Rewterz Threat Alert – Microsoft Detects New Evil Corp Malware Attacks on Financial Institutions

Severity

High

Analysis Summary

Evil Corp phishing campaign is using attachments featuring HTML redirectors for delivering malicious Excel documents. The final payload is being dropped using an Excel document that bundles a malicious macro. Evil Corp (also tracked as TA505 and SectorJ04) is a financially motivated cybercrime group known for focusing on attacks against retail companies and financial institutions via large-sized malicious spam campaigns driven by the Necurs botnet.This threat actor distributed remote access Trojans (RATs) and malware downloaders that delivered the Dridex and Trick banking Trojans as secondary payloads, as well as Locky, BitPaymer, Philadelphia, GlobeImposter, Jaff ransomware strains on their targets’ computer.

The new campaign uses HTML redirectors attached to emails. When opened, the HTML leads to the download Dudear, a malicious macro-laden Excel file that drops the payload.

The phishing messages come with HTML attachments which will automatically start downloading the Excel file used to drop the payload.The victims are instructed to open the Excel document on their computer as online previewing is not available and to enable editing to get access to its contents.Once executed on the victim’s computer, the malware will also attempt to drop an info-stealing Trojan tracked by Microsoft as GraceWire. Like most other info stealers, this will also start collecting sensitive information from the victim’s device and send it to its masters via a command-and-control server.

Impact

• Information Theft
• Additional malware infection

Indicators of Compromise

Domain Name

aka[.]ms

MD5

• e4f3f79678ddb3e304a256fa20154fbe
• 674f833c4c33f5cc9d156533c1b63e12
• 8b2bd6352e0ffe8b0e2bad20b49c8682
• 2ba8747d8ace2e2fb879bb272b8c650f
• e832505580d44c7ad1bee8a67c3ee280
• c4aaab31a70a34709e28baaebd209629

SHA-256

• d75c0e88f203dce04e7c90a32a17cee25e5d3acbb5add7c33d257b8600281f2b
• 6dee4408f563522f7fe5efb9891c409827643039bf7c8cd17c0d80bcc2997ece
• b81302bc5cbfeddf3b608a60b25f86944eddcef617e733cddf0fc93ee4ccc7ab
• bf86ccaf5e7f20124a259212a3a78dae12ec2594f48d5256a01323c772abc606
• 63c137ed882560ba03b7333a49b0714990c581f4e8a1b7579b339c74f465aa03
• 44ffbe69f8f189de7fa4f794686241ee4c814de90681bfff0a37e344ed12954e

URL

http[:]//aka[.]ms/MsftSecIntel

Remediation

• Block the threat indicators at their respective controls.
• Do not respond to untrusted emails.