A new campaign targeting Lebanon and the United Arab Emirates (UAE) affecting .gov domains, as well as a private Lebanese airline company. Based on the research It’s clear that this adversary spent time understanding the victims’ network infrastructure in order to remain under the radar and act as inconspicuous as possible during their attacks.
The attackers’ first attempt to compromise the user involved two malicious websites that mimicked legitimate sites that host job listings:
These sites hosted a malicious Microsoft Office document: hxxp://hr-suncor[.]com/Suncor_employment_form[.]doc.
The document is a copy of a legitimate file available on the website for Suncor Energy, a Canadian sustainable energy company, and contains a malicious macro.
Upon opening the first Office document, the user receives a message that says “Content Mode Available:”
The macros of the analysed samples can be divided into two steps:
When the document is opened, the macro will decode a PE file encoded with base64 and will drop it in %UserProfile%.oracleServices\svshost_serv.doc
When the document is closed, the macro will rename the file “svshost_serv.doc” to “svshost_serv.exe.” Then, the macro creates a scheduled task named “chromium updater v 37.5.0” in order to execute the binary. The scheduled task is executed immediately and repeatedly every minute.
The purpose of these two steps is to avoid sandbox detection.
The payload is executed when Microsoft Office is closed, meaning it requires human interaction to deploy it. The macros, while available through analysis, are also password-protected in Microsoft Word to stop the victim from exploring the macro code via Microsoft Office.
Additionally, the macro uses classical string obfuscation in order to avoid strings detection.
Alters DNS records
Indicators of Compromise
IP(s) / Hostname(s)
Malware Hash (MD5/SHA1/SH256)