Rewterz Threat Alert – Malspam campaign dropping XpertRAT Malware via ISO images

Friday, July 12, 2019

Severity

Medium

Analysis Summary


An email campaign spreading XpertRAT via ISO images with advanced anti-analysis techniques. The phishing email in this campaign mimics a well-known Italian manufacturing company. Attached is an ISO file packed with a Delphi packer, which the researchers note will mount natively to the file system if it is running Windows 8 or above. The malicious payload is stored in the resource section of the ISO as encrypted data. Before the final payload is executed on the system, the malware performs a series of checks for anti-analysis purposes. First, it checks for whether a debugger is attached to the malicious process. Then it checks for cursor movements, indicating real user activity. Next, it checks information about the CPU in order to identify whether the system is running on a hypervisor. The list of running processes is then checked for analysis tools or anti-malware products. Finally, the file path of the EXE is checked for keywords, such as “sandbox”, “sample”, and more. If all the checks are successful, the final payload is injected into a new “iexplore.exe” process. This payload was identified to be XpertRAT. Once it has been installed and has established persistence, it attempts to communicate with its C2.

cobAgm0a7PTheF1qEtB6SP7kx26KKNPL_XdxyiHCpnlovFHszLDe_XpdbdDoRKsv9YYb89yIY_UflIGQII34L_5RS255-htVrKpLjtHtpFqGz_--asiFHaVi9tmYcNsWA2gTKQ4

Impact

  • Keylogging
  • Command execution

Indicators of Compromise

IP(s) / Hostname(s)

216[.]38[.]2[.]211

URLs

thisurl[.]doesntexist[.]com

Filename

po-ima0948436.exe

Malware Hash (MD5/SHA1/SH256)

  • 3fec3cfb179c80e16c68c79b17970e8cb1f1470cd3b786bfc70f91e0632d0208
  • 3c249ea5120fdccc8254db0e0fe8a91e21a9d3d53d90a264a34278f13b1796fe

Remediation

  • Block all threat indicators at your respective controls.
  • Always be suspicious about emails sent by unknown senders.
  • Never click on the link/attachments sent by unknown senders.

Data Sheets

Corporate Brochure


Our Story


Services


Solutions


Managed Security


Upcoming Rewterz Trainings/Events

Rewterz News

  • 16, July 2019 Rewterz Threat Alert – Lazarus Mobile Malware turning devices into bots
  • 16, July 2019 Rewterz Threat Alert – Lazarus APT Group, Attacked as Identity Document
  • 15, July 2019 Rise in Attacks on DNS Infrastructure and Web Applications
  • 15, July 2019 Rewterz Threat Advisory – CVE-2019-0330 – SAP Diagnostic Agent OS Command Injection Vulnerability

Copyright © Rewterz. All rights reserved.