VileDropper

Back in the summer of 2020, DeathStalker’s VileRAT initial infection consisted in spear-phishing emails sent to foreign exchange companies... More recently... the initial infection vector is still a malicious message: a Word document (DOCX) is sent to targets via email.

the DOTM-embedded macro silently gathers information about security products that are installed on the target computer (using WMI)... VileDropper... gathers additional data on the targeted environment (using WMI).

VileDropper... schedules a task to run VileLoader 35 to 65 seconds later, then indefinitely every three hours and 45 minutes... VileRAT functionalities include... Setting up persistence using scheduled tasks.

The malicious DOTM remote templates leverage the VBA stomping technique to conceal the code of an embedded macro... the DOTM-embedded macro silently gathers information... decodes and drops files, then ultimately executes a malicious obfuscated JavaScript (JS) backdoor we called VileDropper.

the DOTM-embedded macro... ultimately executes a malicious obfuscated JavaScript (JS) backdoor we called VileDropper... msgmft.exe /E:jScrIpt "\changelog.txt" 91 pattern.txt

These DOTM files are automatically downloaded by Word when the DOCX is opened, and its embedded macro is triggered if the recipient enabled execution.

VileDropper... schedules a task to run VileLoader 35 to 65 seconds later, then indefinitely every three hours and 45 minutes... VileRAT functionalities include... Setting up persistence using scheduled tasks.

VileDropper... schedules a task to run VileLoader 35 to 65 seconds later, then indefinitely every three hours and 45 minutes... VileRAT functionalities include... Setting up persistence using scheduled tasks.

It is lightly obfuscated, as most text strings are XOR-encoded... VileDropper is an obfuscated JavaScript file... the first stage of VileRAT has been obfuscated at the Python bytecode-level, with the intention of breaking existing decompilers.

a Windows shortcut file masquerading as a PDF... using a renamed copy of the “WScript” interpreter (“msdcat.exe” or “msgmft.exe” in the “%APPDATA%” folder)... files are placed under a seemingly legitimate common folder in “%APPDATA%”.

the DOTM-embedded macro finally triggers VileDropper’s execution, using a renamed copy of the “WScript” interpreter (“msdcat.exe” or “msgmft.exe” in the “%APPDATA%” folder)

The initial DOCX infection document itself is innocuous, but it contains a link to another malicious and macro-enabled DOTM document as a “remote template”. These DOTM files are automatically downloaded by Word when the DOCX is opened.

The malicious DOTM remote templates leverage the VBA stomping technique to conceal the code of an embedded macro... the real macro code that will be executed is hidden from standard tools.

the DOTM-embedded macro silently gathers information about security products that are installed on the target computer... VileDropper: gathers additional data on the targeted environment... The JSON that is passed to the C2 server can be broken down as follows... host, uname, Windows version.

the DOTM-embedded macro silently gathers information about security products that are installed on the target computer (using WMI)... VileRAT functionalities include: Listing security solutions that are installed on the target computer.

The useful information is stored as a JSON document... and set as a cookie value in the HTTP request... VileLoader stage 2 sends an HTTP POST request with a cookie whose value is a XORed JSON dictionary.

VileDropper sends data to a C2 server using an HTTP GET request... VileLoader’s second stage builds an HTTP GET request... VileRAT tries to send an HTTP POST request to each of the C2 servers that exist in its configuration.

The useful information is stored as a JSON document, which is then XOR-encoded, base64-encoded, URL-encoded... The encrypted blob (cookie value) is initially a JSON dictionary, encrypted with the RC4 algorithm, XORed, base64-encoded and URL-encoded.