Rewterz Threat Alert – Malware Campaign Associated With EmpireMonkey Group

Severity

Medium

Analysis Summary

A malware campaign has been detected that seems to be associated with the threat actor tracked as “EmpireMonkey”.

This group uses PowerShell Empire Framework as the initial tool to gain foothold in the targeted entities. Additionally, in multiple earlier malware samples attributed to this actor, they distinctly used variants of the word “monkey” in the Macro functions embedded within their documents.

When the document is opened, the VBA/Macros copies a legitimate wscript.exe executable into the %APPDATA% directory as “cutil.exe” and uses it to execute the following Malicious JavaScript file…

The Malicious JavaScript has several obfuscation layers:

• Base64 Encoding
• RC4 Encryption (Passphrase = kjzppaa)
• After obfuscation, the resulting Malicious JavaScript appears to use code from SharpShooter’s AMSIKiller Module to bypass AMSI.

Impact

EmpireMonkey

Remediation

Block the threat indicators at their respective controls.

Do not download email attachments coming from unknonw or untrusted sources.

Always scan downloaded files before execution.