Beware of Phishing Emails Disguised as Transaction Receipts
Recently, the AhnLab SEcurity intelligence Center (ASEC) identified instances of phishing emails that were disguised as transaction receipts. The emails impersonated employees of a specific US company. The body of the message stated that a transaction receipt was attached and asked the recipient to review it and confirm whether funds had been deposited into their account, thereby enticing the recipient to open the Attachment.
- Attached PDF document: transaction_successful_ID9238249123024.Pdf
[Figure 1] Phishing email body
The attached PDF contains what appears to be an international money transfer confirmation document and displays a message stating that an Adobe Flash Player update is required to view the document. When the user attempts to open the PDF, a download button appears along with the message, “An updater to Adobe Flash Player is needed to view this PDF.” The email then attempts to connect to the site below using Adobe Reader’s external link feature; if the user allows the connection, they are redirected to a website believed to be operated by a threat actor.
- URL: hxxp://transaction-sucessful[.]Vercel.App/
[Figure 2] Attached malicious PDF file
Upon accessing the site, the “adobe-flash-updater.Vbs” file is downloaded. When the user runs the VBS file, the script is re-executed with administrator privileges using ShellExecute, and then opens “payment_receipt.Pdf” from the web page to display a decoy document that is disguised as a legitimate transaction receipt. While the user is viewing the document, the script downloads the `sc.Msi` file from the threat actor’s server in the background through `curl.Exe` and installs the MSI package using the `msiexec.Exe /qn /norestart` options, without displaying a separate installation window to the user. This allows the threat actor to simultaneously carry out the behavior of viewing a legitimate document and the installation of the malicious MSI.
- Legitimate decoy document: hxxp://payment-six-eta.Vercel.App/doc/payment_receipt[.]Pdf
- Malicious MSI file: hxxp://payment-six-eta.Vercel[.]App/doc/sc.Msi
[Figure 3] adobe-flash-updater.Vbs
[Figure 4] Legitimate decoy document
The downloaded sc.MSI is the MSI installation package for ScreenConnect, a remote management solution from ConnectWise. After installation, ScreenConnect.ClientService.Exe runs with command-line arguments containing Access session information (such as the Session ID, Guest role, and public key for server identification) required to connect to relay.Gamedbd.Com:8041. Through this process, the compromised system is registered as an Access session within the ScreenConnect infrastructure, allowing the threat actor to gain persistent remote access to the infected system. This enables the threat actor to carry out follow-up attacks, such as file transfer, command execution, and the deployment of additional payloads. ScreenConnect is legitimate software widely used for remote support and system administration; however, cases of threat actors exploiting it as part of “Living-off-the-Land” (LoL) techniques—which involve abusing legitimate administrative tools—have been consistently identified recently, requiring extra caution.
- Threat actor’s server: relay.Gamedbd.Com:8041
[Figure 5] Session information stored in the registry
Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.
