Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label DLL load hijacking. Show all posts
Spam
Banking Trojan Cyber Attacks Cyberattacks DHL Express DLL load hijacking Emotet Kaspersky malspam Outlook PayPal PowerShell Spam

Emotet : The Infamous Botnet Has Returned

 

Kaspersky researchers were able to retrieve and analyze 10 out of 16 modules, with most having been used by Emotet in the past in one form or another. Kaspersky Lab was created in 1997 as multinational cybersecurity and digital privacy organization. Kaspersky's deep risk intelligence and security expertise are continually evolving into new security solutions and services to safeguard enterprises, vital infrastructure, governments, and consumers all around the world. 

Emotet was discovered in the wild for the first time in 2014. Its major purpose back then was to steal user's financial credentials. Since then, it has gone through several modifications, began transmitting other viruses, and eventually evolved into a strong botnet. Emotet is a type of malware classified as banking Trojans. Malspam, or spam emails with malware, is the most common way for it to propagate. To persuade users, these communications frequently contain familiar branding, imitating the email structure of well-known and trustworthy companies such as PayPal or DHL. 

As per Kaspersky telemetry, the number of victims increased from 2,843 in February 2022 to 9,086 in March 2022, indicating the attackers targeted more than three times the number of users. As a result, the number of threats detected by Kaspersky solutions has increased, from 16,897 in February 2022 to 48,597 in March 2022. 

A typical Emotet infection starts with spam e-mails containing malicious macros in Microsoft Office attachments. The actor can use this macro to launch a malicious PowerShell command which will drop and start a module loader, which will then talk with a command and control server to download and start modules. In the percent Windows percent SysWOW64 or percent User percent AppDataLocal directory, Emotet creates a subfolder with a random name and replicates itself under a completely random name and extension. The exported Control RunDLL method is used to launch the Emotet DLL's primary activity. These modules can be used to carry out a range of actions on the infected computer. Kaspersky researchers were able to extract and evaluate 10 of the 16 modules, the majority of which had previously been utilized by Emotet. 

Researchers now state that the Emotet can download 16 modules judging by the recent Emotet protocol and C2 answers. They were able to recover ten of them (including two separate copies of the Spam module), which were utilized by Emotet to steal credentials, passwords, accounts, and e-mail addresses, as well as spam. We present a brief examination of these modules and also statistics on current Emotet attacks in this post. 

To gather the account details of various email clients, the current version of Emotet can create automated spam campaigns which are further spread down the network from infected devices, retrieving emails and email addresses from Thunderbird and Outlook apps and accumulating passwords from popular web browsers like Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera. 

Emotet infects computers in businesses and homes all around the world. As per our telemetry, Emotet most frequently targeted users from the following countries in Q1 2022: Italy (10.04%), Russia (9.87%), Japan (8.55%), Mexico (8.36%), Brazil (6.88%), Indonesia (4.92%), India (3.21%), Vietnam (2.70%), China (2.62), Germany (2.19%) and Malaysia (2.13%). 

The present set of components is capable of a wide range of malicious activities, including stealing e-mails, passwords, and login data from a variety of sources, as well as spamming. Except for the Thunderbird components, Emotet has utilized all of these modules in some form or another before. However, there are still a few modules that we haven't been able to get our hands-on.
Read more »
Trojan
Chinese Hackers DLL load hijacking ESET ISP malware NATO THORChain Trojan

Hackers from China's 'Mustang Panda' were Utilizing New 'Hodur' Malware

 

Mustang Panda (a.k.a. Temp.Hex, HoneyMyte, TA416 or RedDelta), a China-based advanced persistent threat (APT), has been traced to an ongoing cyberattack campaign using a formerly undocumented variation of the PlugX remote access trojan on affected workstations mostly in and around Southeast Asia. For its similarities to another PlugX (aka Korplug) variation called THOR which surfaced in July 2021, slovak cybersecurity firm ESET termed the current version Hodur. 

Korplug is a proprietary virus used widely, it was initially uncovered in a 2020 investigation that looked into Chinese hackers' activities against Australian targets. Mustang Panda employs phishing lures with counterfeit papers to target European embassies, ISPs (Internet Service Providers), and research institutes in the most recent known campaign, according to cybersecurity firm ESET. "Anti-analysis measures and control-flow obfuscation are used at every level of the deployment process," the firm told.

Hodur is based on PlugX, a remote access tool that "allows remote users to steal data or take control of impacted systems without authorization. It can copy, move, rename, execute, and delete files, as well as log keystrokes and fingerprint the infected system." The infections end with the implementation of the Hodur backdoor on the infected Windows host, irrespective of the phishing lure used. 

As formerly stated, the campaign begins simply, with the group phishing its targets using current events. Proofpoint identified it using a NATO diplomat's email address to send out.ZIP and.EXE files labeled "Situation at the EU Borders with Ukraine" last month. If a victim accepts the bait, a legitimate, properly signed executable prone to DLL search-order hijacking will be delivered. Russia, Greece, Cyprus, South Africa, Vietnam, Mongolia, Myanmar, and South Sudan are the countries targeted in this campaign. 

ESET claims to have sampled sophisticated custom loaders as well as new Korplug (Hodur) versions still using DLL side-loading but has considerably more robust obfuscation and anti-analysis techniques across the infection chain. The side-loading custom DLL loader uses a digitally-signed genuine executable, in this case, a SmadAV file, and leverages a known flaw. Except for one, which loads the new Korplug variation, the loader's many functions are all fake. 

As it is a Chinese actor with a history of pursuing higher political espionage purposes, the scope of its targeting should be rather consistent.
Read more »
PowerShell
APT attacks Cisco Talos Cyber Attacks DLL load hijacking Iranian hackers MuddyWater PowerShell

 Iran's MuddyWater Hacker Group is Exploiting New Malware

 

According to a notice issued by US security and law enforcement authorities, Iran-linked cyber activities are targeting a variety of government and private organizations in several areas across Asia, Africa, Europe, and North America.

"MuddyWater actors are poised to deliver stolen data and access to the Iranian government, as well as to share them with other cybercriminal actors," the agencies stated. The FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the U.S. Cyber Command Cyber National Mission Force (CNMF), and the National Cyber Security Centre of the United Kingdom have issued a combined advisory (NCSC) in the regard.

This year, the cyber-espionage actor was revealed to be working for Iran's Ministry of Intelligence and Security (MOIS), conducting malicious operations against a wide range of state and private organisations in Asia, Africa, Europe, and North America, including telecommunications, defence, local government, and the oil and natural gas sectors. 

MuddyWater is also known by the aliases Earth Vetala, MERCURY, Static Kitten, Seedworm, and TEMP. Aside from publicly disclosed vulnerabilities, the hacker group has already been seen using open-source tools to get access to sensitive information, deliver ransomware, and maintain resilience on victim networks. 

Late last month, Cisco Talos conducted a follow-up analysis and discovered a previously unknown malware campaign focused on Turkish private and governmental entities with the purpose of delivering a PowerShell-based backdoor. In harmful operations, MuddyWater actors use new variations of PowGoop malware as its main loader, which consists of a DLL loader and an Operating system downloader. The malicious programme poses as a valid Google Update executable file and is signed as such. 

A surveying script to identify and send data about target PCs back to the remote C2 server rounds out MuddyWater's arsenal of weapons. A newly discovered PowerShell backdoor was also installed, which is used to perform actions obtained from the attacker. 

The agencies advise enterprises to utilise multi-factor authentication whenever possible, limit the usage of administrator credentials, deploy phishing defences, and prioritise correcting known exploited vulnerabilities to provide barriers against potential attacks.
Read more »
Vulnerability and Exploits
Coin Mining cryptomining malware DLL load hijacking Vulnerability and Exploits

Apple's APSDaemon Vulnerability Abused by Malware Distributors



Attackers can maliciously redirect users on websites sharing counterfeit products, adult content or videos and dupe them into installing malware before they even land on the intended website, it's one of the most popular ways of generating revenue amongst hackers who acquire access to websites by exploiting the vulnerabilities in an installed plugin – it could be a security flaw or outdated software.

Typically, 'malicious redirects' are operated by hackers with the intent of generating advertising impressions, however other consequences of 'malvertising' can be relatively dangerous causing significant damage to unprotected machines. The campaign revolves around the idea of pushing malware and spam-laden advertisements onto the browsers. In 2019, attackers were seen launching such campaigns against popular web browsers namely Google Chrome, Microsoft Edge, Opera, and Safari.

Recently, malware distributors have launched a new malware campaign that makes use of this 'web pages redirect' to exploit a DLL hijacking flaw in Apple's Push Notification service executable Windows to get a cryptocurrency miner installed on the targeted user's system.

What is DLL hijacking?


DLL (Dynamic Link Libraries) are extensions of various applications running on any operating system as most of the applications require storing code in different files, when a user uses an application, it may or not use certain codes – those codes are stored in a different file and are loaded into RAM only when there's a requirement, this reduces the file size while optimizing the usage of RAM and preventing the application from becoming too big to function smoothly.

As these DLLs are essential for running almost all applications on our systems, they are found in different files and folders on users' computers. Now, if an attacker succeeds in replacing the original DLL file with a counterfeit one carrying malicious code, it is termed as DLL Hijacking.

A program that became the latest victim of the aforementioned flaw is Apple's Push Notification service executable (APSDaemon.exe) that had been vulnerable to DLL hijacking. Since, it is responsible for loading AppleVersions.dll upon execution, if it fails to check whether the authentic AppleVersions.dll is being loaded, it could allow cybercriminals to replace the DLL file with a fake one containing malware.

Running in an authentic executable by Apple had allowed the malware to function with less to no risk of being detected by antivirus software, moreover, the threat actors have also employed a hashing algorithm to make the detection even difficult.
Read more »
Malware Report
DLL load hijacking Malware Report

Trojan modifies Critical DLL file(comres.dll) to Avoid Antivirus Detection


Bitdefender researchers spotted a new Dropper Trojan which utilize an interesting technique to avoid being easily detected by Anti-virus application.

Usually, Malwares add themselves to the Startup list by adding their path to the Startup Registry key, but this makes them easy to detect by antivirus solutions or computer-savvy users.

A New Trojan namely "Trojan.Dropper.UAJ " use a new technique to overcome detection, it compromise a library file(comres.dll) forcing all applications that rely on comres.dll to execute the Trojan as well.Comres.dll is widely used by most internet browsers, in some communication applications or networking tools.

The Trojan makes a copy of the genuine comres.dll file, patches it and then saves it in the Windows directory folder.

"The dropper patches the code library by adding a single new malicious function to the imported list to be launched with the rest of its functions.Next, the Trojan drops the file “prfn0305.dat” (identified by Bitdefender as Backdoor.Zxshell.B) that exports (contains) the function that compromises the system. And everything is now in place. The moment the system calls the code library, the malware is turned on." researcher said.
Read more »
Subscribe to: Posts (Atom)