Reply to thread

Message

<blockquote data-quote="Andy Ful" data-source="post: 1093024" data-attributes="member: 32260">WHHLight vs. ViperSoftX campaign[URL unfurl=&quot;true&quot;]https://thehackernews.com/2024/07/vipersoftx-malware-disguises-as-ebooks.html[/URL][ATTACH=full]284248[/ATTACH]&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Rar folder contentAttack flow:Torrent link ---&gt;&nbsp; ebook RAR archive ----&gt; user executes Shortcut File ----&gt; cmd[.]exe ----&gt; powershell.exe&nbsp; ----&gt; malicious AutoIt script&nbsp; (AMSI bypass + malicious PowerShell code)&nbsp; ----&gt; payloads decoded/executed -----&gt; Command and Control (C2)The initial execution of LOLBins cmd[.]exe and powershell.exe does not include malicious commands. The malicious PowerShell code is executed via AutoIt without using powershell.exe and without AMSI support. The connection with the Command and Control (C2) server cannot be prevented by blocking the connections of powershell.exe in the firewall.WHHLight prevents this malware by blocking the Shortcut File (SWH settings). However, the infection can also be mitigated by applying PowerShell Constrained Language Mode (also included in SWH settings). Like many other info-stealers, this malware decodes payloads using types unsupported in that language mode.</blockquote>

[QUOTE="Andy Ful, post: 1093024, member: 32260"] [B][SIZE=5]WHHLight vs. ViperSoftX campaign[/SIZE][/B] [URL unfurl="true"]https://thehackernews.com/2024/07/vipersoftx-malware-disguises-as-ebooks.html[/URL] [ATTACH type="full" width="658px" alt="1720723333866.png"]284248[/ATTACH] [SIZE=4] Rar folder content[/SIZE] [B][COLOR=rgb(184, 49, 47)]Attack flow:[/COLOR][/B] [COLOR=rgb(0, 168, 133)]Torrent link ---> ebook RAR archive ----> user executes [B]Shortcut File [/B]----> cmd[.]exe ----> powershell.exe[/COLOR] ----> [COLOR=rgb(184, 49, 47)]malicious AutoIt script (AMSI bypass + malicious PowerShell code) ----> payloads decoded/executed -----> Command and Control (C2)[/COLOR] The initial execution of LOLBins cmd[.]exe and powershell.exe does not include malicious commands. The malicious PowerShell code is executed via AutoIt without using powershell.exe and without AMSI support. The connection with the Command and Control (C2) server cannot be prevented by blocking the connections of powershell.exe in the firewall. WHHLight prevents this malware by blocking the Shortcut File (SWH settings). However, the infection can also be mitigated by applying PowerShell Constrained Language Mode (also included in SWH settings). Like many other info-stealers, this malware decodes payloads using types unsupported in that language mode. [/QUOTE]

Verification