Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1014075" data-attributes="member: 32260">Babuk Ransomware[URL unfurl=&quot;false&quot;]https://blog.morphisec.com/babuk-ransomware-variant-major-attack[/URL][URL unfurl=&quot;false&quot;]https://malwaretips.com/threads/new-babuk-ransomware-found-in-major-attack.119159/post-1014058[/URL]In the wild, the company domain controller was finally attacked by delivering two files BAT and MSI. Execution of the BAT file started the infection chain.The same infection vector can be used in widespread attacks by using archives, ISO images, etc., which can be containers for BAT and MSI files. For example:ISO (with embedded MSI and (or ) BAT) -------&gt;MSI execution&nbsp; -----&gt;files dropped to the disk: Legit EXE&nbsp; + &quot;malicious&quot; DLL + encrypted shellcode + encrypted payloads -----&gt;DLL hijacking&nbsp; ------&gt;shellcode + payload decrypted and executed in the memory of the legit EXE (no child processes).The DLL used in the attacks is often not-truly-malicious - it cannot do any harm without encrypted shellcode or encrypted payloads.MSI files can run scripts, so the essential code of the initial BAT file can be embedded in the MSI. Such a method has been used in the wild (Batloader, Zloader, etc.):[URL unfurl=&quot;true&quot;]https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html[/URL]Post edited.</blockquote>

[QUOTE="Andy Ful, post: 1014075, member: 32260"] [B]Babuk Ransomware[/B] [URL unfurl="false"]https://blog.morphisec.com/babuk-ransomware-variant-major-attack[/URL] [URL unfurl="false"]https://malwaretips.com/threads/new-babuk-ransomware-found-in-major-attack.119159/post-1014058[/URL] In the wild, the company domain controller was finally attacked by delivering two files BAT and MSI. Execution of the BAT file started the infection chain. The same infection vector can be used in widespread attacks by using archives, ISO images, etc., which can be containers for BAT and MSI files. For example: ISO (with embedded MSI and (or ) BAT) -------> MSI execution -----> files dropped to the disk: Legit EXE + "malicious" DLL + encrypted shellcode + encrypted payloads -----> DLL hijacking ------> shellcode + payload decrypted and executed in the memory of the legit EXE (no child processes). The DLL used in the attacks is often not-truly-malicious - it cannot do any harm without encrypted shellcode or encrypted payloads. MSI files can run scripts, so the essential code of the initial BAT file can be embedded in the MSI. Such a method has been used in the wild (Batloader, Zloader, etc.): [URL unfurl="true"]https://blogs.vmware.com/security/2022/11/batloader-the-evasive-downloader-malware.html[/URL] Post edited. [/QUOTE]

Verification