Criminals are using a virtual hard drive image file to host and distribute dangerous malware

Forcepoint observes a new phishing campaign that distributes virtual hard drive files
The files avoid security protections to implement Venomrat
The victims end up losing confidential data, so he is on guard

Criminals are now using virtual hard disk image files to host and distribute dangerous malwareForcepoint researchers say.

In an in -depth analysis, ForcePoint said he observed a Phishing campaign, with the issue of a purchase order. In the attached file of the email there is a file that, when extracted, shows a hard drive image file (.VHD).

When the victim opens the file, it is mounted as a hard drive and runs a lot script that includes a series of obfuscations that include garbage characters, base encryption files64 and AES. The .bat file drops the remote access Trojan of Venom (rat) and generates a Powershell script that uses the Pastebin service to house C2 and exfiltrated stolen data.

Working around security solutions

Forcepoint Prashant Kumar said the threat actors opted for a VHD file to work with any email security, or Final Point Protection Solutions The objective may have installed on your device.

“Threat actors always like to find new ways to deliver malware without being detected to attack great communities,” Kumar said. “I will cover a current technique threat that actors use to avoid safety measures, deliver malware, infected systems and exfiltrated data, all through the use of a virtual hard disk image file to host and distribute the Venomrat malware.”

Venomrat is a type of Trojan that allows cybercriminals to take total control of an infected system. Once installed, it allows the attackers to execute commands remotely, steal confidential information and manipulate the victim’s computer without their knowledge. It is commonly used for keylogging and the extraction of saving credentials from browsers and web applications.

This malware is also able to capture screenshots and activate web cameras, use several persistence mechanisms and can implement additional malware. Due to its powerful capabilities, Venomrat is often distributed through phishing emails, malicious discharges and exploitation kits that are directed to the vulnerabilities of the system.

Related News

The fire chief says Blaze in Burnaby, BC, Highrise Hings 15, three seriously

Jets trade for $ 19 million WR would make sense with the dentator

Comment: The sale of China’s wrath over the ports of Panama is a call for attention for Hong Kong Tycoons

Debuting UFC’s fighter says that Molly McCann ‘terrified’ to deal with her