AZORult Variant, Other Malware Payloads Delivered by Multi-Pronged Attack Campaign

guest · Apr 7, 2020

Security researchers spotted a multi-pronged attack campaign that delivered a variant of the AZORult family along with other malicious payloads
Effective Unobtrusive Attacks
April 3, 2020
https://isssource.com/effective-unobtrusive-attacks/

There is now a multi-pronged cyber criminal attack using a number of techniques that should alert security professionals with appropriate monitoring capability but are not immediately obvious to end-users, said Cisco Talos’ Vanja Svajcer in a blog post.

Attackers are constantly reinventing ways to monetize their tools. Cisco Talos discovered a complex campaign with several different executable payloads, all focused on providing financial benefits for the attacker in a slightly different way.
The first payload is a Monero cryptocurrency miner based on XMRigCC, and the second is a Trojan that monitors the clipboard and replaces its content. There’s also a variant of the AZORult information-stealing malware, a variant of Remcos remote access tool and, finally, the DarkVNC backdoor Trojan.

The Cisco Talos team discovered an attack that has a low to medium level of technical ability but quite a clear idea on how to achieve their financial goals.
Click to expand...

Cisco Talos: AZORult brings friends to the party

We are used to ransomware attacks and big game hunting making the headlines, but there is an undercurrent of other attack types that allow attackers to monetize their efforts in a less intrusive way.
WHAT'S NEW?
Embedding an executable downloader in an ISO image file is a relatively new method of delivery for AZORult. It's also unusual to see attackers using multiple methods to make money.
HOW DID IT WORK?
The infection chain starts with a ZIP file, which contains an ISO disk image file. When the user opens the ISO file, a disk image containing an executable loader is mounted. When the loader is launched, it deobfuscates malicious code which downloads the first obfuscated PowerShell loader stage that kickstarts the overall infection, disables security tools and Windows update service and downloads and launches the payloads.
Click to expand...

Technical case overview
EXECUTABLE DROPPER WITH ANTI-SANDBOXING
The dropper's functionality is rather simple, but the code contains some interesting features. [...]
Click to expand...

Log in or Sign up

AZORult Variant, Other Malware Payloads Delivered by Multi-Pronged Attack Campaign

guest Guest

Log in or Sign up

AZORult Variant, Other Malware Payloads Delivered by Multi-Pronged Attack Campaign

guest Guest

Useful Searches