Kaspersky Analyzes Horabot Campaign Predominantly Affecting Mexico
Summary
Kaspersky researchers traced a Horabot campaign from fake CAPTCHA and mshta execution through polymorphic VBScript and AutoIt loaders to a Delphi banking Trojan. An exposed page attributed to the operators listed 5,384 victims, 5,030 in Mexico.
Key points
- A fake CAPTCHA page tricked users into running an mshta command that fetched a remote HTA loader.
- Server-side polymorphic VBScript stages downloaded AutoIt components, which decrypted an AES-192-encrypted blob and loaded a Delphi banking Trojan in memory.
- The Trojan harvested browser credentials and used HTTP(S) and a custom encrypted TCP protocol for command-and-control communications.
- A PowerShell spreader used MAPI to collect email addresses and distribute phishing emails with malicious PDF attachments.
- The malware included anti-VM and anti-Avast checks and established persistence with a Startup-folder LNK file.
- The researchers found an exposed page attributed to the operators that listed 5,384 victims, including 5,030 located in Mexico.
- The article provides YARA rules, a Suricata rule, and hunting queries for detecting the loaders, Trojan, and network traffic.
Article Details
- Attack Vectors
- A fake CAPTCHA page instructed victims to paste and run an mshta command that retrieved a remote HTA loader.
- The HTA loaded JavaScript that fetched and executed polymorphic VBScript stages, including an obfuscated loader that performed environment checks and gathered host information.
- The loader downloaded AutoIt components and an encrypted blob; the AutoIt script decrypted the blob with AES-192 and loaded the resulting Delphi Trojan into memory.
- The VBScript loader and Trojan used PowerShell to retrieve spreader stages.
- The spreader harvested email addresses through MAPI, filtered them, and mass-distributed phishing emails with malicious PDF attachments.
- The Delphi Trojan queried browser databases for credentials and displayed fake banking pop-ups to solicit credentials.
- The malware communicated over HTTP/HTTPS and a custom encrypted TCP socket protocol, and created a Startup-folder LNK for persistence.
- Defensive Notes
- Kaspersky Endpoint Security terminated the malicious process and removed related files before the incident progressed further.
- The article provides YARA rules for the AutoIt loader and Delphi Trojan, plus a Suricata signature for the custom socket traffic pattern framed by ## markers.
- Hunting guidance includes URL patterns associated with lure pages and staged loaders; monitor suspicious mshta commands, PowerShell downloads, AutoIt components, and Startup-folder LNK creation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aufal[.]filevexcasv[.]buzz | Attacker-controlled domain receiving victim information from the Trojan. |
| DOMAIN | cfg[.]brasilinst[.]site | Attacker-controlled endpoint used by the Trojan to post host information. |
| DOMAIN | cgf[.]facturastbs[.]shop | Attacker-controlled domain serving Trojan configuration and a malicious lure page. |
| DOMAIN | cgf[.]midasx[.]site | Attacker-controlled domain hosting the first stage leading to the email spreader. |
| DOMAIN | evs[.]grupotuis[.]buzz | Attacker-controlled domain hosting the fake CAPTCHA lure and remote HTA loader. |
| DOMAIN | lifenews[.]pro | Host in the malware's hardcoded fallback C2 socket address. |
| DOMAIN | pdj[.]gruposhac[.]lat | Attacker-controlled domain hosting polymorphic VBScript loader stages. |
| DOMAIN | upstar[.]pics | Domain for a resource requested by the Trojan; the resource was unavailable during testing. |
| MD5 | 4caa797130b5f7116f11c0b48013e430 | Hash listed for the Delphi banking Trojan in the article's YARA rule. |
| MD5 | 6272ef6ac1de8fb4bdd4a760be7ba5ed | Hash listed for the Delphi banking Trojan in the article's YARA rule. |
| MD5 | c882d948d44a65019df54b0b2996677f | Hash listed for the Delphi banking Trojan in the article's YARA rule. |
| URL | hxxps[:]//aufal[.]filevexcasv[.]buzz/on7/index15.php | Trojan URL used to post victim information. |
| URL | hxxps[:]//aufal[.]filevexcasv[.]buzz/on7all/index15.php | Additional Trojan URL used to post victim information. |
| URL | hxxps[:]//cfg[.]brasilinst[.]site/a/br/logs/index.php?CHLG | Trojan URL used to post host information. |
| URL | hxxps[:]//cgf[.]facturastbs[.]shop/0725/a/home | Trojan-requested URL serving encrypted configuration. |
| URL | hxxps[:]//cgf[.]facturastbs[.]shop/a/08/150822/au/at.html | Malicious lure page whose content was also used as a phishing PDF attachment. |
| URL | hxxps[:]//cgf[.]midasx[.]site/a/08/150822/au/au | URL hosting the first stage leading to the spreader. |
| URL | hxxps[:]//evs[.]grupotuis[.]buzz/0capcha17/ | URL of the fake CAPTCHA page used to induce victims to run the malicious command. |
| URL | hxxps[:]//evs[.]grupotuis[.]buzz/0capcha17/DMEENLIGGB.hta | Remote HTA payload retrieved and executed through mshta. |
| URL | hxxps[:]//pdj[.]gruposhac[.]lat/g1/ | Attacker-hosted loader path used to advance the infection chain. |
| URL | hxxps[:]//pdj[.]gruposhac[.]lat/g1/ld1/ | Attacker-hosted polymorphic VBScript loader fetched by the earlier stage. |
| URL | hxxps[:]//upstar[.]pics/a/08/150822/up/up | Resource requested by the Trojan; it was unavailable during testing. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe campaign used heavily obfuscated scripts, custom string decoding, and server-side polymorphism across VBScript stages.T1041 · Exfiltration Over C2 ChannelThe malware sent collected host details and harvested email addresses to C2 infrastructure.T1059.001 · PowerShellPowerShell commands retrieved spreader stages from remote URLs.T1059.005 · Visual BasicPolymorphic VBScript stages were fetched and executed to load subsequent payloads.T1071.001 · Web ProtocolsThe Trojan used HTTP and HTTPS requests for configuration retrieval and C2 communication.T1105 · Ingress Tool TransferThe loader downloaded AutoIt components and an encrypted blob from attacker-controlled servers.T1114 · Email CollectionThe spreader used MAPI to harvest email addresses for filtering and mass distribution.T1204 · User ExecutionThe fake CAPTCHA lure persuaded victims to paste and run a malicious command through the Run dialog.T1218.005 · MshtaVictims were instructed to run mshta with a URL to retrieve and execute the remote HTA loader.T1497 · Virtualization/Sandbox EvasionThe loader checked for VM artifacts and a specific Avast folder, terminating when those indicators were found.T1547.001 · Registry Run Keys / Startup FolderThe loader created an LNK file in the Startup folder for persistence.T1555.003 · Credentials from Web BrowsersThe Delphi Trojan used SQL commands to harvest credentials from browser data.T1566.001 · Spearphishing AttachmentThe spreader sent phishing emails with malicious PDF attachments.T1573.001 · Symmetric CryptographyThe custom TCP socket channel encrypted traffic using a stateful XOR-based algorithm.T1620 · Reflective Code LoadingThe AutoIt script decrypted the blob and loaded the resulting DLL directly into memory.
Malware
Casbaneiro#Horabot #CasbaneiroHorabotA targeted Horabot campaign used a fake CAPTCHA lure that tricked victims into running a remote HTA via mshta, which then staged multiple polymorphic VBScript loaders and downloaded AutoIt components that decrypted andMetamorfoThe heavy VBScript loader downloaded AutoIt components and an encrypted blob, which was AES-192 decrypted and loaded into memory as a Delphi banking Trojan (known as Casbaneiro/Ponteiro/Metamorfo/Zusy).PonteiroThe heavy VBScript loader downloaded AutoIt components and an encrypted blob, which was AES-192 decrypted and loaded into memory as a Delphi banking Trojan (known as Casbaneiro/Ponteiro/Metamorfo/Zusy).ZusyThe heavy VBScript loader downloaded AutoIt components and an encrypted blob, which was AES-192 decrypted and loaded into memory as a Delphi banking Trojan (known as Casbaneiro/Ponteiro/Metamorfo/Zusy).
Vendors
Products
AvastPersistence was established via a LNK placed in the Startup folder; the operation also performed anti-VM and anti-Avast checks and included cleanup routines to remove traces.Kaspersky Endpoint SecurityKaspersky Endpoint Security intervened, terminated the malicious process (via a proactive defense module (PDM)) and removed the related files before the threat could progress any further.
Tools
Aut2Exe[T1105 ] Ingress Tool Transfer – Tooling and components were retrieved from attacker-controlled servers: ‘retrieves an AutoIt executable, its compiler (Aut2Exe), a script (au3), and a blob file.’AutoItrunning a remote HTA via mshta, which then staged multiple polymorphic VBScript loaders and downloaded AutoIt components that decrypted and loaded a Delphi banking Trojan in memory.PowerShellThe spreader used PowerShell and MAPI to harvest and exfiltrate email addresses, filter them, and mass-distribute phishing emails with malicious PDF attachments; comments and language in the code indicate BrazilianSuricatathe observed dataset) and the campaign left multiple actionable IOCs and detection opportunities (YARA, Suricata, hunting queries).YARAin the observed dataset) and the campaign left multiple actionable IOCs and detection opportunities (YARA, Suricata, hunting queries).