Hackers Using Self-Extracting Archives Exploit for Stealthy Backdoor Attacks

An mysterious danger actor made use of a malicious self-extracting archive (SFX) file in an endeavor to build persistent backdoor accessibility to a victim’s natural environment, new results from CrowdStrike display.

SFX data files are able of extracting the knowledge contained in just them with no the want for committed software to display the file contents. It achieves this by including a decompressor stub, a piece of code that is executed to unpack the archive.

“However, SFX archive files can also comprise concealed malicious operation that might not be straight away visible to the file’s receiver, and could be missed by technology-primarily based detections by itself,” CrowdStrike researcher Jai Minton reported.

In the circumstance investigated by the cybersecurity organization, compromised credentials to a procedure had been used to run a genuine Windows accessibility application named Utility Manager (utilman.exe) and subsequently launch a password-safeguarded SFX file.

This, in transform, is built achievable by configuring a debugger plan (another executable) in the Windows Registry to a particular system (in this case, utilman.exe) so that the debugger is routinely started off each individual time the system is introduced.

The abuse of utilman.exe is also noteworthy as it can be released immediately from the Windows login display screen by making use of the Windows brand essential + U keyboard shortcut, likely enabling threat actors to configure backdoors through the Picture File Execution Solutions Registry vital.

“Closer inspection of the SFX archive unveiled that it functions as a password-guarded backdoor by abusing WinRAR setup alternatives somewhat than that contains any malware,” Minton discussed.

Particularly, the file is engineered to run PowerShell (powershell.exe), Command Prompt (cmd.exe), and Endeavor Manager (taskmgr.exe) with NT AUTHORITYSYSTEM privileges by furnishing the correct password to the archive.

“This sort of attack is very likely to stay undetected by regular antivirus software program that is on the lookout for malware inside of an archive (which is generally also password-guarded) alternatively than the behavior from an SFX archive decompressor stub,” Minton included.

Future WEBINARLearn to Protected the Id Perimeter – Proven Techniques

Increase your business security with our approaching pro-led cybersecurity webinar: Discover Id Perimeter methods!

Don’t Overlook Out – Conserve Your Seat!

This is not the to start with time SFX documents have been employed in assaults as a usually means for attackers to continue to be undetected. In September 2022, Kaspersky disclosed a malware marketing campaign that used backlinks to these kinds of password-secured data files to propagate RedLine Stealer.

A month afterwards, the infamous Emotet botnet was observed sending out an SFX archive that, after opened by a consumer, would mechanically extract a next password-safeguarded SFX archive, enter the password, and execute its written content without the need of further more user interaction applying a batch script.

To mitigate threats posed by this attack vector, it truly is encouraged that SFX archives are analyzed via unarchiving computer software to establish any probable scripts or binaries that are set to extract and run upon execution.

Identified this report appealing? Stick to us on Twitter  and LinkedIn to examine a lot more exclusive content we article.

Some parts of this article are sourced from:
thehackernews.com