Saturday, June 15, 2024

Pro-Russia Hacker Groups Exploiting Winrar Flaw to Steal Login Credentials

A new phishing attack has been discovered, which uses malicious archive files to exploit the recently found WinRAR vulnerability CVE-2023-38831 using a Powershell script that steals credentials from Google Chrome and Microsoft Edge browsers.

The archive consists of a PDF document that shows the list of Indicators of Compromise (IOCs), which includes domain names and hashes associated with different malware like SmokeLoader, Nanocore RAT, Crimson RAT, and AgentTesla.

Due to the WinRAR vulnerability, threat actors could create a reverse shell on the affected system and execute PowerShell scripts.

Document
FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Technical Analysis – CVE-2023-38831

CVE-2023-38831 was an arbitrary code execution vulnerability in WinRAR 6.23, which can be exploited by including an ordinary file (a JPG file) and also a folder with the same name as the file embedding inside the ZIP archive.

If the folder consists of executable content, it is processed when WinRAR attempts to access only the ordinary file.

This vulnerability in WinRAR was reportedly executed in the wild between April and August 2023.

However, WinRAR has released patches for fixing this vulnerability. This vulnerability was exploited in the current phishing campaign.

Exploiting the CVE-2023-38831

Threat actors used a file named IOC_09_11.rar to pretend to be a file that might contain Indicators of Compromise. This RAR file consists of a folder and a file named “IOC_09_11.pdf”. The folder consists of the “IOC_09_11.pdf[.]cmd, ” a BAT script.

Due to the vulnerability, when opening the PDF file, the BAT script is executed from the folder, which extracts the RAR file contents in the %TEMP% directory. Once extracted, the script file gets deleted from the folder and opens the PDF file for the victim to view.

Three Malicious Powershell commands

When the victim starts to view the contents of the PDF, the script starts to proceed with its intended work by launching three PowerShell commands. The first command creates a Private RSA Key in the %LOCALAPPDATA%\Temp folder, the second opens a reverse shell to the victim machine, and the third executes a Base64-encoded string.

In addition, the script steals the Login credentials from Google Chrome and Microsoft Edge browsers, which are then sent to the threat actor using the legit Webhook.Site service using a unique URL.

Furthermore, a complete report has been published by Cluster25, which provides detailed information about the source code, PowerShell commands, and other information. 

Indicators of Compromise

CATEGORYTYPEVALUE
PAYLOADSHA256072afea7cae714b44c24c16308da0ef0e5aab36b7a601b310d12f8b925f359e7
PAYLOADSHA19e630c9879e62dc801ac01af926fbc6d372c8416
PAYLOADMD589939a43c56fe4ce28936ee76a71ccb0
PAYLOADSHA25691dec1160f3185cec4cb70fee0037ce3a62497e830330e9ddc2898f45682f63a
PAYLOADSHA1bd44774417ba5342d30a610303cde6c2f6a54f64
PAYLOADMD59af76e61525fe6c89fe929ac5792ab62
NETWORKIPv4216[.]66[.]35[.]145
NETWORKURLhttp://webhook[.]site/e2831741-d8c8-4971-9464-e52d34f9d611

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.

Website

Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
Eswar
Eswar
Eswar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles