Thursday, December 12, 2024
HomeBackdoorHackers Infect Windows With Backdoor Malware Via "Car For Sale" Ad

Hackers Infect Windows With Backdoor Malware Via “Car For Sale” Ad

Published on

SIEM as a Service

Fighting Ursa, a Russian APT, has employed a car sales phishing lure to distribute the HeadLace backdoor malware targeting diplomats since March 2024. This strategy mirrors previous campaigns by the group and other Russian threat actors. 

The attack leveraged public, free infrastructure services and exploited user clicks on malicious content within the car advertisement. 

Hackers exploited Webhook.site, a legitimate service for creating custom URLs used in development projects. On March 14th, 2024, a URL linked to a malicious infection chain was submitted to VirusTotal. 

- Advertisement - SIEM as a Service

This Webhook.site URL didn’t host malicious content itself. Instead, it delivered a malicious HTML page when accessed, which abuses the service’s functionality of generating unique URLs for triggering custom actions based on visitor information. 

HTML code used in the attack was hosted on the Webhook.site service.

The HTML code employs a multi-stage attack by initially filtering visitors based on the operating system, redirecting non-Windows users to a decoy car advertisement hosted on ImgBB.

How to Build a Security Framework With Limited Resources IT Security Team (PDF) - Free Guide 

For Windows users, it embeds Base64-encoded ZIP archive data, offers it for download, and attempts to automatically open it using JavaScript, suggesting a targeted attack designed to deliver a malicious payload to Windows systems under the guise of a legitimate car advertisement.

Diplomatic car for sale lure hosted on ImgBB.

The downloaded ZIP archive named IMG-387470302099.zip contains a malicious executable file disguised as a JPG image. 

The file IMG-387470302099.jpg.exe has the double extension .jpg.exe, but due to the default Windows configuration, only the .jpg extension is displayed, which is a social engineering tactic to trick users into thinking it’s a harmless image file and executing the malware.  

According to Unit 42, a malicious executable disguised as the Windows calculator sideloads the WindowsCodecs.dll file, a component of the modular HeadLace backdoor. 

The staged infection process leverages a legitimate application to introduce malicious code, likely aimed at evading detection and delaying analysis.

The DLL’s function, as depicted, is crucial to understanding the backdoor’s subsequent actions and overall operation. 

Code in the WindowsCodecs.dll file to run a file named zqtxmo.bat.

The ZIP archive contains a malicious batch file named zqtxmo.bat, which leverages Microsoft Edge (msedge) to execute a Base64-encoded iframe that retrieves content from a Webhook.site URL. Downloaded content is saved as a JPEG file (IMG387470302099.jpg) in the user’s downloads directory. 

The batch file then moves the downloaded file to the %programdata% directory and modifies the extension to .cmd (IMG387470302099.cmd). Finally, the script executes the .cmd file and deletes itself to erase evidence.  

Fighting Ursa, a persistent threat actor that leverages dynamic infrastructure and diverse lure sets to distribute HeadLace malware, continues to exploit legitimate web services for malicious purposes. 

Organizations should restrict access to such platforms and meticulously examine their usage to proactively identify and mitigate potential attack vectors associated with Fighting Ursa. 

A malicious campaign leverages a webhook site hosting a decoy car-for-sale image and a ZIP archive containing a legitimate calc.exe, a malicious DLL, and a batch file. 

Once extracted, calc.exe is abused to sideload the malicious DLL, which subsequently executes the batch file, indicating a potential malware infection or data theft operation. 

Are you from SOC and DFIR Teams? – Analyse Malware Incidents & get live Access with ANY.RUN -> Free Access

Latest articles

Resecurity introduces Government Security Operations Center (GSOC) at NATO Edge 2024

Resecurity, a global leader in cybersecurity solutions, unveiled its advanced Government Security Operations Center...

Reserachers Uncovered Zloader DNS Tunneling Tactics For Stealthy C2 Communication

Zloader, a sophisticated Trojan, has recently evolved with features that enhance its stealth and...

US Charged Chinese Hackers for Exploiting Thousands of Firewall

The US Treasury Department's Office of Foreign Assets Control (OFAC) has sanctioned Sichuan Silence...

DMD Diamond Launches Open Beta for v4 Blockchain Ahead of 2025 Mainnet

DMD Diamond - one of the oldest blockchain projects in the space has announced the...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

DMD Diamond Launches Open Beta for v4 Blockchain Ahead of 2025 Mainnet

DMD Diamond - one of the oldest blockchain projects in the space has announced the...

Hackers Deploy Weaponized LNK Files for Malicious Payload Delivery

Researchers reported a phishing attack on December 4th, 2024, where malicious emails purportedly from...

Microsoft Patch Tuesday December 2024, 71 Vulnerabilities Fixed Including 1 Zero-day

In its final Patch Tuesday of 2024, Microsoft has released a significant security update...