Short thread about a specific malspam campaign delivering ZLoader as there appears to have been a recent uptick in the number of samples being submitted to VT, etc. Also seeing more tweets about the campaign.
The campaign appears to have started in January. At first they used PDF attachments containing Bilty or TinyURL links. These redirected to compromised WordPress sites, that then redirected to newly registered domains under their control, that would then redirect to Zoho Docs.
Hosted at Zoho Docs was an .xls file with a typical Office macro lure and a hidden sheet + XLM macro. The macro would download a 32-bit ZLoader DLL (from the same domain that had previously redirected to Zoho Docs) and drop it to C:\Users\Public where it was to be executed.
You could expect to see folders/files created in %APPDATA% (including a copy of the .dll), a couple of newly created subkeys at HKEY_CURRENT_USER\SOFTWARE\Microsoft\, and persistence setup via the Run key -> rundll32.exe %APPDATA%\<random>\*.dll,DllRegisterServer.
On Feb 12th they began to use Excel web queries to download additional macro containing the next stage payload URL. Feb 13th, they had gone away from exclusively using PDF attachments and started to attach the .xls downloader (hidden sheet + XLM macro) directly to the emails.
Early in March the XLM macro sheets become very hidden. They've also started to incorporate other macro lures like DocuSign. Just a couple days ago they stopped using web queries as an additional stage (who knows how long this will last).
Here are some recent blogs that examined samples from the campaign:
comae.com/posts/2020-02-…
hornetsecurity.com/en/security-in…
comae.com/posts/2020-03-…
inquest.net/blog/2020/03/1…
comae.com/posts/2020-02-…
hornetsecurity.com/en/security-in…
comae.com/posts/2020-03-…
inquest.net/blog/2020/03/1…
