Microsoft Signature Verification Malsmoked !

A new malware campaign that has already stolen passwords and user information from over 2000 victims in 111 countries worldwide, researchers warn.

ZLoader is a known banking Trojan that uses web injection to steal cookies, passwords, and sensitive information. It has also been linked to the delivery of the infamous Conti and Ryuk ransomware variants.  In the past, ZLoader has been delivered via both traditional phishing email campaigns and abuse of online advertising platforms, where attackers purchase ads pointing to legitimate-looking websites hosting the malware.

The new campaign, connected to a cybercrime group Malsmoke, begins with the installation of a legitimate remote management program from Atera pretending to be a Java installation. This provides the attacker full access to the targeted system, enabling them to upload and download files and run additional scripts. One of these scripts purportedly runs “mshta.exe” with the file “appContast.dll” as the parameter.

Although appContast.dll is signed by Microsoft, the attackers found a way to exploit the firm’s digital signature verification method to add extra information to the file. This info downloads and runs the final Zloader payload.

People need to know that they can’t immediately trust a file’s digital signature. What we found was a new ZLoader campaign exploiting Microsoft’s digital signature verification to steal the sensitive information of users. ZLoader campaign authors put great effort into defense evasion and are still updating their methods on a weekly basis. Its strongly recommended users to apply Microsoft’s update for strict Authenticode verification. It is not applied by default.

Researchers added

Users were also urged not to install programs from unknown sources and not to click on links or open attachments in unsolicited messages. It’s unknown exactly how this campaign is being disseminated, but the largest group of victims are in the US (40%), followed by Canada (14%) and India (6%)

Indicators Of Compromise