Friday, April 25, 2025
HomeCyber AttackHackers Launching New Muncy Malware as .EXE File Worldwide via DHL Phishing...

Hackers Launching New Muncy Malware as .EXE File Worldwide via DHL Phishing Campaign

Published on

SIEM as a Service

Follow Us on Google News

Cyber Criminals now distributing new dubbed Muncy malware as a EXE file format via DHL phishing campaigns to target the users around the world.

DHL phishing is one of the widely distributing campaigns that delivers that various sophisticated malware in recent past via malspam emails.

Threat actors are leveraging the poorly configured SMTP servers and email spoofing techniques to distributing the DHL phishing campaign that looks like a legitimate one.

- Advertisement - Google News

DHL is a globally well-known and trusted logistics company that providing
international courier, parcel, and express mail services and the reputation abused by cybercriminals in order to deliver the powerful malware.

Malicious actors using Email spoofing technique in currently distributed phishing email campaign where the email pretending that it comes from DHL express.

Distributed malspam Email contained a malicious attachment that posed as PDF and the extracted files format is .exe.

Initial wave observed was on February 12th, 2019 by Segurança Informática (SI) Lab and the further analysis revealed that SMTP servers with bad configurations are a majestic vector to spread malicious campaigns.

Also, the body of the email tricked with embedded PNG image instead of the plain-text message that attached to the following local path in the system C:/Users/Administrator/Desktop/DHL.png .

Muncy Malware Via DHL Phishing

Once the victim open the attachment, it drops the Muncy trojan file on the system and the malware is completely packed.

Later its starts the initial execution process that unpacked to the PE File .data section and scans the entire C:\ drive  in order to find the sensitive files.

MUNCY MALWARE WORK FLOW

“The phishing campaign is trying to impersonate DHL shipment notification and the malware is attached in the email”, Founder and Pentester at CSIRT.UBI, Pedro Tavares who discovered this malware told to GBHackers via email.

“This malware is on the rise and is affecting user’s in-the-wild while stealing sensitive information from their devices.”

The giant DHL has already been informed about the phishing campaign but has not yet issued any public statement. researcher said.

Indicators of Compromise

Hashes

7eb38ece89e903d298d7cf03b3aec69d
4df6d097671e0f12b74e8db080b66519

Also Read:

Google Launches phishingquiz To Test That you Can Identify Phishing Emails

New Phishing Attack Taking Advantages of Vulnerability in Office 365 to Bypass all of Microsoft’s Security

Phishing Email Scams Target American Express Card Users To Steal Sensitive Information

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

DragonForce and Anubis Ransomware Gangs Launch New Affiliate Programs

Secureworks Counter Threat Unit (CTU) researchers have uncovered innovative strategies deployed by the DragonForce...

“Power Parasites” Phishing Campaign Targets Energy Firms and Major Brands

Silent Push Threat Analysts have uncovered a widespread phishing and scam operation dubbed "Power...

Threat Actors Register Over 26,000 Domains Imitating Brands to Deceive Users

Researchers from Unit 42 have uncovered a massive wave of SMS phishing, or "smishing,"...

Russian Hackers Attempt to Sabotage Digital Control Systems of Dutch Public Service

The Dutch Defense Ministry has revealed that critical infrastructure, democratic processes, and North Sea...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

“Power Parasites” Phishing Campaign Targets Energy Firms and Major Brands

Silent Push Threat Analysts have uncovered a widespread phishing and scam operation dubbed "Power...

Russian Hackers Attempt to Sabotage Digital Control Systems of Dutch Public Service

The Dutch Defense Ministry has revealed that critical infrastructure, democratic processes, and North Sea...

North Korean APT Hackers Pose as Companies to Spread Malware to Job Seekers

Silent Push Threat Analysts have uncovered a chilling new cyberattack campaign orchestrated by the...