Hackers exploit Oracle WebLogic Servers, knowing that they are extensively used in enterprises.
Threat actors can use security vulnerabilities present in the WebLogic servers to gain unauthorized access to sensitive data and install backdoors that open avenues for further exploitation.
FortiGuard Labs recently uncovered the 8220 Gang using ScrubCrypt, an antivirus evasion tool, to launch attacks on exploitable Oracle WebLogic servers last year.
Recently, a threat actor distributed a phishing email with malicious SVG files, downloading an obfuscated Batch file containing BatCloak, which uses ScrubCrypt to load VenomRAT payload.
It maintains a C2 connection to install plugins like VenomRAT v6, Remcos, XWorm, NanoCore, and crypto wallet stealer on victims’ systems, bypassing antivirus detection.
ScrubCrypt ‘AV Evasion Tool’
The attacker begins with a phishing email claiming package delivery, attaching an SVG file titled “INV0ICE_#TBSBVS0Y3BDSMMX.svg” containing base64-encoded data.
AI-Powered Protection for Business Email Security
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .
When opened, the ECMAScript converts it to a ZIP file named “INV0ICE_#TBSBVS0Y3BDSMMX.zip,” containing an obfuscated batch file.
Presumed to be from the BatCloak tool, it copies a PowerShell file to “C:\Users\Public\xkn.exe” and hides its activities with parameters.
Decoding the data, it saves as “pointer.png,” then as “pointer.cmd” in a hidden directory. Upon executing “pointer.cmd,” all files are deleted using “cmd /c del.
The “pointer.cmd” file is a ScrubCrypt batch file that deliberately fills it with jumbled-up strings so that it is difficult to read.
It consists of two payloads, which are Base64 encoded, decrypted using AES-CBC, and compressed using GZIP.
It uses PowerShell to load an assembly from a byte array and execute its code.
The initial payload establishes persistence and loads malware, which checks for administrator privileges and the presence of a debugger.
In addition, if the user has special rights, then the script copies itself over to “strt.cmd” and schedules a task.
Otherwise, it copies itself into the “StartUp” folder. Next, it loads an assembly called “P” to initiate VenomRAT, Fortinet said.
The second payload evades AMSI and ETW to enable remote access.
Spam emails propagating unauthorized system access, like a modified Quasar RAT called VenomRAT, distribute this malware.
.webp)
It sends victim details back to its command and control (C2) server. Debugging shows keep-alive sessions and mechanisms for acquiring plugins.
After receiving orders, it unzips and stores plugins using filename-based PowerShell commands.
Here below, we have mentioned all the plugins that are used:-
- Plugin 1 – Venom RAT v6.0.3
- Plugin 2 – NanoCore
- Plugin 3 – XWorm
- Plugin 4 – Remcos
- Plugin 5 – Stealer
The campaign involves various levels of obscurity and uses phishing emails and malicious software to silently spread VenomRAT through ScrubCrypt as well as other malware plugins that give it persistence, evasion mechanisms, and means for running damaging codes.
The originality in adapting strategies and utilizing the wide range of functionalities available to infiltrate systems without being detected by security solutions illustrates how complex modern threats are, which demand strong security measures.
Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.
