Pro-Russia Hacker Groups Exploiting Winrar Flaw to Steal Login Credentials

A new phishing attack has been discovered, which uses malicious archive files to exploit the recently found WinRAR vulnerability CVE-2023-38831 using a Powershell script that steals credentials from Google Chrome and Microsoft Edge browsers.

The archive consists of a PDF document that shows the list of Indicators of Compromise (IOCs), which includes domain names and hashes associated with different malware like SmokeLoader, Nanocore RAT, Crimson RAT, and AgentTesla.

Due to the WinRAR vulnerability, threat actors could create a reverse shell on the affected system and execute PowerShell scripts.

FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Free Demo

Technical Analysis – CVE-2023-38831

CVE-2023-38831 was an arbitrary code execution vulnerability in WinRAR 6.23, which can be exploited by including an ordinary file (a JPG file) and also a folder with the same name as the file embedding inside the ZIP archive.

If the folder consists of executable content, it is processed when WinRAR attempts to access only the ordinary file.

This vulnerability in WinRAR was reportedly executed in the wild between April and August 2023.

However, WinRAR has released patches for fixing this vulnerability. This vulnerability was exploited in the current phishing campaign.

Exploiting the CVE-2023-38831

Threat actors used a file named IOC_09_11.rar to pretend to be a file that might contain Indicators of Compromise. This RAR file consists of a folder and a file named “IOC_09_11.pdf”. The folder consists of the “IOC_09_11.pdf[.]cmd, ” a BAT script.

Due to the vulnerability, when opening the PDF file, the BAT script is executed from the folder, which extracts the RAR file contents in the %TEMP% directory. Once extracted, the script file gets deleted from the folder and opens the PDF file for the victim to view.

Three Malicious Powershell commands

When the victim starts to view the contents of the PDF, the script starts to proceed with its intended work by launching three PowerShell commands. The first command creates a Private RSA Key in the %LOCALAPPDATA%\Temp folder, the second opens a reverse shell to the victim machine, and the third executes a Base64-encoded string.

In addition, the script steals the Login credentials from Google Chrome and Microsoft Edge browsers, which are then sent to the threat actor using the legit Webhook.Site service using a unique URL.

Furthermore, a complete report has been published by Cluster25, which provides detailed information about the source code, PowerShell commands, and other information. 

Indicators of Compromise

CATEGORY	TYPE	VALUE
PAYLOAD	SHA256	072afea7cae714b44c24c16308da0ef0e5aab36b7a601b310d12f8b925f359e7
PAYLOAD	SHA1	9e630c9879e62dc801ac01af926fbc6d372c8416
PAYLOAD	MD5	89939a43c56fe4ce28936ee76a71ccb0
PAYLOAD	SHA256	91dec1160f3185cec4cb70fee0037ce3a62497e830330e9ddc2898f45682f63a
PAYLOAD	SHA1	bd44774417ba5342d30a610303cde6c2f6a54f64
PAYLOAD	MD5	9af76e61525fe6c89fe929ac5792ab62
NETWORK	IPv4	216[.]66[.]35[.]145
NETWORK	URL	http://webhook[.]site/e2831741-d8c8-4971-9464-e52d34f9d611

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.