Malware gang uses .NET library to generate Excel docs that bypass security checks

mood · Sep 5, 2020

Malware gang uses .NET library to generate Excel docs that bypass security checks
Just not your typical Excel files. Enough to trick some security systems, though
September 5, 2020
https://www.zdnet.com/article/malwa...erate-excel-docs-that-bypass-security-checks/

A newly discovered malware gang is using a clever trick to create malicious Excel files that have low detection rates and a higher chance of evading security systems.

Discovered by security researchers from NVISO Labs, this malware gang — which they named Epic Manchego — has been active since June, targeting companies all over the world with phishing emails that carry a malicious Excel document.
But NVISO said these weren't your standard Excel spreadsheets. The malicious Excel files were bypassing security scanners and had low detection rates.
Click to expand...

Malicious Excel files were compiled with EPPlus
According to NVISO, this was because the documents weren't compiled in the standard Microsoft Office software, but with a .NET library called EPPlus.

NVISO says the Epic Manchego gang appears to have used EPPlus to generate spreadsheet files in the Office Open XML (OOXML) format.
OOXML spreadsheet files lack a portion of compiled VBA code, specific to Excel documents compiled in Microsoft's proprietary Office software.

Some antivirus products and email scanners specifically look for this portion of VBA code to search for possible signs of malicious Excel docs, which would explain why spreadsheets generated by the Epic Manchego gang had lower detection rates than other malicious Excel files.
Click to expand...

The final payloads were classic infostealer trojans like Azorult, AgentTesla, Formbook, Matiex, and njRat, which would dump passwords from the user's browsers, emails, and FTP clients, and sent them to Epic Machengo's servers.
In the end, NVISO said it discovered more than 200 malicious Excel files linked to Epic Manchego, with the first one dating back to June 22, this year.
Click to expand...

NVISO Labs: Epic Manchego – atypical maldoc delivery brings flurry of infostealers

In July 2020, NVISO detected a set of malicious Excel documents, also known as “maldocs”, that deliver malware through VBA-activated spreadsheets. While the malicious VBA code and the dropped payloads were something we had seen before, it was the specific way in which the Excel documents themselves were created that caught our attention.
Click to expand...

Log in or Sign up

Malware gang uses .NET library to generate Excel docs that bypass security checks

mood Updates Team

Log in or Sign up

Malware gang uses .NET library to generate Excel docs that bypass security checks

mood Updates Team

Useful Searches