Threat actors from TA505 currently spreading powerful FlawedAmmyy RAT via weaponized MS Excel documents with malicious Excel 4.0 macro which is hard to detect by standard security controls.
Observed FlawedAmmyy RAT sample is highly sophisticated that can control the infected victims remotely and evade the security software.
TA505 threat actors are a well-known cybercrime group that has been already infected millions of victims using various malicious operations including large-scale Dridex, Locky, and GlobeImposter campaigns, among others.
Based on the malware capabilities, it will be detected only when it passed the first level of execution by MSI file (Windows installer).
Researcher was dig deeper into leaked source analysis that reports, FlawedAmmyy RAT can perform various operation including remote desktop control, file system manager, proxy support and audio chat.
Apart from these infections it also can provide complete access of victim machines to the attackers and steal files, credentials, collect screenshots and access the camera and microphone.
According to the Researcher, Pedro Tavares from
FlawedAmmyy Infection Process
TA505 Threat actors initially leveraging
The email contains attached Excel documents and the body content of the email trick users to open the file which carried and execute the malicious Excel 4.0 macro code.
“Malicious XLM macro code is located within a hidden form to avoid the attention of the victims. The name of the hidden form is written in the Russian language: Макрос1 — Macro 1, in English.”
After the successful execution of the Macro, MSI dropper will be ready drop the first stage of malware msiexec.exe process which is an another downloader of the original FlawedAmmyy RAT ( wsus.exe ).
Later it establishes the C2 server communication where it
“Users who receive emails with xls files attached should be aware as that files can be an undetected vehicle spreading any kind of malware and the Infection is dependent on the victim allowing the macro to run. Users should ensure that macros are disabled in their Microsoft Office applications. ” Researcher said.
Indicators of Compromise
c4463d6ae741d4fb789bd0895fafebee (.msi installer/dropper)
2944eca03bc13b0edf064a619ec41459 (malware first stage)