Horabot Returns in Mexico, Spreading via Phishing and Email Worm Attacks
Horabot has re-emerged in Mexico with an advanced, multi-stage attack strategy. This strategy integrates deceptive CAPTCHA interfaces, living-off-the-land techniques, and an email worm-style mechanism to disseminate a Latin American banking trojan.
Horabot has re-emerged in Mexico with an advanced, multi-stage attack strategy. This strategy integrates deceptive CAPTCHA interfaces, living-off-the-land techniques, and an email worm-style mechanism to disseminate a Latin American banking trojan.
A recent investigation by our MDR team uncovered a targeted Horabot campaign. The operation was detected after an endpoint alert indicated suspicious MSHTA activity within a client environment.
Further threat hunting revealed the campaign was part of a broader Horabot operation, utilizing a Delphi banking trojan and an email spreader, alongside multiple layers of obfuscated scripts.
An attacker-controlled webpage exposed a victim panel with 5,384 entries, highlighting a significant concentration of affected systems in Mexico. This operation demonstrates a targeted approach towards Spanish-speaking users in Latin America.
Kaspersky Endpoint Security successfully intercepted the threat, terminating the malicious process and eradicating related files prior to full execution.
The infection initiates with a fake CAPTCHA page hosted on attacker infrastructure, instructing users to execute a specific MSHTA command that references a remote HTA file. This HTA file acts as a loader, displaying a blank window while retrieving external JavaScript that injects a VBScript reference into the page header.
Horabot has re-emerged in Mexico with an advanced, multi-stage attack strategy.
The VBScript is delivered with server-side polymorphism, ensuring each request yields a modified but functionally identical script, thus complicating static detection.
Subsequent VBScript stages grow increasingly complex, featuring obfuscation, custom string decoders, anti-VM measures, basic anti-Avast logic, host profiling, and data exfiltration to a command-and-control server.
The script downloads an AutoIt executable, its compiler, an obfuscated AutoIt script, and an encrypted blob. It establishes persistence via a Startup LNK file and eliminates temporary artifacts to minimize forensic detection.
The AutoIt components decrypt the blob using AES-192 with a hard-coded key, mapping the result directly into memory as a DLL. This DLL is identified as a Delphi banking trojan from the Casbaneiro/Metamorfo/Zusy family.
The trojan retrieves its configuration from hard-coded URLs, employing a custom cipher for decryption and leveraging OpenSSL libraries for HTTPS-based communication with its command-and-control server.
Horabot also features an email worm-like spreader, implemented in PowerShell and managed through staged downloaders. The spreader utilizes Outlook/MAPI automation to collect email addresses, exfiltrate contacts, clear the outbox, and send phishing emails with malicious attachments.
The emails, often disguised as invoices or confidential financial documents, direct recipients to content that reinitiates the phishing chain.
Monitor for MSHTA launching remote HTA content via the Run dialog. Detect chained JavaScript and VBScript execution from unusual domains. Identify AutoIt scripts and AES-192 usage in small loaders. Watch for Delphi DLLs with Casbaneiro-style export patterns. Network monitoring should focus on Horabot's unique HTTPS endpoints and characteristic socket frames. Pay attention to invoice-themed HTML/PDF attachments, particularly in cases of unexpected spikes in outbound email traffic.
Based on reporting by GBHackers.