National Cyber Warfare Foundation (NCWF)

This campaign is observed to be targeting multiple countries, including the U.S., Nigeria, Germany, Egypt, the U.K., Poland, the Philippines, Norway, and Japan. The threat actor behind this ongoing campaign has been identified as “CoralRaider, ” whose Tactics, Techniques, and Procedures (TTPs) overlap with the current campaign. The threat actor’s previous campaigns, which included using […]

The post CoralRaider Hacker Evade Antivirus Detections Using Malicious LNK File appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

This campaign is observed to be targeting multiple countries, including the U.S., Nigeria, Germany, Egypt, the U.K., Poland, the Philippines, Norway, and Japan.

The threat actor behind this ongoing campaign has been identified as “CoralRaider, ” whose Tactics, Techniques, and Procedures (TTPs) overlap with the current campaign.

The threat actor’s previous campaigns, which included using a Windows Shortcut file, identical PowerShell Decryptor and Payload download scripts, and FoDHelper techniques for bypassing UAC (User Access Control) on the victim machine, are similar.

CoralRaider Hacker Evade Antivirus

The threat actor hosted the download of files like the malicious HTA (HTML Application) file and the payload on a Content Delivery Network (CDN) Cache domain.

This is done as a means of evading detection from security products.

A new PowerShell command-line argument was found inside the LNK file, which was used to evade antivirus products and download the final payload onto the victim’s machine.

The PowerShell scripts used in this campaign were observed to have similarities with the CoralRaider threat group’s Rotbot campaign.

Free Webinar | Mastering WAAP/WAF ROI Analysis | Book Your Spot

Multi-Stage Infection Chain

The infection chain starts with a victim opening a malicious shortcut embedded inside a ZIP file. This ZIP file is downloaded via drive-by download techniques or phishing emails.

This shortcut file contains an embedded PowerShell command running a malicious HTA file on the Attacker-controlled CDN domain.

Attack flow chain (Source: Talos Intelligence)

This malicious HTA file executes an embedded JavaScript which decodes and runs a PowerShell decrypter script which decrypts another embedded PowerShell Loader script that runs on the victim machine’s memory.

Following this, the downloader script executes multiple functions for downloading and running one of the infostealer malware (Cryptbot, LummaC2, or Rhadamanthys).

In addition, this loader script also evades detections and bypasses User Access Control (UAC).

PowerShell script inside the LNK file (Source: Talos Intelligence)

This loader script also drops a batch script onto the victim’s temporary folder and also writes its contents.

This batch script will also include the PowerShell command to add the “ProgramData” folder to the Windows Defender Exclusion.

The Use Of LoLBin – FodHelper.exe

This new campaign also uses Living-off-the-land binary techniques as the dropped batch script is executed using “FoDHelper.exe” and also uses Programmatic identifiers (ProgIDs) registry keys to bypass UAC controls.

The FoDHelper has elevated privileges if certain registry keys have commands assigned.

First Batch script (Source: Talos Intelligence)

After doing so, the loader script also downloads the payload “X1xDd.exe” and saves it in the ” C: ProgramData” folder, which is not detected due to the addition of the ProgramData folder to the exclusion list in Windows Defender.

However, the PowerShell loader also overwrites the dropped batch script with new instructions.

Second Batch Script (Source: Talos Intelligence)

The new instructions include the commands to run the newly downloaded payload information stealer with the Windows start command.

Additionally, this step follows a similar pattern of using the FoDHelper to run the batch script.

Selection Of Payload With Requirement

All three infostealer malware, LummaC2, Cryptbot, and Rhadamanthys, have their own merits and demerits.

These info stealers can harvest multiple sensitive information such as system data, browser data, credentials, cryptocurrency wallets, and financial information.

CryptBot

First found in 2019, the CryptBot targets Windows systems designed to steal sensitive information from affected computers.

The new variant of Cryptbot has been distributed since January 2024 and is packed with VMProtect V2.0.3-2.13.

This new variant also has password manager application databases and authenticator application information in an attempt to steal cryptocurrency wallets that have two-factor authentication enabled.

As an added advantage, Cryptbot Stealer also scans the victim’s machine for database file extensions for targeted applications to harvest credentials.

CryptBot targeted applications (Source: Talos Intelligence)

LummaC2

The threat actor is also observed using a new variant of LummaC2 malware, modified by the threat actor.

This malware seems to have been obfuscated by the threat actor with a custom algorithm. Moreover, the threat actor has set up over nine C2 servers, to which the malware connects one by one.

All of these servers use a different key to encrypt the C2 domains.

The exfiltration of information is similar to the previous versions of LummaC2 malware but has added the exfiltration of discord credentials from the victim.

Rhadamanthys

This infostealer malware has been sold on underground forums since September 2022.

This malware seems to be evolving until now, with newer versions coming out every now and then. The latest version, V0.6.0, was released on February 15, 2024.

The threat actor has been using a Python executable file as a loader to execute this Rhadamanthys malware, which is done in two stages.

The first stage uses a simple Python script, and the second stage uses the Windows API to allocate a memory block and inject Rhadamanthys malware into the process.

Rhadamanthys sold on Underground Forums (Source: Talos Intelligence)

Indicators Of Compromise

SHA-256

150dd450f343c7b1e3b2715eae3ed470c1c1fadf91f2048516315f1500a58ffa

74ea6e91c00baad0b77575740eb7f0fb5ad1d05ddea8227dc1aa477e179e62df

3ae459746637e6f5536f3ba4158c822031578335505a512df3c31728cac8f627

88528be553f2a6f72e2ae0243ea907d5dcdcd7c8777831b4c3ab2a67128bc9b9

fd53383d85b39e68d817e39030aa2184764ab4de2d478b7e33afc39dd9661e96

e68c9aedfd080fe8e54b005482fcedb16f97caa6f7dcfb932c83b29597c6d957

8c732ec41550851cc933e635708820ec9202fddc69232ca4ed625d420aec3d86

1942c417f2b71068fb4c1abb31bc77426bbe3513334cdaceaff3603955830e21

5ad73cf7e08b8c7bab0d96ba92607b8c9b22b61354052cf59df93b782b6e039b

a1f16ab97b9516e85c202ff00bd77b0b5e0e4ed29bfad28797fbbd0f25a8e0ae

963ffc17565079705c924b8ab86d1c7018f5edc50ce8e810df3eebead4e14e7f

3b54d05ec98321980c1d71b89c42ff77a42f121e37f6ea54a6368a58ce1b1ad3

31b4fd83c16bf7266c82a623998b0d7b54bb084b24a5cb71a2b5e9b17bb633dc

5dc77655bddf8881b533e4db732dcf7ac5ebf3adad4be77ff226909a49bfc89b

2ad94e492bc18e11f513a29968054e1a37df504ac577fd645e781e654f2730c9

02e03904d09ccece4f71e34a4a6d0f1181471c4d17208ee6cfe940e11e185018

eef156d681c4921cbed720e6de257a69ad6a187e814037257977958eb0c7604e

6089c53ef2b0100fd91554c2a56aafaeea86b08c5ad0459fd66bd05a6602a3ee

934dc78ab89dd466b1a140954c6528b6a8591ca09a023616405cf71faf69f010

305bf697e89e6eef59b0beef2b273a1daad174ebec238a67a6e80c5df5fffaf8

7db78346dde71258ae1307b542d162a030c71031eebd0ed80816112d82c008f0

7f19557ee3024c59668e5bd1c96a8124b0a201a9fd656bd072332b400c413405

b6dbee1b6e444216668c44e41a84ca91cbd966e9035621423ecc12db52a36e01

b3e694ce12e6f67db5db56177abfddebbc29f558618987e014f47a46996a8ced

1397268735c5c6e88d8bc717ac27f8810225b554ed2f0d76a3e0048b0933af18

958508a626b94d5e2e00ab0b94cb75dca58091cce708d312ee1a1c0688ef067c

51c1eccc1b95ecbeaebc4853606c02808fce208ff1f76f0c7aa11ad7fbb4b763

3c075a2bcd06e103e6ec3a1b74ceaaf600d3a9e179e2719795377f71c4f8f9c8

3ac52be2039a73df64e36672f3f0c748de10f6a8bed4b23642dd8da256137681

aea7c613ac659a083c35afd8e20f19a2c3583f81597dec48cbc886292cfcc975

a04c6804b63220a9cb1ea6c5f2990e6a810d7b4b7225e0fc5aa7ed7e2bac3c99

7682ec1cc9155e1dfa2ec2817f0510ac3f66800299088143f8a6b58eeb9a96c8

a28152ed5039484e858d3c7d4bac03c6ad66fbaffb0e8ea3dfa8def95e115181

b796cc4a54ee27601c1ed3a0016caa6f58206f4f280391f67820b8b019602add

5cb65b469023dcc77ede21c66a753fa9cbe67597aae142958fce4936ce3974aa

Files

kzeight8ht.top/upload.php

kbeight8sb.top/upload.php

kbeight8vs.top/upload.php

kbeight8ht.top/upload.php

kbeight8pn.top/upload.php

dbeight8pt.top/zip.php

kveight8sb.top/zip.php

API Calls

peasanthovecapspll.shop/api

claimconcessionrebe.shop/api

culturesketchfinanciall.shop/api

gemcreedarticulateod.shop/api

liabilityarrangemenyit.shop/api

modestessayevenmilwek.shop/api

secretionsuitcasenioise.shop/api

sofahuntingslidedine.shop/api

triangleseasonbenchwj.shop/api

IP Address

185.23.108.220|6339

Domains

techsheck.b-cdn.net/Zen90

zexodown-2.b-cdn.net/Peta12

denv-2.b-cdn.net/FebL5

metrodown-2.b-cdn.net/MebL1

metrodown-2.b-cdn.net/SAq2

denv-2.b-cdn.net/FebL4

download-main5.b-cdn.net/BSR_v7IDcc

metrodown-3.b-cdn.net/MebL1

dashdisk-2.b-cdn.net/XFeb18

Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.

The post CoralRaider Hacker Evade Antivirus Detections Using Malicious LNK File appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.

Source: gbHackers
Source Link: https://gbhackers.com/coralraider-lnk-antivirus-evasion/