Cloud-Based Malware Attack Abusing Google Drive & Dropbox to Hack Windows

A new malware campaign, CLOUD#REVERSER, leverages cloud storage services like Google Drive and Dropbox to deploy malicious scripts that embed themselves within the cloud platform and grant the attacker persistence on the target system. 

The malware can then steal data and execute commands remotely by updating operational scripts and fetching commands from a remote server, which is facilitated through VBScript and PowerShell scripts that are re-executed via Windows scheduled tasks.  

A phishing email with a ZIP archive attachment initiates the attack, by containing a single executable disguised as an Excel file using Left-to-Right Override (LTRO) characters. 

The LTRO character flips the order of subsequent characters, making the filename appear to have a benign .xlsx extension (e.g., RFQ-101432620247fl<LTRO_CHARACTER>xslx.exe becomes RFQ-101432620247flexe.xlsx to the user), which trick deceives users into double-clicking the malicious executable and launching the malware infection. 

The malware initially drops several obfuscated files, including VBScripts and a lure file, into the C:\ProgramData directory, and then it executes the first VBScript (3156.vbs), which leverages WScript.exe to achieve persistence. 

This script deobfuscates its code and performs several actions: 1) suppresses errors; 2) sets the working directory; 3) creates objects for file system manipulation; 4) executes the .xlsx lure and two other VBScripts using ShellExecute; 5) sleeps for 3000 seconds; and finally, 6) cleans up by deleting all .vbs and .jse files in the directory.  

The malicious script i4703.vbs creates a scheduled task disguised as a Google Chrome update to achieve persistence on the infected machine, which runs another hidden script (C:\ProgramData\97468.tmp) every minute with elevated privileges. 

Similarly, another obfuscated script, i6050.vbs, creates a separate scheduled task named “GoogleUpdateTaskMachineUF” that triggers another VBScript (C:\ProgramData\68904.tmp) to run every minute, which ensures continuous execution of potentially malicious scripts even after the initial malware payload is removed. 

The analysis by Securonix identified two VBScripts, 97468.tmp and 68904.tmp, both leveraging Schtasks for execution, that decode to reveal their functionality: launching PowerShell commands to execute hidden PowerShell scripts (Tmp912.tmp, tmpdbx.ps1, Tmp703.tmp, zz.ps1) stored in C:\ProgramData. 

Interestingly, the first script employs WScript.Shell to achieve this through two methods: firstly, reading the script content and invoking it via Invoke-Expression, and secondly, directly calling the script using the -f flag. 

The second script simply uses the -f flag for execution. In the latter case, the script is even deleted after running using objFSO. DeleteFile method.  

Attackers leveraged a VBScript to download a PowerShell script that fetches a compressed binary, which is then directly executed in memory using reflection to bypass potential antivirus or EDR detection. 

The script establishes communication with the attacker’s C2 server (IP: 159.100.13.216, Port: 6606) by decompressing the downloaded binary, loading it into memory as a.NET assembly, and invoking a predefined “start” method with the C2 server details.