EBooks are popular, and their popularity lucrative threat actors the most, as they are widely shared digital assets that can easily circumvent security measures.
Threat actors exploit users’ trust in seemingly harmless documents by embedding malware in eBook files or disguising malicious code as legitimate eBooks.
ASEC researchers reported that AsyncRAT distribution is via multiple file extensions (.chm, .wsf, .lnk), with threat actors hiding the malware in apparently normal document files like questionnaires.
Are you from SOC/DFIR Teams? - Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files
Recently, a new tactic emerged where AsyncRAT is disguised as an eBook, demonstrating the evolving methods used to trick users into executing this remote access trojan.
Within the weaponized eBook package, there is a fraudulent icon indicating an LNK file containing malicious code, another TXT file with a hidden PowerShell script, compressed video files, and an actual eBook.
Upon execution, it runs RM.TXT’s hidden PowerShell script through the LNK file, which then hides the downloader malware folder and performs an obfuscated script.
Based on security products found by this script, it can begin the real malware from fake video files.
In total, three functions decompress the hidden files, register the task schedules, and execute the scripts. To run the AsyncRAT, these scripts gather the following data:-
The malware masquerades as legitimate processes to evade detection and uses various obfuscation techniques.
The AsyncRAT, the final payload, features anti-detection mechanisms, persistence, and data exfiltration capabilities.
It’s distributed through various methods, including disguised files on sharing sites and phishing emails, making it a versatile and dangerous threat.
“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo
A groundbreaking technique for Kerberos relaying over HTTP, leveraging multicast poisoning, has been recently detailed…
Since mid-2024, cybersecurity researchers have been monitoring a sophisticated Android malware campaign dubbed "Tria Stealer,"…
Proton, the globally recognized provider of privacy-focused services such as Proton VPN and Proton Pass,…
The cybersecurity landscape faces increasing challenges as Arcus Media ransomware emerges as a highly sophisticated…
Proofpoint researchers have identified a marked increase in phishing campaigns and malicious domain registrations designed…
A recent investigation by Unit 42 of Palo Alto Networks has uncovered a sophisticated, state-sponsored…