additionally, macOS users should exercise vigilance as the attackers can exploit the operating system’s vulnerabilities.

Building Your Malware Defense Strategy – Download Free E-Book


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles