SynkLoader

The malware attempts to phish the user’s system login credentials by creating a fake lock screen.

By obtaining the password, the attackers could use it alongside the tunneling module to access corporate environments from the infected device, bypassing IP allow-list restrictions.

A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen.

Persistence Module — Creates a randomly named scheduled task that launches SynkLoader at user logon and daily at 10 a.m.

Interactive Shell (RAT) — Allows attackers to remotely execute PowerShell commands and receive their output.

The installer extracts a PowerShell script named cleaner.ps1

The installer extracts... a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries

the attacks direct the victim to install a fake “PowerShell Cleaner” executable (.MSI) hosted in Microsoft Azure

The DLL itself installs the task by leveraging the COM (Component Object Module) interface... By using the COM provider CLSID_TaskScheduler with RIID IID_ITaskService

Persistence Module — Creates a randomly named scheduled task that launches SynkLoader at user logon and daily at 10 a.m.

By obtaining the password, the attackers could use it alongside the tunneling module to access corporate environments from the infected device, bypassing IP allow-list restrictions.

Persistence Module — Creates a randomly named scheduled task that launches SynkLoader at user logon and daily at 10 a.m.

By obtaining the password, the attackers could use it alongside the tunneling module to access corporate environments from the infected device, bypassing IP allow-list restrictions.

The command uses the -join [char[]] expression to build a string from hex encoded values... the command contains a Base64 encoded AES-CBC encrypted string.

The attacker impersonates the target company's IT help desk... attacks direct the victim to install a fake “PowerShell Cleaner” executable (.MSI) hosted in Microsoft Azure, making the download appear trustworthy.

By obtaining the password, the attackers could use it alongside the tunneling module to access corporate environments from the infected device, bypassing IP allow-list restrictions.

The second DLL, this time a native DLL, is a manual DLL loader. It enables the Python script to manually map DLLs into memory without them touching the disk

System Profiler — Collects the hostname, username, privilege level, running processes, services

System Profiler — Collects... number of computers in Active Directory.

'username': command('whoami', dll) ... 'whoami': command('whoami /all', dll)

System Profiler — Collects the hostname, username, privilege level, running processes, services

System Profiler — Collects the hostname, username, privilege level, running processes, services, domain details

System Profiler — Collects the hostname, username, privilege level, running processes, services, domain details

TrafficRedirector — Creates a reverse proxy that lets attackers reach internal network services

The loader randomly chooses 1 of 3 hardcoded C2 domains ... then builds the full URL using the format https://<random_domain>/<token_1>/<victim_id>/<token2>

TrafficRedirector — Creates a reverse proxy that lets attackers reach internal network services or route internet traffic through the infected computer.

StreamMaster (VNC) — Streams the victim’s desktop and enables remote mouse and keyboard control of the active session.