Ramadan Coupon Lure Delivers RAT to Middle East Retail Customers
Summary
A campaign uses a fake Ramadan coupon document to deliver a Windows RAT. Its multi-stage infection chain uses a VBA macro and C# loader, while the RAT routes file exfiltration through AWS S3 presigned URLs.
Key points
- A malicious document impersonates AlCoupon and offers fake retail discounts and a Ramadan prize.
- Opening the document triggers a hidden VBA macro that drops, compiles, and runs a C# loader.
- The loader retrieves a raw MSIL assembly, compiles it on the device, and executes it via rundll32.
- The resulting Ftu4You RAT communicates with a dedicated C2 panel over HTTPS.
- RAT capabilities include remote shell access, screenshots, filesystem browsing, and bidirectional file transfer.
- Screenshots and documents are exfiltrated through AWS S3 presigned URLs, according to the report.
Article Details
- Attack Vectors
- A malicious document impersonating a Ramadan discount offer uses a hidden VBA macro to drop, compile, and execute a C# loader.
- The loader contacts a delivery C2, downloads a raw MSIL assembly, compiles it on the endpoint, and executes it via rundll32.
- The RAT communicates with a dedicated C2 panel over HTTPS and supports remote shell access, screenshot capture, remote filesystem browsing, and bidirectional file transfer.
- Screenshots and documents are exfiltrated through AWS S3 presigned URLs.
MITRE ATT&CK
T1059.005 · Visual BasicThe malicious document uses a VBA macro to drop, compile, and execute the loader.T1071.001 · Web ProtocolsThe RAT communicates with its C2 panel over HTTPS.T1105 · Ingress Tool TransferThe loader fetches a raw MSIL assembly from a delivery C2.T1113 · Screen CaptureThe RAT supports full-screen screenshot capture.T1204.002 · Malicious FileTargets are enticed to open a malicious document disguised as a Ramadan discount offer.T1218.011 · Rundll32The resulting payload is executed via rundll32.T1567.002 · Exfiltration to Cloud StorageThe report says screenshots and documents are exfiltrated through AWS S3 presigned URLs.