Malspam Exploits WinRAR ACE Vulnerability to Install a Backdoor

guest · Feb 25, 2019

Malspam Exploits WinRAR ACE Vulnerability to Install a Backdoor
February 25, 2019
https://www.bleepingcomputer.com/ne...nrar-ace-vulnerability-to-install-a-backdoor/

Today, 360 Threat Intelligence Center tweeted that they have discovered an email that was distributing a RAR archive that when extracted will infect a computer with a backdoor.

If UAC is running, when you attempt to extract the archive it will fail to place the malware in the C:\ProgramData folder due to lack of permissions. This will cause WinRAR to display an error stating "Access is denied" and "operation failed" as shown below.
On the other hand, if UAC is disable or WinRAR is run with administrator privileges it will install the malware to C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\CMSTray.exe.

Now that CMSTray.exe is extracted to the user's Startup folder, on the next login the executable will be launched. Once launched, it will copy the CMSTray.exe to %Temp%\wbssrv.exe and execute the wbssrv.exe file. [...]
As we expect to see more malware attempt to exploit this vulnerability, whether it be through malspam or other methods, it is important that you upgrade to the latest version of WinRAR.
Click to expand...

guest · Mar 3, 2019

Warning! Upgrades in WinRAR Exploit with Social Engineering and Encryption
March 2, 2019
https://blog.360totalsecurity.com/e...ploit-with-social-engineering-and-encryption/

As predicted, we captured multiple samples using this vulnerability in the following days and also observed some related APT attacks. Obviously, attackers use this exploit in a more delicate way.
For example, they embed lots of pictures and lure the target to decompress since those cannot be previewed in the compressed archive, encrypt the malicious ACE file before delivering, and so on.

Since pictures inside WinRAR archive could not get previewed, in order to trigger the vulnerability, attackers put inside lots of image files and lure the victim to decompress the archive.
WinRAR would extract a malicious script (Wipolicy.vbe) to the startup folder if the vulnerability gets triggered. [...] It is an encrypted VBS script [...] The VBS script will execute a PowerShell script after decryption. [...]
Conclusion
360 Threat Intelligence Center has observed APT attacks using this vulnerability in the process of composing this article, which may also indicate it is in the early stages of an outbreak.
We would like to remind users once again to make timely and effective measures against the coming attacks.
Click to expand...

guest · Apr 11, 2019

Office 365 Team Discovers Phishing Email Pushing WinRAR Exploit
April 11, 2019
https://www.bleepingcomputer.com/ne...covers-phishing-email-pushing-winrar-exploit/

Office 365 Advanced Threat Protection (ATP) spotted the malicious file carrying the exploit for the WinRAR ACE vulnerability. Noticing an attack with a higher sophistication level, the Office 365 ATP Research Team started to analyze the incident.
Complex chain of events
Rex Plantado of Microsoft's Office 365 ATP Research Team says that the compromise attempt started with a phishing email pretending to be from the Ministry of Foreign Affairs in Afghanistan.
[...]
"Enabling the macro starts a series of malicious actions that leads to the download of the malware payload," which requires a computer restart to run, says Plantado.
A long road to delivering a malicious archive
In the background, the malicious macro runs a series of actions designed to obtain a second-stage PowerShell script brimming with multi-layered encryption. According to the researcher, the script is similar to code used in previous MuddyWater campaigns.
Click to expand...

Log in or Sign up

Malspam Exploits WinRAR ACE Vulnerability to Install a Backdoor

guest Guest

guest Guest

guest Guest

Log in or Sign up

Malspam Exploits WinRAR ACE Vulnerability to Install a Backdoor

guest Guest

guest Guest

guest Guest

Useful Searches