Monday, November 25, 2024
HomeComputer SecurityHackers Using InfoStealer Malware that Attacks Windows Servers To Steal Sensitive Data

Hackers Using InfoStealer Malware that Attacks Windows Servers To Steal Sensitive Data

Published on

A new InfoStealer malware has been identified which targets the windows servers, stealing its sensitive data that includes the login credentials, OS version, IP addresses and also uploads the victim’s data to the FTP attacker’s server.

Security researchers from Checkpoint observed a huge malware campaign that runs malicious contents specifically to steal sensitive data from windows server using Mimikatz tool and the campaign specifically targets countries in Asia.

The infection starts with the executable file, downloaded from 66[.]117.6.174/ups.rar and then it gets executed on the victim’s machine, and continues to check if the compromised machine is a windows server or not.

- Advertisement - SIEM as a Service
InfoStealer malware

If the infected machine is a windows server then it executes the malware. whereas, when a different Operating System is identified, the malware will not run.

Upon finding the target as a “Windows Server”, the server sends two requests, one is to drop the batch files and to trigger the file-less attack, and the next is to send a request to sync with C2 server.

The Patch file contains the components of the infamous Mirai botnet and the attackers enhanced this module with new malicious behaviors. The new module is capable of creating a WMI Event customer object that runs the PowerShell and escalates it to admin permission.

Then it tries downloading the following malwares such as Mirai, Dark cloud and XMRig miner. To download the malware it uses cradle obfuscator method and invokes the content from the following IP http://173[.]208.139.170/s.txt.

In order to avoid the detection, it invokes another command which downloads the ps1 file that runs various commands. Then malware calls GetVersionExA which extracts the OS version.

It extracts the details of the processor and invokes Mimikatz from an external URL and dumps all the passwords. Once the password is exfiltrated, it is saved in a file and then the file is uploaded to an FTP server managed by attackers.

Based on Checkpoint analysis, the FTP server is still open and the uploads are continuously stored in the server every second.

Related Read:

Beware!! Hackers Now Spreading Dangerous FlawedAmmyy Malware Through PDF & IQY File

Hackers Using Microsoft Publisher File To Deliver Dangerous FlawedAmmyy RAT Targeting Banks

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to...

Meta Removed 2 Million Account Linked to Malicious Activities

 Meta has announced the removal of over 2 million accounts connected to malicious activities,...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Threat Actors Exploit Google Docs And Weebly Services For Malware Attacks

Phishing attackers used Google Docs to deliver malicious links, bypassing security measures and redirecting...

Python NodeStealer: Targeting Facebook Business Accounts to Harvest Login Credentials

The Python-based NodeStealer, a sophisticated info-stealer, has evolved to target new information and employ...

XSS Vulnerability in Bing.com Let Attackers Send Crafted Malicious Requests

A significant XSS vulnerability was recently uncovered in Microsoft’s Bing.com, potentially allowing attackers to...