Spam campaign: Netwire RAT via paste.ee and MS Excel to German users

[struppigel]

Content source

https://www.gdatasoftware.com/blog/netwire-rat-via-pasteee-and-ms-excel

My writeup of a Netwire spam campaign targeting Germany yesterday.

Spam campaign delivers Netwire RAT via paste.ee to German users

G DATA discovered an email spam campaign in Germany that delivers NetWire RAT via PowerShell in Excel documents. The emails mimick the German courier, parcel and express mail service DHL.

www.gdatasoftware.com

At noon on 13. April 2020 our monitoring system created an alert because DeepRay reported more hits than usual for one particular detection on PowerShell downloaders. The alarm system is there to see early if something goes wrong. However, this alarm went off because of a spam campaign hitting our German customers. The detections were all legitimately preventing the malware downloader from doing it's job.

We investigated the threat and also found BEAST-related entries which showed that the culprit were Excel documents delivered by email. While we do not receive the Excel or email documents themselves, we do see infection chains reported by BEAST for those customers that agreed to the Malware Information Initiative (Mii).

...

 

[upnorth]

Possible similar file shared in MTs malware Hub.

https://malwaretips.com/threads/trojan-downloader-13-05-2020.100933/

 

[struppigel]

Possible similar file shared in MTs malware Hub.

https://malwaretips.com/threads/trojan-downloader-13-05-2020.100933/

I have no access to those files.

 

[upnorth]

I have no access to those files.

I thought you had VT access. I'm sending you a PM instead and I'll help you there.

 

[struppigel]

I thought you had VT access. I'm send you a PM instead and I'll help you there.

Yes, I have VT access.
I didn't know you included VT. I just saw previous posts in this section and saw that I don't have access there.

 

[upnorth]

Yes, I have VT access.
I didn't know you included VT. I just saw previous posts in this section and saw that I don't have access there.

Click on the blue spoiler button where it says " VirusTotal ".

 

[struppigel]

Possible similar file shared in MTs malware Hub.

https://malwaretips.com/threads/trojan-downloader-13-05-2020.100933/

ee51b288d09fe254acd6c444a04128125d7ee22241850ba85a18b0e9e111974b seems to be related, yes.

 

[struppigel]

Confirmed related @upnorth

 

[upnorth]

Thanks for the help @struppigel . Much appreciated!