Hackers Leverage Judicial Notifications to Deploy Info-Stealer Malware
A recent phishing campaign has been identified, targeting Colombian users through counterfeit judicial notifications. This campaign deploys a multi-stage malware delivery system that results in AsyncRAT infection.
A recent phishing campaign has been identified, targeting Colombian users through counterfeit judicial notifications. This campaign deploys a multi-stage malware delivery system that results in AsyncRAT infection.
The phishing emails are crafted in Spanish and mimic official communications from the "Juzgado 17 Civil Municipal del Circuito de Bogotá" (17th Municipal Civil Court of the Bogotá Circuit). These emails falsely notify recipients of lawsuits, employing formal legal language to enhance authenticity.
The emails include SVG file attachments named "Fiscalia General De La Nacion Juzgado Civil 17.svg," translating to "Attorney General's Office Civil Court 17.svg" in English. Upon execution, these files redirect users to a false webpage imitating the Attorney General's Office and Citizen’s Consultation Portal.
The fake interface integrates elements such as judicial information systems and fictitious registration numbers to reinforce its legitimacy. When users download files from this page, they trigger a malware infection chain involving multiple file stages and encoding techniques.
Technical Details: Infection Chain and Implementation
Seqrite analysts have identified this malware campaign during threat intelligence monitoring. The attack uses SVG files as the initial vector, with embedded JavaScript executing the OpenDocument() function, which initiates the attack sequence.
A recent phishing campaign has been identified, targeting Colombian users through counterfeit judicial notifications.
function OpenDocument() { // Accept base64 encoded embedded data // Decode it to attacker controlled "HTML" blob // Create a temporary URL object for that blob // Open that URL in new tab }
This process decodes base64-encoded data to create an HTML blob, displayed in a new browser tab with a fake progress bar interface. This action triggers the download of a malicious HTA file named "DOCUMENTO_OFICIAL_JUZGADO.HTA."
The HTA file contains obfuscated code with extensive base64-encoded content. When executed, it decodes and deploys a Visual Basic script file, "actualiza.vbs," on the victim's system. This script executes a PowerShell command, connecting to a domain to download an encoded file, "Ysemg.txt."
Subsequent decoding processes yield "classlibrary3.dll," a .NET assembly that functions as a module loader. The loader incorporates anti-virtual machine techniques to evade detection, injecting the AsyncRAT payload into the MSBuild.exe process.
AsyncRAT provides comprehensive remote access capabilities, including keystroke logging, system information gathering, and command-and-control communications via encrypted TLS connections using MessagePack serialization.
Based on reporting by Cyber Security News.