Thursday, March 28, 2024

Emotet Uses Unconventional IP Address Formats to Spread Malware & Evade Detection

In a recent ongoing Emotet malware campaign, it has been identified that the threat actors behind this malicious campaign are using the unconventional IP address formats for the first time to confuse and deceive the security solutions.

Here the threat actors have used hexadecimal and octal representations of the IP address. They use this to initiate the request from the remote servers so that the IP address gets transformed to the dotted decimal quad representation.

Routine using hexadecimal & octal IP address

In hexadecimal routing, a malicious Excel 4.0 Macros was detected as an email attachment that enables the attacker to accomplish and automate the repetitive tasks in Excel that are manipulated to deliver the malware.

At this point, using the auto_open macro the malware was executed, and to help the whole mechanism, the attackers abused the feature of the malicious document.

While in octal routing, they also do the same as the hexadecimal routing, since, in this case, Excel 4.0 Macros is used to execute the malware when the malicious document is opened and enabled.

In short, with the help of carets, the URL is obfuscated, but the IP holds an octal representation.

The URL that is obfuscated with carets (“h^tt^p^:/^/0xc12a24f5/cc.html”), when the victim is fooled and enables the malicious document macros. While here under the control of the attackers, the host incorporates a hexadecimal representation of the IP address to execute an HTML application (HTA) code.

Since 2014 the Emotet banking trojan has been active, and behind this botnet, the experts have detected TA542. Apart from this, this banking trojan also used to deliver other malicious items like:-

  • Trickbot trojans
  • QBot trojans
  • Conti ransomware
  • ProLock ransomware
  • Ryuk ransomware
  • Egregor ransomware

Here’s what the security analyst, Ian Kenefick stated:-

“The unconventional use of hexadecimal and octal IP addresses may result in evading current solutions reliant on pattern matching. Evasion techniques like these could be considered evidence of attackers continuing to innovate to thwart pattern-based detection solutions.”

However, to mitigate such a situation, the use of the unusual technique in the command lines will be helpful for the detection. 

And not only that, even Microsoft has also affirmed that they are planning to disable the Excel 4.0 (XLM) Macros by default, as this will keep all their customers safe against security threats.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles