Emotet Botnet Distributing Self-Unlocking Password-Protected RAR Files to Drop Malware

The infamous Emotet botnet has been connected to a new wave of malspam campaigns that consider advantage of password-secured archive information to drop CoinMiner and Quasar RAT on compromised systems.

In an attack chain detected by Trustwave SpiderLabs researchers, an invoice-themed ZIP file entice was observed to include a nested self-extracting (SFX) archive, the initial archive acting as a conduit to start the next.

While phishing assaults like these ordinarily require persuading the concentrate on into opening the attachment, the cybersecurity organization said the campaign sidesteps this hurdle by building use of a batch file to mechanically provide the password to unlock the payload.

The 1st SFX archive file additional makes use of possibly a PDF or Excel icon to make it surface authentic, when, in fact, it is made up of 3 factors: the password-guarded 2nd SFX RAR file, the aforementioned batch script which launches the archive, and a decoy PDF or image.

“The execution of the batch file sales opportunities to the installation of the malware lurking within the password-shielded RARsfx [self-extracting RAR archive],” researchers Bernard Bautista and Diana Lopera reported in a Thursday generate-up.

The batch script achieves this by specifying the archive’s password and the desired destination folder to which the payload will be extracted, in addition to launching a command to screen the entice document in an endeavor to conceal the malicious exercise.

Finally, the an infection culminates in the execution of CoinMiner, a cryptocurrency miner that can also double up as a credential stealer, or Quasar RAT, an open up source .NET-based mostly distant access trojan, based on the payload packed in the archive.

The one-click on attack strategy is also noteworthy in that it efficiently jumps past the password hurdle, enabling malicious actors to carry out a large variety of actions this sort of as cryptojacking, data exfiltration, and ransomware.

Trustwave stated it has determined an raise in threats packaged in password-guarded ZIP files, with about 96% of these remaining dispersed by the Emotet botnet.

“The self-extracting archive has been all-around for a very long time and eases file distribution between end end users,” the scientists stated. “Having said that, it poses a security risk due to the fact the file contents are not easily verifiable, and it can operate commands and executables silently.”

Observed this post attention-grabbing? Adhere to THN on Facebook, Twitter  and LinkedIn to read through a lot more distinctive articles we post.

Some parts of this article are sourced from:
thehackernews.com