Infostealer Malware: Targeting the Italian Region

MITRE Techniques

• [T1566.001] Spearphishing Attachment – The attacker delivered emails through spam or phishing mail with a password-protected ZIP named “IT_Fattura_n99392.zip.” Quote: “Upon clicking the link, which comes through spam email, a password-protected ZIP file named “IT_Fattura_n99392.zip” is downloaded into the local system.”
• [T1218.005] Signed Binary Proxy Execution: MSHTA – The VBScript is invoked via MSHTA to run code from a URL. Quote: “it launches powershell.exe and it tries to run the script file directly from the URL using MSHTA.”
• [T1218.011] Signed Binary Proxy Execution: Rundll32 – The malware uses rundll32 to execute a DLL for rendering/launch. Quote: “”C:WindowsSystem32rundll32.exe” “C:Program FilesWindows Photo ViewerPhotoViewer.dll”, ImageView_Fullscreen C:ProgramDataimage.png”
• [T1105] Ingress Tool Transfer – The payloads are downloaded from remote sources (GitHub) during execution. Quote: “start.exe downloads binary payloads from github which get dropped in %appdata%Roamingwininfo64lib32.exe”
• [T1555.003] Credentials in Web Browsers – The trojan exfiltrates browser data (cookies, bookmarks, credentials). Quote: “The trojan steals information such as cookies, bookmarks, credit cards, downloads, and credentials from browsers by comparing the hardcoded browser list.”
• [T1547.001] Registry Run Keys/Startup Folder – The malware creates an auto-start entry in the Run key. Quote: “HKUSOFTWAREMicrosoftWindowsCurrentVersionRunEAC_Update: “C:UsersAppDataRoamingwininfo64lib32.exe””