META

If the scanning and authentication are successful, command execution occurs to install “mysql,” an XMRig CoinMiner, on the Attack Target server.

META, the last of which has been observed delivered via malspam campaigns to collect sensitive data.

The infection chain in the particular campaign follows the "standard" approach of a macro-laced Excel spreadsheet arriving in prospective victims' inboxes as email attachments.

One thing to note is that META modifies Windows Defender via PowerShell to exclude .exe files from scanning, to protect its files from detection.

The spreadsheet files feature a DocuSign lure that urges the target to "enable content" required to run the malicious VBS macro in the background.

The spreadsheet files feature a DocuSign lure that urges the target to "enable content" required to run the malicious VBS macro in the background.

If the scanning and authentication are successful, command execution occurs to install “mysql,” an XMRig CoinMiner, on the Attack Target server.

Eventually, the final payload is assembled on the machine under the name "qwveqwveqw.exe," which is likely random, and a new registry key is added for persistence.

These fingerprints meant the criminals could access ... without triggering security warnings ... Users could even bypass multi-factor authentication.

If the scanning and authentication are successful, command execution occurs to install “mysql,” an XMRig CoinMiner, on the Attack Target server.

Eventually, the final payload is assembled on the machine under the name "qwveqwveqw.exe," which is likely random, and a new registry key is added for persistence.

Multiple families have successfully bypassed App-Bound Encryption including Phemedrone, LummaC2, Meduza, Vidar, StealC, Rhadamanthys, WhiteSnake, Meta, and Lumar.

Some of the downloaded files are base64 encoded or have their bytes reversed to bypass detection by security software.

# rm pack.Jpg ... # rm mysql ... # rm -rf meta ranges pass found.Lst

If the scanning and authentication are successful, command execution occurs to install “mysql,” an XMRig CoinMiner, on the Attack Target server.

These fingerprints meant the criminals could access ... without triggering security warnings ... Users could even bypass multi-factor authentication.

One thing to note is that META modifies Windows Defender via PowerShell to exclude .exe files from scanning, to protect its files from detection.

The analysis draws on approximately 44 million infostealer logs and recommends monitoring for "credential exposure," "credential theft," and compromised data following law-enforcement takedowns.

“When executed, RedLine would steal data, including access devices, from victims’ computers.” Infostealers thieve billions of user credentials such as passwords annually.

Scanning and login attempts targeting SSH service honeypots occurred from multiple attack sources.

provided criminals access to “bots” or “browser fingerprints” ... including IP addresses, session cookies, operating system information, and plugins

META is actively used in attacks, being deployed to steal passwords stored in Chrome, Edge, and Firefox, as well as cryptocurrency wallets.

These fingerprints meant the criminals could access ... without triggering security warnings ... Users could even bypass multi-factor authentication.

It runs as follows, scanning the address range specified in “ranges” using the credentials contained in “pass.”

“Meta” is also written in Go and serves as a propagation-focused malware that scans SSH ports and executes commands to install malware upon a successful connection.

“When executed, RedLine would steal data, including access devices, from victims’ computers.” Infostealers thieve billions of user credentials such as passwords annually.

A clear and persistent sign of the infection is the EXE file generating traffic to a command and control server at 193.106.191[.]162, even after the system reboots, restarting the infection process on the compromised machine.

It also sends the attack results to “hxxp://youpost[.]In/” via an HTTP POST request.

When the malicious script runs, it will download various payloads, including DLLs and executables, from multiple sites, such as GitHub.

“When executed, RedLine would steal data, including access devices, from victims’ computers.”