Security researchers from Trustwave spotted the Email campaign subjected “Payment Advice” with Microsoft Office Publisher file attached.
Once the .pub file is opened it asks the victim’s to Enable Macros, the macro script triggers Document_Open() event which opens the file and once the file is opened it access the URL that located in the Tag Property and executes a downloaded file.
At the time of analysis the URL was not active, but with further analysis, it was identified that the URL was used to download the self-extracting archive that contains the FlawedAmmyy RAT.
The FlawedAmmy RAT functions as follows
Remote Desktop control
File system manager
With further analysis in the Cuckoo Sandbox, researchers confirmed that the backdoor accessed a certain IP related to FlawedAmmyy. It transfers the information such as id”, “os”, “names” and credentials from the victim’s machine to attacker’s server.
Researchers said this campaign is unusual and it was originated from the infamous notorious Necurs botnet. The campaign was small and it particularly targets domains belonging to banks.
With the previous campaign, attackers deliver FlawedAmmyy RAT via Weaponized Microsoft Word and PDF Attachments to spy victims device and steal the sensitive information Remotely.