'Salfram' Email Campaign Spreads Malware to Businesses

guest · Sep 4, 2020

'Salfram' Email Campaign Spreads Malware to Businesses
Attackers User Specialized Crypter to Hide Malicious Code
September 4, 2020
https://www.inforisktoday.com/salfram-email-campaign-spreads-malware-to-businesses-a-14948

A recently uncovered malicious email campaign is delivering to businesses multiple types of malware, including a Trojan designed to steal banking credentials and other financial information, according to a research report from Cisco Talos.

This email campaign, which started in January and remains active, also uses several techniques to evade detection and maximize its effectiveness, according to the report.
Click to expand...

For example, the campaign uses a crypter that's designed to alter the malicious code to make it more difficult for security tools to detect. And the threat actors behind this campaign are taking advantage of legitimate hosting platforms, such as Google Drive, to obscure malicious files designed to deliver malware to compromised devices.

The emails are used to deliver several types of malware, including Gozi ISFB, ZLoader, SmokeLoader, Oski, AveMaria and malicious versions of Cobalt Strike - a legitimate penetration testing tool, according to the report. The malware includes Trojans designed to steal banking credentials.

"The diverse list of malware families being distributed by adversaries creates a variety of risks to organizations which should be considered by defenders who are responsible for security corporate environments," the report notes.
Click to expand...

Cisco Talos: Salfram: Robbing the place without removing your name tag

Obfuscated binaries are completely different, from both a binary and execution flow graph perspective.

The techniques used by this crypter can confuse weak API behavior-based systems and static analysis tools.

This crypter appears to be undergoing active development and improvement over time.

The use of web-based contact forms demonstrates how adversaries can take advantage of any communications pathway to internal employees to attempt to infect organizational systems with malware.
Click to expand...

Log in or Sign up

'Salfram' Email Campaign Spreads Malware to Businesses

guest Guest

Log in or Sign up

'Salfram' Email Campaign Spreads Malware to Businesses

guest Guest

Useful Searches