Security researchers observed a new campaign targeting financial institutions and governmental organizations with a customized version of a remote access tool called “Proyecto RAT”.
The payload found to be written in Visual Basic 6 and it uses Disposable E-mail Address service yopmail for its C&C communication. The yopmail is known for creating temporary inboxes.
Infection Process
According to the Trend Micro report, the attack primarily targets the organizations in the South American region, particularly in Colombia. The infection starts with a customized email sent to the target from open or compromised mail servers in the South America region.
The Email contains an RTF attachment file and contains tempting subjects
- “Hemos iniciado un proceso en su contra por violencia laboral.” (Loosely translates to “We have filed a lawsuit against you for workplace violence.”)
- “Se hara efectivo un embargo a su(s) cuenta(s) Bancarias.” (Loosely translates to “Your banking accounts are going to be blocked.”)
- “Almacenes exito te obsequia una tarjeta regalo virtual por valor de $500.000.” (Loosely translates to “Exito shops offer you a virtual gift worth $500.000.”)
The attachment contains shorten links that direct victims to file-sharing services, the delivery file is a macro-enabled MHTML file. The macrocode is responsible for downloading and executing the first stage payload Imminent Monitor RAT.
As the name indicates it monitors all the network activities and includes information for executing the second-stage payload. The Imminent Monitor RAT supports a wide range of monitoring activities that include spying on keyboards, File transfer, Grabbing screenshots and recording audio feeds.
Second Stage Payload – Proyecto RAT
The second stage of the payload is the “Proyecto RAT” which uses a disposable yopmail email service for C&C communication.
Based on the Trend Micro analysis report, “the malware connects to a mailbox, reads the only available email message, parses it, and then extracts the subject of the email. The C&C server URL is between the ‘¡’ characters, a character used in the Spanish language and tree email boxes has been used.”
Researchers believe that “Proyecto RAT” “is an old and limited version of the Xpert RAT — either a custom modification of Xpert RAT or malware with source code based on Xpert RAT’s.”
The attacks target South American and Colombia is the most targeted country, followed to the campaign, the recent campaigns appeared to be targeting government entities, healthcare/pharmaceutical institutions, agro-industry/food/packaging organizations.
Related Read
