The return of the BOM

guest · Mar 28, 2019

The return of the BOM
Because sometimes you can't teach an old malware developer new tricks
March 28, 2019
https://securelist.com/the-return-of-the-bom/90065/

There’s nothing new in Brazilian cybercriminals trying out new ways to stay under the radar. It’s just that this time around the bad guys have started using a method that was reported in the wild years ago.

Russian gangs used this technique to distribute malware capable of modifying the hosts file on Windows systems. Published by McAfee in 2013, the UTF-8 BOM (Byte Order Mark) additional bytes helped these malicious crews avoid detection.

Instead of having the normal ZIP header starting with the “PK” signature (0x504B), we have three extra bytes (0xEFBBBF) that represent the Byte Order Mark (BOM) usually found within UTF-8 text files. Some tools will not recognize this file as being a ZIP archive format, but will instead recognize it as an UTF-8 text file and fail to extract the malicious payload.

However, utilities such as WinRAR and 7-Zip ignore this data and extract the content correctly. Once the user extracts the file with any of these utilities they can execute it and infect the system. The malicious executable acts as a loader for the main payload which is embedded in the resource section.
Click to expand...

The final payload that’s delivered is a variant of a Banking RAT malware, which is currently widespread in Brazil and Chile.
Click to expand...

Log in or Sign up

The return of the BOM

guest Guest

Log in or Sign up

The return of the BOM

guest Guest

Useful Searches