TLP-GREEN
The distribution method of malware has been diversifying as of late. Among these methods, a malware strain that uses the Windows Help file (*.chm) has been on the rise since last year.
First, unlike the types covered in the past, a blank Help screen is created when the CHM file is executed.
The contents of the malicious script that is run under the noses of users. It clearly has a simpler structure compared to previous types. This script uses mshta to execute a malicious command that exists in the address "hxxps://2023foco.com[.]br/plmckv.hta".
A malicious VBScript exists within this address and a portion of its command. The malicious VBScript has fragmented strings to evade detection, and is responsible for executing PowerShell commands.
There are 2 PowerShell commands that are executed. The commands respectively download and execute the vbs and hta files from the following URL.
Dowload URL
The distribution method of malware has been diversifying as of late. Among these methods, a malware strain that uses the Windows Help file (*.chm) has been on the rise since last year.
First, unlike the types covered in the past, a blank Help screen is created when the CHM file is executed.
The contents of the malicious script that is run under the noses of users. It clearly has a simpler structure compared to previous types. This script uses mshta to execute a malicious command that exists in the address "hxxps://2023foco.com[.]br/plmckv.hta".
A malicious VBScript exists within this address and a portion of its command. The malicious VBScript has fragmented strings to evade detection, and is responsible for executing PowerShell commands.
There are 2 PowerShell commands that are executed. The commands respectively download and execute the vbs and hta files from the following URL.
SkyWatchSM Alert Legend
Warning
Active Threat
Malware
Ransomware
Phishing
Network/IOT
Glesec Information Sharing Protocol
GLESEC CYBER SECURITY INCIDENT REPORTS are in compliance with the U.S. Department of Homeland Security (DHS) Traffic-Light Protocol (TLP).
TLP-White
Disclosure is Not Limited.
TLP-Green
Limited Disclosure, Restricted Only to the Community.
TLP-Amber
Limited Disclosure, restricted to the Participant's Organization.
TLP-Red
Not for Disclosure, Restricted/ Classified - Only Shared with US DHS.
Discover Glesec.
Authority. Consistency.
Sign-up today for SkywatchSM Alerts.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.