New AgingFly malware utilized in assaults on Ukraine executive, hospitals

A brand new malware circle of relatives named ‘AgingFly’ has been recognized in assaults towards native governments and hospitals that thieve authentication information from Chromium-based browsers and WhatsApp messenger.

The assaults had been noticed in Ukraine through the rustic’s CERT staff closing month. In response to the forensic proof, objectives might also come with representatives of the Protection Forces.

CERT-UA has attributed the assaults to a cyber danger cluster it tracks as UAC-0247.

Assault chain

In line with the Ukrainian company, the assault starts with the objective receiving an e mail purporting to be a humanitarian assist be offering, which inspires them to click on an embedded hyperlink.

The hyperlink redirects to a valid web site that have been compromised by way of a cross-site scripting (XSS) vulnerability, or to a faux web site generated the use of an AI software.

CERT-UA says that the objective receives an archive with a shortcut report (LNK) that launches a integrated HTA handler, which in flip connects to a far flung useful resource to retrieve and execute the HTA report.

The HTA shows a decoy shape to divert consideration and creates a scheduled process that downloads and runs an EXE payload that injects shellcode into a valid procedure.

Subsequent, the attackers deploy a two-stage loader by which the second one degree makes use of a customized executable structure, and the general payload is compressed and encrypted.

“An ordinary TCP opposite shell or an analogue labeled as RAVENSHELL can be utilized as stagers, which gives for setting up a TCP reference to the control server,” CERT-UA says in a file these days.

A TCP connection encrypted the use of the XOR cipher is established to the C2 server for executing instructions by way of the Command Instructed in Home windows.

Within the subsequent degree, the AgingFly malware is delivered and deployed. On the similar time, a PowerShell script (SILENTLOOP) is used to execute instructions, replace the configuration, and retrieve the C2 server cope with from a Telegram channel or fallback mechanisms.

After investigating a dozen such incidents, the researchers made up our minds that the attacker is stealing browser information the use of the open-source safety software ChromElevator that may decrypt and extract delicate knowledge, like cookies and stored passwords, from Chromium-based browsers (e.g., Google Chrome, Edge, Courageous) while not having administrator privileges.

The danger actor additionally tries to extract delicate information from the WhatsApp software for Home windows through decrypting databases the use of the ZAPiDESK open-source forensic software.

In line with the researchers, the actor engages in reconnaissance process and tries to transport laterally at the community, and makes use of publicly to be had utilities, just like the RustScan port scanner, the Ligolo-ng and Chisel tunneling gear. 

Compiling supply code at the host

AgingFly is a C# malware that gives its operators with far flung regulate, command execution, report exfiltration, screenshot seize, keylogging, and arbitrary code execution.

It communicates with its C2 server by way of WebSockets and encrypts the site visitors the use of AES-CBC with a static key.

The researchers word {that a} particularity of the AgingFly malware is that it does now not come with pre-built command handlers; as a substitute, it compiles them at the host from supply code gained from the C2 server.

“A distinguishing function of AGINGFLY in comparison to equivalent malware is the absence of integrated command handlers in its code. As a substitute, they’re retrieved from the C2 server as supply code and dynamically compiled at runtime,” CERT-UA explains.

Some great benefits of this means come with a smaller preliminary payload, the power to modify or prolong features on call for, and the possible to evade static detection.

Then again, this ordinary means provides complexity, depends upon C2 connectivity, a bigger runtime footprint, and in the end will increase detection chance.

CERT-UA recommends that customers block the release of LNK, HTA, and JS recordsdata to disrupt the assault chain used on this marketing campaign.