Microsoft: Massive malware campaign delivers fake ransomware

[Kongo]

Content source

https://www.bleepingcomputer.com/news/microsoft/microsoft-massive-malware-campaign-delivers-fake-ransomware/

A massive malware campaign pushed the Java-based STRRAT remote access trojan (RAT), known for its data theft capabilities and the ability to fake ransomware attacks.
In a series of tweets, the Microsoft Security Intelligence team outlined how this "massive email campaign" spread the fake ransomware payloads using compromised email accounts.
The spam emails lured the recipients into opening what looked like PDF attachments but instead were images that downloaded the RAT malware when clicked.
"The emails contained an image that posed as a PDF attachment but, when opened, connected to a malicious domain to download the STRRAT malware," Microsoft said.
"This RAT is infamous for its ransomware-like behavior of appending the file name extension .crimson to files without actually encrypting them."

Microsoft: Massive malware campaign delivers fake ransomware

A massive malware campaign pushed the Java-based STRRAT remote access trojan (RAT), known for its data theft capabilities and the ability to fake ransomware attacks.

www.bleepingcomputer.com

I think @struppigel can tell you guys more about this.

 

[Andy Ful]

Scripts (including JAR files) are blocked in Outlook and Gmail. So, if one has installed Java in the system it is recommended to use Outlook, Gmail, etc., which can block opening script attachments from emails. Unfortunately, many email clients and email service providers allow opening script attachments.

Attachments blocked by Outlook:

Blocked attachments in Outlook - Microsoft Support

Some attachment file types are automatically blocked because of their potential for introducing a virus into your computer.

support.microsoft.com

Attachments blocked by Gmail

File types blocked in Gmail - Gmail Help

There are a number of reasons why you may find the "This message was blocked because its content presents a potential security issue" error in Gmail. Gmail blocks messages that may spread viruses, lik

support.google.com

 

[struppigel]

Scripts (including JAR files) are blocked in Outlook and Gmail. So, if one has installed Java in the system it is recommended to use Outlook, Gmail, etc., which can block opening script attachments from emails. Unfortunately, many email clients and email service providers allow opening script attachments.

The version that I analysed one year ago indeed contained a .JAR file as attachment. But the new version mentioned by Microsoft is delivered via something that looks like a PDF. I could not determine from the Microsoft tweets if it is actually a PDF or a file posing as one. They don't say.

Anyways I assume the StrRAT threat actors have done improvements to their infection chain and also their malware, seeing that there is a new version number. The whole infection chain might be working without pre-installed Java by now.

 

[Andy Ful]

The version that I analysed one year ago indeed contained a .JAR file as attachment. But the new version mentioned by Microsoft is delivered via something that looks like a PDF. I could not determine from the Microsoft tweets if it is actually a PDF or a file posing as one. They don't say.

Anyways I assume the StrRAT threat actors have done improvements to their infection chain and also their malware, seeing that there is a new version number. The whole infection chain might be working without pre-installed Java by now.

It seems to be a common drive-by attack:
"The emails contained an image that posed as a PDF attachment but, when opened, connected to a malicious domain to download the STRRAT malware."


I also found one sample (initial attack via JS script):
https://app.any.run/tasks/8409bd89-fe8c-4cb6-954b-4834d9621432/

There are many STRRAT samples on Any.Run, one has to click the "strrat" below "Total time" on the above analysis webpage.

 

[Andy Ful]

Here is an example from Any.Run:

Analysis https://gossyexperience.co.uk Malicious activity - Interactive analysis ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

In this attack the STRRAT malware is delivered via malicious URL.

The user is redirected to the webpage with captcha (to be more convincing):

Spoiler

After passing by the captcha the malware is downloaded to disk with the information that the file can harm the computer:

If the user will choose to keep it, the malware can be run from the Downloads folder:

 

[Kongo]

Here is an example of STRRAT delivery via malicious URL:

The user is redirected to the webpage with captcha (to be more convincing):
View attachment 258340

After passing by the captcha the malware is downloaded to disk with the information that the file can harm the computer:
View attachment 258341

If the user will choose to keep it, the malware can be run from the Downloads folder:

View attachment 258343

URL can still be seen in the tabs...

 

[Andy Ful]

Ha. Ha. I really did not notice it.

 

[wat0114]

What is the Windows O/S being used in those examples? It looks quite old.

 

[Kongo]

What is the Windows O/S being used in those examples? It looks quite old.

Windows 7 32bit on AnyRun

 

[wat0114]

Windows 7 32bit on AnyRun

Okay thanks. I'm curious then what might happen if the same samples were run on Windows 10, 64 bit, with its built-in Defender settings at at Default?

 

[Kongo]

Okay thanks. I'm curious then what might happen if the same samples were run on Windows 10, 64 bit, with its built-in Defender settings at at Default?

It also depends on the browser that is used if the site is blocked or not. The website from where the sample was dropped still is up at the moment, but I think it doesn't have any malicious content anymore as far as I can see (didn't fully check it out). Also the sample wasn't run in that example, he only downloaded the file.

 

[wat0114]

It also depends on the browser that is used if the site is blocked or not. The website from where the sample was dropped still is up at the moment, but I think it doesn't have any malicious content anymore as far as I can see (didn't fully check it out). Also the sample wasn't run in that example, he only downloaded the file.

Of course, that makes sense. I use uBlock Origin extension on Medium mode, with some additional hardening filters, in both Firefox and Ungoogled-Chromium, so I would expect that alone would block it.

 

[Kongo]

Of course, that makes sense. I use uBlock Origin extension on Medium mode, with some additional hardening filters, in both Firefox and Ungoogled-Chromium, so I would expect that alone would block it.

Not sure, as I never really used uBlock Origin before. Does it even have any malware block-listes? However I don't like depending on the web-protection of any extension or security software. NextDNS is great at preventing you from visiting malicious sites by having things like Typosquatting protection and the blocking of newly registered domains (blocks domains that are newer than 30 days).

 

[wat0114]

Not sure, as I never really used uBlock Origin before. Does it even have any malware block-listes?

Yes there are a number of malware block lists that can be used, and then it will block iframes and 3rd-party scripts in Medium mode, along with ads. I might try NextDNS one of these days.

 

[wat0114]

BTW, the reason I asked about the older looking O/S is because I've seent his sort of thing before where testing a latest malware sample was done on an older O/S, and that rather puzzles me; why not test them on the latest O/S, Windows 10 in this case, especially with 64 bit?

 

[Kongo]

BTW, the reason I asked about the older looking O/S is because I've seent his sort of thing before where testing a latest malware sample was done on an older O/S, and that rather puzzles me; why not test them on the latest O/S, Windows 10 in this case, especially with 64 bit?

Cause AnyRun only offers Windows 7 32 bit in the free version. Otherwise you have to pay monthly which is too pricy for an average user I guess...

Subscription Plans - ANY.RUN

Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

app.any.run

 

[wat0114]

Cause AnyRun only offers Windows 7 32 bit in the free version. Otherwise you have to pay monthly which is too pricy for an average user I guess...

Got it, thanks

 

[struppigel]

BTW, the reason I asked about the older looking O/S is because I've seent his sort of thing before where testing a latest malware sample was done on an older O/S, and that rather puzzles me; why not test them on the latest O/S, Windows 10 in this case, especially with 64 bit?

Depends what you mean by testing.
I would not test security products on outdated OS. That would be unfair.
But for analysis I run malware on outdated OS because it increases the likelyhood that I get to see malicious behaviour.

 

[wat0114]

But for analysis I run malware on outdated OS because it increases the likelyhood that I get to see malicious behaviour.

Interesting! This is what I mean; I would have thought it more pertinent to the current effectiveness of the malware to test it on newer O/S' because more people are running Windows 10 than older Windows versions. That said, I understand your reasoning.

 

[silversurfer]

Maybe it's interesting for some people: another free samples analysis service "Triage" there it's possible running samples even on Windows 10 x64

On link below we can see the same sample Scanned-Doc.js time stamp was on the same day (21-04-20) compared to AnyRun posted by @Andy Ful

305c943edc6a19014d64ad5d8709ca362e6289b0acba244eb833da08f96214d7 | Triage

Check this report malware sample 305c943edc6a19014d64ad5d8709ca362e6289b0acba244eb833da08f96214d7, with a score of 7 out of 10.

tria.ge

Below a new analysis done a few minutes ago, as expected, sample doesn't work anymore compared to the first link above from 21-04-20

305c943edc6a19014d64ad5d8709ca362e6289b0acba244eb833da08f96214d7 | Triage

Check this report malware sample 305c943edc6a19014d64ad5d8709ca362e6289b0acba244eb833da08f96214d7, with a score of 4 out of 10.

tria.ge