Malicious AutoHotkey Scripts Used to Steal Info, Remotely Access Systems

guest · Apr 17, 2019

Malicious AutoHotkey Scripts Used to Steal Info, Remotely Access Systems
April 17, 2019
https://www.bleepingcomputer.com/ne...s-used-to-steal-info-remotely-access-systems/

Attackers are targeting potential victims using a malicious AutoHotkey script to avoid detection and to steal information, to drop more payloads, and to remotely access compromised machines using TeamViewer.

The malicious AutoHotkey script payload is delivered with the help of a decoy Excel Macro-Enabled Workbook email attachment [...]
As discovered by Trend Micro's Cyber Threat Research Team. once the victims enabled macros in Microsoft Excel, the XSLM document will "drop the legitimate script engine AutoHotkey along with a malicious script file."

In the end, as the researchers found, one of the downloaded malicious scripts will also drop a copy of TeamViewer making it possible for the bad actors gain remote access to the infected computers.

"These files allow the attackers to get the computer name and take screen captures. More importantly, one of these files also enables the download of TeamViewer, a remote access tool that gives threat actors remote control over the system," says Trend Micro's report.
Click to expand...

guest · Dec 29, 2020

AutoHotkey-Based Password Stealer Targeting US, Canadian Banking Users
December 29, 2020
https://thehackernews.com/2020/12/autohotkey-based-password-stealer.html

Threat actors have been discovered distributing a new credential stealer written in AutoHotkey (AHK) scripting language as part of an ongoing campaign that started early 2020.

Customers of financial institutions in the US and Canada are among the primary targets for credential exfiltration, with a specific focus on banks such as Scotiabank, Royal Bank of Canada, HSBC, Alterna Bank, Capital One, Manulife, and EQ Bank. Also included in the list is an Indian banking firm ICICI Bank.
Click to expand...

What makes this malware different is that instead of receiving commands directly from the C&C server, it downloads and executes AHK scripts to accomplish different tasks.

"By doing this, the attacker can decide to upload a specific script to achieve customized tasks for each user or group of users," Trend Micro researchers said in an analysis. "This also prevents the main components from being revealed publicly, specifically to other researchers or to sandboxes."
Chief among them is a credential stealer that targets various browsers such as Google Chrome, Opera, Microsoft Edge, and more. Once installed, the stealer also attempts to download an SQLite module ("sqlite3.dll") on the infected machine, using it to perform SQL queries against the SQLite databases within browsers' app folders.
Click to expand...

"By using a scripting language that lacks a built-in compiler within a victim's operating system, loading malicious components to achieve various tasks separately, and changing the C&C server frequently, the attacker has been able to hide their intention from sandboxes," the researchers concluded.
Click to expand...

Trend Micro: Credential Stealer Targets US, Canadian Bank Customers

We discovered a campaign that distributed a credential stealer, and its main code components are written in AutoHotkey (AHK).
Click to expand...

Log in or Sign up

Malicious AutoHotkey Scripts Used to Steal Info, Remotely Access Systems

guest Guest

guest Guest

Log in or Sign up

Malicious AutoHotkey Scripts Used to Steal Info, Remotely Access Systems

guest Guest

guest Guest

Useful Searches