File manager (allows a remote user to search, download, install, copy and remove files).This malicious application has the following functionality: POST request to remote command and control server Luminosity RAT The victim’s system information is also included: Access credentials for FTP servers, file servers, email clients and synchronized folders Īccess credentials for the following legitimate applications are targeted: FAR ManagerĪfter all the data is collected, it is sent to a remote C&C server by executing a POST HTTP command.Web service access credentials (account and passwords) saved in the browser history and cache with the URL they were used with.

Malicious payload that steals authentication credentials:

However, we should note that the malicious apps used specific VB and MSIL packers that can diminish the ability of antivirus to detect the malware used. Description of malicious applications used in the attackĪnalysis of the binaries and their relation to known malware shows that no new code was written specifically for this attack. They may then have used this information to craft “legitimate” email communications, so that the victim didn’t recognize the malicious aspect of the email. The hackers could have accessed and read previous communications between the target and their partners. That can only happen if the source emails were accessible to hackers and were, possibly, compromised earlier. In some cases, the subject line contained the actual text used in an organization’s correspondence.

Final Proforma InvoiceUnaBaoshan Petro-2016.8.17#01092016#.xlsx.gzįurther analysis of the emails, especially the headers, shows that most of them were sent from legitimate email addresses belonging to valid organizations.

Woodeck Specifications best Prices Quote.uue.

REQUIREMENTS FOR KUWAIT LOWER FARS HEAVY OIL DEVELOPMENT PROJECT PHASE 1.rar.

dhl shipment notification awb and complete shipping docs_docx.zip.

Saudi Aramco Quotation Request for October 2016.zip.

Energy & Industrial Solutions W.L.L_pdf.ace.

Also archives of different formats are sent in the attachments that contain executable files. Documents attached in the emails are RTF files containing an exploit for the CVE-2015-1641 vulnerability which are detected by Kaspersky Lab security products as.

Expandrive registry change