The operators of a Trickbot spam campaign have found a new way to spread their digital infection: by using fears of a biological one. Spam targeting Italian e-mail addresses is playing on fears over the Coronavirus outbreak in that country.

The e-mail carries a document purported to be a list of precautions to take to prevent infection. But the enclosed file is in fact a weaponized Word document, carrying a Visual Basic for Applications (VBA) script that carries a dropper used to deliver a new Trickbot variant.

Hunting for a hook

The Coronavirus twist to the spam message and the Trickbot malware delivered on it may be new, but the mechanisms used to deliver it (including the spam “bots” that send the message, the enclosed scripted Word document and the JavaScript dropper) are similar or identical to those used in campaigns that have been active for at least six months.

Sophos detected other email payloads from the same spam-generating malware dating back to September of last year, spiking on October 29, 2019. But these earlier spam messages, which also carried malicious documents, carried a different variety of concern-inducing calls to action, with subject lines such as “you have email about your credit” and “you have received fax about your loan.”

Incidents of messages sent by the spambot behind the Trickbot campaign over the past six months caught by SophosLabs spam traps.

But with concerns about COVID-19 on the rise – particularly in Italy, where cases are surging – the spam campaign’s subject line is now in tune with the concerns of the day.

The emails, with the subject line “coronavirus: informazioni importanti su precauzioni” – purportedly from a “Dr. Penelope Marchetti ”—state (in Italian):

Due to the fact that cases of coronavirus infection are documented in your area, the World Health Organization has prepared a document that includes all necessary precautions against coronavirus infection. We strongly recommend that you read the document attached to this message!

The attached document is, of course, viral in a totally different sense of the word.

The chain of infection

When opened, if macros are disabled, the Word document displays a message asking the recipient to enable editing and content because “this document was created in an earlier version of Microsoft Office Word.”

If macros are already enabled, or if the targeted user complies with the instructions, the VBA script does a number of things:

  • It disgorges files encoded within the document to disk: a VBA macro file (vbaProject.bin), and several Word-related XML files. The macro, in turn, contains an obfuscated JavaScript (jse) file.
  • It connects back to a PHP script on a remote server (hxxps://185[.]234.73.125/wMB03o/Wx9u79.php in some samples) – passing the IP address and some basic details about the target as variables within an HTTP GET request.
  • It calls the macro file. While the macro script is obfuscated by code from legitimate VBA script, its actual function is to create the JavaScript dropper and a .bat batch file that executes the dropper with the Windows Script Host (WSH) command line tool, cscript.exe.

The JavaScript file (detected by Sophos as JS / Agent-BCAJ ) connects back to a command and control server (in some cases, the same PHP script as the VBA script does] 1, sending back the computer name and some other data in its . request . When successful, it downloads a Base64-encoded Windows executable, saving it in the system’s set location for temporary files; For example:

 C:UsersusernameAppDataLocalTemp320455ed.pro

Next, it creates a separate JavaScript file to decode and execute the malicious payload, and then launches it using wscript.exe, another WSH executable. In one sample tested, once launched, the dropper’s malicious payload attempts to connect to 23 [.] 19 [.] 227 [.] 235.

As with most viruses – digital or biological – this particular contagion can be prevented through good hygiene: Disable macros in Office applications for all but the most trusted documents, and train everyone in the organization what not to do with documents received via email.

IoCs

Network indicators

hxxps://185[.]234.73.125/wMB03o/Wx9u79.php

23[.]19.227.235

We analyzed the following files during this investigation:

SHA256 Filename
dd7023dd82b641c9307566b87acf0951f16b27c34094a341fa1fe7671d269bf4 RANLSOJF.JSE
58e918466a61740abe42a2d1ca29bd8d56daf53912e6d65879cbe944466fb80c ERRORFIX.BAT
8e3240a2a6b07ae8a6fde884c0e18e476ca3e92438022fe1a1ad4b2ba2334737 A.COM

Acknowledgments

SophosLabs would like to acknowledge the contributions to this report from analysts Richard Cohen, Brett Cove, and Suriya Natarajan.

Save & Share Cart
Your Shopping Cart will be saved and you'll be given a link. You, or anyone with the link, can use it to retrieve your Cart at any time.
Back Save & Share Cart
Your Shopping Cart will be saved with Product pictures and information, and Cart Totals. Then send it to yourself, or a friend, with a link to retrieve it at any time.
Your cart email sent successfully :)