Proofpoint security researchers warn about A new information-stealing malware named “August”. This uses Word documents that contain malicious macros and it is abusing PowerShell for a fileless infection.
This malware is being distributed by TA530, who is an actor already known to be involved in very highly personalised campaigns. The August distribution campaign, researchers say, was targeting customer service and managerial staff at retailers in an attempt to steal sensitive documents and credentialsfrom the compromised machines.
To ensure successful infection, the actor used subject lines for the emails to reference to issues pertaining to alleged purchases from the targeted company’s website. These emails were targeted at employees who could supposedly help resolve the problems, which made it likely that they would open the attached documents, which supposedly contained detailed information about the issue.
However, as soon as the recipient opened the document, they would be prompted to enable the macros, which in turn would launch a PowerShell command to download and install the August stealer on the machine. The malicious payload is downloaded from a remote site as a PowerShell byte array, along with a few lines of code to deobfuscate the array through a XOR operation.
The security researchers noticed that the macros used in this campaign are similar to those used in a campaign delivering the Ursnif banking Trojan. They are meant to add sandbox evasion capabilities to the distribution attempt by performing checks such as Maxmind, task counts, task names, and recent file counts.
The August stealer was written in .NET and its authors used Confuser to obfuscate it. By looking at the source code from a particular sample, Proofpoint researchers determined that the threat can steal and upload files with specified extensions to a command and control (C&C) server, can steal .rdp and wallet.dat files, and can also steal cryptocurrency wallets including Electrum and Bither, in addition to being able to determine whether security tools such as Wireshark and Fiddler are installed on the machine.
Additionally, the malware can grab credentials from FTP applications (such as SmartFTP, FileZilla, TotalCommander, WinSCP, and CoreFTP) and messenger apps (Pidgin, PSI, LiveMessenger, and others); can collect cookies and passwords from Firefox, Chrome, Thunderbird, and Outlook; can communicate the hardware ID, OS name, and victim’s username to the C&C server; and can encrypt network data via base64 encoding, character replacement, adding a random key (passed to server encoded in the User-Agent field), and reversing the strings.
“August could be used to steal credentials and files in a wide range of scenarios. The malware itself is obfuscated while the macro used in these distribution campaigns employs a number of evasion techniques and a fileless approach to load the malware via PowerShell. All of these factors increase the difficulty of detection, both at the gateway and the endpoint,” Proofpoint researchers say.
Because cybercriminals are using increasingly sophisticated and personalised email lures, organisations are advised to use email gateways that can detect macros with sandbox evasion built-in. They should also consider educating their employees on emails that do not initially look suspicious, but which could carry malware.