The cyber espionage group APT (Advanced Persistent Threat) Blackwell has been targeting Japanese companies with a new type of malware that researchers call “Flag pro”. Second level malware and run it.
Breaching corporate networks
The chain of infection begins with a phishing e-mail that was developed for the target organization and pretends to be a message from a trusted partner.
The e-mail contains a password-protected ZIP or RAR attachment with a Microsoft Excel file [.XLSM] linked to a malicious macro. Running this code creates an executable file in the Flag pro home directory.
When it first runs, Flagpro connects to the C2 server over HTTP and sends the system identification details obtained by executing hard-coded operating system commands.
In response, the C2 can send additional commands or a second-level payload that Flag pro can execute.
An example of a sent command Source: NTT Security
Communication between the two is base64 encoded, and there is also a configurable delay between connections to avoid creating an identifiable operating model.
Communication between Flagpro and the C2 Source: NTT Security
Flagpro has been used against Japanese companies for more than a year, at the latest since October 2020, according to a report by NTT Security.
The most recent samples the researchers were …read more
Source:: TechCrunch
This content was originally published here.