Forest Global Training Partners

Cyber Risks · Cisco Talos

Malware Meets Sys Admin - Automation Tools Gone Bad

Summary: Cisco Talos reported a targeted phishing attack that impersonated a real business, using its logo and physical address, and delivered a Microsoft Word document with a macro that downloaded and executed a binary from hxxp://frontlinegulf[.]com/tmp/adobefile.exe. The payload was a self-extracting archive that used AutoIT, a legitimate freeware administration tool, to run a script performing anti-analysis checks, payload decryption, installation and persistence, ultimately delivering the Nanocore RAT.

Key Takeaway: The attackers hid a backdoor inside a tool your administrators already run, so the activity resembles normal system management and is built to evade traditional antivirus; Talos notes the adversaries changed the hosted payload several times during the investigation.

Read the original at Cisco Talos ↗

Topics
Malware
Related