Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1082488" data-attributes="member: 32260">WHHLight vs. VenomRAT campaign (delivered via SVG attachment)[URL unfurl=&quot;true&quot;]https://malwaretips.com/threads/attackers-using-obfuscation-tools-to-deliver-multi-stage-malware-via-invoice-phishing.130253/post-1082458[/URL][URL unfurl=&quot;true&quot;]https://thehackernews.com/2024/04/attackers-using-obfuscation-tools-to.html[/URL]Attack flow (initial phase):Phishing email with SVG attachment&nbsp; -------&gt; user opens the SVG attachment -------&gt; ZIP archive downloaded with embedded Batch script (BatCloak) -------&gt; user opens the archive and runs the script -------&gt;&nbsp; another Batch script is created and executed (ScrubCrypt)&nbsp; --------&gt;&nbsp; two EXE payloads are decoded/dropped/executed -------&gt; UAC bypass + VenomRat ------&gt; .....The default SWH settings block the attack (Batch scripts are blocked). The attack could be also blocked at the later infection stage because the malware uses PowerShell method invocations and types blocked by Constrained Language Mode :[Text.encoding]::UTF8.getstring()[System.Security.Cryptography.Aes]::Create()[System.Reflection.Assembly]::Load()New-Object System.IO.MemoryStreamNew-Object System.IO.Compression.GzipStreamThe full attack includes additional malicious plugins (NanoCore, XWorm, Remcos, Stealer):[ATTACH=full]282702[/ATTACH]</blockquote>

[QUOTE="Andy Ful, post: 1082488, member: 32260"] [B][SIZE=5]WHHLight vs. VenomRAT campaign (delivered via SVG attachment)[/SIZE][/B] [URL unfurl="true"]https://malwaretips.com/threads/attackers-using-obfuscation-tools-to-deliver-multi-stage-malware-via-invoice-phishing.130253/post-1082458[/URL] [URL unfurl="true"]https://thehackernews.com/2024/04/attackers-using-obfuscation-tools-to.html[/URL] [B][COLOR=rgb(184, 49, 47)]Attack flow (initial phase):[/COLOR] Phishing email with SVG attachment -------> user opens the SVG attachment -------> ZIP archive downloaded with embedded Batch script (BatCloak) -------> user opens the archive and runs the script -------> another Batch script is created and executed (ScrubCrypt) --------> two EXE payloads are decoded/dropped/executed -------> UAC bypass + VenomRat ------> ..... [COLOR=rgb(0, 168, 133)]The default SWH settings block the attack (Batch scripts are blocked). [/COLOR][/B] The attack could be also blocked at the later infection stage because the malware uses PowerShell method invocations and types blocked by Constrained Language Mode :[Text.encoding]::UTF8.getstring() [System.Security.Cryptography.Aes]::Create() [System.Reflection.Assembly]::Load() New-Object System.IO.MemoryStream New-Object System.IO.Compression.GzipStream The full attack includes additional malicious plugins (NanoCore, XWorm, Remcos, Stealer): [ATTACH type="full" alt="1712700849088.png"]282702[/ATTACH] [/QUOTE]

Verification