Malvertisers zoom in on cryptocurrencies and initial access | Malwarebytes

MITRE Techniques

• [T1189] Drive-by Compromise – The threat actor is targeting users via Google ads related to a search for zoom. ‘The threat actor is targeting users via Google ads related to a search for zoom’
• [T1204] User Execution – Users are tricked into downloading a file called ZoomInstaller.zip. ‘Users are tricked into downloading a file called ZoomInstaller.zip’
• [T1574.001] DLL Search Order Hijacking – _Zoom.exe side-loads librcrypto-3-zm.dll; DLL side-loading used to bypass detection. ‘The _Zoom.exe side-loads librcrypto-3-zm.dll’
• [T1036] Masquerading – Main executable is a legitimate binary signed by Zoom Video Communications, Inc. ‘The _Zoom.exe file is a legitimate binary signed by Zoom Video Communications, Inc’
• [T1027] Obfuscated/Compressed Files and Information – Payload inflated with junk code to evade detection. ‘Dropped file over 774 MB… The file has been inflated with junk code’
• [T1059.001] PowerShell – Base64-encoded PowerShell reveals the malware’s command and control server and telemetry commands. ‘The Base64-encoded PowerShell reveals the malware’s command and control server as well as a number of other commands such as reporting telemetry back about the machine and any security software installed’
• [T1105] Ingress Tool Transfer – Download process initiated via a JavaScript event linking to the MSIX file hosted. ‘The download process is initiated via a JavaScript event linking to the MSIX file is hosted’
• [T1082] System Information Discovery – Telemetry on machine and installed security software. ‘reporting telemetry back about the machine and any security software installed’
• [T1041] Exfiltration – Data theft via stealer payload and data exfiltration. ‘data exfiltration’
• [T1071.001] Web Protocols – C2 and command-and-control server communications. ‘a number of other commands such as reporting telemetry back about the machine and any security software installed’