Malware News This worm spreads a fileless version of the Trojan Bladabindi

[silversurfer]

Content source

https://www.zdnet.com/article/this-worm-spreads-fileless-trojan-bladabindi-through-removable-drives/

According to researchers from Trend Micro, the worm spreads Bladabindi -- also known as njRAT/Njw0rm -- in a fileless form by propagating through removable drives and storage.

In a blog post on Tuesday, the cybersecurity team said Bladabindi has been recompliled, refreshed, and rehashed for years, leading to its presence in countless cyberespionage campaigns.

The worm which is now spreading a modern variant of Bladabindi is detected as Worm.Win32.BLADABINDI.AA.

Bladabindi hides a copy of itself on any removable drives connected to an infected system and will also create a registry entry called AdobeMX to maintain persistence. This entry will execute a PowerShell script to load the malware via reflective loading.

This loading technique is what makes the malware fileless. By loading from an executable hidden in memory rather than a system disk, this can make detection by traditional antivirus software more difficult to achieve.

 

[509322]

It says in the Trend Micro report:

Restrict and secure the use of removable media or USB functionality, or tools like PowerShell (particularly on systems with sensitive data), and proactively monitor the gateway, endpoints, networks, and servers for anomalous behaviors and indicators such as C&C communication and information theft.

* * * * *

Gee, thanks Microsoft for making Windows so trivial to smash.

 

[Andy Ful]

The malicious code in Autoit creates a standard shortcut in the root of the removable drive, that points to the executable hidden on the same drive in SSS folder. So, the infection is not automatic, it requires running the shortcut by the user. The propagation scenario is pretty standard.
The fileless execution idea and persistence method have been known known since the Poweliks trojan. It is only slightly modificated, because the malware uses PowerShell to get the .NET Framework class System.Reflection.Assembly, which loads the malicious code from the Registry key to PowerShell memory and next the code is executed (filelessly).
The malc0ders used AutoIt to compile the encoded payload and the main script, into a single executable. This can be harder to detect by non-signature AV modules. Such technique was used in the past to hide the python ransomware in the InnoSetup installer.
Generally, that sort of malware can be stopped by applying Constrained Language Mode to PowerShell or restricting the execution from removable drives.