Rewterz Threat Alert – New WhiteShadow Downloader Retrieves Malware Using Microsoft SQL

September 30, 2019

Severity

High

Analysis Summary

The use of Microsoft SQL queries to retrieve next-stage payloads has been relatively rare as a form of malware distribution. Using this tactic, new Microsoft Office macros are found acting as a staged downloader called “WhiteShadow.” WhiteShadow has been resurfacing in multiple campaigns with evolving evasion techniques.

Below is an example of one such campaign:

When recipients open malicious attached documents and activate macros, WhiteShadow operates by executing SQL queries against attacker-controlled Microsoft SQL Server databases.
Once retrieved, the macro decodes the string and writes it to disk as a PKZip archive of a Windows executable. Once extracted by the macro, the executable is run on the system to start installing malware, which is determined by the actor based on the script configuration stored in the malicious Microsoft Office attachments.
Series of malicious email campaigns distributing Microsoft Word and Microsoft Excel attachments containing the WhiteShadow downloader Visual Basic macro have been retrieved. Below is a visual infection chain of WhiteShadow.

Impact

Agent Tesla
AZORult
Crimson
Nanocore
njRat
Orion Logger
Remcos
Formbook

Indicators of Compromise

IP(s) / Hostname(s)

mundial2018[.]duckdns[.]org
www[.]5214zz[.]com
antinio[.]mssql[.]somee[.]com
robinmmadi[.]servehumour[.]com
halwachi50[.]mymediapc[.]net
bytesdata[.]mssql[.]somee[.]com
naddyto[.]warzonedns[.]com
www[.]wortexpharma[.]com
www[.]scaker[.]com
tslserv[.]duckdns[.]org
www[.]bilbord[.]site
fabancho[.]mssql[.]somee[.]com
jasoncarlosscot[.]dynu[.]net

87[.]247[.]155[.]111
193[.]111[.]155[.]137
45[.]138[.]172[.]161
185[.]157[.]79[.]115
185[.]161[.]210[.]111
185[.]161[.]209[.]183
139[.]28[.]36[.]212
79[.]134[.]225[.]77
46[.]246[.]85[.]129
51[.]254[.]228[.]144
45[.]92[.]156[.]76
193[.]228[.]53[.]0
192[.]3[.]157[.]104

URLs

http[:]//rebrand[.]ly/purchaseorder54326
http[:]//rebrand[.]ly/813ed538169eeeethczfz2346577777777788kfvmdkf

Malware Hash (MD5/SHA1/SH256)

4b554367f8069f64201418cddcec82d7857dcc2573be7f0fb387c1b4802040b6
5d7339e420e98c5730ac966e3f8099e3
2ea787dfd65b0488b76b0a0a69ff2a632bb3bea3735ad007336b8dd1473f5768
c8892f7a5fdc48dddcec0e0da0d77842
a2b5168fb4b6a18d66571c6debc54f9f462f5b05a82313123feecc96dab0e595
198161f222448d6c010d650f0f3725e3
c5193ba871414448c78cb516dfea622f2dbafa6bacb64e9d42c1769ebd4ffea3
07faf2fc0e36a353f2b0a31dee587a18
fe88d40c56274a38ecd3a7178ac96970dd473c7ef3d0f54b5c8819f0b1fa41c3
dda4bb0c2c5bb7c1da6cd1845f6e50c0
a6a6b8c7cb72dd2670b6171576bc20c2f28198df12907b4d3ce010dcd97358e4
dcb035e6ea6d7af2adc72efd9b5e0593
bde269bf69582312c1ec76090991e7369e11dbee47a153af53e49528c8bd1b27
f7f0eda9b0db2c8427c1a2edb26bdb67
0943a968cc9e00f83c0bb44685c67890c59ad7785db7fc12e9a0de8df309cbfa
4b585be700825e0e4fbfa2d23f4e1306
b2c0b1535518321fbcde2c9d80f222e9477053e6ee505f2dd3b680277f80de1d
8540a565ca9535779dcfba0f1e35a0d8
bd7abfaa0d3b1d315c2565c83c1003c229c700176c894752df11e6ecae7ad7e6
5a13432e4f3e8afa4773662c3df457fd
0e54bf9380d40d34e6a3029b6e2357f4af1738968646fdaa0c369a6700e158f4
40345b441e5f547a364483f9cbaee208
64c5d3f729d9a1ec26d5686002ccb0111ee9ba6a6a8e7da6ad31251f5d5dde6a
61971b56add584c6ffdffc36dda8d00f
fcc8802b49bfb86d0cffb1cbc4f1b283887015b7da2263f9165a28f1b0f63f47
d397f71c280ad5b9a3342d36ff619a9f
17742a3ca746f7f13aff1342068b2b78df413f0c9cd6cdd02d6df7699874a13a
300f8518f18fe6c55f1f674e236e54f2
4c487ba8dfded5d050d01ab656ef3916c5269551e51ed60f9cfa5995f55e3264
2a6c94033d9f6ace23a4b0a24299375e
35e81258c4365fb97ae57f3989164ed4e8b8e62668af9d281a57c5e7a70c288c
00d02ec4503c664f6acf1bcbfb4c6971
ee0f3eb8a4d7c87a4c33a1f8b08e78bb95fa7ee41ddf0b07d9b6eabe87a33b2e
69acb200963a9ba1fbcc700143d08756
ed8f4a7f09e428ceff8ede26102bb153b477b20775a0183be4ca2185999d20c8
b266aafb2b1036232b93373a44a256b5
acf9c1dda4a2076f0d503450db348ae2913345ebd134a3701baa2ff5ebaccd6e
e01bc1c85c19527494a73ab45d32684f
95dbabe512ba4fc45e32786e87c292fb665e18bc0e2fea1cadb43ba1fe93f13b
b25ceb983ad0fa37e41cf1d4b0b6486a

Remediation

Block the threat indicators at their respective controls.
Do not download files (word & excel) attached in emails coming from untrusted sources.
Always scan files before executing.
Do not enable macros for files downloaded from untrusted sources.