CryptBot Infostealer Constantly Changing and Being Distributed Posted By jcleebobgatenet , August 9, 2021 CryptBot is an Infostealer that is being distributed through malicious websites disguised as software download pages. Because there are multiple malicious websites created and many of them appear on the top page when keywords such as cracks and serials of popular commercial software are entered in search engines, many users are subject to download the malware and run it. In addition, the sample uses the SFX packing, making difficult to distinguish between normal and malicious files, and changes occur multiple…
Fileless Remcos RAT Malware Delivery Posted By jcleebobgatenet , July 29, 2021 The ASEC analysis team identified that Remcos RAT malware is being distributed through malicious macros in Excel files. As for the malware, the team introduced it in detail in the post linked below this text. While the method of coming into the system through spam mails is the same as before, it should be noted that the Remcos RAT malware is ultimately delivered filelessly after going through multiple loader stages. In summary, the overall operation method is as follows: The attacker attaches…
APT Attack Attempts Using Word Documents Targeting Specific Individuals Posted By jcleebobgatenet , July 27, 2021 The ASEC analysis team confirmed that the malware with the same format of malicious word documents introduced in the post “Malicious Word Documents Pretending ‘Korea Association for Political and Diplomatic History’ and ‘Policy Advisory Member Profile’ Being Distributed” is still being distributed. Like the malicious word documents introduced in previous cases, the recently discovered word files also download the dotm file with the malicious macro through the external link. The filenames and external URLs confirmed are as follows. Date Discovered…
Excel Files Becoming More Sophisticated (Distribution of Dridex and Cobalt Strike) Posted By jcleebobgatenet , July 26, 2021 The distribution method of Dridex through Excel files has been steadily discovered since last year and was introduced on this blog. Recently, the ASEC analysis team found that the Cobalt Strike tool along with Dridex is being distributed with a similar method as before. Yet unlike previous cases, recent Excel documents that are being distributed were found to perform malicious behaviors after a certain time using the task scheduler. It is assumed that the change in the operation method was…
Excel 4.0 Macro with Various Images being Distributed Posted By jcleebobgatenet , July 22, 2021 The ASEC analysis team found that malicious Excel files using the Excel 4.0 macro (formula macro) have been continually distributed. The malware has been distributed indiscriminately through e-mails since May, and as it is still being discovered today, users need to take caution. The malicious Excel files include images that prompt users to enable macros. Figures below show the files that are currently being distributed. The malware sets particular cells with Auto_Open in the Name Manager. When macros are enabled,…
