Jump to content
iulik

Threat Spotlight: Astaroth — Maze of obfuscation and evasion reveals dark stealer

Recommended Posts

Cisco Talos detected a new Astaroth attack campaign targeting users in Brazil. The operation began when a user received an email written in Portuguese that resorted to a car rental service as a lure in order to trick the user into clicking on a link that masqueraded as an overdue invoice. In actuality, that link redirected the user to Google Drive for the purpose of downloading a malicious ZIP file.

 

image28.jpg

 

detalii -> https://blog.talosintelligence.com/2020/05/astaroth-analysis.html

  • Upvote 1
Link to comment
Share on other sites

Din cate am citit, i-a dat cateva dureri de cap sa ii faca debug.

 

Sunt targetati oamenii din mexic, malware-ul verifica daca limba setata pe sistemul de operare e portugheza, daca nu termina procesul.

 

Ce mi s-a mai parut interesant e ca foloseste canale de youtube, canalele de youtube linkuiesc catre o serie de domenii, iar de acolo domeniile trimit instructiuni la persoanele infectate.

image27.png

image6.png

  • Upvote 1
Link to comment
Share on other sites

Parca in rootkits and bootkits descriau ca foloseau canale de twiter, telegram sau generatoare de domenii. Daca malwareul nu gasea domeniul respectiv apela generatorul offline si stia unde sa mearga.

Mai erau si malwareurile care foloseau pastebin.

La youtube nu m-am gandit niciodata, dar pe langa faptul ca este mai repede de dezvoltat partea de infrastructura (se folosesc de youtube) ii ajuta si faptul ca pe multe pc-uri traficul catre youtube e permis.

  • Upvote 1
Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...