Thursday, March 28, 2024

Hackers Launching Powerful Malware ExileRAT Via Weaponized Microsoft PowerPoint Document

Researchers observed a new malicious campaign that delivers a powerful ExileRAT malware via Microsoft powerpoint documents using previously used C2 server infrastructure.

Attackers deliver the malware via Email attachment and the Mail address represented the Central Tibetan Administration (CTA), a Tibetan based government organization.

Nature of this malware campaign seems to spy on civilian populations for political reasons and its most likely not distributing for financial gain.

PPSX file format document, a non-editable slideshow derived via MS Powerpoint was used for this attack and it attached with a CTA mailing list

Further analysis revealed that the malware campaign shared the payload and infrastructure that is used by previous malware LuckyCat, an Android- and Windows-based trojans.

Apart from that, discovered C2 server hosting used for multiple campaigns using the same payloads and the PPSX file dropper helps an attacker to execute the various payload into victims system.

Mailing list infrastructure used from Indian based company DearMail,  that provides a cloud enabled web-based email campaign manager.

Attackers abusing the Email Header and modified the standard reply that helps to get a direct reply from victims to the attacker’s email address.

ExileRAT Malware Infection Process

Attackers using Microsoft office based remote code execution vulnerability and its exploit hosted on GitHub which is available for public.

The exploit code resides in the “slide1.xml.rels” file and the researchers analyze file by dynamic analysis on Threat Grid and find that the
PPSX also attempts to contact IP location to perform some geo-location lookups.

Later it initiate the HTTP request to C2 server where it retrieves the JavaScript script that’s responsible for downloading the payload “syshost.exe” and infect the system.

ExileRAT is Remote access Trojan based Malware that is capable of getting information on the system (computer name, username, listing drives, network adapter, process name), getting/pushing files and executing or terminating processes.

According to Cisco Talos Research, Apart from this ExileRAT infection, the researcher identified several other open directories that contained other .exe and .dll files, namely “AcroRd32.exe” and “ccL100U.dll.”.

“The hardcoded C2 server IP in Syshost.exe was also recently home to a specific interesting domain: mondaynews[.]tk. This domain is the C2 domain of an Android RAT created on Jan. 3. This is a newer version of the LuckyCat Android RAT used in 2012 against Tibetan activists” Talos researchers said.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep your self-updated.

Also Read:

Hackers Exploiting Adobe Flash Zero-Day that Launching via a Microsoft Office Document

New AZORult Malware Spreading Via Office Documents Steals to Credentials & Launch Ransomware Attack

Hackers Distributing PowerShell-based Backdoor Via MS Office document That Shares Stolen Data Via C&C Server

Website

Latest articles

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including...

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and...
Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles