Business as usual: Criminal Activities in Times of a Global Pandemic

The attachment to the first email is said to be a list of the victims of COVID-19. However, upon analyzing the file, it can be easily identified as an archive that contains an executable file – LIST.exe. This is a red flag already as a file that claims to be a text file, is an archive that contains an executable file. The attachment from the second email looks like a usual archive, but also contains an executable file.
Further analysis shows that the malicious executable files from the extracted archives are files associated with a well-known malware family called GuLoader, that has been existing since way before COVID19. GuLoader is a known malware that downloads its payload from cloud services such as Google Drive and Microsoft Drives. It is then used to download a remote access trojan (RAT), a malicious program that includes a backdoor for administrative control over the target computer. In this case, considering that the files we analyzed came from two different emails with two distinct targets, the attachment files were identical, which both end up downloading a Parallax RAT.

Further analysis shows that the malicious executable files from the extracted archives are files associated with a well-known malware family that has been existing since way before COVID19: GuLoader is a known malware that downloads its payload from cloud services such as Google Drive and Microsoft Drives. It is then used to download a remote access trojan (RAT), a malicious program that includes a backdoor for administrative control over the target computer. In this case, considering that the files we analyzed came from two different emails with two distinct targets, the attachment files were identical, which both end up downloading a Parallax RAT.

While checking our telemetry statistics for the past 6 months with 58,524 malware samples, aside from Parallax, there are several other malware families that leverages COVID-19 related news to entice a large number of potential victims to open attachments from unknown source. These malware families, most of which are RATs like Remcos, Nanocore, Netwire, Agent Tesla and other trojans, ranging from least destructive to most destructive, are unceasingly being distributed through various means like spam emails or as a downloadable file from deceitful websites.

Remcos was first seen in the wild at the 2^nd half of 2016 being promoted as a commercialized RAT at the price of $58 to $389. It was first used in spear phishing campaigns targeting Turkish organizations. Currently, it is being sold by a German company called ‘Breaking Security’^[2] and  their website advertised it as a legitimate powerful remote control and surveillance software that can be used to access computers anywhere around the world.

The current trend for Remcos malware campaigns involved malware authors leveraging new and trending news worldwide for its phishing emails. Those mails usually  have a pdf attachment. Once opened, this PDF contains a Remcos RAT dropper which runs a VB Script which in turn will execute the malware. To ensure persistence, a startup key is added to the registry.

Aliases:

• RemcosRAT
• Remvio

Other reference lines used in previous campaigns:

• "Re: nCoV: Coronavirus outbreak and safety measures in your city (Urgent)".
• Small Business Grant/Testing Centre Vouchers
• SBA Grant/Testing Centre Vouchers
• SBA Payroll Protection Program Status

Nanocore was first seen in the wild in 2013. Its author Thoms Huddleston aka AeonHacks, admitted to developing and marketing NanoCore on the DarkWeb betweeen 2012 to 2016. He was arrested, but this does not stop the spread of his creation. It was kept alive and was updated since then. The new version of NanoCore was being sold on unterground markets for as low as $25. Some features included remote surveillance, reverse proxy connection, plugins and even customer support.

Nanocore is a sophisticated RAT that enables the attackers to gain access to details of victim’s machine such as hostname and operating system. This in turn will let the cyber criminals carry out more malicious activities in the victim’s machine like hijacking the web camera and microphone, steal confidential information and more.

What sets this RAT apart from other RATs is how difficult it is to detect. Unlike other RAT designed to run in a specific way, most of its behavior were similar with that of legitimate applications. Nanocore allows malware actors to just do anything they want to, once they gain access to a victim machine

This type of  malware may not be as destructive as the previous malwares we have cited, but this can mislead the user into thinking that something is wrong with their system. One COVID-19 themed jokeware will prompt a message box that says “CoronaVirus has stopped working” when executed. This is very likely to cause alarm in many users and lead them into thinking that something is wrong with their computers, when in reality, all is well and the system was never in any danger to begin with. Jokewares may be the least of our worries involving COVID-19 malwares circulating the cyber world right now, but it is better to be safe than to be sorry. It may be mildly annoying to some, but has the potential to launch an organization into full “damage control mode” and cause some level of disruption.

Looking at the mode of delivery for malware, , there is one thing that stick out:
Even though malware authors take advantage of the current events around the world, most malicious files they commonly attach to spam emails are part of long-established  and well-known malware families which have  a high infection rate and enjoy broad support and a large user base within the underground community.

Aliases:

• NetWeird
• NetWire
• Recam

Other Email Subjects Used by Netwire RAT when sending Phishing Emails:

• Malspam claiming to be from Dr Stella Chungong at the WHO