New alleged MuddyWater attack downloads a PowerShell script from GitHub

Security expert spotted a new piece of malware that leverages weaponized Word documents to download a PowerShell script from GitHub.

Security expert discovered a new piece of malware uses weaponized Word documents to download a PowerShell script from GitHub.

This PowerShell script is also used by threat actors to download a legitimate image file from image hosting service Imgur and decode an embedded Cobalt Strike script to target Windows systems.

The researcher Arkbird published technical details of the malware that uses steganography to hide the malicious code in the image.

Arkbird pointed out that the sample could be part of the Muddywater APT’s arsenal.

The attack chain starts with the execution of a macro embedded in a legacy Microsoft Word (*.doc) file, a technique that was employed by the Muddywater group in its attacks.

Upon executing the embedded macro, it launches powershell.exe and attempts to execute a PowerShell script hosted on GitHub (archived).

The PowerShell is composed of a single line that downloads a PNG file from the image hosting service Imgur.

The PowerShell scrips analyze a set of pixel values of the image to prepare the next stage payload.

“As observed by BleepingComputer and shown below, the payload calculation algorithm runs a foreach loop to iterate over a set of pixel values within the PNG image and performs specific arithmetic operations to obtain functional ASCII commands.” reported Ax Sharma on Bleeping Computer.

PowerShell script uses the image to calculate the payload
Source: BleepingComputer

Once decoded, the script reveals a Cobalt Strike payload that allows attackers to deploy “beacons” on compromised Windows machines.

The shellcode uses an EICAR string to evade the detection by tricking the defense into thinking that the code is used as part of a security test.

The EICAR Anti-Virus Test File, or EICAR test file, is a computer file that was developed by the European Institute for Computer Antivirus Research (EICAR) and Computer Antivirus Research Organization (CARO), to test the response of computer antivirus (AV) programs. Instead of using real malware, which could cause real damage, this test file allows people to test anti-virus software without having to use a real computer virus.

The payload receives instructions from the C2 via a WinINet module.

The researcher noted that the domain used as C2 was registered on December 20 and is no longer active, while the scrip was uploaded in the GitHub account on December 24.

Additional details about this attack, including Indicators of Compromise (IOCs) and YARA rules, are available in the post published by Bleeping Computer.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, PowerShell)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.