Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Aveo Malware Family Targets Japanese Speaking Users

Summary: Palo Alto Networks identified a malware family called Aveo, named for an embedded debug string, that targets Japanese speaking users and is closely tied to the previously reported FormerFirstRAT family. Aveo disguises itself as a Microsoft Excel document via a WinRAR self-extracting executable, drops a Japanese-language decoy document about a 2016 research initiative from the Ido Laboratory at the Saitama Institute of Technology, exfiltrates victim information over HTTP to snoozetime[.]info using RC4 with the key 'hello', and accepts commands giving attackers full control of the victim machine.

What's compelling: The C2 domain snoozetime[.]info was registered in May 2015 and has since resolved to three IP addresses, all in the United States, and the malware persists through the registry key HKCU\software\microsoft\windows\currentversion\run\msnetbridge - infrastructure and a foothold that outlast a single campaign.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related