Researchers observed a new malicious campaign that delivers a powerful ExileRAT malware via Microsoft powerpoint documents using previously used C2 server infrastructure.
Attackers deliver the malware via Email attachment and the Mail address represented the Central Tibetan Administration (CTA), a Tibetan based government organization.
Nature of this malware campaign seems to spy on civilian populations for political reasons and its most likely not distributing for financial gain.
PPSX file format document, a non-editable slideshow derived via MS Powerpoint was used for this attack and it attached with a CTA mailing list
Further analysis revealed that the malware campaign shared the payload and infrastructure that is used by previous malware LuckyCat, an Android- and Windows-based trojans.
Apart from that, discovered C2 server hosting used for multiple campaigns using the same payloads and the PPSX file dropper helps an attacker to execute the various payload into victims system.
Mailing list infrastructure used from Indian based company DearMail, that provides a cloud enabled web-based email campaign manager.
Attackers abusing the Email Header and modified the standard reply that helps to get a direct reply from victims to the attacker’s email address.
ExileRAT Malware Infection Process
Attackers using Microsoft office based remote code execution vulnerability and its exploit hosted on GitHub which is available for public.
The exploit code resides in the “slide1.xml.rels” file and the researchers analyze file by dynamic analysis on Threat Grid and find that the
PPSX also attempts to contact IP location to perform some geo-location lookups.
Later it initiate the HTTP request to C2 server where it retrieves the JavaScript script that’s responsible for downloading the payload “syshost.exe” and infect the system.
ExileRAT is Remote access Trojan based Malware that is capable of getting information on the system (computer name, username, listing drives, network adapter, process name), getting/pushing files and executing or terminating processes.
According to Cisco Talos Research, Apart from this ExileRAT infection, the researcher identified several other open directories that contained other .exe and .dll files, namely “AcroRd32.exe” and “ccL100U.dll.”.
“The hardcoded C2 server IP in Syshost.exe was also recently home to a specific interesting domain: mondaynews[.]tk. This domain is the C2 domain of an Android RAT created on Jan. 3. This is a newer version of the LuckyCat Android RAT used in 2012 against Tibetan activists” Talos researchers said.
To read the orignal article: