{"id":4661,"date":"2023-04-06T07:30:11","date_gmt":"2023-04-06T07:30:11","guid":{"rendered":"\/cybersecurity-blog\/?p=4661"},"modified":"2023-04-07T05:29:44","modified_gmt":"2023-04-07T05:29:44","slug":"malware-analysis-digest-march-2023","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/malware-analysis-digest-march-2023\/","title":{"rendered":"Malware Analysis Digest: March 2023\u00a0"},"content":{"rendered":"\n

Welcome to the March 2023 edition of our monthly malware analysis news report. We’ve compiled some of the most significant security events and emerging threats that took place over the past month to keep you informed and help you stay one step ahead of cybercriminals. <\/p>\n\n\n\n

Let’s dive into some of the key highlights and developments in the world of malware and cybersecurity. <\/p>\n\n\n\n

1. Outlook Vulnerability (CVE-2023-23397) and Mitigation Steps <\/h2>\n\n\n\n

A new Microsoft Office Outlook vulnerability, CVE-2023-23397, has been identified<\/a>.  <\/p>\n\n\n\n

This vulnerability enables threat actors to steal user account credentials, including the NTLM hash value, upon receiving an email and triggering a notification. Attackers can exploit this information for internal propagation and further system compromise. <\/p>\n\n\n\n

Users can mitigate the vulnerability by disabling the ‘Reminder’ feature in MS Outlook. However, caution is advised as the vulnerability can still be triggered if the sound is played by checking ‘Play this sound’ on a malicious email. <\/p>\n\n\n\n

2. LummaC2 Infostealer Disguised as Illegal Cracks <\/h2>\n\n\n\n

A new infostealer called LummaC2 is being distributed<\/a> disguised as illegal cracks and keygens.  <\/p>\n\n\n\n

Similar to other malware such as CryptBot, RedLine, and Vidar, it has been available for purchase on the dark web since early this year. LummaC2 uses obfuscation techniques and anti-sandbox measures to evade detection and hinder analysis. It targets browser data, browser extensions, cryptocurrency wallet programs, system information, email clients, and other applications for theft. <\/p>\n\n\n\n

The distribution method involves users searching for a crack or serial key for popular software, leading them to a malicious website. After clicking the download button, users are redirected several times before reaching the malware distribution page. The malware is then downloaded in a compressed format, either through the threat actor’s server or services like MediaFire or MEGA. <\/p>\n\n\n\n

3. New IcedID Variants Focus on Malware Delivery Instead of Bank Fraud <\/h2>\n\n\n\n

Recent IcedID malware variants have shifted<\/a> focus from online banking fraud to installing further malware on compromised systems. <\/p>\n\n\n\n

Proofpoint has identified two new IcedID loader variants, “Lite” and “Forked,” which deliver the IcedID bot with a narrower feature set. <\/p>\n\n\n\n

By removing unneeded functions, these variants become stealthier and leaner, helping threat actors evade detection. The “Lite” variant appeared in November 2022, while the “Forked” version emerged in February 2023. Proofpoint predicts the use of new IcedID variants will likely grow, with more variants possibly emerging later in 2023. <\/p>\n\n\n\n

4. CatB: a new Ransomware Strain Discovered <\/h2>\n\n\n\n

CatB is a new ransomware family with unique characteristics, including performing basic evasion checks before executing its loader component to avoid running in an analysis environment like a sandbox.\u00a0<\/p>\n\n\n\n

Once the checks are passed, the payload containing the ransomware is executed via a DLL Side-Loading attack using a trusted Windows service.  <\/p>\n\n\n\n

CatB searches for user-specific files to encrypt, but unlike other ransomware families, it prepends the ransom note to each encrypted file instead of dropping it in separate files in various locations. The malware uses anti-VM techniques to hide its behavior from analysis environments, making it more challenging for security researchers to study its operations. <\/p>\n\n\n\n

Emotet malware is now targeting<\/a> US taxpayers by impersonating W-9 tax forms allegedly sent by the Internal Revenue Service and companies taxpayers work with. <\/p>\n\n\n\n

5. Emotet Malware Targets US Taxpayers with Fake W-9 Forms <\/h2>\n\n\n\n

This notorious malware infection is distributed through phishing emails, which in the past contained Microsoft Word and Excel documents with malicious macros. However, with Microsoft now blocking macros by default, Emotet has switched to using Microsoft OneNote files with embedded scripts to install the malware.  <\/p>\n\n\n\n

Once installed, Emotet steals victims’ emails for future reply-chain attacks, sends spam emails, and installs other malware that grants initial access to threat actors, such as ransomware gangs. <\/p>\n\n\n\n

\"Emotet<\/figure>\n\n\n\n

Emotet \u2014 which holds a spot in the top 5 of most popular malware families<\/a> (according to our monthly submissions data at the time of writing) \u2014 can evade discovery by waiting for user interaction to start executing. This tactic means that its detection in an automated sandbox is not guaranteed. <\/p>\n\n\n\n

We successfully activated the malware and gathered the following:<\/p>\n\n\n\n

Indicators of Compromise (IOCs)<\/h4>\n\n\n\n
SHA256 <\/td>e173ecebfd5b01766dd8184250d5f2d442507b9b097e4ced319c246b78550d85 <\/td><\/tr>
SHA1 <\/td>dd6ba6ae1680e4245f5ecc22ee12a18b9e16db2d <\/td><\/tr>
MD5 <\/td>b1a10568aa1e4a47ad2aa35788edc0af <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Domains <\/h4>\n\n\n\n
sipo.ru <\/td><\/tr>
sdspush.beget.tech <\/td><\/tr>
www.agropuno.gob.pe<\/td><\/tr>
www.gomespontes.com.br<\/td><\/tr>
meteo.camera<\/td><\/tr>
www.garrett.kz<\/td><\/tr>
penshorn.org<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

IP<\/h4>\n\n\n\n
186.202.153.5 <\/td><\/tr>
209.126.85.32 <\/td><\/tr>
187.63.160.88 <\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

Feel free to explore more DNS and HTTP requests and connections on the linked analysis page above. Alternatively, visit our public submissions<\/a> page for more Emotet analyses. <\/p>\n\n\n\n

In our recent analysis<\/a> in ANY.RUN, a researcher detonated the malware by interacting with a OneNote document<\/strong> and dismissing a few system warnings. So, no matter what system you use, ensure that it also allows for interactivity or employs alternative methods for detecting user-triggered malware. <\/p>\n\n\n\n

<\/div>\n\n\n\n

Try ANY.RUN for Enterprises <\/strong><\/h3>\n\n\n\n

Combat new threats together \u2013 ANALYZE MALWARE IN A TEAM<\/h2>\n\n\n\n
\n
Get a free trial<\/a><\/div>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n

6. New ‘HinataBot’ Botnet Could Launch Massive 3.3 Tbps DDoS Attacks <\/h2>\n\n\n\n

A new botnet named HinataBot has been discovered<\/a> targeting Realtek SDK, Huawei routers, and Hadoop YARN servers to recruit devices for massive DDoS (distributed denial of service) attacks. <\/p>\n\n\n\n

Researchers at Akamai discovered the botnet at the beginning of 2023 and believe it is based on Mirai, a notorious malware strain. HinataBot is under active development and has shown functional improvements and anti-analysis additions. <\/p>\n\n\n\n

The botnet can potentially perform powerful DDoS attacks using HTTP and UDP floods. With 10,000 nodes, the attack data volume could reach 3.3 Tbps for UDP floods and generate 20,400,000 requests per second for HTTP floods. As HinataBot’s development remains active, more potent versions may soon appear in the wild. <\/p>\n\n\n\n

7. CASPER Attack Steals Data Using Air-Gapped Computer’s Internal Speaker <\/h2>\n\n\n\n

CASPER is a new covert channel attack that can steal<\/a> data from air-gapped computers using their internal speakers.  <\/p>\n\n\n\n

It transmits high-frequency audio inaudible to humans, up to 1.5 meters away, to a nearby smartphone or laptop microphone. Malware must first be installed on the target, and the maximum reliable transmission bit rate is 20 bits\/s. To defend against CASPER, remove internal speakers from mission-critical computers or implement a high-pass filter to block ultrasound transmissions. <\/p>\n\n\n\n

8. Kimsuky Group Distributes Malware via Fake Profile Template on GitHub <\/h2>\n\n\n\n

A malicious Word file distributed by the Kimsuky Group, disguised as a profile template was found<\/a> in the wild.  <\/p>\n\n\n\n

The password-protected file, named ‘[Attachment] Profile Template.doc,’ contains a malicious VBA macro. When activated, it connects to a C2 server via PowerShell, downloading and executing additional scripts. <\/p>\n\n\n\n

The malware collects information saved on browsers, similar to the one found in a previously discovered Malicious Word Document. However, unlike the previous version, which used FTP to leak user credentials, this altered script uses the GitHub API to transmit the information to a specific repository. The Red Eyes threat group (also known as APT37 or ScarCruft) has recently been found using GitHub as their malware distribution site as well. <\/p>\n\n\n\n

Users are advised to exercise caution as these scripts continue to evolve. <\/p>\n\n\n\n

ANY.RUN March news <\/h2>\n\n\n\n

March proved to be an eventful month for ANY.RUN<\/a>, and if you haven’t had a chance to catch up on our latest news, now is the perfect time before we jump headfirst into April! <\/p>\n\n\n\n

We shared a comprehensive analysis of LimeRat, explored the potential impact of AI on the development of super malware, and discussed how ANY.RUN assists large security teams in staying coordinated daily, and reported on our participation at GISEC 2022 in Dubai. <\/p>\n\n\n\n

<\/p>\n\n\n