Attack of the Imminent Monitor remote control Trojan using Excel 4.0 macro to avoid AV detection

guest · Oct 30, 2018

The analysis of the attack which uses Excel 4.0 macro to avoid antivirus software detection
October 30, 2018
https://blog.360totalsecurity.com/e...-macro-to-avoid-antivirus-software-detection/

On October 18, 2018, 360 Threat Intelligence Center captured for the first time an example of an attack using the Excel 4.0 macro to spread the Imminent Monitor remote control Trojan.

Also, because Excel 4.0 macros are stored in the Workbook OLE stream in Excel 97-2003 format (.xls, composite binary file format), this makes it very difficult for anti-virus software to parse and detect Excel 4.0 macros.

The macro code will be from: [...] the file suffixed with PDF and execute it. The file is actually a malicious msi file. After execution by msiexec, it will decrypt and release a .NET type executable file in the %temp% directory, named 033ventdata.exe and execute [...] The injected Trojan master PE file is also a .NET program. [...]

Enterprise users should be as cautious as possible to open documents of unknown origin. If necessary, disable all macro code execution by opening the File: Options – Trust Center – Trust Center Settings – Macros setting in Office Excel.
Click to expand...

Log in or Sign up

Attack of the Imminent Monitor remote control Trojan using Excel 4.0 macro to avoid AV detection

guest Guest

Log in or Sign up

Attack of the Imminent Monitor remote control Trojan using Excel 4.0 macro to avoid AV detection

guest Guest

Useful Searches