Thursday, March 28, 2024

Rubella Macro Builder – A Malware Development Crimeware Kit Selling in Underground Hacking Forum

A Malware development crimeware kit called Rubella Macro Builder activity selling in Russian based underground hacking Forum for $500 per month.

This kit has extremely sophisticated with a lot more capabilities with cheap cost with fast performance and also evade the antivirus detection.

A Malware kit developers also reduce the price since April to $120 USD for a 3-month license and Rubella Macro Builder activities getting various updates, additions, and pricing changes in hacking Forum.

This tool enables to use various social engineering techniques to distribute the malware through office document and enable the macro.

Also, this crimeware kit using various encryption algorithm choices ( XOR and Base64), download methods (PowerShell, Bitsadmin, Microsoft.XMLHTTP, MSXML2.XMLHTTP, custom PowerShell payload), payload execution methods (executable, JavaScript, Visual Basic Script)
Rubella Macro Builder settings

Malware Builder Capabilities in Hacking Forum

Office document and Excel-based Email attachment is the main medium of distribution  Rubella-generated malware act as a first-stage loader and it helps to download other malware and install into the target machine.

After the infection, if it doesn’t find any vulnerabilities in the vicitms machine, it relies on social engineering techniques to force victims to enable malicious macro execution to run it.

Also Rubella Macro Builder capable to generate Microsoft Word (.DOC) and Microsoft Excel (.XLS) payloads.

Rubella document imitates a DPD shipping document to Enable Macro

According to flashpoint research, The observed server call request is achieved via the IXMLHTTPRequest method in this specific variant. The macro code contains auto execution when the Word document is opened via an AutoOpen call. Additionally, the code has logic to delete the file if it exists via a Kill call.

Rubella Kit Malware leads to install two banking malware called Panda and Gootkit which has a capacity to perform credential harvesting capabilities, browser infection through webinjects, and remote PC access via a hidden virtual network computing.

Researchers believe that these two banking malware developers gang are customers of the actor offering Rubella on the underground.

Website

Latest articles

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across...

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two...

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft...

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included...

Beware of Free Android VPN Apps that Turn Your Device into Proxies

Cybersecurity experts have uncovered a cluster of Android VPN applications that covertly transform user...

ZENHAMMER – First Rowhammer Attack Impacting Zen-based AMD Platforms

Despite AMD's growing market share with Zen CPUs, Rowhammer attacks were absent due to...

Airbus to Acquire INFODAS to Strengthen its Cybersecurity Portfolio

Airbus Defence and Space plans to acquire INFODAS, a leading cybersecurity and IT solutions...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles