Pierluigi Paganini January 04, 2021

Security expert spotted a new piece of malware that leverages weaponized Word documents to download a PowerShell script from GitHub.

Security expert discovered a new piece of malware uses weaponized Word documents to download a PowerShell script from GitHub.

This PowerShell script is also used by threat actors to download a legitimate image file from image hosting service Imgur and decode an embedded Cobalt Strike script to target Windows systems.

The researcher Arkbird published technical details of the malware that uses steganography to hide the malicious code in the image.

Arkbird pointed out that the sample could be part of the Muddywater APT’s arsenal.

The attack chain starts with the execution of a macro embedded in a legacy Microsoft Word (*.doc) file, a technique that was employed by the Muddywater group in its attacks.

Upon executing the embedded macro, it launches powershell.exe and attempts to execute a PowerShell script hosted on GitHub (archived).

The PowerShell is composed of a single line that downloads a PNG file from the image hosting service Imgur.

The PowerShell scrips analyze a set of pixel values of the image to prepare the next stage payload. 

“As observed by BleepingComputer and shown below, the payload calculation algorithm runs a foreach loop to iterate over a set of pixel values within the PNG image and performs specific arithmetic operations to obtain functional ASCII commands.” reported Ax Sharma on Bleeping Computer.

Once decoded, the script reveals a Cobalt Strike payload that allows attackers to deploy “beacons” on compromised Windows machines.

The shellcode uses an EICAR string to evade the detection by tricking the defense into thinking that the code is used as part of a security test.

The EICAR Anti-Virus Test File, or EICAR test file, is a computer file that was developed by the European Institute for Computer Antivirus Research (EICAR) and Computer Antivirus Research Organization (CARO), to test the response of computer antivirus (AV) programs. Instead of using real malware, which could cause real damage, this test file allows people to test anti-virus software without having to use a real computer virus.

The payload receives instructions from the C2 via a WinINet module.

The researcher noted that the domain used as C2 was registered on December 20 and is no longer active, while the scrip was uploaded in the GitHub account on December 24.

Additional details about this attack, including Indicators of Compromise (IOCs) and YARA rules, are available in the post published by Bleeping Computer.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Pierluigi Paganini

(SecurityAffairs – hacking, PowerShell)

[adrotate banner=”5″]

[adrotate banner=”13″]