Hackers Outsmart SEGs with Unbelievably Sophisticated Malware

Threat actors are exploiting SEG limitations by embedding malicious HTML files within .zip archives disguised as .mpeg video files, where SEGs incorrectly identify the archive contents as safe, allowing bypass. 

Upon extraction with standard tools, the archive appears to contain a non-playable .mpeg, deceiving users, and when opened within Outlook or Windows Explorer, the true HTML content is revealed, enabling the execution of embedded FormBook malware. 

Phishing emails target Spanish-speaking employees at an international financial institution, disguising themselves as invoices, and employ advanced techniques, including a full email body and signature, bypassing Cisco IronPort and likely other email security gateways. 

The emails utilized the “Roundcube Webmail/1.4.8” User-Agent and contained an attached archive with obfuscated malicious content. 

Analysis indicates Secure Email Gateways (SEGs) incorrectly parse archive files, allowing malicious attachments to bypass detection. While SEGs effectively blocked standalone malicious HTML emails, they failed to identify and block malicious content within .zip archives. 

Cisco IronPort’s behavior exemplifies this, extracting .zip contents to reveal a GIF and HTML file, highlighting the SEG’s inability to detect malicious payloads embedded within archives. 

It identified a .zip archive containing a file disguised as a.mpeg video within an email. Despite the incorrect file extension, IronPort accurately classified the file as HTML, which, likely employed to evade detection, was successful in misleading IronPort’s initial scan. 

Using common archive extraction tools will show that similar deceptive tactics are effective against other security gateways. A .zip archive, seemingly innocuous to standard security tools and appearing as an .Mpeg, like common archive extractors, exhibits deceptive behavior. 

While Windows Explorer correctly identifies the archive’s contents as an .html file, Power ISO and 7-Zip misclassify the enclosed file as an .Mpeg. 7-Zip’s generic warning about archive headers offers insufficient insight, highlighting the need for more sophisticated analysis to uncover potential threats. 

Analysis by Cofense of a .zip archive using the Ubuntu unzip tool revealed a discrepancy between the locally stored file name and the actual content. 

By examining the archive’s header and footer in a text editor, investigators determined that the threat actor had intentionally mislabeled the file as a.Mpeg in the header, while the footer correctly identified it as a .html file. 

It highlights the limitations of many common archive extraction tools, which primarily rely on header information and may overlook critical details hidden in the file footer. 

A deceptively simple HTML file conceals a nested ZIP archive containing a CAB file disguised as a CMD script, which unpacks into a DBat Loader executable, which downloads and executes FormBook in memory. 

FormBook, a notorious information stealer, exfiltrates sensitive data, including keystrokes, credentials, and network traffic, to multiple C2 servers, while its ability to download additional malware poses a significant risk to infected systems. 

Also Read:

• 250 Million Hamster Kombat Players Under Attack by Android and Windows Malware
• Stargazers Ghost Network – A Network of GitHub Accounts Distributing Malware