Tuesday, April 16, 2024

Hackers Launching Powerful Malware ExileRAT Via Weaponized Microsoft PowerPoint Document

Researchers observed a new malicious campaign that delivers a powerful ExileRAT malware via Microsoft powerpoint documents using previously used C2 server infrastructure.

Attackers deliver the malware via Email attachment and the Mail address represented the Central Tibetan Administration (CTA), a Tibetan based government organization.

Nature of this malware campaign seems to spy on civilian populations for political reasons and its most likely not distributing for financial gain.

PPSX file format document, a non-editable slideshow derived via MS Powerpoint was used for this attack and it attached with a CTA mailing list

Further analysis revealed that the malware campaign shared the payload and infrastructure that is used by previous malware LuckyCat, an Android- and Windows-based trojans.

Apart from that, discovered C2 server hosting used for multiple campaigns using the same payloads and the PPSX file dropper helps an attacker to execute the various payload into victims system.

Mailing list infrastructure used from Indian based company DearMail,  that provides a cloud enabled web-based email campaign manager.

Attackers abusing the Email Header and modified the standard reply that helps to get a direct reply from victims to the attacker’s email address.

ExileRAT Malware Infection Process

Attackers using Microsoft office based remote code execution vulnerability and its exploit hosted on GitHub which is available for public.

The exploit code resides in the “slide1.xml.rels” file and the researchers analyze file by dynamic analysis on Threat Grid and find that the
PPSX also attempts to contact IP location to perform some geo-location lookups.

Later it initiate the HTTP request to C2 server where it retrieves the JavaScript script that’s responsible for downloading the payload “syshost.exe” and infect the system.

ExileRAT is Remote access Trojan based Malware that is capable of getting information on the system (computer name, username, listing drives, network adapter, process name), getting/pushing files and executing or terminating processes.

According to Cisco Talos Research, Apart from this ExileRAT infection, the researcher identified several other open directories that contained other .exe and .dll files, namely “AcroRd32.exe” and “ccL100U.dll.”.

“The hardcoded C2 server IP in Syshost.exe was also recently home to a specific interesting domain: mondaynews[.]tk. This domain is the C2 domain of an Android RAT created on Jan. 3. This is a newer version of the LuckyCat Android RAT used in 2012 against Tibetan activists” Talos researchers said.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep your self-updated.

Also Read:

Hackers Exploiting Adobe Flash Zero-Day that Launching via a Microsoft Office Document

New AZORult Malware Spreading Via Office Documents Steals to Credentials & Launch Ransomware Attack

Hackers Distributing PowerShell-based Backdoor Via MS Office document That Shares Stolen Data Via C&C Server


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles