{
  "timestamp": "2025-02-05T22:57:24.971696",
  "content": "Search Free Trial Get Demo Covid AgentTesla April 17, 2020 With the world under threat of the COVID-19 aka corona virus, many cybercriminals are taking this opportunity to blend in the chaos. Here we have an email posing to have an order of masks. An important personal protection equipment that is on a very high demand as of this moment. Infection Chain Overview RTF Attachment Once the file is opened, it will try to exploit a vulnerability in Microsoft Word to download and execute a file. hxxpbit.ly2J9KXAM which resolves to hxxpposqit.netGE5091203.jpg 5091203.jpg The downloaded .jpg file is actually a PE Executable file. It is a .NET file so we can use DnSpy to analyze its code. Once executed, it will decrypt a DLL fileDKaQso.dll using AES from its resource and will load and execute it using Assembly.Load and InvokeMember methods. Resource section object named AL is the encrypted DKaQso.dll. Key and IV used to decrypt the file Execute X on DKaQso.dll DKaQso.dll The DLL file contains another 3 files in its resource. The 2 image files contain 1 DLL file each. 1.bmp - LOL.dll which is embedded in an image. SourceTIASK .bmp- 26.dll. which is compressed and embedded in image. IsConsoleEnabledsANCK - AgentTesla binary payload which is compressed and encrypted. It uses the Bitmap Class to get the embedded DLL in the BMP file which is a form of Steganography.Here we have an image of a snippet code which gets the first pixel and get the color.B property.The byte is equal to 0x4D which is equal to M, the start of the MZ header in PE files.It will perform a loop on each pixel and get the byte in the color.B property to form the the DLL file. In the case of 26.dll, once the file is taken out of the image, it will be decompressed. LOL.dll Once loaded and executed, the files task is to create a persistence mechanism for the malware. It checks for files and folders related to Anti-Malware vendors and creates the necessary files for its persistence mechanism. If the following files exist in the system, it will create .js file in the startup folder CProgram FilesAVAST SoftwareAvastavastUI.exe CProgram Files x86AVAST SoftwareAvastavastUI.exe CProgram FilesAVGAntivirusAVGUI.exe CProgram Files x86AVGAntivirusAVGUI.exe Content of the .js file var nPiCCaK  new ActiveXObjectShell.Application nPiCCaK.ShellExecuteMALWARE PATH, , , Open, 1 If the following folder exist in the system, it will create a shortcut link in the startup folder. CProgram Files x86KasperSky Lab FilesKasperSky Lab - folder path contains the string If windows Windows Defender exist in the system, it will create a registry entry that is linked to the malware executable path SOFTWAREMicrosoftWindowsCurrentVersionRun 26.dll This DLL is responsible for injecting the payload on Regasm.exe. It checks for the following directory related to Anti-Malware vendors CProgram FilesAVAST Software CProgram Files x86AVAST Software It also checks for the following strings related to Anti-Malware vendors BullGuard a2guard drweb vssery AVGUI bdagent odscanui bdredline It also checks for Windows Defender Payload The main payload of this infection chain is a variant of AgentTesla. The strings used by this malware is encrypted using AES. Using the info of its decryption routine,we can try and decrypt the strings it uses. Here we have the SMTP account and server it uses. SHA256 Description Detection 0cddd9b85decde446a800c9d3dee489758f39e5131c9dc4f0c06622f9370e82d email 27d601ef1a2b340b6b644493a627064f60ad8a95271248e00f7bb54a59abb069 RTF attachment  COVID 19 NEW ORDER FACE MASKS.doc CVE-2017-11882.C.gen!Camelot 69f559b9cd5b586e4a2c0bba58be74b85124a230bef6035739a325cf57066e2f downloaded payload W32MSIL_Kryptik.AIA.gen!Eldorado Try it for Free Instant Data Classification Cyren URL Category Chacker Prev File-less almost and Confused Covid-19 Exposes a Newly Remote Workforce to More Evasive Phishing Attacks Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443",
  "analysis_type": "product",
  "analysis": "**Analysis of Security Features and Capabilities Against COVID-19 Themed Phishing Attack**\n\n**1. Key Security Features and Capabilities**\n\n- **Email Security:** Implement advanced email filtering, attachment sandboxing, and AI-based phishing detection to block malicious emails.\n- **Endpoint Protection:** Utilize endpoint security solutions with exploit prevention to block attacks targeting vulnerabilities like CVE-2017-11882.\n- **Application Control:** Enforce application whitelisting to ensure only authorized applications execute.\n- **Vulnerability Management:** Regularly patch software to mitigate known vulnerabilities.\n- **Network Monitoring:** Monitor for Command and Control (C2) communications to detect and block malicious traffic.\n- **Endpoint Detection and Response (EDR):** Deploy EDR solutions to detect and respond to suspicious activities indicative of malware.\n- **User Training:** Educate users on phishing tactics to reduce susceptibility to social engineering.\n\n**2. User Benefits and Protection Measures**\n\n- **Enhanced Email Filtering:** Protects users from opening malicious attachments or clicking harmful links.\n- **Proactive Endpoint Defense:** Stops attacks before they can exploit vulnerabilities, safeguarding user data.\n- **Controlled Application Execution:** Prevents unauthorized software from running, reducing the risk of infection.\n- **Timely Patching:** Ensures systems are up-to-date, minimizing exploit opportunities.\n- **Network Visibility:** Detects and disrupts communication with attackers' servers, limiting malware activity.\n- **Real-Time Threat Detection:** Quickly identifies and mitigates potential threats, minimizing attack impact.\n- **Informed Users:** Reduces the success of phishing campaigns by empowering users to recognize threats.\n\n**3. Integration with Existing Security Systems**\n\n- **Endpoint Protection Platforms (EPP):** Integrates with EPP to provide comprehensive device security.\n- **Security Information and Event Management (SIEM):** Enhances threat detection and response through centralized monitoring.\n- **Firewall Solutions:** Works alongside firewalls to monitor and block suspicious traffic.\n- **Email Gateway Solutions:** Integrates with email systems to filter and block malicious content.\n- **Incident Response Tools:** Facilitates quick response and remediation in the event of a breach.\n\n**4. Compliance and Certification Details**\n\n- **Data Protection Regulations:** Aligns with GDPR and CCPA requirements, ensuring personal data security.\n- **Industry Standards:** Meets NIST guidelines, providing a robust cybersecurity framework.\n- **Third-Party Certifications:** Solutions are certified by reputable organizations, ensuring reliability and effectiveness.\n\n**5. Security Best Practices for Users**\n\n- **Regular Patching:** Keep all software updated to protect against known vulnerabilities.\n- **User Education:** Train users to identify and report suspicious emails.\n- **Monitoring:** Continuously monitor networks and endpoints for unusual activity.\n- **Backup:** Regularly back up critical data to prevent losses from ransomware or data corruption.\n- **Incident Response Plan:** Have a plan in place for quick and effective response to security incidents.\n\n**6. Technical Specifications and Requirements**\n\n- **Supported Operating Systems:** Solutions cover Windows, macOS, and Linux.\n- **Compatibility:** Ensure security tools are compatible with existing infrastructure.\n- **Performance:** Optimize solutions to maintain system performance while providing robust protection.\n- **Scalability:** Choose solutions that scale with organizational growth and evolving threats.\n- **Support:** Ensure vendor support is available for timely assistance with security issues.\n- **Visibility:** Tools should provide detailed logs and visibility into network and endpoint activities.\n\nIn summary, a multi-layered security approach is essential to combat sophisticated attacks like the COVID-19 themed phishing campaign. By integrating various security features, ensuring compliance, and adhering to best practices, organizations can effectively protect themselves against such threats."
}