Cybersecurity (opens in new tab) researchers have shared details about an ill-conceived malware (opens in new tab) campaign that falls flat on its face.
Enterprise network security company Trustwave spotted a campaign that uses a novel disk image file to conceal malware. It says that while the use of unusual attachments helps bypass security software like firewalls (opens in new tab) and antivirus software (opens in new tab), it also runs the risk of raising red flags with users.
However, in this instance, the threat actors used such an esoteric file format that it isn’t even supported by Windows (opens in new tab).
- Protect your devices with these best antivirus software (opens in new tab)
- Here's our choice of the best malware removal (opens in new tab) software on the market
- These are the best ransomware protection tools (opens in new tab)
“Encapsulating malware in an unusual archive file format is one of the common ways to bypass gateways and scanners. However, this strategy also poses a hurdle – the target system must recognize the file type or at least have a tool which can unpack and process the file,” notes Trustwave in its analysis (opens in new tab).
WIMs and fancies
The campaign saw the threat actors use the WIM (Windows Imaging Format) file, disguised as an invoice or a consignment note, to smuggle malware.
In the past threat actors have relied on disk image files such as .ISO, .IMG, and .DAA to conceal malware. However, as Trustwave notes, unlike the other disk image formats, Windows does not have the built-in ability to extract these files, which can only be unpacked using archiving tools (opens in new tab) like 7Zip (opens in new tab), PowerISO, and PeaZip (opens in new tab).
Trustwave analysis reveals that the file contains the Agent Tesla (opens in new tab) malware, which is a dangerous remote access trojan (RAT) that can exfiltrate data via HTTP, SMTP, FTP, and Telegram and also allow the threat actors to exercise control over a compromised system.
However, concealing such a lethal malware inside such an obscure file format isn’t really a smart move as it ensures that a majority of the targets will not be able to accidentally infect their computers.
- These are the best endpoint protection tools (opens in new tab)
