Wednesday, June 19, 2024

Fileless Malware Installing Backdoor Via USB Flash Disks

A Fileless Malware Discovered as “TROJ_ANDROM.SVN” that can ability to Create a Backdoor into Target Windows Computer which is installing via USB Flash Disks.

USB Flash Disk contained  2 Different Backdoor that is fully Encrypted and initially it abuse many Legitimate functions is the System.

Mostly Filess Malware infecting the computer Memory and vector involves some writing to the hard disk.

Its purpose is to reside in volatile system areas such as the system registry, in-memory processes and service areas.

Also Read:    Filelessmalware that uses PowerShell scripts from Window’s registry leading to Click Fraud Malware Campaign

How Does Fileless Malware Infection Chain Works

This Fileless Malware Discovered in USB flash disk which contains 2 malicious Backdoor files and both Detected as “TROJ_ANDROM.SVN”.

Both Files have the Different lengthy file name and Both Files have Different infection capability.

1.addddddadadaaddaaddaaaadadddddaddadaaaaadaddaa.addddddadadaaddaaddaaaadadddddadda

2. IndexerVolumeGuid

Once user Click the Malware, It will be Decrypted and Loaded into Memory and later it will create an auto start registry entry and run.

A shortcut with the target path %System%\cmd.exe /c start rundll32 {DLL file with long file name},{DLL’s export function} may also be used. These shortcut files may have appear to have the same name as the removable drive, tricking the user into clicking it. (We detect these shortcuts as LNK_GAMARUE.YYMN.)

This Decryptor’s file name serves as a Decryption key to  Decrypt the Malware.

Fileless Malware

Infection Flow Chart

Later, AutoStart Registry Entry Created by decrypted code and it will Serve as a Starting point for Execution Process.

Once Registry entry createdeventually  JS_POWMET.DE leading to the download and execution of a backdoor onto the affected system.

According to Trend Micro, After this Process, a second Backdoor wil be Detected as BBKDR_ANDROM.SMRA  and Drop dropped in the %AppData% folder with the filename ee{8 random characters}.exe. A shortcut to it is also created in the user startup folder, ensuring that this second backdoor is automatically executed.

End of the Result, This Second Backdoor take over the complete control of the system by Executing the  BBKDR_ANDROM.SMRA  Backdoor.

Registry entries Contained two URL’s and both used for Different Operating Systems that is one URL is used for Windows 10, another for earlier versions of Windows.

This Different URL allows for Different Attack based on the user’s operating system.

Website

Latest articles

Singapore Police Arrested Two Individuals Involved in Hacking Android Devices

The Singapore Police Force (SPF) has arrested two men, aged 26 and 47, for...

CISA Conducts First-Ever Tabletop Exercise Focused on AI Cyber Incident Response

On June 13, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) made history by...

Europol Taken Down 13 Websites Linked to Terrorist Operations

Europol and law enforcement agencies from ten countries have taken down 13 websites linked...

New ARM ‘TIKTAG’ Attack Impacts Google Chrome, Linux Systems

Memory corruption lets attackers hijack control flow, execute code, elevate privileges, and leak data.ARM's...

Operation Celestial Force Employing Android And Windows Malware To Attack Indian Users

A Pakistani threat actor group, Cosmic Leopard, has been conducting a multi-year cyber espionage...

Hunt3r Kill3rs Group claims they Infiltrated Schneider Electric Systems in Germany

The notorious cybercriminal group Hunt3r Kill3rs has claimed responsibility for infiltrating Schneider Electric's systems...

Hackers Employing New Techniques To Attack Docker API

Attackers behind Spinning YARN launched a new cryptojacking campaign targeting publicly exposed Docker Engine...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles