‘Roma225’ campaign targets companies in the Italian automotive sector

guest · Dec 31, 2018

‘Roma225’ campaign targets companies in the Italian automotive sector
December 31, 2018
https://securityaffairs.co/wordpress/79324/malware/roma225-campaign-italian-automotive.html

The malicious email intercepted during the CSDC operations contains a PowerPoint add-in document (“.ppa” extension), armed with auto-open VBA macro code.
The macro code in the .ppa file contains a simple instruction invoking the “mshta.exe” tool to download and execute the next-stage of the dropper [...]

The Blogspot hosted web page downloaded by mshta.exe appears innocent-looking [...]
It’s funny to see the malware author tried to attribute the paternity of the script to “Microsoft Corp.”, adding pieces of comments belonging to legit Microsoft utilities:
RevengeRAT Payload
Once executed, the RAT immediately contacts its command and control servers sending victim machine’s information. [...]
Click to expand...

Technical details about the Roma225 compaign, including Indicators of Compromise (IoCs) and Yara rules are reported in the analysis published on the Yoroi blog.
Click to expand...

Log in or Sign up

‘Roma225’ campaign targets companies in the Italian automotive sector

guest Guest

Log in or Sign up

‘Roma225’ campaign targets companies in the Italian automotive sector

guest Guest

Useful Searches