Tuesday, March 19, 2024

Hackers Launching Powerful Malware ExileRAT Via Weaponized Microsoft PowerPoint Document

Researchers observed a new malicious campaign that delivers a powerful ExileRAT malware via Microsoft powerpoint documents using previously used C2 server infrastructure.

Attackers deliver the malware via Email attachment and the Mail address represented the Central Tibetan Administration (CTA), a Tibetan based government organization.

Nature of this malware campaign seems to spy on civilian populations for political reasons and its most likely not distributing for financial gain.

PPSX file format document, a non-editable slideshow derived via MS Powerpoint was used for this attack and it attached with a CTA mailing list

Further analysis revealed that the malware campaign shared the payload and infrastructure that is used by previous malware LuckyCat, an Android- and Windows-based trojans.

Apart from that, discovered C2 server hosting used for multiple campaigns using the same payloads and the PPSX file dropper helps an attacker to execute the various payload into victims system.

Mailing list infrastructure used from Indian based company DearMail,  that provides a cloud enabled web-based email campaign manager.

Attackers abusing the Email Header and modified the standard reply that helps to get a direct reply from victims to the attacker’s email address.

ExileRAT Malware Infection Process

Attackers using Microsoft office based remote code execution vulnerability and its exploit hosted on GitHub which is available for public.

The exploit code resides in the “slide1.xml.rels” file and the researchers analyze file by dynamic analysis on Threat Grid and find that the
PPSX also attempts to contact IP location to perform some geo-location lookups.

Later it initiate the HTTP request to C2 server where it retrieves the JavaScript script that’s responsible for downloading the payload “syshost.exe” and infect the system.

ExileRAT is Remote access Trojan based Malware that is capable of getting information on the system (computer name, username, listing drives, network adapter, process name), getting/pushing files and executing or terminating processes.

According to Cisco Talos Research, Apart from this ExileRAT infection, the researcher identified several other open directories that contained other .exe and .dll files, namely “AcroRd32.exe” and “ccL100U.dll.”.

“The hardcoded C2 server IP in Syshost.exe was also recently home to a specific interesting domain: mondaynews[.]tk. This domain is the C2 domain of an Android RAT created on Jan. 3. This is a newer version of the LuckyCat Android RAT used in 2012 against Tibetan activists” Talos researchers said.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep your self-updated.

Also Read:

Hackers Exploiting Adobe Flash Zero-Day that Launching via a Microsoft Office Document

New AZORult Malware Spreading Via Office Documents Steals to Credentials & Launch Ransomware Attack

Hackers Distributing PowerShell-based Backdoor Via MS Office document That Shares Stolen Data Via C&C Server

Website

Latest articles

CryptoWire Ransomware Attacking Abuses Schedule Task To maintain Persistence

AhnLab security researchers detected a resurgence of CryptoWire, a ransomware strain originally prevalent in...

E-Root Admin Sentenced to 42 Months in Prison for Selling 350,000 Credentials

Tampa, FL – In a significant crackdown on cybercrime, Sandu Boris Diaconu, a 31-year-old...

WhiteSnake Stealer Checks for Mutex & VM Function Before Execution

A new variant of the WhiteSnake Stealer, a formidable malware that has been updated...

Researchers Hack AI Assistants Using ASCII Art

Large language models (LLMs) are vulnerable to attacks, leveraging their inability to recognize prompts...

Microsoft Deprecate 1024-bit RSA Encryption Keys in Windows

Microsoft has announced an important update for Windows users worldwide in a continuous effort...

Beware Of Free wedding Invite WhatsApp Scam That Steal Sensitive Data

The ongoing "free wedding invite" scam is one of several innovative campaigns aimed at...

Hackers Using Weaponized SVG Files in Cyber Attacks

Cybercriminals have repurposed Scalable Vector Graphics (SVG) files to deliver malware, a technique that...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles