Multi-Layered Infection Attack Installs Betabot Malware

guest · Jun 19, 2018

Multi-Layered Infection Attack Installs Betabot Malware
The Betabot Trojan is being spread in a multi-stage attack that starts with malicious Office documents attempting to exploit a 17-year old vulnerability.
June 19, 2018
https://www.securityweek.com/multi-layered-infection-attack-installs-betabot-malware

Betabot is a piece of malware that evolved from being a banking Trojan to a password stealer, and then a botnet capable of distributing ransomware and other malicious programs

The recently spotted attacks start with a Word document attempting to exploit CVE-2017–11882, a vulnerability introduced in November 2000 in the Microsoft Equation Editor (EQNEDT32.EXE) component. Discovered only last year, the security bug was manually patched by Microsoft in late 2017.

As part of this attack, the actor embedded an OLE object into a specially crafted RTF file to execute commands on the victim system.
[...] At the last stage of the attack, a new variant of Betabot is deployed. The sample contains some anti-debugging and anti-virtualization tricks, then initiates communication with a domain, likely for tracking purposes.
Click to expand...

Log in or Sign up

Multi-Layered Infection Attack Installs Betabot Malware

guest Guest

Log in or Sign up

Multi-Layered Infection Attack Installs Betabot Malware

guest Guest

Useful Searches