New WhiteShadow Downloader Uses MSSQL Servers for Malware Delivery

mood · Sep 26, 2019

New WhiteShadow Downloader Uses MSSQL Servers for Malware Delivery
September 26, 2019
https://www.bleepingcomputer.com/ne...ader-uses-mssql-servers-for-malware-delivery/

A new malware downloader delivered via multiple campaigns uses detection evasion techniques and Microsoft SQL queries to drop malicious payloads onto compromised machines.
The malware, dubbed WhiteShadow by researchers at Proofpoint Threat Insight Team who found it, comes in the form of a set of Microsoft Office macros designed to work together to infect targets with a large array of malware strains it downloads from attacker-controlled Microsoft SQL Servers.

WhiteShadow is delivered via malspam emails containing malicious URLs or Microsoft Word and Microsoft Excel attachments that bundle malicious the downloader's Visual Basic macros which will install the malware payloads after execution.
Multiple WhiteShadow campaigns observed in just two months
Proofpoint's research team observed multiple malspam campaigns peddling the WhiteShadow downloader, with almost a dozen of them being spotted since the malware was first spotted in August.

"It appears that WhiteShadow is one component of a malware delivery service, which includes a rented instance of Microsoft SQL Server to host payloads retrieved by the downloader," also found the researchers.
Click to expand...

Proofpoint: New WhiteShadow downloader uses Microsoft SQL to retrieve malware

Log in or Sign up

New WhiteShadow Downloader Uses MSSQL Servers for Malware Delivery

mood Updates Team

Coronavirus map used to spread malware

Lampion malware origin servers geolocated in Turkey

New Mozart Malware Gets Commands, Hides Traffic Using DNS

The Rise of Skywalker Is Being Used to Push Malware Downloads, Surprising No One

Malicious Actors Are Extensively Using CypherIT to Package Their Malware

Log in or Sign up

New WhiteShadow Downloader Uses MSSQL Servers for Malware Delivery

mood Updates Team

Coronavirus map used to spread malware

Lampion malware origin servers geolocated in Turkey

New Mozart Malware Gets Commands, Hides Traffic Using DNS

The Rise of Skywalker Is Being Used to Push Malware Downloads, Surprising No One

Malicious Actors Are Extensively Using CypherIT to Package Their Malware

Useful Searches