(Image from Pixabay)
Researchers at Malwarebytes discovered a malware that targets a vulnerability in Flash Player. The attackers resort to malvertising in adult sites to lure victims, whom they suspect are from Asian countries based on the advertisements used, to the exploit kit landing page.
Behind the supposedly online dating service is a malicious iframe that spreads the malware.
The researchers call the attack as a “drive-by download.” They noticed something unusual from the existing exploitation framework they are monitoring ” as referenced in late 2017 by Chinese security firm Qihoo360.”
The criminals are using “encryption to package exploits on-the-fly.” A key is needed from the server to be able to decrypt and execute the malware. The researchers also noted that the payload served is unusual “because it is not a standard PE file. Instead, it is a multiple-stage custom executable format, acting also as a downloader to retrieve LUA scripts used by the threat actors behind the Hidden Bee miner botnet. This was perhaps the first case of a bootkit being used to enslave machines mining cryptocurrencies.”
Exploit kits makes their landing page and exploits unintelligible or confusing. But for this exploit, the criminals decided to use encryptions and key exchange with the backend server to be able to deploy the malware. They use the block Base64 which is encoded and encrypted with RC4 and Rabbit algorithms that started from a webpage.
The attackers use their own private RSA key to decrypt the server.
“However, researchers who just have the traffic captured cannot retrieve the original session key, and replaying the exploit is impossible. Thankfully, we managed to capture the exploit during dynamic analysis,” the researchers in Malwarebytes noted.
They also said that the newer Flash exploit was not part of the exploit toolkit the Qihoo documented.
The researchers consider this as a sophisticated attack for its use of multiple technologies in the exploit delivery and payload package. “According to our telemetry, we believe it is also focused on a select few Asian countries, which makes sense when taking its payload into consideration,” they said.
There has been a slowdown in the use of exploit kits but the actors are persistent as evidenced by this latest attack.
[…] View Full Story […]
[…] View Full Story […]
[…] “Hidden Bee” Miner Uses Malvertising To Lure Victims (August 8, 2018)Security researchers at MalwareBytes found a malware that specifically targets a vulnerability in Flash Player to target victims from Asian countries. The attackers use malvertising on adult sites to redirect them to an exploit kit landing page to then install a cryptomining bot. This campaign does not use a standard PE file for the payload, and instead uses a multiple-stage custom executable format to download retrievable LUA scripts. The exploit kit uses encryptions and key exchanges with the backend server to be able to deploy their malware on the target’s machine. They utilise block Base64 that is encrypted with RC4 and Rabbit algorithms. Since the malware is encrypted, the threat actors use their own private RSA key to decrypt the server. It is noted that despite a reduction in threat actors employing exploit kits to conduct malware campaigns, some actors are still adapting them in order to continue to conduct similar attacks.Click here for Anomali recommendation […]