Under-Detected ODT Files Deliver Common Remote Access Trojans

guest · Sep 30, 2019

Under-Detected ODT Files Deliver Common Remote Access Trojans
September 30, 2019
https://www.bleepingcomputer.com/ne...t-files-deliver-common-remote-access-trojans/

Security researchers noticed multiple cybercriminal operations using OpenDocument Text (ODT) files to distribute malware that is typically blocked by antivirus engines. The campaigns target English and Arabic-speaking users.
Two RATs and an info-stealer
Some antivirus engines treat ODT files as standard archives and do not open the document as a Microsoft Office file, allowing malware to be downloaded on the target host.

Researchers at Cisco Talos noticed that the OLE object launched an HTA (HTML executable) file that downloaded and RevengeRAT and the underground's favorite, njRAT, from top4top[.]net, a popular Arabic file-hosting platform.
In a second campaign the researchers found to be using a malicious ODT file, the final payload launched on the target machine is the infamous AZORult info stealer.
Old software macros
The third campaign leveraging ODT files was aimed at OpenOffice and LibreOffice users, and it used "the equivalent of macros in Microsoft Office documents in the StarOffice Basic open-source software," the researchers say in a blog post today.
Click to expand...

Cisco Talos: Open Document format creates twist in maldoc landscape

Log in or Sign up

Under-Detected ODT Files Deliver Common Remote Access Trojans

guest Guest

Log in or Sign up

Under-Detected ODT Files Deliver Common Remote Access Trojans

guest Guest

Useful Searches