CertUtil.exe Could Allow Attackers To Download Malware While Bypassing AV

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/certutilexe-could-allow-attackers-to-download-malware-while-bypassing-av/

Windows has a built-in program called CertUtil, which can be used to manage certificates in Windows. Using this program you can install, backup, delete, manage, and perform various functions related to certificates and certificate stores in Windows.
One of the features of CertUtil is the ability to download a certificate, or any other file for that matter, from a remote URL and save it as a local file using the syntax "certutil.exe -urlcache -split -f output.file". Security researcher [URL='https://twitter.com/subTee']Casey Smith tweeted in 2017 his concerns that this method could be used to download malware.

Using CertUtil+Base64 to Bypass Security Software

Today security consultant and ISC Handler Xavier Mertens published a handler diary that adds a twist to the use of CertUtil that may make it easier for attacker's downloads to remain undetected by edge security devices. This is to first base64 encode the malicious file so it appears as harmless text and then decode it after it has been downloaded using CertUtil.exe.


As already discussed, you can download a file using CertUtil.exe by using the following command:

certutil.exe -urlcache -split -f output.file

This will download the file in its original form and save it to the computer. The problem with this method is that network security devices can detect the file as malicious and block it.
...
.....

http:// output.file This will down...as malicious and block it. ... ..... [/QUOTE][/QUOTE]