Varenyky

This spambot will send emails using the SMTP protocol through port 25 and only targets the customers of the French ISP Orange.

One month later, in June 2019, we saw the first malicious document that initiates the infection of the victim’s computer, attached to an email message.

That email states that a bill of €491.27 is available and attached. The Microsoft Word document filename contains the word “facture” which is a French word for “bill”.

Early versions of the malware could receive a command to download a file and execute it. The malware was able to handle executable files, batch files and PowerShell scripts.

The malware was able to handle executable files, batch files and PowerShell scripts. Support for the last was later removed.

The macro contained in the Word document has two purposes: the first is to filter out non-French victims based on their computers’ locale and the second is to download and execute the malware.

The content of the document explains how to enable the “human verification”, which, in fact, is how to enable macros.

It also makes itself persistent by adding an entry to HKLM\Software\Microsoft\Windows\CurrentVersion\Run in the Windows Registry.

They are extracted, injected into another executable and run once to steal the victim’s passwords, which are then exfiltrated to the C&C server.

It also makes itself persistent by adding an entry to HKLM\Software\Microsoft\Windows\CurrentVersion\Run in the Windows Registry.

The custom unpacker will first XOR its payload with a 32 character-long alphanumeric string and then decompress it using the LZNT1 algorithm.

They are extracted, injected into another executable and run once to steal the victim’s passwords, which are then exfiltrated to the C&C server.

The custom unpacker will first XOR its payload with a 32 character-long alphanumeric string and then decompress it using the LZNT1 algorithm.

This is a good trick to fool automatic sample analyzers and to avoid drawing attention because of the limited number of computer configurations on which this malware will be installed.

This is a good trick to fool automatic sample analyzers and to avoid drawing attention because of the limited number of computer configurations on which this malware will be installed.

It creates a mutex named with this same hash to avoid two instances running at the same time.

A new command was later added, allowing the malware to deploy NirSoft’s WebBrowserPassView and Mail PassView tools.

These are password recovery tools for web browser and email client passwords.

These are password recovery tools for web browser and email client passwords.

This is a good trick to fool automatic sample analyzers and to avoid drawing attention because of the limited number of computer configurations on which this malware will be installed.

This is a good trick to fool automatic sample analyzers and to avoid drawing attention because of the limited number of computer configurations on which this malware will be installed.

The macro uses the function Application.LanguageSettings.LanguageID() to get the language ID of the victim’s computer.

It creates a mutex named with this same hash to avoid two instances running at the same time.

The malware would record the computer’s screen using an FFmpeg executable that it previously would have downloaded through the Tor network.

The malware can be directed to start various applications that have a graphical interface... navigating menus, reading text, taking screenshots, clicking on the screen

All communication to the C&C is done through Tor at jg4rli4xoagvvmw47fr2bnnfu7t2epj6owrgyoee7daoh4gxvbt3bhyd.onion using the HTTP protocol.

communication to the C&C server is done through Tor

Early versions of the malware could receive a command to download a file and execute it.

the victim’s passwords, which are then exfiltrated to the C&C server