Rewterz Threat Alert – Malspam campaign dropping XpertRAT Malware via ISO images

Severity

Medium

Analysis Summary

An email campaign spreading XpertRAT via ISO images with advanced anti-analysis techniques. The phishing email in this campaign mimics a well-known Italian manufacturing company. Attached is an ISO file packed with a Delphi packer, which the researchers note will mount natively to the file system if it is running Windows 8 or above. The malicious payload is stored in the resource section of the ISO as encrypted data. Before the final payload is executed on the system, the malware performs a series of checks for anti-analysis purposes. First, it checks for whether a debugger is attached to the malicious process. Then it checks for cursor movements, indicating real user activity. Next, it checks information about the CPU in order to identify whether the system is running on a hypervisor. The list of running processes is then checked for analysis tools or anti-malware products. Finally, the file path of the EXE is checked for keywords, such as “sandbox”, “sample”, and more. If all the checks are successful, the final payload is injected into a new “iexplore.exe” process. This payload was identified to be XpertRAT. Once it has been installed and has established persistence, it attempts to communicate with its C2.

Impact

• Keylogging
• Command execution

Indicators of Compromise

IP(s) / Hostname(s)

216[.]38[.]2[.]211

URLs

thisurl[.]doesntexist[.]com

Filename

po-ima0948436.exe

Malware Hash (MD5/SHA1/SH256)

• 3fec3cfb179c80e16c68c79b17970e8cb1f1470cd3b786bfc70f91e0632d0208
• 3c249ea5120fdccc8254db0e0fe8a91e21a9d3d53d90a264a34278f13b1796fe

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the link/attachments sent by unknown senders.