JPCERT/CC highlights ongoing DangerousPassword campaigns against Japanese cryptocurrency exchanges, detailing four attack patterns: CHM files via LinkedIn, OneNote files, VHD-delivered payloads, and macOS targeting. The operators use social engineering, script-based malware, and C2 communications with anti‑defense evasion to deploy the threats and collect data from infected hosts. #DangerousPassword #CryptoMimic #SnatchCrypto #LinkedIn #OneNote #VHD #macOS
Keypoints
- DangerousPassword campaigns have persisted since 2019, using multiple delivery patterns to infect targets (LinkedIn-sent CHM via RAR, OneNote attachments, VHD containers, and macOS payloads).
- Attackers contact targets through LinkedIn, disguise malware as job offers, and deliver a CHM file that downloads an MSI and a PowerShell-based second-stage payload.
- The MSI stage collects host information and exfiltrates it via HTTP POST, with data encoded in Base64.
- OneNote-based infections embed an MSI that saves a DLL and uses curl for download, and can detect antivirus software to alter behavior and delivery.
- The OneNote delivery includes anti-analysis techniques like DLL unhooking and injection paths (Explorer or Rundll32) to evade defenses.
- VHD files mount as virtual disks containing a decoy PDF, a main DLL, and an EXE to start the DLL, representing a portable delivery method.
- macOS targets employ AppleScript to download and execute an unauthorized application, with XOR decoding and a C2 download step.
MITRE Techniques
- [T1566.001] Phishing – Spearphishing Attachment – ‘The file sent via LinkedIn is compressed in RAR format… contains a Windows Help file (CHM file). When this file is executed, it downloads and executes an external Windows Installer file (MSI file).’
- [T1059.007] JavaScript – JScript – ‘Figure 2 shows a part of the malware code for collecting information about the infected host. You can see that it is written in JScript.’
- [T1059.001] PowerShell – ‘The executed MSI file uses a PowerShell script to download and execute an additional MSI file…’
- [T1105] Ingress Tool Transfer – ‘downloads and executes an external Windows Installer file (MSI file).’
- [T1041] Exfiltration Over C2 Channel – ‘The information is sent by HTTP POST request… Base64 encoded.’
- [T1132] Data Encoding – ‘Base64 encoded.’
- [T1204.002] User Execution – ‘clicking on the icon that appears when viewing a OneNote file… leads to the malware infection.’
- [T1059.005] AppleScript – ‘AppleScript is contained, and it downloads an unauthorized application in main.scpt using the curl command and then executes it.’
- [T1140] Deobfuscate/Decode Files or Information – ‘XOR decode the contents of the file to read…’
- [T1562.001] Impair Defenses – ‘detect antivirus software… cancels the hook process to NTDLL to bypass monitoring by the antivirus software’ (Avast, Avira, Bitdefender, Kaspersky, Sophos, Trend Micro, Windows Defender)
Indicators of Compromise
- [Domain] C2 domains used by DangerousPassword – www.thecloudnet.org, azure.protection-service.cloud, and other domains listed in Appendix A
- [IP] C2/command infrastructure IP – 104.200.137.32
- [Hash] Malware/file hashes – bdd109cba8346548dd6fe5110180aa23eb9f5805c90733025344a5881c15c985, 4867215129fead94a52e4b62ef6851b3170a0a8b66a87eadfc919f84257d25b8, and 2 more hashes
- [File Name] Known MSI payloads – Administrator-a214051.msi, [user name]-a12345 1.msi
Read more: https://blogs.jpcert.or.jp/en/2023/05/dangerouspassword.html