New wave of malicious XLS files spreading Zloader
The SonicWall Capture Labs Threat Research Team has observed a new wave of malicious Excel files distributing Zloader.
From the onset of 2020, we have observed malware campaigns using the Macro 4 feature available in Microsoft Excel, which we have written about in our previous blog posts.
Thus far, malicious Excel files used for spreading Zloader have contained the following characteristics:
- Two Sheets: Some of them had one visible sheet and one other sheet hidden whereas in others both the sheets are visible
- Auto_Open name is not visible in the Name Manager dialog box; and
- Excel in-built functions CHAR or MID were used to operate upon cell data which were later joined using concatenation operator '&' to construct further instructions
Fig-1: Excel file used earlier by Zloader
Transformations observed in this new wave of MS-Excel files :
- Excel has more than 2 sheets with one visible worksheet and remaining sheets, including a macro sheet, are hidden
- Auto_Open is visible in the name manager dialog box;
- Data is simply retrieved from cells, joined using a concatenation operator to construct further instructions; and
This re-modelling gives the file a more legitimate appearance.
Fig-2: Excel with visible and hidden sheets
Fig-3: Auto_Open name visible in Name Manager dialog box
Fig-4: Plain cell data reading and concatenation
These files were created either on 3rd or 4th June 2020 which indicates the freshness of samples and RTDMI detection effectiveness.
Fig-5: RTDMI Detection
Indicators Of Compromise:
SHA256 of Malicious MS-Excel files:
- 41879c115ae2a85d0a136d62b6169e95756f0b9bd8f47e32238a4e2e26e0fc03
- 5c264ad2647000a4e260ff5f60df04a2d9b24676dc7b4bc45e07e1b70c053b0c
- cffef738b2ec86d56432f0a988cf4a8511bf813515edc91b2e1d6729d5f1cfef
- 0c47d7fe4c8d6563fd4c616080703a974d04694658b23c2d36ecc03b03eeec32
- b24019b7b02989bb5e02e5243d704d63bab71442613574a7d4a3a69a8b36541e
- 9c1d837a523f86c8117be3a607f1910e248993e6e77c47bb86b17eec2503e627
- 56a662fcfaa103edd1fc45ed24c7e974662136a95c2191e65f46702b4d98a7ea
- 0e186d534befcd860e2618d4cf77af6180effe42b07cecde75164142e2090ff4
- 2a0d637ff6bcdf1fd37905fb84926e7ef35190fc62e97f3305b1da65b9f15a8f
- f83f7117ddab2be46f57000e3623a22f15f46da2c4878000bb8de87c9b2ebba9
Network Connectivity:
- https://destgrena[.]at/3/tsk.dll
SHA256 of payload:
- 444a977a2d0768f115fef0704a3f067d937823877a8202a4796425a58f49b6e0
- 1526e62be6b34c6ea39220569f90e44cf04efccaa4b4ed75af8a4f669f10b2e9
- 06a297b1c6b0b25ef3cc3ca6c77ad62e2ff5bd801c8cb9c081fbb4ea90d313fa
- 363d8b43541e37ae9b25a5fd6b6eef5245fc667c449b3d37e45a3de15d60780b
- 6c95e2eeeb98b0557a849e972ad26d2c77e7d9d8bfbd45ec680cfb6eb508667c
- 8cbe7c61e8b1bd3d2187b9e7f10449dfcb4f20c309cf768433f164dc83149a1a
- 327b41d9bcad614f2e62b3e838ae9a1237dc0bd3ed17c59e1290abf596e5f178
- b22779f52daffae57465b8becfa4e19240304d6e835ffe4448fa4d5588a2e9cc
- e27bcec6ccb48108abdf87328d0e260de1036df851af20317061da2419734d1f
