Image Hosted on Web Server Serving Malware

[Fi8sVrs]

Security researchers at TrenMicro have identified a new type of malware that update their configuration in a very interesting way. This means that compromised machines are configured to download JPEG files that contain encrypted configuration files/binaries without victim’s knowledge.

The image is hosted on web server located in Asia-Pacific region and contains three types of settings:

• configuration file (Type A)
  
• configuration file (Type
  
• binary content (either DLL or EXE files)
  

The first type of configuration is the standard C&C settings where it allows attacker to send instruction to victim machines and customize the hosts or update the malware to use another type of configuration. This technique makes the botnet resist in case of functionality issue.

The second configuration file is containing several process names for antimalwares and hostnames of the compromised network. JPEG images may not only include configurations but it also host a binary content that allows malware authors to update the malicious software packages at any moment.

The way that cyber-criminal are hiding their activities is becoming more and more complex to not identify their network and techniques. Hosting a malicious image on web server is hard to detect with the security software. This makes the attack more resilient and not spotted by security software.

JPEG files used by attacker to host configuration and binaries for the Malware

TrendMicro also revealed that reversing the images allowed to identify hostnames and IP addresses of infected machine’s/networks, list of images used in the cyber attack that is accessed by the malware beside the operating system version installed on infected machines.

Via Image Hosted on Web Server Serving Malware | SecTechno