Malware News AdvisorsBot Downloader Emerges in Raft of Malware Campaigns

[silversurfer]

Content source

https://threatpost.com/advisorsbot-downloader-emerges-in-raft-of-malware-campaigns/136863/

A new downloader was disclosed today, sporting significant anti-analysis features and increasingly sophisticated distribution techniques.

Researchers at Proofpoint have been tracking the downloader as a first-stage payload in campaigns since May 2018. Dubbed AdvisorsBot (due to early command-and-control domains, all containing the word “advisors”), it has been targeting hotels, restaurants and telecom-sector victims.

“A majority of the targets were located in the United States, but we’ve observed this threat globally,” Chris Dawson, threat intelligence lead at Proofpoint, told Threatpost. “To date, the campaigns have targeted thousands of recipients.”

The research team said in a post Thursday that the campaigns use several themes in their email lures, including a “grievance” gambit.

 

[upnorth]

The telecom-sector is suffering bad from examples like the SS7 issue.

Off-Topic - How a 40 Year Old Mobile Security Flaw Puts Consumers at Risk

 

[Libera Milanesi]

AdvisorsBot (May):
VirusTotal
Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'upd'

(Thanks to ProofPoint for the Indicators of Compromise).

If you do not have the ability to download from either above sources, don't hesitate to let me know and I can provide you with the download.

 

[Libera Milanesi]

(Thanks to ProofPoint for the Indicators of Compromise).

Source:
New modular downloaders fingerprint systems - Part 2: AdvisorsBot

It's a well-written article and an interesting read... Kudos to the author.

You will find more IOCs on the above linked analysis article; you can also use these to help you find newer versions of AdvisorsBot (e.g. June and August versions) as well as PoshAdvisor.

 

[silversurfer]

Source:
New modular downloaders fingerprint systems - Part 2: AdvisorsBot

It's a well-written article and an interesting read... Kudos to the author.

You may want to read the first part of these reports: New modular downloaders fingerprint systems, prepare for more - Part 1: Marap

 

[Libera Milanesi]

You may want to read the first part of these reports: New modular downloaders fingerprint systems, prepare for more - Part 1: Marap

Thanks for sharing and letting me know, I hadn't seen that one yet. ProofPoint have a new fan, I like how they remember to include the IOCs, it's really helpful.

Marap downloader (PDF version):
Antivirus scan for 2c5729e17b64cd4e905ccfeabbc913ed945e17625c35ec1d6932194aae83d7c6 at 2018-08-23 23:54:05 UTC - VirusTotal
Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'DOC_2606660638_10082018.pdf'

Marap payload:
Antivirus scan for bc1fc69f9747dc034ece7d9bb795c5e596d9be6ca71efe75c6c0fd18f3cbfbf5 at 2018-08-24 00:08:29 UTC - VirusTotal
Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'data3.exe'

(Credits to the ProofPoint article (linked to by @silversurfer in the above post) containing the IOCs).

If anybody needs the downloads from the sources linked to above and cannot download it from there for one reason or another, feel free to let me know and I can help you out.