Stop Scanning My Macro[html]
FireEye Labs detected an interesting evasion strategy in two recent,
large Dridex campaigns. These campaigns changed the attachment
file-type and location of malicious logic in an attempt to avoid scanners.
Overview
Both campaigns used an invoice theme and came from a wide variety of
sending addresses, with messages being sent to more than 40 countries
across all industries, as seen in Figure 1 and Figure 2. The following
subject lines were used:
Invoice <xxxx> from Tip Top Delivery
Urgent: IMAGINiT
invoice <xxxx> is Past due
Figure 1. Affected Countries
Figure 2. Affected Industries
What made these two campaigns interesting was the major shift in the
downloader techniques used to evade signature-based detection. The
following are some of the key techniques that were used:
- Disguising WordprocessingML as RTF file to evade type specific
signatures. - Keeping the main malicious macro clean to avoid
macro-based detection. The malicious VBA code was instead stored in
TextBox objects located within the Forms, as seen in Figure 4.
- Dropping a VBE based downloader that could not be seen without
execution of the malicious RTF file. This downloader would then
download and execute the malicious payload.
1.
