Taxpayers Targeted With Improved NetWire RAT Variant

guest · Apr 16, 2020

Taxpayers Targeted With Improved NetWire RAT Variant
...a recent malspam campaign that makes use of an improved keylogger and an Excel 4.0 Macro
April 15, 2020
https://threatpost.com/taxpayers-targeted-with-improved-netwire-rat-variant/154830/

A new variant of the the NetWire remote access trojan (RAT) is hitching a ride on IRS-themed phishing ploys targeting taxpayers in hopes of snatching victims’ credentials and tax information.

The recently uncovered campaign reveals the RAT’s operators swapping up infection tactics to use a legacy Microsoft Excel 4.0 Macro, helping them sidestep detection and analysis efforts. The NetWire variant’s payload has also been given a facelift, with improved keylogger and credential-collecting features.

“In this new variant, I noticed that it has improved its feature that collects credentials from the victim’s system,” said Xiaopeng Zhang, with Fortinet in a Tuesday analsysis. “It also fixed some bugs in the keylogger, which were wrongly recorded Esc as Ctrl in previous versions.”
NetWire has been spreading widely over the past few years, focused on stealing credential information, logging keystrokes and stealing hardware information.
Click to expand...

Excel 4.0 Macros has been used previously in other malware campaigns – but this is a first for NetWire, said Zhang.

“Probably due to the technology [being] very old (28 years by now) and rarely being used in nowadays, most antivirus engines don’t detect it and treat Excel files with a malicious Excel 4.0 Macro as clean,” said Zhang.
Once executed, the Excel 4.0 Macro starts an extensive chain of download: First, the program “powershell.exe” is executed [...]
Click to expand...

Fortinet: NetWire RAT Targeting Taxpayers is Spreading via Legacy Microsoft Excel 4.0 Macro

Log in or Sign up

Taxpayers Targeted With Improved NetWire RAT Variant

guest Guest

Log in or Sign up

Taxpayers Targeted With Improved NetWire RAT Variant

guest Guest

Useful Searches