Rewterz Threat Alert – New ‘Duri’ Campaign Uses HTML Smuggling to Deliver Malware

Severity

High

Analysis Summary

Researchers have been closely monitoring an attack we are naming “Duri.” Duri leverages HTML smuggling to deliver malicious files to users’ endpoints by evading network security solutions such as sandboxes and legacy proxies. Isolation prevents this attack from infecting the endpoint. The malware that Duri downloads is not new. It has previously been delivered via Dropbox, but the attackers have now displaced Dropbox with other cloud hosting providers and have blended in the HTML smuggling technique to infect endpoints. Once the user clicks on the link, there are multiple levels of redirection before the user lands on an HTML page hosted on duckdns[.]org. The landing page invokes a JavaScript onload that initializes data for a blob object from a base64 encoded variable.

A ZIP file is dynamically constructed from the blob object with MIME type as octet/stream and is downloaded to the endpoint. The user still needs to open the ZIP file and execute it.

Impact

• Security bypass
• Data breach
• Exposure of data 

Indicators of Compromise

URL

• hxxp[:]//huzirh[.]com/hidrol/
• hxxp[:]//isocamprh[.]com[.]br/
• hxxp[:]//hxxp[.]plasticospr[.]com/webmailgrupo?nzn11t6c68b5k40ry31c903ez3xaq/formulario_correios_37[.]pdf
• hxxp[:]//gmpbusdoor[.]com/
• hxxp[:]//hxxp[.]isocamprh[.]com[.]br/incolajes
• hxxp[:]//iboxrh[.]com/consultoriarh?1e0wq712tctv0232v000lnjsn4c7a/boleto[.]3673[.]pdf
• hxxp[:]//www[.]isocamprh[.]com[.]br/incolajes
• hxxp[:]//hxxp[.]isocamprh[.]com[.]br/incolajes/
• hxxp[:]//isocamprh[.]com[.]br/incolajes?page=boletos&idBoleto=8868
• hxxp[:]//hxxp[.]westermarh[.]com/waycompany?WhatsApp_Historico_de_Conversas?whatsapphistorico/index[.]html?visualizar=c06e8cf10aeaf00c33360d2b2bfb6792
• hxxp[:]//hxxp[.]grentrepostorh[.]com/
• hxxp[:]//update-completo[.]com/
• hxxp[:]//plasticospr[.]com/webmailgrupo?fotoswhatsapps/Imagem[.]htmldigitaloceanspaces[.]com/Fotos[.]html
• hxxp[:]//ultrafarmarh[.]com/transglobal?WhatsApp_Historico_de_Conversas?whatsapphistorico/index[.]html?visualizar=c06e8cf10aeaf00c33360d2b2bfb6792
• hxxp[:]//hidrolrh[.]com/
• hxxp[:]//hxxp[.]casadaembalagemriopreto[.]com/officeclean?NZN11T6C68B5K40RY31C903EZ3XAQ/Formulario_Correios_37[.]pdf
• hxxp[:]//www[.]fjpconstrucoes[.]com/predilecta

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.