Cardinal RAT Remained Hidden for Two Years

itman · Apr 25, 2017

What's interesting about this malware is how it used a macro to compile .Net code and execute it on the fly.

A recently discovered remote access Trojan (RAT) that abuses Excel macros in an innovative way has been active for more than two years, Palo Alto Networks security researchers reveal.

Dubbed Cardinal RAT, the malware had a very low volume over the two-year timeframe, with only 27 total samples found to date. The manner in which the threat is delivered, however, is both innovative and unique: malicious macros in Microsoft Excel documents are used to compile embedded C# (C Sharp) source code into an executable that downloads the RAT.

The delivery documents, which the Palo Alto Networks researchers refer to as the Carp downloader, use various financial-related lures to trick users into executing them. The malicious macros were designed to generate two paths, to a randomly named executable, and to a randomly named C# file in the %APPDATA%\\Microsoft folder.

Next, it base64-decodes the embedded C# source code and writes it to the C# file path, after which it compiles and executes the C# source code using the Microsoft Windows built-in csc.exe utility. The executed code simply downloads the Cardinal RAT from secure.dropinbox[.]pw using HTTP on port 443 (not HTTPS), decrypts it using AES-128, and then executes it.

The malware was named Cardinal RAT based on the internal names used by the author within the observed Microsoft .NET Framework executables, the security researchers reveal. Because only 27 unique samples of the RAT have been found, the malware managed to remain hidden although some of these samples are dating back to December 2015.

When executed on an infected system, the malware checks its current working directory and enters an installation routine if the directory doesn’t match the expected path. The threat copies itself to a randomly named executable in the specified directory, after which it compiles and executes embedded source code featuring watchdog functionality.

The newly spawned executable ensures that a specific registry key is set, and periodically queries the key to verify it is set appropriately and to re-set it if it has been deleted. This key acts as a persistence mechanism, as it ensures the RAT is executed every time a user logs on.

The watchdog process checks that the Cardinal RAT process is always running and that the executable is located in the correct path. If one of these conditions isn’t met, it either spawns a new instance of Cardinal RAT, or writes the malware to the correct location.

After completing the installation routine, the RAT injects itself into a newly spawned process, attempting to use one of six executables for this process: RegAsm.exe, RegSvcs.exe, vbc.exe, csc.exe, AppLaunch.exe, or cvtres.exe.
Click to expand...

http://www.securityweek.com/cardinal-rat-remained-hidden-two-years

guest · Mar 19, 2019

Cardinal RAT Sins Again, Targets Israeli Fin-Tech Firms
March 19, 2019
https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/

In 2017, Unit 42 reported on and analyzed a low-volume malware family called Cardinal RAT. This malware family had remained undetected for over two years and was delivered via a unique downloader named Carp Downloader.

We witnessed attacks targeting the financial technology (FinTech) sector, primarily focused on organizations based in Israel. While researching these attacks, we discovered a possible relationship between Cardinal RAT and another malware family named EVILNUM. EVILNUM is a JavaScript-based malware family that is used in attacks against similar organizations.
Cardinal RAT Employs BMP Trick
The first layer of obfuscation comes in the form of steganography; the initial sample is compiled with .NET and contains an embedded bitmap (BMP) file.
Upon execution, the malware will read this file, parse out pixel data from the image, and decrypt the result using a single-byte XOR key.

Underneath all this obfuscation, this Cardinal RAT payload does not have any significant changes compared to the previously discussed version in terms of its operation or capabilities.
Click to expand...

guest · May 7, 2020

How hackers are updating the EVILNUM malware to target the global financial sector
May 6, 2020
https://www.cyberscoop.com/evilnum-financial-malware-prevailion/

Hackers behind a series of targeted financial attacks have been updating their malware to better evade detection over the last year, according to new Prevailion research slated to be published Wednesday.

Since at least February 2019, the hackers, who have begun impersonating CEOs and banks in their lure documents, have introduced at least seven updates to the malicious software known as EVILNUM, which enables attackers to upload and download files, harvest tracking cookies, and run arbitrary commands.
The prior version of EVILNUM, number 3.6, only was detected by six of the vendors on VirusTotal. Details about the latest hacking tool were shared exclusively with CyberScoop prior to their publication.

“It shows there’s an ongoing evolution of this kit,” said Danny Adamitis, director of intelligence analysis at Prevailion. “I believe this is one of the more advanced financial crime actors that we’ve seen.”
Click to expand...

While EVILNUM has been used in conjunction with a remote access trojan (RAT), called Cardinal RAT, in campaigns against financial technology targets primarily located in Israel, according to Palo Alto Networks, it is not clear that EVILNUM has a specific geographic focus, Adamitis said.

“Given the nature of these lures, Prevailion suspects with moderate confidence these efforts were targeted towards select financial institutions rather than wide-scale spamming,” the researchers note.
Although it is unclear exactly what the hackers’ ultimate goals are, Adamitis suspects there is a second stage of the attack.
Click to expand...

Log in or Sign up

Cardinal RAT Remained Hidden for Two Years

itman Registered Member

guest Guest

guest Guest

Log in or Sign up

Cardinal RAT Remained Hidden for Two Years

itman Registered Member

guest Guest

guest Guest

Useful Searches