Experts have identified a new ongoing campaign which looks to distribute the novel META malware to as many endpoints as possible.
Initially discovered by security researcher and ISC Handler Brad Duncan, META is an infostealer malware, which can harvest passwords and other login data from browsers, as well as from cryptocurrency wallets.
The distribution campaign is nothing out of the ordinary, with threat actors opting for emails and macro-heavy Excel files. The emails are usually a “notification” about fund transfers, with “details” found on the link attached to the email.
Filling the void
The link leads to DocuSign, a well-known digital signature service provider, where users are invited to download the Excel file and urged to “enable content” which, instead, enables malicious macros.
The researcher is saying the email isn’t particularly convincing, but believes that it is still capable of fooling many recipients.
The macro will then download multiple payloads, some being hosted on GitHub, as well. The final payload, once assembled, will be visible on the compromised endpoint under “qwveqwveqw.exe”. It will also have a registry key, for persistence.
Speaking of persistence, META is found to modify Windows Defender via PowerShell, to exclude .exe files from being scanned by antivirus software.
According to BleepingComputer, META is one of a couple of new infostealers which are trying to fill the void after Racoon Stealer left the market. It’s being sold online for a monthly subscription of $125. Those interested in unlimited, lifetime use, will have to shell out $1,000.
META is built upon RedLine Stealer, another hugely popular infostealer.
RedLine Stealer is often used to steal passwords stored in people’s browsers, and is usually sold online for roughly $150 - $200. As email is the most popular distribution method, security experts are warning users to be extra careful when accepting attachments from emails, or clicking on links.
Via: BleepingComputer
