Share news article

Share on facebook
Share on twitter
Share on linkedin
Share on email

Emotet Botnet Distributing Self-Unlocking Password-Protected RAR Files to Drop Malware

The notorious Emotet botnet has been linked to a new wave of malspam campaigns that take advantage of password-protected archive files to drop CoinMiner and Quasar RAT on compromised systems.

In an attack chain detected by Trustwave SpiderLabs researchers, an invoice-themed ZIP file lure was found to contain a nested self-extracting (SFX) archive, the first archive acting as a conduit to launch the second.

While phishing attacks like these traditionally require persuading the target into opening the attachment, the cybersecurity company said the campaign sidesteps this hurdle by making use of a batch file to automatically supply the password to unlock the payload.

The first SFX archive file further makes use of either a PDF or Excel icon to make it appear legitimate, when, in reality, it contains three components: the password-protected second SFX RAR file, the aforementioned batch script which launches the archive, and a decoy PDF or image.

“The execution of the batch file leads to the installation of the malware lurking within the password-protected RARsfx [self-extracting RAR archive],” researchers Bernard Bautista and Diana Lopera said in a Thursday write-up.

The batch script achieves this by specifying the archive’s password and the destination folder to which the payload will be extracted, in addition to launching a command to display the lure document in an attempt to conceal the malicious activity.

Lastly, the infection culminates in the execution of CoinMiner, a cryptocurrency miner that can also double up as a credential stealer, or Quasar RAT, an open source .NET-based remote access trojan, depending on the payload packed in the archive.

The one-click attack technique is also notable in that it effectively jumps past the password barrier, enabling malicious actors to carry out a wide range of actions such as cryptojacking, data exfiltration, and ransomware.

Trustwave said it has identified an increase in threats packaged in password-protected ZIP files, with about 96% of these being distributed by the Emotet botnet.

“The self-extracting archive has been around for a long time and eases file distribution among end users,” the researchers said. “However, it poses a security risk since the file contents are not easily verifiable, and it can run commands and executables silently.”

Found this article interesting? Follow THN on Facebook, Twitter and LinkedIn to read more exclusive content we post.

Related News

CyberSecure Announces Strategic Alliance

CyberSecure Announces Strategic Alliance

BETHESDA, Md., March 24, 2023 /PRNewswire/ — Cybersecure IPS and LockDown Inc. jointly announce that they have entered a strategic alliance to…
Tesla Model 3 Hacked in Less Than 2 Minutes at Pwn2Own Contest

Tesla Model 3 Hacked in Less Than 2 Minutes at Pwn2Own Contest

Researchers from France-based pen-testing firm Synacktiv demonstrated two separate exploits against the Tesla Model 3 this week at the Pwn2Own…
GitHub's Private RSA SSH Key Mistakenly Exposed in Public Repository

GitHub's Private RSA SSH Key Mistakenly Exposed in Public Repository

GitHub, a Microsoft subsidiary has replaced its SSH keys after someone inadvertently published its private RSA SSH host key part of…