A sophisticated phishing campaign is leveraging virtual hard disk (.vhd) files to distribute the dangerous VenomRAT malware.

The attack begins with purchase order-themed emails containing archive attachments that, when extracted, reveal hard disk image files designed to evade traditional security measures.

Batch file inside .vhd file (Source – Forcepoint)

Upon opening, the .vhd file mounts itself as a disk drive containing a heavily obfuscated batch script that performs malicious activities using PowerShell.

The batch file contains multiple layers of obfuscation including garbage characters, Base64 encoding, and AES encryption.

Forcepoint researchers identified that once executed, the malware creates a copy of itself in “C:\Users\%userprofile%\dwm.bat” and opens PowerShell to execute additional commands.

The script then modifies registry entries to ensure persistence on the infected system.

The attack chain continues as the malware drops additional files into the StartUp folder and connects to Pastebin.com where command and control server information is stored.

These techniques help the malware establish a foothold and maintain communication with its operators.

Analysis VenomRAT

Analysis of the payload reveals it is VenomRAT version 6.0.3, which includes HVNC (Hidden Virtual Network Computing) service capabilities for remote system control.

DataLogs.conf in AppData – Roaming (Source – Forcepoint)

The malware drops a DataLogs.conf file in “C:\Users\%userprofile%\AppData\Roaming\MyData\” to capture keystrokes and other sensitive information.

Config file used by VenomRAT (Source – Forcepoint)

This configuration file contains an AES encryption key “a487de3093a5DGe47d49bc0733cbcleMec5Ed75adee513c39017e977a04597dr” with a salt value of “VenombatzyVeacon”, which the malware uses for secure communication with its command servers.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

The post Hacker Weaponizing Hard Disk Image Files To Deliver VenomRAT appeared first on Cyber Security News.