Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

New Wine in Old Bottle: New Azorult Variant Found in Find MyName Campaign using Fallout Exploit Kit

Summary: Unit 42 observed new Azorult variants used as primary payloads in a campaign it named FindMyName, first seen October 20, 2018, where 5 different URL chains over 3 days all redirected victims to the domain findmyname[.]pw and delivered the Fallout Exploit Kit. The kit's obfuscated landing page exploits IE VBScript vulnerability CVE-2018-8174, patched in August, then drops a .tmp file in %Temp% that is the new Azorult sample, which uses API flooding and control flow flattening to evade anti-virus and steals credentials from 32 browsers plus cryptocurrency wallets and applications including Thunderbird, FileZilla, Outlook, WinSCP, Skype, Telegram and Steam.

Key Takeaway: The malware pulls 48 legitimate DLLs from its command-and-control server to do the stealing, so the tools doing the credential theft are signed, trusted libraries your controls may not flag. Two of the three captured samples had not been seen in the wild when discovered, and the exploit targets a vulnerability patched in August, leaving unpatched Windows hosts exposed.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Zero-Days & Exploits
Mentions
CVE-2018-8174
Related
On VBScript Cyber Risks ·