ScrubCrypt Deploys VenomRAT with an Arsenal of Plugins

Testo acquisito dalla fonte

Evento MISP pubblicato con TLP:CLEAR: ScrubCrypt Deploys VenomRAT with an Arsenal of Plugins. Report from - [URL rimossa] (1712774572) Last year, FortiGuard Labs uncovered the 8220 Gang’s utilization of ScrubCrypt to launch attacks targeting exploitable Oracle WebLogic Servers. ScrubCrypt has been described as an “antivirus evasion tool” that converts executables into undetectable batch files. It offers several options to manipulate malware, making it more challenging for antivirus products to detect. We recently discovered a threat actor distributing a phishing email containing malicious Scalable Vector Graphics (SVG) files. The email lures victims into clicking on an attachment, which downloads a ZIP file containing a Batch file obfuscated with the BatCloak tool. ScrubCrypt is then used to load the final payload, VenomRAT while maintaining a connection with a command and control (C2) server to install plugins on victims’ environments. The plugin files downloaded from the C2 server include VenomRAT version 6, Remcos, XWorm, NanoCore, and a stealer designed for specific crypto wallets. This article provides detailed insights into how the threat actor distributes VenomRAT and other plugins. Click to Enlarge Figure 1: Attack chain ## Initial Access The attacker initiates the attack by sending a phishing email stating that a shipment has been delivered. It also includes an attached invoice. The attachment is an SVG file named “INV0ICE\_#[dominio rimosso],” which contains e