O futuro do Zero Trust e do SASE é agora! Assista sob demanda

fechar
fechar
  • Por que Netskope chevron

    Mudando a forma como a rede e a segurança trabalham juntas.

  • Nossos clientes chevron

    A Netskope atende a mais de 3.000 clientes em todo o mundo, incluindo mais de 25 das empresas da Fortune 100

  • Nossos parceiros chevron

    Fazemos parceria com líderes de segurança para ajudá-lo a proteger sua jornada para a nuvem.

O mais alto nível de Execução. A Visão mais avançada.

A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.

Obtenha o Relatório
A Netskope foi reconhecida como Líder no Magic Quadrant™ do Gartner® de 2023 para SSE.
Ajudamos nossos clientes a estarem prontos para tudo

Veja nossos clientes
Woman smiling with glasses looking out window
A estratégia de comercialização da Netskope, focada em Parcerias, permite que nossos Parceiros maximizem seu crescimento e lucratividade enquanto transformam a segurança corporativa.

Saiba mais sobre os parceiros da Netskope
Group of diverse young professionals smiling
Sua Rede do Amanhã

Planeje seu caminho rumo a uma rede mais rápida, segura e resiliente projetada para os aplicativos e usuários aos quais você oferece suporte.

Receba o whitepaper
Sua Rede do Amanhã
Apresentando a plataforma Netskope One

O Netskope One é uma plataforma nativa da nuvem que oferece serviços convergentes de segurança e rede para permitir sua transformação SASE e zero trust.

Saiba mais sobre o Netskope One
Abstrato com iluminação azul
Adote uma arquitetura Secure Access Service Edge (SASE)

O Netskope NewEdge é a maior nuvem privada de segurança de alto desempenho do mundo e oferece aos clientes cobertura de serviço, desempenho e resiliência inigualáveis.

Conheça a NewEdge
NewEdge
Netskope Cloud Exchange

O Cloud Exchange (CE) da Netskope oferece aos clientes ferramentas de integração poderosas para tirar proveito dos investimentos em estratégias de segurança.

Saiba mais sobre o Cloud Exchange
Vídeo da Netskope
A plataforma do futuro é a Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) e Private Access for ZTNA integrados nativamente em uma única solução para ajudar todas as empresas em sua jornada para o Secure Access Service Arquitetura de borda (SASE).

Vá para a plataforma
Vídeo da Netskope
Next Gen SASE Branch é híbrida — conectada, segura e automatizada

Netskope Next Gen SASE Branch converge o Context-Aware SASE Fabric, Zero-Trust Hybrid Security e SkopeAI-Powered Cloud Orchestrator em uma oferta de nuvem unificada, inaugurando uma experiência de filial totalmente modernizada para empresas sem fronteiras.

Saiba mais sobre Next Gen SASE Branch
Pessoas no escritório de espaço aberto
Desenvolvendo uma Arquitetura SASE para Leigos

Obtenha sua cópia gratuita do único guia de planejamento SASE que você realmente precisará.

Baixe o eBook
Mude para serviços de segurança na nuvem líderes de mercado com latência mínima e alta confiabilidade.

Conheça a NewEdge
Lighted highway through mountainside switchbacks
Permita com segurança o uso de aplicativos generativos de IA com controle de acesso a aplicativos, treinamento de usuários em tempo real e a melhor proteção de dados da categoria.

Saiba como protegemos o uso de IA generativa
Ative com segurança o ChatGPT e a IA generativa
Soluções de zero trust para a implementação de SSE e SASE

Conheça o Zero Trust
Boat driving through open sea
Netskope obtém alta autorização do FedRAMP

Escolha o Netskope GovCloud para acelerar a transformação de sua agência.

Saiba mais sobre o Netskope GovCloud
Netskope GovCloud
  • Recursos chevron

    Saiba mais sobre como a Netskope pode ajudá-lo a proteger sua jornada para a nuvem.

  • Blog chevron

    Saiba como a Netskope permite a transformação da segurança e da rede por meio do SSE (Security Service Edge)

  • Eventos e workshops chevron

    Esteja atualizado sobre as últimas tendências de segurança e conecte-se com seus pares.

  • Security Defined chevron

    Tudo o que você precisa saber em nossa enciclopédia de segurança cibernética.

Podcast Security Visionaries

Confiança zero: É mais do que apenas identidade
Neste episódio, a apresentadora Emily Wearmouth explora o conceito de confiança zero com os especialistas em segurança cibernética John Kindervag, o "padrinho da confiança zero," e Neil Thacker.

Reproduzir o podcast
Confiança zero: É mais do que apenas identidade
Últimos blogs

Leia como a Netskope pode viabilizar a jornada Zero Trust e SASE por meio de recursos de borda de serviço de segurança (SSE).

Leia o Blog
Sunrise and cloudy sky
SASE Week 2023: Sua jornada SASE começa agora!

Replay das sessões da quarta SASE Week anual.

Explorar sessões
SASE Week 2023
O que é o Security Service Edge?

Explore o lado de segurança de SASE, o futuro da rede e proteção na nuvem.

Saiba mais sobre o Security Service Edge
Four-way roundabout
  • Empresa chevron

    Ajudamos você a antecipar os desafios da nuvem, dos dados e da segurança da rede.

  • Liderança chevron

    Nossa equipe de liderança está fortemente comprometida em fazer tudo o que for preciso para tornar nossos clientes bem-sucedidos.

  • Customer Solutions chevron

    Estamos aqui junto com você a cada passo da sua trajetória, assegurando seu sucesso com a Netskope.

  • Treinamento e certificação chevron

    Os treinamentos da Netskope vão ajudar você a ser um especialista em segurança na nuvem.

Apoiando a sustentabilidade por meio da segurança de dados

A Netskope tem o orgulho de participar da Visão 2045: uma iniciativa destinada a aumentar a conscientização sobre o papel da indústria privada na sustentabilidade.

Saiba mais
Apoiando a sustentabilidade por meio da segurança de dados
Pensadores, construtores, sonhadores, inovadores. Juntos, fornecemos soluções de segurança na nuvem de última geração para ajudar nossos clientes a proteger seus dados e seu pessoal.

Conheça nossa equipe
Group of hikers scaling a snowy mountain
A talentosa e experiente equipe de Serviços Profissionais da Netskope fornece uma abordagem prescritiva para sua implementação bem sucedida.

Conheça os Serviços Profissionais
Netskope Professional Services
Proteja sua jornada de transformação digital e aproveite ao máximo seus aplicativos de nuvem, web e privados com o treinamento da Netskope.

Saiba mais sobre Treinamentos e Certificações
Group of young professionals working

Infected PowerPoint Files Using Cloud Services to Deliver Multiple Malware

Jan 24 2022

Co-authored by Gustavo Palazolo and Ghanashyam Satpathy

Sumário

In 2021, malicious Office documents accounted for 37% of all malware downloads detected by Netskope, showing favoritism for this infection vector among attackers. This is likely due to the ubiquitous usage of Microsoft Office in enterprises across the globe. Throughout 2021 we have analyzed many techniques used by attackers to deliver payloads through infected documents, which included the return of Emotet, a campaign that primarily uses infected documents to spread malware.

Since December 2021, Netskope Threat Labs has observed an increase in the usage of one specific file type from the Microsoft Office suite: PowerPoint. These relatively small files are being delivered through phishing emails, then downloading and executing malicious scripts through LoLBins, a common technique often used to stay under the radar. 

We spotted this campaign delivering multiple malware, such as AveMaria (a.k.a. Warzone) and AgentTesla. These files are using Bitly to shorten URLs and different cloud services like MediaFire, Blogger, and GitHub to host the payloads. In this blog post, we will analyze a malicious PowerPoint Add-In file detected by Netskope that delivers multiple malware, including AgentTesla.

Stage 01 – Infected PowerPoint File


The infection flow starts with a phishing email that carries the infected file as an attachment, along with a message that lures the victim to download and open it.

Screenshot of phishing email with a malicious attachment.
Phishing email with a malicious attachment.

The file is fairly small and it doesn’t contain anything but the malicious VBA macro.

Example of infected PowerPoint file.
Infected PowerPoint file.

The macro is obfuscated and it uses an internal function to decrypt important strings at runtime.

Example of obfuscated VBA code within the infected PowerShell file.
Obfuscated VBA code within the infected PowerShell file.

The script deobfuscation is straightforward and leads to the following VBA code.

Screenshot of command executed by the malicious PowerShell file.
Command executed by the malicious PowerShell file.

This technique uses Outlook (COM Object) to execute PowerShell, which bypasses the child process created by PowerPoint.

Screenshot of PowerShell spawned by Outlook’s process.
PowerShell spawned by Outlook’s process.

The script is executed with a combination of PowerShell and mshta, a similar technique employed by BazarLoader.

Screenshot of malicious script being executed through LoLBins.
Malicious script being executed through LoLBins.

Stage 02 – VBS File

The URL contacted by the mshta binary is shortened through the Bitly domain “j.mp”, and the payload is hosted on MediaFire, a cloud service for file storage and sharing.

The next stage is a VBS script that is lightly obfuscated within an HTML page, which is decoded and executed through a simple JavaScript function.

Screenshot of second stage executed by the infected PowerPoint file.
Second stage executed by the infected PowerPoint file.

Once deobfuscated, the VBS script performs multiple tasks to:

  1. Create a persistence mechanism through the Windows registry to execute two PowerShell scripts from external URLs. The first script delivers AgentTesla, and the second script is used to disable some OS defenses, such as Windows Defender.
  1. Create a scheduled task that executes a script from an external URL through mshta approximately every hour. This script delivers a cryptocurrency stealer developed in PowerShell, hidden within a fake web page hosted with Blogger.
  1. Create a persistence mechanism through the Windows registry to execute a script from an external URL using mshta. Unfortunately, we can’t tell what was being executed as this URL was offline at the time of the analysis.
Example of malicious VBS responsible for the next stages.
Malicious VBS responsible for the next stages.

Stage 03 – AgentTesla

The first PowerShell script is responsible for executing AgentTesla, which is a .NET-based Remote Access Trojan with many capabilities, such as stealing browser’s passwords, capturing keystrokes, clipboard, etc.

The code is slightly obfuscated, protecting variables, function names, and strings. There are two large arrays that contain:

  1. Compressed bytes of AgentTesla;
  2. Compressed bytes of a .NET Injector used for process injection;

None of the executables are written to disk, which characterizes this attack as fileless.

Screenshot of PowerShell script responsible for executing AgentTesla.
PowerShell script responsible for executing AgentTesla.

Once both files are decompressed, the script loads the injector and calls a function named “Execute”, responsible for injecting AgentTesla payload into an instance of “aspnet_compiler.exe”, which is a binary from the .NET framework.

Example of removing a minor obfuscation in the PowerShell script, showing how the payload gets executed.
Removing a minor obfuscation in the PowerShell script, showing how the payload gets executed.

Most of the injector’s function names are obfuscated, but we can see the namespace, the class, and the method that is being called to inject AgentTesla into a process. Furthermore, an injector using “projFUD” as namespace was previously spotted in the wild, used by other malware such as ASyncRAT and RevengeRAT.

Screenshot of injector’s decompiled code.
Injector’s decompiled code.

AgentTesla is developed in .NET and this sample is using a protector known as “Obfuscar”, which creates a few mechanisms in the code to make analysis harder.

Screenshot of AgentTesla sample delivered by the infected PowerPoint file.
AgentTesla sample delivered by the infected PowerPoint file.

Despite the protector’s usage, it’s still possible to see clean code from the decompiler, like this method that sends HTTP requests.

Example of function used by AgentTesla for network requests.
Function used by AgentTesla for network requests.

All the strings used by AgentTesla are encrypted within the binary, where all the characters are stored in a single array of bytes. Once it’s running, the code decrypts all the characters in the list using a simple XOR operation with the encrypted byte, its position on the list, and the decimal 170.  Whenever AgentTesla needs to access a string, it calls a function that returns the string by accessing its position in the list, and the respective length.

Screenshot of AgentTesla string encryption scheme.
AgentTesla string encryption scheme.

Using the same logic, we can use a combination of regex and a Python script to decrypt all the strings in the binary. The complete list of decrypted strings can be found on our Github page.

Screenshot of decrypted strings from AgentTesla.
Decrypted strings from AgentTesla.

Furthermore, AgentTesla sends an HTTP POST request to a malicious server with information about the infected machine, such as the computer name, username, IP address, etc.

Screenshot of AgentTesla HTTP request.
AgentTesla HTTP request.

Stage 04 – PowerShell

The second PowerShell file executed by the VBS script in the second stage is mostly used to disable Windows Defender.

Screenshot of PowerShell downloading the payloads.
PowerShell downloading the payloads.

Once running, it downloads a file from GitHub named NSudo, which is used for privilege escalation (TA0004). NSudo is executed as “TrustedInstaller” through the arguments  “-U:T”.

Screenshot of GUI from downloaded file “NSudo”.
GUI from downloaded file “NSudo”.

The second download is a VBS script hosted on MediaFire, which uses NSudo and other commands to disable Windows Defender and to add a few AV exclusions based on file extensions, paths, and executable names.

Screenshot of VBS downloaded by PowerShell.
VBS downloaded by PowerShell.

The VBS is executed through another Living-off-the-Land technique, by first creating an INF file with the command to be executed.

Screenshot of PowerShell creating INF file.
PowerShell creating INF file.

And then executing the INF file with the cmstp LoLBin.

Screenshot of executing the INF file.
Executing the INF file.

Stage 05 – Cryptocurrency Stealer

The third URL downloaded by the second stage VBS is hosted with Blogger, which tries to camouflage itself through a fake web page that says the content is sensitive.

Example of fake web page downloaded by the second stage.
Fake web page downloaded by the second stage.

Despite the attempt to hide behind this web page, we can find two malicious VBS within the HTML, which are decoded and executed with a simple JavaScript.

Example of VBS code hidden in the HTML page.
VBS code hidden in the HTML page.

One of the VBS executed in this stage leads to the same PowerShell that delivers AgentTesla, which is redundant. However, the other VBS code leads to a simple cryptocurrency stealer written in PowerShell.

Example of VBS loading and executing the cryptocurrency stealer.
VBS loading and executing the cryptocurrency stealer.

The malware is fairly simple, it works by checking the clipboard data with a regex that matches the cryptocurrency wallet pattern. If it is found, the data is replaced with the attacker’s wallet address.

Example of cryptocurrency stealer in PowerShell.
Cryptocurrency stealer in PowerShell.

The code is able to replace the address for many coins, such as Bitcoin, Ethereum, XMR, DOGE, etc.

Screenshot of cryptocurrency addresses used by the attacker.
Cryptocurrency addresses used by the attacker.

The complete list of the addresses used by the attacker can be found on our GitHub page.

Conclusão

Attackers not only continue to abuse Microsoft Office to deliver malware, but are also increasingly including cloud services in their attacks, as this adds a certain resilience to the entire process. Netskope Advanced Threat Protection includes a custom Microsoft Office file analyzer and a sandbox to detect campaigns like the one we described in this analysis. We will continue to provide updates on this threat as it evolves.

Proteção

O Netskope Threat Labs está monitorando ativamente esta campanha e garantiu cobertura para todos os indicadores de ameaças e cargas conhecidas.

  • Proteção Contra Ameaças Netskope
    • Document-Office.Trojan.AgentTesla
    • Win32.Trojan.AgentTesla
  • A Netskope Advanced Protection oferece cobertura proativa contra essa ameaça.
    • Gen.Malware.Detect.By.StHeur indica uma amostra que foi detectada usando análise estática
    • Gen.Malware.Detect.By.Sandbox indica uma amostra que foi detectada por nosso sandbox na nuvem
  • Gen.Malware.Detect.By.StHeur.MsOffice indicates a sample that was detected by Netskope’s static ML Microsoft Office analyzer engine.

Below we have an example of a sample detected by Netskope, which has a score of 9/63 on VirusTotal.

Screenshot of VirusTotal page

IOCs

A full list of IOCs and a Yara rule are all available in our GitHub repo.

author image
Gustavo Palazolo
Gustavo Palazolo é especialista em análise de malware, engenharia reversa e pesquisa de segurança, atuando há muitos anos em projetos relacionados à proteção contra fraudes eletrônicas. Atualmente, ele está trabalhando na Equipe de Pesquisa da Netskope, descobrindo e analisando novas ameaças de malware.

Stay informed!

Subscribe for the latest from the Netskope Blog