DangerousPassword – Hackers Use New Attack Pattern to Infect Devices With Malware

Recently, it has been observed by JPCERT/CC that threat actors are actively targeting the cryptocurrency exchanges linked to the DangerousPassword attack campaign (aka CryptoMimic or SnatchCrypto), involving the distribution of malware through email shortcuts since June 2019.

Apart from malware distribution through email, various attack patterns are utilized by the attackers to infect targets with malware, with four specific patterns being observed.

Here below we have mentioned those four attack patterns:-

  • Attacks by sending malicious CHM files from LinkedIn
  • Attacks using OneNote files
  • Attacks using virtual hard disk files
  • Attacks targeting macOS

Analysis of Attack Patterns

Here below, we have mentioned the complete analysis of the four attack patterns that are observed:-

Attacks by sending malicious CHM files from LinkedIn

Attackers employ alternative methods of reaching targets by utilizing LinkedIn to send malware, where the compressed RAR file received contains a CHM file that, upon execution, downloads and runs an external MSI file.

DangerousPassword

Upon execution, the MSI file deploys a PowerShell script to download and execute another MSI file (Administrator-a214051.msi) which, in turn, collects and transmits information about infected hosts via HTTP POST request in Base64 encoded format.

Researchers have confirmed that compromised LinkedIn accounts, posing as job providers, are used to send malware to targets, although the method of compromising social networking accounts by the attackers remains unknown.

Attacks Using OneNote files

The utilization of OneNote file exploitation for malware infection, observed in Emotet and other malware attacks, is increasingly prevalent in email attachment-based infection campaigns.

In line with other malware attacks, DangerousPassword employs a OneNote file containing embedded malware, and opening the file triggers the infection.

The OneNote file contains a malicious MSI file that installs a DLL on the host and executes it, while also possessing the ability to identify AV tools.

Upon detecting specific antivirus software, the malware adjusts its actions by terminating the following things:-

  • It hooks the process to NTDLL to evade monitoring
  • Modifying data in curl commands
  • Altering the method of launching downloaded malware

Here below we have mentioned the AV programs:-

  • Avast
  • Avira
  • Bitdefender
  • Kaspersky
  • Sophos
  • Trend Micro
  • Windows Defender

Attacks using virtual hard disk files

According to the report, Attackers can conceal malware by compressing it in ZIP or RAR formats, incorporating it into an ISO file, or embedding it within a VHD file, which can be mounted on Windows OS by double-clicking and is commonly used for Hyper-V virtualization.

The VHD file includes a decoy PDF, the main malware (DLL), and an executable (EXE) to initiate the DLL. The DLL file operates similarly to the OneNote file’s malware.

Attacks targeting macOS

Attackers are now targeting both Windows and macOS by utilizing an AppleScript that downloads and executes an unauthorized application through the main.scpt file using the curl command.

The executed application displays a window and utilizes XOR decoding to read file contents, downloads a file from the decoded command and control (C2) server, and subsequently executes it.

The persistent APT group DangerousPassword targets cryptocurrency exchanges in Japan, utilizing LinkedIn as a potential contact method, necessitating caution when engaging with social media platforms. 

Additionally, macOS users should exercise vigilance as the attackers can exploit the operating system’s vulnerabilities.

Building Your Malware Defense Strategy – Download Free E-Book

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting the growing, widespread use and potential…

12 hours ago

C2A Security’s EVSec Risk Management and Automation Platform Gains Automotive Industry Favor as Companies Pursue Regulatory Compliance

In 2023, C2A Security added multiple OEMs and Tier 1s to its portfolio of customers, successful evaluations, and partnerships such…

13 hours ago

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and education. The latest update, Wireshark 4.2.4,…

15 hours ago

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered platform designed to redefine how we…

15 hours ago

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information and grant unauthorized access. It's an…

16 hours ago

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including two zero-day exploits showcased at the…

19 hours ago