READ ALSO: Spyware vs. Infostealer – what’s the difference?

The information provided within the current article, including the images, is courtesy of Brad Duncan, an independent cybersecurity analyst, the man behind the malware-traffic-analysis.net blog.

Spam Campaign details

The Meta infostealer malware gets into the victim’s computer. It begins with an email with an attachment. Already a stay-away thing for the experienced ones, but someone might still buy into that. The bait is classic: you have received payment, and there is a little paperwork to be done before getting your money.

After the user downloads the attachment (an excel table within the current campaign,) the file will, just as expected, request allowance to execute macros. The sheets file features a DocuSign image to be more persuasive, although it is unnecessary since it is already downloaded. If the victim consents, enabled scripts (VBS) start downloading stuff from several sources.

The downloaded payload gets encoded with base64 (schemes presenting binary data as text) or undergoes byte reversal. Both methods increase the malware’s chances of passing undetected by antivirus programs. The fetched content constitutes *.dll and *.exe files.

The hacker’s plan succeeds as a malicious executable gets assembled on the victim’s computer, and it starts sending data to the server with 193[.]106[.]191[.]162 address. The file name is ‘qwveqwveqw,’ and it even gets itself a system registry entry. Meta steals passwords for cryptocurrency wallets and web browsers, namely Chrome, Firefox, and Edge. By the way, Meta alters PowerShell and Windows Security settings, excluding *.exe files from antivirus examination.

Brief information on Meta malware

The hacker community quickly reacted to the suspension of Raccoon Stealer malware. Its operators stopped selling and supporting the tool as one of the developers became a victim of the war in Ukraine. Meta, advertised as the successor of RedLine, is one of several stealers that arrived to occupy the vacant niche. Its monthly price on the 2Easy botnet marketplace is $125 and a lifetime subscription costs $1000. For a more thorough analysis of the Meta malware, consider reading the original report by Brad Duncan on the Internet Storm Center security forum.

RELATED: Why is the 2easy trading platform gaining popularity?

The post Meta Infostealer Malware Spread via Spam appeared first on Gridinsoft Blog.

The idea is based on the use of RFC791 standard. Researchers remind that, for example, https://google.com is the same as https://216.58.199.78, it’s just the first option that is easier to remember.

“Technically, an IP address can be represented in several formats and therefore can be used in a URL in a variety of ways”, — explain Trustwave researchers.

For example, any IP address can be written in other formats, including:

• octal IP address: https://0330.0072.0307.0116;
• hexadecimal IP address: https://0xD83AC74E;
• integer or DWORD IP address: https://3627730766.

This feature uses spammer, who have been using hexadecimal IP addresses in their mailings since July this year. While browsers understand these formats and direct the user to google.com anyway, as in the example above, many spam filters stop “seeing” dangerous URLs because of this.

“Any threat actor equipped with this knowledge can craft an obscure-looking URL like the ones shown above and send it via email with a convincing message to deceive the email gateway and the victim and lure them to click and open a site controlled by the attacker”, — write Trustwave researchers.

Experts note that since the start of this trick, the activity of the enterprising spam group has markedly increased, as much more spam began to fall into user inboxes. At the peak of the campaign, scammers sent out about 25,000 letters. Spammers advertised various drugs to lower cholesterol, antifungal, anti-aging, anti-inflammatory drugs, medical masks, UV lamps, as well as all kinds of dietary supplements.

Interestingly, this is not the first such case discovered by information security specialists.

For example, last summer, Proofpoint experts talked about the PsiXBot Trojan, whose operators also used hexadecimal IP addresses to hide the location of their control servers.

Find out better how spam works in our blog post: Spam Email. What Do Spammers Hope For?

The post Spammers hide behind hexadecimal IP addresses appeared first on Gridinsoft Blog.

The new infection method involves the use of spam emails that contain a link to a malicious website. When a user clicks on the link, it downloads a file that appears to be a PDF document but is actually an executable file that installs the Smoke Loader malware on the computer.

Once installed, the malware can steal sensitive information from the infected computer, such as login credentials, banking information, and personal data. It can also download additional malware, making the infection even more dangerous.

Smoke Loader is designed to evade detection by traditional antivirus software. It uses a variety of obfuscation and encryption techniques to hide its presence on the infected computer.

To protect yourself from this type of malware, it is important to be cautious when clicking on links or downloading files from unknown sources. You should also ensure that your antivirus software is up-to-date and that you are using a firewall to block incoming traffic.

IoC Smoke Loader

• Trojan.Win32.SmokeLoader.bot: a7f605d4110bba430e02c7c5240e656fb3f1dd7f02dce985e9e5677169c9de55
• Trojan.Win32.SmokeLoader.bot: cc58ad1f7a097f077f06b78e21c1f5a01007cd98613b602bb22b95751920ba80
• Trojan.Win32.SmokeLoader.bot: 143310670009099214b1b1a812e98a485db3e2879ab35dca8ba63005a62a610c
• Trojan.Win32.SmokeLoader.bot: 980a736f3c959e814619ab185cf89fd17a930774f11aa06ca79e263be6d077c9
• Trojan.Win32.SmokeLoader.bot: 109d9077e847550b471e717986dec00400d4a49cccf438a462ec9630eda654c5
• Trojan.Win32.SmokeLoader.bot: 0c1f4caa4168d458ffedcd65213253b42d972964ea78d042d4c560d8a71973bc
• Trojan.Win32.SmokeLoader.bot: 47c6cee60f89a6562df66731d25bb8992e1b4cf125d871895808946fa69a501e

If you believe that your computer may be infected with Smoke Loader or any other malware, you should immediately disconnect it from the internet and run a full system scan with your antivirus software. You should also change any passwords that may have been compromised and monitor your bank accounts and credit card statements for any suspicious activity.

In conclusion, the discovery of this new infection method for Smoke Loader is a reminder of the ongoing threat posed by malware and the importance of taking proactive measures to protect your computer and personal information. By following best practices for online security and staying vigilant, you can help minimize the risk of falling victim to these types of attacks.

The post Smoke Loader Malware: New Password-Stealing Infection Method appeared first on Gridinsoft Blog.