Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 973380" data-attributes="member: 32260">Post updated.SWH vs. new sophisticated campaign delivery of AsyncRAT trojan[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/hackers-using-new-evasive-technique-to-deliver-asyncrat-malware.112162/[/URL][URL unfurl=&quot;true&quot;]https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign[/URL]Infection chain (delivery stage in blue):email with HTML attachment ---&gt; ISO created ---&gt; BAT or VBS script ---&gt; PowerShell ---&gt; fileless payloads<s>Depending on SWH settings, the infection chain can be stopped at the delivery stage by blocking the ISO file (non-default setting).</s> The infection chain can be blocked by blocking BAT or VBS scripts (blocked by default). So, despite the advanced tactics, the attack is fully neutralized. After running PowerShell, the malware would also try to use UAC bypass, add exclusions to Defender, and disable action center notifications.Edit.Unfortunately, the opening of the ISO files is managed by the Windows built-in handler that does not support SRP.But, ISO files can be still protected by SRP when they are opened by 3rd party applications like WinISO or Deamon Tools.</blockquote>

[QUOTE="Andy Ful, post: 973380, member: 32260"] Post updated. [B][SIZE=5]SWH vs. new sophisticated campaign delivery of AsyncRAT trojan[/SIZE][/B] [URL unfurl="true"]https://malwaretips.com/threads/hackers-using-new-evasive-technique-to-deliver-asyncrat-malware.112162/[/URL] [URL unfurl="true"]https://blog.morphisec.com/asyncrat-new-delivery-technique-new-threat-campaign[/URL] [B]Infection chain [/B](delivery stage in blue): [B][COLOR=rgb(41, 105, 176)]email with HTML attachment ---> ISO created ---> BAT or VBS script ---> [/COLOR][COLOR=rgb(184, 49, 47)]PowerShell ---> fileless payloads[/COLOR][/B] [S]Depending on SWH settings, the infection chain can be stopped at the delivery stage by blocking the ISO file (non-default setting).[/S] The infection chain can be blocked by blocking BAT or VBS scripts (blocked by default). So, despite the advanced tactics, the attack is fully neutralized. After running PowerShell, the malware would also try to use UAC bypass, add exclusions to Defender, and disable action center notifications. Edit. Unfortunately, the opening of the ISO files is managed by the Windows built-in handler that does not support SRP. But, ISO files can be still protected by SRP when they are opened by 3rd party applications like WinISO or Deamon Tools. [/QUOTE]

Verification