Thursday, April 17, 2025
HomeComputer SecurityHackers Distributing FELIXROOT Backdoor Malware using Microsoft Office Vulnerabilities

Hackers Distributing FELIXROOT Backdoor Malware using Microsoft Office Vulnerabilities

Published on

SIEM as a Service

Follow Us on Google News

Newly discovered malware campaign distributing powerful FELIXROOT Backdoor using Microsoft Office Vulnerabilities to compromise the victim’s windows computers.

FELIXROOT backdoor campaign initially discovered in September 2017 that distributed via malicious Ukrainian bank documents with macro that download the backdoor from C&C server.

Currently attackers distributing weaponized lure documents that contains exploits for Microsoft office vulnerabilities CVE-2017-0199 and CVE-2017-11882 .

- Advertisement - Google News

based on the source, the malware is distributed via Russian-language documents with Microsoft office Vulnerabilities.

How Does This FELIXROOT Backdoor Works

As we mentioned earlier there are two vulnerabilities (CVE-2017-0199 and CVE-2017-11882) exploiting and the malicious document distributed with the name “Seminar.rtf”.

Seminar.rtf contains embedded binary file that will be is dropped in %temp% which is used to drop and execute the FELIXROOT dropper.

FELIXROOT dropper compressed within dropped executable that will be create a two files, an LNK file that points to %system32%\rundll32.exe, and the FELIXROOT loader component.

Here the LNK file is responsible for execute the loader component of FELIXROOT and the backdoor component is completely encrypted using custom encryption that uses XOR with a 4-byte key.

After the successful execution in victims machine it sleeps 10 and the new thread will be created.

FELIXROOT  backdoor using HTTP and HTTPS POST protocols for command & control server communication and once it collected the data from the victims machine then the data sent over the network that is encrypted and arranged in a custom structure.

According to FireEye,  The malware queries the Windows API to get the computer name, user name, volume serial number, Windows version, processor architecture and two additional values.

Later all the stolen data is transferred to C2 servers using AES encryption using HTTP or HTTPS protocol and the AES key is completely unique.

After encryption, the cipher text to be sent over C2 is Base64 encoded. FELIXROOT backdoor contains various  commands for specific tasks and it used to sleep one minute before executing the next task.

Once it complete the execution and steal the compromised machine information, the  FELIXROOT  backdoor stops the loop execution and finally it wipe the footprints of the infected machine.

Indicators of Compromise

11227ECA89CC053FB189FAC3EBF27497Seminar.rtf
4DE5ADB865B5198B4F2593AD436FCEFFSeminar.rtf
78734CD268E5C9AB4184E1BBE21A6EB9Zam<RandomNumber>.doc
92F63B1227A6B37335495F9BCB939EA2FELIXROOT Dropper
DE10A32129650849CEAF4009E660F72FFELIXROOT Backdoor

Also Read

Beware !! Hackers Deliver FlawedAmmyy RAT via Weaponized Microsoft Word and PDF Documents

US-CERT Alerts Powerful Emotet Banking Malware Attack on Government, Private and Public Sectors

Dangerous macOS Backdoor That Steals User Login Credentials Remained Undetected for Years

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Managing Burnout in the SOC – What CISOs Can Do

The Security Operations Center (SOC) is the nerve center of modern cybersecurity, responsible for...

The Future of Cybersecurity Talent – Trends and Opportunities

The cybersecurity landscape is transforming rapidly, driven by evolving threats, technological advancements, and a...

Mobile Security – Emerging Risks in the BYOD Era

The rise of Bring Your Own Device (BYOD) policies has revolutionized workplace flexibility, enabling...

Model Context Protocol Flaw Allows Attackers to Compromise Victim Systems

A critical vulnerability in the widely adopted Model Context Protocol (MCP), an open standard...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Model Context Protocol Flaw Allows Attackers to Compromise Victim Systems

A critical vulnerability in the widely adopted Model Context Protocol (MCP), an open standard...

Gamaredon’s PteroLNK VBScript Malware Infrastructure and TTPs Uncovered by Researchers

Researchers have unearthed details of the Pterodo malware family, notably the PteroLNK variant used...

Critical Erlang/OTP SSH Vulnerability Allow Hackers Execute Arbitrary Code Remotely

A major security flaw has been uncovered in the widely used Erlang/OTP SSH implementation,...