Dissecting the latest Ursnif DHL-Themed Campaign

guest · Dec 4, 2018

Dissecting the latest Ursnif DHL-Themed Campaign
December 4, 2018
https://securityaffairs.co/wordpress/78672/breaking-news/dissecting-ursnif-dhl-campaign.html

In the last weeks, a new variant of the infamous Ursnif malware was discovered hitting Italian users through a malspam campaign.

The content of the attachment is a .js file and when it is launched, starts the infection by downloading other components from the Internet. [...]
Conclusion
In the end, the whole infection chain could be summarized in four stages: the generation of network noise to hide the attacker’s infrastructure, the download of the executable payload, the achievement of persistence through the registry key installed and the checking and the download of the Ursnif modules.

Further details, including IoCs and Yara rules, are reported in the original blog post published by Yoroi.
Click to expand...

guest · Aug 14, 2019

Sophisticated Dropper Masqueraded as Fake DHL Invoice to Distribute Ursnif Malware
August 13, 2019
https://securityintelligence.com/ne...ake-dhl-invoice-to-distribute-ursnif-malware/

Deep Instinct recently came across an attack email that attempted to trick people into opening a fake DHL invoice. This notice was actually an Excel spreadsheet that prompted users to enable a VBA macro contained therein.

Once activated, the macro displayed a fake progress bar to trick the user into thinking the malicious document was legitimate while it secretly ran malicious code in the background. The macro was also obfuscated and contained randomly generated comments to make the code appear benign and help it evade detection by security solutions.
This PowerShell code also came with multiple layers of obfuscation, encoding and compression.
A History of DHL Malware Campaigns
This is not the first time threat actors have disguised their malware campaigns as DHL correspondence. Back in 2018, for instance, Yoroi Security discovered a malspam campaign [...]
That was just a few months before SI-Lab spotted a DHL-themed phishing campaign pushing Muncy malware.
Click to expand...

Deep Instinct: Ursnif ups its game with sophisticated VBA and PowerShell combination Dropper

Log in or Sign up

Dissecting the latest Ursnif DHL-Themed Campaign

guest Guest

guest Guest

Log in or Sign up

Dissecting the latest Ursnif DHL-Themed Campaign

guest Guest

guest Guest

Useful Searches