SambaSpy

Then the user is redirected to a malicious website... This server provided an HTML page containing JS code... It redirects users to a malicious OneDrive URL but only if they are running Edge, Firefox, or Chrome with their language set to Italian.

The threat actors behind this infection chain cluster relies on invoice-themed phishing for initial access and delivers a .jar file which corresponds to a version of Sorillus RAT.

As observed by our CyberSOC, the infection chain is initiated by a phishing email encouraging the recipient to settle a payment... The email in French contains a PDF attachment masquerading as an invoice, titled “Facture.pdf”.

The file contains a Stream Object that, when clicked upon, opens a OneDrive view link on Edge.

Upon analysis, our reverse engineers identified the following capabilities: Running commands Using WMI (Windows Management Instrumentation)

The threat actors behind this infection chain cluster relies on invoice-themed phishing for initial access and delivers a .jar file...

In some cases, we also observed an intermediary VBS loader being used.

A class is supplied to the RAT and loaded using URLClassLoader to open a file on the disk previously downloaded by the RAT. It then invokes the addURL() method in the loaded class.

Depending on its configuration, upon execution, the JAR file attempts to create a persistence mechanism, adding a registry subkey and setting its value to execute the JAR file under another name with javaw.exe.

The shellcode is likely generated using the open-source tool Donut and uses this technique for code injection.

Depending on its configuration, upon execution, the JAR file attempts to create a persistence mechanism, adding a registry subkey and setting its value to execute the JAR file under another name with javaw.exe.

The content of these classes is obfuscated using the characters “[Il]{5,}”... Strings are arbitrarily ciphered using three methods: Encryption with the “blowfish” key, DES encryption XOR encryption

The ZIP contained a HTML file smuggling a JAR file with the RAT binary.

In our case, the file masqueraded as a PNG image file (1741159637278.png).

The shellcode is likely generated using the open-source tool Donut and uses this technique for code injection.

The dropper observed by Kaspersky checks out if it runs in a VM environment as well as the language of the machine, before executing the malware embedded in the resources of the JAR file.

The server then performs checks on the victim’s browser and language settings to determine whether to proceed with the next stage of the infection.

Logging keystrokes

The RAT can steal credentials from major browsers including Chrome, Edge, Opera, Brave, Iridium and Vivaldi.

It redirects users to a malicious OneDrive URL but only if they are running Edge, Firefox, or Chrome with their language set to Italian.

Managing processes (list, kill, etc.)

Collecting system information (running processes, screen size, hardware details) on Mac, Linux, and Windows

Accessing and modifying the file system

The dropper observed by Kaspersky checks out if it runs in a VM environment as well as the language of the machine, before executing the malware embedded in the resources of the JAR file.

The server then performs checks on the victim’s browser and language settings to determine whether to proceed with the next stage of the infection.

It redirects users to a malicious OneDrive URL but only if they are running Edge, Firefox, or Chrome with their language set to Italian... The downloader runs some checks... It then checks that the environment is set to Italian again and if not, exits.

Logging keystrokes

Capturing screenshots and screen videos

Reading the clipboard contents

Recording audio from the microphone

Taking pictures with the machine’s webcam Recording webcam videos

Creating ZIP files to be exfiltrated

Downloading and uploading files over HTTP

Downloading and uploading files over HTTP

SambaSpy implements a custom remote control system. It uses the Java Abstract Window library’s Robot class to control the mouse and keyboard from the system, along with the GraphicsDevice class to provide a screen display under the attacker’s control.

It also encrypts its communications with the C2, complicating analysis