Windows 10 App Installer abused in BazarLoader malware attacks

guest · Nov 12, 2021

Windows 10 App Installer abused in BazarLoader malware attacks
November 11, 2021
https://www.bleepingcomputer.com/ne...taller-abused-in-bazarloader-malware-attacks/

The TrickBot gang operators are now abusing the Windows 10 App Installer to deploy their BazarLoader malware on the systems of targets who fall victim to a highly targeted spam campaign.

BazarLoader (aka BazarBackdoor, BazaLoader, BEERBOT, KEGTAP, and Team9Backdoor) is a stealthy backdoor Trojan commonly used to compromise the networks of high-value targets and sell access to compromised assets to other cybercriminals.
It has also been used to deliver additional payloads, such as Cobalt Strike beacons that help threat actors access their victims' network and ultimately deploy dangerous malware, including but not limited to Ryuk ransomware.
Click to expand...

In the recent campaign spotted by SophosLabs Principal Researcher Andrew Brandt, the attackers' spam emails induce a sense of urgency by using threatening language and impersonating a company manager who asks for more info on a customer complaint about the email recipient.

To add to the ruse, those on the receiving end of this spam campaign are double baited into installing the BazarLoader backdoor using an adobeview subdomain that further adds credibility to the scheme.
Click to expand...

However, instead of pointing to a PDF document, the "Preview PDF" button on the phishing landing site opens a URL with an ms-appinstaller: prefix.

Clicking "Open" in the warning dialog will launch Microsoft's App Installer — a built-in app since the release of Windows 10 version 1607 in August 2016 — to deploy the malware on the victim's device in the form of a fake Adobe PDF Component, delivered as an AppX app bundle.
Once launched, App Installer will first start downloading the attackers' malicious .appinstaller file and a linked .appxbundle file containing the final payload named Security.exe nested within a UpdateFix subfolder.
Click to expand...

Sophos: BazarLoader ‘call me back’ attack abuses Windows 10 Apps mechanism

The unusual technique invokes the Windows App Installer to deliver malware
Click to expand...

Log in or Sign up

Windows 10 App Installer abused in BazarLoader malware attacks

guest Guest

Log in or Sign up

Windows 10 App Installer abused in BazarLoader malware attacks

guest Guest

Useful Searches