Researchers observers that the AdvisorsBot Malware spreading in 3 different form, the first one has appeared via email to that target hotels, the second one is targeting restaurant, the third one mimics as a resume with the malicious macro document to attack telecommunications.
All the targeting email contain macros and the attack trick users to enable the macro that executes a PowerShell command to download and execute the AdvisorsBot Malware.
later threat actor shifted the technique that helps to download another PowerShell script when the PowerShell command gets executed which is responsible for net technique AdvisorsBot to execute without writing it to disk.
AdvisorsBot Malware Infection Technique
An AdvisorsBot word derived from its command & control server which is used for receiving the command from malware authors that contain the word “advisors” in many areas.
Attackers using many junk code such as extra instructions, conditional statements, and loops to strengthen the anti-analysis techniques that makes difficult to analyze the malware.
AdvisorsBot malware contains a list of hard code hash value to compare with the running process hash of the system’s volume serial number, name and compare with it if its matches then it terminates the execution.
Attacker paying very close attention to victims to get connected with the C&C server and increase the success ratio, they are implementing an additional anti-analysis check that compared the system’s machine SID to a list of 13 hardcoded values.
“More specifically, the data that is encoded in the URI contains the machine SID, CRC32 hash of the computer name, some unknown hardcoded values, and the Windows version.”
Finally, an attacker using fingerprinting module being sent from a C&C server and the command will perform stealing activities such as Takes a screenshot, Extracts Microsoft Outlook account details and other malicious activities.