Friday, March 29, 2024

Trickbot Malware Campaign Targets users with COVID-19 Themed Malspam

The Cyberthreat uses COVID-19 themed malspam to distribute the Trickbot malware, says IBM Security Researchers. This time attacker utilizes FMLA (Family and Medical Leave Act) to lure the user over COVID-19 medical leaves with the attachment named “Family and Medical Leave of Act 22.04.doc” to distribute the malware. Spam mail disguised to come from the U.S. Department of Labor (DoL).

Trickbot Campaigns

TrickBot is a sophisticated banking Trojan operated by an organized cybercrime gang. Users infected with the TrickBot Trojan becomes part of a botnet that can allow attackers to gain complete control of the device.

Typical consequences of TrickBot infections are bank account takeover, high-value wire fraud, and possibly ransomware attacks targeting organizational networks. Mainly financially motivated cyber-attacks.

DocuSign themes used by Trickbot

Sample email US-DoL.eml, contains three attachments: uslogo.png, faq.png, and Family and Medical Leave of Act 22.04.doc.

As first two attachments were just image files and the third one “Family and Medical Leave of Act 22.04.doc” asks users to enable macros ((ThisDocument.cls), to drops the bat file into the user machine location ”C:\Test\terop.bat”.

Trickbot Malware Campaign

Using the cURL utility, the terop.bat file attempts to download an executable from what appears to be a hijacked or compromised domain: hxxps://www.omegasystemsuae[.]com/9hfudnsfl.exe .The file is set to be written to %APPDATA%\Bio_Tecs.exe.

Terop.bat contains TIMEOUT /T 30 and ping 8.8.8.8 commands to evade detection and delay execution.

Overall, the following files are used in the infection chain:

File NameFile CategoryFile HashParent
US-DoL.emlEmailf481ba37fdcfaee9fa991e203963bad8N/A
Family and Medical Leave of Act 22.04.docCarrier Filed341215eb15167870aeff64d5380a69bUS-DoL.eml
terop.batDownloader9f52f07856cdf2b076c27ae60cb0d100Family and Medical Leave of Act 22.04.doc
faq.pngBenigneb77c6a9fc86bd73d77b92c24ca889dbUS-DoL.eml
us-logo.pngBenign1af19e6717acf7f38b8f1a651c738954US-DoL.eml
Infection chain – Trickbot

Infection chain – Trickbot This has been observed that the “Macro on Close” function used in the Docusign theme became a tactic for Trickbot distributors.

Other Trickbot Campaigns

New TrickBot Module BruteForce RDP Connections Attacks Telecommunication Industry

Hackers Abusing Window 10 Remote Desktop ActiveX control to Install New Version of Trickbot Malware

TrickBot Credential Stealer Malware Abuses Google Suite to Hide Malicious Activity

Website

Latest articles

Beware Of Weaponized Air Force invitation PDF Targeting Indian Defense And Energy Sectors

EclecticIQ cybersecurity researchers have uncovered a cyberespionage operation dubbed "Operation FlightNight" targeting Indian government...

WarzoneRAT Returns Post FBI Seizure: Utilizing LNK & HTA File

The notorious WarzoneRAT malware has made a comeback, despite the FBI's recent efforts to...

Google Revealed Kernel Address Sanitizer To Harden Android Firmware And Beyond

Android devices are popular among hackers due to the platform’s extensive acceptance and open-source...

Compromised SaaS Supply Chain Apps: 97% of Organizations at Risk of Cyber Attacks

Businesses increasingly rely on Software as a Service (SaaS) applications to drive efficiency, innovation,...

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles