Hackers Using Microsoft Teams to Deliver DarkGate Malware Via HR-themed Messages

Recent reports indicate that threat actors have been using Microsoft Teams to deliver DarkGate Loader malware.

The campaign originated from two compromised external Office 365 accounts identified to be “Akkaravit Tattamanas” (63090101@my.buu.ac.th) and “ABNER DAVID RIVERA ROJAS” (adriverar@unadvirtual.edu.co)

DarkGate loader malware was introduced in 2017 but was only being used by its original developer. However, in June 2023, the malware developer started to advertise it on several cybercrime forums as Malware-as-a-service (MaaS).

It was traditionally spread via email until one of the operators had other ideas and started to use Microsoft Teams to deliver the malware. The message context sent to the victims consisted of an HR-themed social engineering chat message.

Hackers Using Microsoft Teams

Further investigations revealed that the chat messages consisted of an externally hosted Sharepoint link, which contains a ZIP file under the name “Changes to the vacation schedule.zip.”

Once the victims download this ZIP file, it consists of an LNK file (shortcut) disguised as a PDF document and has the name “Changes to the vacation schedule.pdf.lnk”.

Further analysis of the LNK file revealed that if opened, the file has several commands for a chain of execution, which will initially create a VBScript file with the name “asrxmp.vbs” in the C:\tpgh\ directory and execute it automatically.

Once the VBScript file gets executed, it downloads the file from the remote server hXXp:// 5[.]188[.]87[.]58:2351/wbzadczl and executes it. This execution leads to the use of the Windows version of cURL (renamed to wbza) for downloading and executing Autoit3.exe and the bundled script eszexz.au3. 

This AutoIT script drops another shellcode file and checks if Sophos is installed before executing it. If not, the AutoIT script deobfuscates its code further and launches the shellcode.

This final shellcode execution creates a file byte to byte to load a new Windows executable identified as the “DarkGate loader” malware.

A complete report has been published by Truesec, which provides detailed information about the deobfuscation, configuration analysis, and other information about this DarkGate loader malware.

“Unfortunately, current Microsoft Teams security features such as Safe Attachments or Safe Links were not able to detect or block this attack.” reads the post by Truesec. This campaign was detected due to the security awareness training of the recipients.

Organizations and IT administrators are recommended to implement some security features, including allowing Microsoft Teams chat requests from specific external domains and creating a whitelist of trusted domains.

It is also recommended that organizations train their employees in cyber security awareness, which can educate all the employees and prevent future attacks.

Indicators of Compromise

Filename	SHA256 Hash
Changes to the vacation schedule.zip	0c59f568da43731e3212b6461978e960644be386212cc448a715dbf3f489d758
Changes to the vacation schedule.pdf.lnk	bcd449470626f4f34a15be00812f850c5e032723e35776fb4b9be6c7be6c8913
c:\tgph\asrxpm.vbs	4c21711de81bb5584d35e744394eed2f36fef0d93474dfc5685665a9e159eef1
c:\wbza\eszexz.au3	1bcde4d4613f046b63e970aa10ea2662d8aa7d326857128b59cb88484cce9a2d

Command & Control Server

• hXXp://5[.]188[.]87[.]58:2351

Compromised Email Addresses

• 63090101@my.buu.ac.th
• adriverar@unadvirtual.edu.co

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.