Zurück 
Netskope Threat Research Labs has become aware of an ongoing data theft attack. The attack begins as an email attachment and results in the installation of banking and credential theft malware, including Ursnif. Though the attachments used in the campaign were once malicious Office documents, they have recently been updated to use attachments more difficult for traditional security products to process. In either case, many of the attachments will then download the payload malware from SaaS applications.
The current attack chain employs .lnk files and PowerShell to install its payload. As a result, several difficulties exist in traditional static scan, or runtime/sandbox evaluation of this threat. Netskope Threat Research Labs recommends that Security Administrators use a threat-aware CASB with cloud app instance-level inspection to broadly prevent these threats.
This blog will provide an analysis of attacks using .lnk files powered with PowerShell and how these attacks can be prevented with app-level granularity by applying threat protection policies.
Analysis of the .LNK file
In the most recent versions of the attack, .lnk attachments are used in place of more common Office file attachments. These attachments, detected by Netskope Threat Protection as Backdoor.LNK.NX execute PowerShell which downloads final payloads from SaaS applications, such as Dropbox.
Many enterprise users employ features to automatically sync their attachments to the cloud, opening their collaborative network up to a CloudPhishing fanout effect. In these cases, the aforementioned detection is crucial to preventing subsequent attack spread.
Figure 1 shows one such localized attack being received by a .ch TLD (Top Level Domain).
Figure 1: Email with the malicious .lnk file
The .lnk file contained PowerShell code to download the second stage payload as shown in Figure 2.
Figure 2: .LNK file with PowerShell code
Figure 2 illustrates that the powershell is run in hidden mode and then downloads the second stage payload from a Dropbox URL:
https://www.’+’Dropbox.c’+’om/s/’+’az’+’kky’+’zzo41tk84i/Fz’+’F7sEB’+’lz1288’+’59.exe’+’?dl’+’=1
This obfuscated string is using concatenation to thwart antivirus scanners from identifying the URL.
The visual depiction of the attack and the protection using Netskope is shown in Figure 3.