Security experts at Proofpoint have discovered a new phishing campaign that exploits a variant of Dridex that evades detection with the AutoClose feature.
The teams behind the banking malware, Dridex, are very prolific and are improving the infamous malicious code. Recently, a variant of Dridex was discussed that was spread through phishing emails, with Microsoft Office documents embedding malicious macros.
Attackers exploit the social engineering technique to trick victims into opening the document and enabling macros, which are disabled by default since the release of Office 2007.
The most recent enhancement to the malware campaign is the integration of an AutoClose VBscript function as a detection evasion technique.
“The user is tricked into enabling macros and opening the attachment, and when they open it, they see a blank page and seemingly nothing bad happens,” it states in a blog post published by Proofpoint. “Instead, the malicious action takes place when the document is closed. The AutoClose method executes another method, “vhjVHsdfdsf,” which includes masked code. The code is executed by XORing with 0xFF, yielding a PowerShell downloader code that installs Dridex with botnet ID 120.”
Basically, a sandbox detection mechanism does not implement a wait function for the user to close the document.
“No matter how long the sandbox waits, the infection will not be achieved, and if the sandbox is closed without closing the document, the infection will be lost completely,” Proofpoint reports.
Dridex belongs to the GameOver Zeus family and works by injecting code into the browsers when victims visit their online banking accounts. The malicious code is used to steal sensitive information, including banking credentials.
Dridex, like previous GameOver Zeus, uses a peer-to-peer architecture network and domain algorithm generation techniques that make botnets difficult to terminate.
