The spam messages contained URLs that downloaded FlawedAmmyy remote-access trojan (RAT), a well-known backdoor.

Another interesting aspect of the is that It was powered by the Necurs .

“This campaign was in the use of .pub files. It also appeared to originate from the Necurs botnet, a notorious botnet responsible for much mass distribution in the past,” reads the analysis published by Trustwave.

“Unlike previous mass campaigns, this campaign was small and, interestingly, all of the To: addresses we saw targeted were domains belonging to , indicating a desire for the attackers to get a foothold within with the FlawedAmmyy RAT.”

malspam  - malspam banks - Unusual Malspam campaign targets banks with Microsoft Publisher filesSecurity Affairs

When the victims open the pub file, they are prompted to “Enable Macros,” earlier versions of Microsoft Publisher may display instructions to “Enable Editing” and “Enable Content”

When manually opening the Visual Basic Editor (VBA Editor) in Microsoft Publisher and clicking “ThisDocument” in Project Explorer, the VBScript executes a weaponized archive containing the RAT.

“The macro script is triggered with the function Document_Open(). As the name implies, when the file is opened, the script will access a URL and execute a downloaded file.” continues the analysis.

The malicious code leverages control objects in forms to hide the URL from which It downloads the RAT, the URL is stored in the Tag Property.

malspam  - malspam banks 2 - Unusual Malspam campaign targets banks with Microsoft Publisher filesSecurity Affairs

“By the time we examined the sample, the URL was not accessible anymore, but a little further research indicated this URL was used for downloading a self-extracting archive, which contained the FlawedAmmyy RAT,” researchers said.

In July, Proofpoint uncovered another massive malspam campaign delivering the FlawedAmmyy RAT that was leveraging emails with weaponized PDF documents containing malicious SettingContent-ms files.

The campaign was attributed to the financially motivated cybercriminal group TA505.

“this campaign was unusual in the use of .pub files. It also appeared to originate from the Necurs botnet, a notorious botnet responsible for much mass malware distribution in the past (see here and here).” concludes Trustwave.

“Unlike previous mass campaigns, this campaign was small and, interestingly, all of the To: addresses we saw targeted were domains belonging to banks, indicating a desire for the attackers to get a foothold within banks with the FlawedAmmyy RAT.” 

Technical details, including the IoCs, are reported in the analysis published by the experts.

Pierluigi Paganini

(Security Affairs – Malspam, Publisher)




Source link

LEAVE A REPLY

Please enter your comment!
Please enter your name here