Threat Intelligence Report November 8 - November 14 2022

Threat name:

Researchers recently found a sophisticated malware framework and named it NetDooka after the names of some of its components. This malware is being delivered using a pay-per-install (PPI) service and comprise multiple parts, including a loader, a dropper, a protection driver, and a full-featured remote access trojan (RAT). NetDooka is spread via Private Loader malware which once installed, starts the whole infection chain.

Persistence T1574.002/T1546 - Privilege Escalation T1055/TA0004/T1546 - Defense Evasion T1036/T1497 - Credential Access T1056.001 - Discovery T1010/ T1012/T1082/T1083/T1497 - Collection T1113/T1125 - Command and Control T1571- Impact T1489

In the beginning of 2022, a new malware named ChromeLoader a.k.a CS_installer was detected, in the wild targeting Chrome browsers. The ChromeLoader uses ISO image malicious files as the initial infection vector. The malware installs itself as a Chrome extension. It works as a browser hijacker capable of stealing users' personal information and track back all browser activities. The ChromeLoader found was developed in .NET programming language and is known as ChromeLoader due to its scheduled task entry for persistence in the infected device.

Recently, a new Ursnif malware has been observed in the wild. Ursnif was known for bank fraud activities. A new variant of the Ursnif malware seems to have shifted to a backdoor and ransomware-like behaviour. The threat starts from a recruitment email lure that contains links that will lead to the domain of a recruitment company. The email includes documents related to the email that contains the payload when downloaded and executed.

Cloud9 Botnet is a browser extension trojan that has a multitude of functionalities. It steals user sessions, logs keystrokes, can initiate DDoS attacks, mine cryptocurrency, inject ads and exploit browsers. It masquerades itself as an Adobe player plugin that needs to be installed on a browser.

IceXLoader is a commercial malware used to download and deploy additional malware on infected machines. While the version discovered in June (v3.0) looked like a work-in-progress, v3.3.3 loader looks to be fully functional and includes a multi-stage delivery chain.

​​​​​​​A threat group tracked as 'Worok' hides malware within PNG images to infect victim's machines with information-stealing malware without raising alarms. The malware is deployed by attackers via ProxyShell vulnerabilities. In some corner cases, exploits against the ProxyShell vulnerabilities were used for persistence in the victim’s network. The attackers then used publicly available exploit tools to deploy their custom malicious kits. So, the final compromise chain is straightforward: the first stage is CLRLoader which implements a simple code that loads the next stage (PNGLoader).​​​​​​​