Spam Campaign with .PUB Attachment Delivers RAT, Targets Food and Retail Brands

We have been following a spam campaign with attached malicious Publisher files used as malicious macro-downloaders. The cybercriminals behind it may be taking advantage of using .PUB files as the macro-downloader during the busiest quarter of the year for businesses as it is not associated with possible infections, unlike other document files such as .DOC (Word) and .XLS (Excel).

[Read: Same old yet brand-new: New file types emerge in malware spam attachments]

Behavior

These manipulated .PUB files download a malicious MSI file, installing a Remote Access Trojan (RAT) on the user’s computer after accessing the command and control (C&C) server. The choice of using an .MSI file can be a means for evasion as these are associated with legitimate Microsoft Installer files. When executed, the .PUB file displays the following:

Figure 1. .PUB file when executed

Data from our telemetry tells us that majority of the targets are in the food and retail industries, as well as a few government agencies. We have identified more than 50 companies belonging under these sectors repeatedly targeted via blocked spam messages between November 20 to 27, including the US Department of Agriculture and the Taiwanese Food and Drug Administration, Starbucks and Taco Del Mar in the food sector, and Harris Teeter and Save Mart Supermarkets in the retail industry.

The cybercriminals use social engineering techniques, likely targeting specific offices from these companies as the email addresses are disguised to appear as the “Operations Department,” while the attached file is named “invoice.pub”.

Figure 2. Sample email using the “Operations Department” signature

[Read: Spam campaign delivers malware via .WIZ, targets banks]

Further, as we scanned through the wave of emails received from detection feedback, we found emails targeting the financial sector in the first two weeks of November. This may imply that the cybercriminals were initially targeting financial institutions, some of which include La Banque Postale France, Kotak Mahindra Bank, China Construction Bank, and Natixis.

Figure 3. Sample email sent to a financial institution

The usual infection chain for these types of attacks uses a malicious Word document or Excel file as macro-downloader and uses a PowerShell function to deliver the .EXE payload. However, this malware uses the infected .PUB as the malicious macro-downloader but schedules the task of downloading and executing the .MSI file instead of doing so immediately or directly. The additional layer of detection evasion allows the msiexec process to fall under the scheduler instead of the publisher executing the macro. Once scheduled, the task now falls under the usual parameter for msiexec ,/q /I {url}, installing the file automatically and without the need for additional user interaction.

The techniques used by the cybercriminals are not new. However, the detection evasion maneuver added to the usual infection chain and payload delivery behavior makes it unique.

Figure 4. Comparing the usual macro virus routine vs. the malicious .PUB’s infection chain

[Read: Spam campaign targets Japan, uses steganography to deliver the BEBLOH banking Trojan]

We are currently following and investigating this campaign. Our most recent detections have shown that the cybercriminals have reverted to the conventional routine of using a .DOC file and delivering a different malware payload, but with a similar coding style, spam layout, and target companies. Cybercriminals will continue combining old techniques with new ones, as well as using legitimate applications and tools to infiltrate businesses for malicious activities. Make sure you stay ahead of these threats:

• Update your systems and software to prevent cybercriminals from taking advantage of possible outdated entry points.
• Be aware of urgent-looking emails with attachments. Compare and verify with previous communication and transactions if the email addresses and documents are legitimate.
• Use a multi-layered security solution that can scan and block emails with malicious attachments and URLs.

Indicators of Compromise

Hashes:

Malicious domains/URLs:

• hxxp://homeofficepage[.]com/TabSvc (Source of MSI file)
• 89.144.25.16/backnet (C&C)

 
With additional insights from Junestherry Salvador and Byron Gelera