zgRAT

It tricks unsuspecting users into downloading what appears to be an update to their Chrome browser, but is actually a remote access trojan (RAT).

Like many phishing stories, this one starts with a lure urging the recipient to review a purchase order and check for dates related to shipping times to ensure they are correct.

As shown in Figure 1, the file “Purchase Order FG-20220629.xlsx” is attached to the email. Opening this file begins the process of infection.

Most importantly, at the very bottom of the source code the bad actors lodged JavaScript code which triggers the malicious download whenever a user clicks on the “Update” button.

These messages contained URLs masquerading as links to evidence provided by a guest, but led to the download of a zipped LNK file that launched a PowerShell command, which then executed a PowerShell script.

At the very bottom of the source code the bad actors lodged JavaScript code which triggers the malicious download whenever a user clicks on the “Update” button.

These messages contained URLs leading to a download of a JavaScript file hosted on Microsoft Azure. The JavaScript called PowerShell to run a remote PowerShell script.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Execution User Execution: Malicious Link T1204.001 ClickFix/FakeCaptcha pages

The RAR file contained the executable “Rechnung DE009100019000.exe”... When the .exe was executed, it sideloaded the included PYTHON27.DLL...

MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 HKCU...\CurrentVersion\Run

MITRE ATT&CK Mapping Tactic Technique ID Implementation Persistence Boot or Logon Autostart: Registry Run Keys T1547.001 HKCU...\CurrentVersion\Run

The DLL is heavily obfuscated. However, it’s still possible to pick out the primary namespace, class, and entry function.

MITRE ATT&CK Mapping ... Defense Evasion Obfuscated Files: Software Packing T1027.002 Donut + .NET Reactor + ZgRAT (three-layer packing)

The file is described as “WinRAR” (legitimate file compression and archiving software). In addition, the original and current file names do not match... “receipt.doc” ... is not a Microsoft Word document. Instead, it is a Rich Text File (RTF).

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Masquerading: Match Legitimate Name T1036.005 msedge_elf.dll, libpsl-5.dll

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497 Benign API calls (catfact.ninja, httpbin.org) for timing

According to Trellix's data, various malware families, including Agent Tesla, UmbralStealer, Stealerium, and zgRAT, have also used Discord webhooks over the past few years to steal sensitive information like credentials, browser cookies, and cryptocurrency wallets from compromised devices.

According to Trellix's data, various malware families, including Agent Tesla, UmbralStealer, Stealerium, and zgRAT, have also used Discord webhooks over the past few years to steal sensitive information like credentials, browser cookies, and cryptocurrency wallets from compromised devices.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery System Owner/User Discovery T1033 Username, admin status collection

MITRE ATT&CK Mapping Tactic Technique ID Implementation Discovery System Information Discovery T1082 PS1 fingerprinting (OS, model, AV products)

MITRE ATT&CK Mapping Tactic Technique ID Implementation Defense Evasion Virtualization/Sandbox Evasion T1497 Benign API calls (catfact.ninja, httpbin.org) for timing

Victims received a ZIP pairing a legitimate executable with a malicious DLL.

MITRE ATT&CK Mapping Tactic Technique ID Implementation C2 Application Layer Protocol: Web T1071.001 HTTPS to asmweosiqsaaw[.]com

MITRE ATT&CK Mapping Tactic Technique ID Implementation C2 Web Service T1102 Cloudflare-proxied C2

This script uses an intermediary chromium-themed domain to fetch the URL of the final download, which is normally hosted on a compromised third-party site.

MITRE ATT&CK Mapping Tactic Technique ID Implementation Exfiltration Exfiltration Over C2 Channel T1041 Via zgRAT C2 protocol

Discord's permanent file hosting capabilities have frequently been misused to distribute malware and exfiltrate data gathered from compromised systems using webhooks.