Hackers Abusing Windows Management Interface Command Tool to Deliver Malware That Steal Email Account Passwords

Cybercriminals are continuing to innovate and use legitimate tools to deliver the malicious file, with this new campaign attacker used WMIC (Windows Management Interface Command) to deliver the information-stealing malware.

WMIC is a command line interface that allows users to run WMI operations, which used to get the status of the local or remote computer systems. The use of legitimate tools allows threat actors to fly under the radar of security products.

Researchers from Symantec observed malware authors abusing WMIC to download the information-stealing malware.

How the attack works

Attackers use to deliver a shortcut file (.lnk) through URL or link in email or as an attachment, once the user opens the file contains a WMIC command, it downloads the malicious file from the attacker’s remote server.

The file downloaded from the remote server is the malicious XSL(eXtensible Stylesheet Language) file and the malicious XSL contains the javascript which is executed using another legitimate application mshta[.]exe used in running Microsoft HTML Application Host.

Researchers said the JavaScript contains a list of 52 domains and it chooses a random URL as well as the random port between 25010-25099 to download the HTA file.

The HTA file also has randomization option to download other files, most of them are DLLs compiled with programming language Delphi.

Then HTA would launch the DLL hwasrhela64196155383.dll file with RegSvr32.exe, which is a direct executable and it loads additional DDL, the final export is BTMEMO used to decrypt and load the DLL files.

The Payload modules downloaded are

Email password stealer
Web browser password stealer
Network Phishing
File browser
Coinminer
Backdoor
Keylogger

The primary payload is an information stealer and the additional modules are downloaded by the URL’s generated by the HTA, the downloaded modules will have .jpg or .gif extensions.

Also Read

Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

Android Device With Open ADB Ports Exploited to Spread Satori Variant of Mirai Botnet

60,000 Android Devices are Infected with Malicious Battery Saver App that Steals Various Sensitive Data

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

MediaTek Releases Security Patch to Fix Vulnerabilities in Mobile and IoT Devices

MediaTek, a prominent semiconductor company specializing in mobile, IoT, and multimedia chipsets, has announced the…

37 minutes ago

Malicious Python Packages Target Popular Cryptocurrency Library to Steal Sensitive Data

In a recent development, the ReversingLabs research team has uncovered a sophisticated software supply chain…

2 hours ago

Lazarus Adds New Malicious npm Using Hexadecimal String Encoding to Evade Detection Systems

North Korean state-sponsored threat actors associated with the Lazarus Group have intensified their Contagious Interview…

3 hours ago

50,000+ WordPress Sites Vulnerable to Privilege Escalation Attacks

In a recent cybersecurity development, over 50,000 WordPress websites using the Uncanny Automator plugin have…

3 hours ago

Python JSON Logger Vulnerability Enables Remote Code Execution – PoC Released

A recent security disclosure has revealed a remote code execution (RCE) vulnerability, CVE-2025-27607, in the…

3 hours ago

Sakura RAT Released on GitHub Can Bypass Antivirus and EDR Tools

A newly developed remote administration tool (RAT) named "Sakura RAT" has been released on GitHub,…

5 hours ago