AdvisorsBot Downloader Emerges in Raft of Malware Campaigns

guest · Aug 23, 2018

AdvisorsBot Downloader Emerges in Raft of Malware Campaigns
August 23, 2018
https://threatpost.com/advisorsbot-downloader-emerges-in-raft-of-malware-campaigns/136863/

A new downloader was disclosed today, sporting significant anti-analysis features and increasingly sophisticated distribution techniques.

Researchers at Proofpoint have been tracking the downloader as a first-stage payload in campaigns since May 2018. Dubbed AdvisorsBot (due to early command-and-control domains, all containing the word “advisors”), it has been targeting hotels, restaurants and telecom-sector victims.

The research team said in a post Thursday that the campaigns use several themes in their email lures, including a “grievance” gambit.

The malware also features a basic system fingerprinting module. The modular nature allows cybercriminals to adapt the malware, adding capabilities as they become available or download additional modules post infection, researchers said.
Click to expand...

guest · Feb 1, 2019

The return of the AdvisorsBot malware
February 1, 2019
https://securityaffairs.co/wordpress/80567/malware/advisorsbot-malware-return.html

Security experts at Cybaze– Yoroi ZLab have analyzed a new sample of the AdvisorsBot malware, a downloader that was first spotted in August 2018.
Conclusions
Weaponized Microsoft Office documents delivered via email represent the top infection vector in today malware landscape, at the second place we found the abusing of Microsoft DDE protocol with CVE-2017-11882.

One reason is that, very often, macro malware does not rely on most-expensive-to-deploy 0-day exploit and could bypass end-point security solution (macro are often whitelisted in enterprise environment) due to extensive utilization of multi-layered obfuscation mainly in powershell, broadly speaking with a very low barrier-to-entry.

This sample show an high level of obfuscation to defeat AV and does not use any exploit, in fact, the obfuscated DLL component was not flagged by VT(0/60) at the time of writing.
Click to expand...

Further details, including IoCs and Yara rules, are reported in the analysis published
https://blog.yoroi.company/research/the-return-of-advisorsbot/
Click to expand...

Log in or Sign up

AdvisorsBot Downloader Emerges in Raft of Malware Campaigns

guest Guest

guest Guest

Log in or Sign up

AdvisorsBot Downloader Emerges in Raft of Malware Campaigns

guest Guest

guest Guest

Useful Searches