Hackers Embedded the Malicious Code Within WAV Audio Files to Gain Reverse Shell Access

Researchers observed a new malware campaign using WAV audio files to hide the malware and to avoid detection. Threat actors embedded the malicious code within the WAV audio files.

Based on BlackBerry Cylance threat researchers’ analysis, each WAV file contains a loader component to decode and executing malicious content embedded in audio files.

Similar techniques were observed between multiple threat actors, they used PNG (1,2) and JPEG files, employs steganography techniques to hide the malware.

Miner and Metasploit code – WAV Audio

Further analysis reveals that some of the WAV files contain crypto miner script XMRig Monero CPU miner and others include Metasploit code used to establish a reverse shell.

Both of the WAV files use the same infrastructure, which indicates the campaign used to gain remote access over the victim networks and for monetary benefits.

Attackers use steganography methods to hide the malicious codes in the WAV files. Earlier this year, Symantec published a report about the Turla APT hacker group, the APT group uses the .wav files with Metasploit code embedded.

Researchers classified the loaders into three categories

  • Loaders that employ the Least Significant Bit (LSB) steganography to decode and execute a PE file.
  • Loaders that employ a rand()-based decoding algorithm to decode and execute a PE file.
  • Loaders that employ rand()-based decoding algorithm to decode and execute shellcode.

Steganography & Encoding Methods

The first type is based on the steganography method, the .wav file employees steganography method to extract the content.

Upon executing the audio file Song(.)wav, it executes a DLL in memory and triggers the export process, the exported file is an XMRig Monero CPU miner, which is designed to steal victim’s resources and to mine cryptocurrency, reads the blog post.

The second category is based on the rand()-based decoding algorithm used to hide the PE files, in this case, the audio files don’t have any music.

When the audio file is executed, the loader reads the file and executes the DLL in memory, the extracted file is the XMRig Monero CPU miner.

The third category is the rand()-based decoding algorithm to hide PE files, like the previous one, this audio file also contains white noise.

Upon executing the audio file the loader opens the PE files, decodes its contents and executes the shellcode. The Metasploit shellcode is capable of launching reverse shell access to the specified IP address.

Attackers continue to use innovative methods to compromise victim machines, in this campaign attackers used both steganography and other encoding techniques.





You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates

Guru Baran

Guru is an Ex-Security Engineer at Comodo Cybersecurity. Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

Free Threat Hunting Platform Security Onion Released Updates – What’s New!

The third Beta version of Security Onion 2.4 is made available by Security Onion Solutions.…

8 hours ago

Toyota Server Misconfiguration Leaks Owners Data for Over Seven Years

The Leak discloses Address, Vehicle Identification Number (VIN), Email address, Phone number, Name, and Vehicle…

14 hours ago

Dark Pink APT Group Compromised 13 Organizations in 9 Countries

Dark Pink has successfully targeted 13 organizations across 9 countries, highlighting the extent of their…

1 day ago

Hackers Exploit Barracuda Zero-Day Flaw Since 2022 to Install Malware

This vulnerability exists due to improper processing, validation, and sanitization of the names of the…

1 day ago

Critical Jetpack WordPress Flaw Exposes Millions of Website

This vulnerability could be used by authors on a site to manipulate any files in…

2 days ago

Shut Down Phishing Attacks – Types, Methods, Detection, Prevention Checklist

In today's interconnected world, where digital communication and transactions dominate, phishing attacks have become an…

2 days ago