Horabot Campaign Uses PowerShell and DLL Sideloading to Steal Data and Spread Phishing
Summary
Cisco Talos detailed a campaign targeting Spanish-speaking users in the Americas that uses phishing, PowerShell, and DLL sideloading to deploy Horabot, a banking trojan, and a spam tool.
Key points
- Talos says the campaign has been active since at least November 2020, predominantly targeting users in Mexico and other countries in the Americas.
- Spanish-language tax-themed phishing emails deliver malicious HTML that leads victims to download an archive containing a batch file.
- The batch file runs a PowerShell downloader that retrieves payloads, creates startup shortcuts, and reboots the victim’s machine.
- Legitimate executables and an AutoIt interpreter sideload malicious DLLs, including banking trojan components and a spam tool.
- The banking trojan can steal credentials and banking security codes, log keystrokes, capture screenshots, and collect system information.
- Horabot accesses Outlook mailboxes to collect contacts and send phishing emails with malicious HTML attachments; the spam tool also targets webmail accounts.
- Talos published related infrastructure indicators and Snort and ClamAV detections.
Article Details
- Attack Vectors
- Spanish-language tax-themed phishing emails deliver malicious HTML attachments that redirect victims to attacker-controlled content and a RAR file.
- A CMD batch file downloads and executes an obfuscated PowerShell downloader, which downloads a ZIP containing payloads and creates startup shortcuts.
- Malicious DLLs are sideloaded through legitimate executables, including kinit.exe and an AutoIt interpreter.
- Startup shortcuts launch additional PowerShell scripts, the banking trojan, the spam tool, and Horabot.
- The banking trojan steals credentials and financial security codes and collects keystrokes, screenshots, clipboard data, and system information.
- Horabot and the spam tool access victim mailboxes, collect contacts, and send phishing or spam messages to those contacts.
- Defensive Notes
- Cisco Talos recommends Cisco Secure Endpoint, Secure Web Appliance, Secure Email, Secure Firewall, Secure Malware Analytics, Umbrella, and Cisco Duo protections.
- The article states that Snort Subscriber Rule Set customers can use Snort SIDs 61839–61856 for Snort 2 and 300569–300577 for Snort 3.
- ClamAV detections listed for the threat include Txt.Loader.Horabot-10003071-0, Ps1.Downloader.Horabot-10003078-0, Win.Trojan.DelphiTrojanBanking-10003087-0, Win.Trojan.DelphiTrojanBanking-10003088-0, Txt.Malware.Horabot-10003089-0, Txt.Malware.Horabot-10003090-0, Txt.Malware.Horabot-10003091-0, and Win.Tool.HorabotSpamTool-10003092-0.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | amarte[.]store | Domain identified as part of the campaign's malicious infrastructure. |
| DOMAIN | ckws[.]info | Domain identified as part of the campaign's malicious infrastructure. |
| DOMAIN | facturacionmarzo[.]cloud | Attacker-controlled domain hosting the malicious HTML resource used in phishing emails. |
| DOMAIN | m9b4s2[.]site | Domain identified as part of the campaign's malicious infrastructure. |
| DOMAIN | tributaria[.]website | Campaign domain used to host attacker tools and exfiltrated data. |
| DOMAIN | wiqp[.]xyz | Domain identified as part of the campaign's malicious infrastructure. |
| IPV4 | 139[.]177[.]193[.]74 | Attacker-controlled server receiving Horabot-exfiltrated email addresses. |
| IPV4 | 185[.]45[.]195[.]226 | Malicious server hosting the PowerShell downloader script. |
| IPV4 | 216[.]238[.]70[.]224 | Malicious server hosting the payload ZIP and used for trojan communications. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe PowerShell downloader is obfuscated with substituted random symbols and Base64-encoded strings.T1041 · Exfiltration Over C2 ChannelThe banking trojan and Horabot send collected system information or email addresses to attacker-controlled servers.T1059.001 · PowerShellPowerShell scripts download payloads, execute further scripts, and operate Horabot.T1059.003 · Windows Command ShellA downloaded CMD batch file runs embedded commands as part of the infection chain.T1105 · Ingress Tool TransferThe batch file and PowerShell downloader retrieve scripts, ZIP payloads, and other files from attacker-controlled servers.T1114.001 · Local Email CollectionHorabot enumerates Outlook data, messages, and contacts to collect email addresses.T1497 · Virtualization/Sandbox EvasionThe banking trojan checks for sandbox and virtual-machine environments and uses anti-debugging checks.T1547.001 · Registry Run Keys / Startup FolderThe downloader creates Windows startup-folder shortcuts that launch payloads after reboot.T1566.001 · Spearphishing AttachmentThe campaign begins with phishing emails carrying malicious HTML attachments.T1566.002 · Spearphishing LinkHorabot sends phishing emails with malicious HTML attachments to addresses collected from victims' mailboxes.T1574.002 · DLL Side-LoadingThe banking trojan DLL and other malicious DLLs are sideloaded through legitimate executables or the AutoIt interpreter.
Malware
Products
Microsoft Windowsdownload a ZIP file that contains the payload DLLs and a few legitimate executables and DLLs. It creates Windows shortcut files configured to run the payloads in the startup folder of the victim’s machine and restartsOutlookHorabot enables the threat actor to control the victim’s Outlook mailbox, exfiltrate contacts’ email addresses, and send phishing emails with malicious HTML attachments to all addresses in the victim’s mailbox.
Tools
Countries
ArgentinaThe attacks predominantly target users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama. In analyzing the phishing emails used in the campaign, Talos identified that usersBrazilThe threat actor appears to be targeting Spanish-speaking users in the Americas and, based on our analysis, may be located in Brazil.Guatemalapredominantly target users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama. In analyzing the phishing emails used in the campaign, Talos identified that users inMexicoThe attacks predominantly target users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama. In analyzing the phishing emails used in the campaign, Talos identified that usersPanamatarget users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama. In analyzing the phishing emails used in the campaign, Talos identified that users in organizationsUruguayThe attacks predominantly target users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama. In analyzing the phishing emails used in the campaign, Talos identified that usersVenezuelaThe attacks predominantly target users in Mexico, with a few infections in Uruguay, Brazil, Venezuela, Argentina, Guatemala and Panama. In analyzing the phishing emails used in the campaign, Talos identified that users
Industries
accountingcampaign, Talos identified that users in organizations across several business verticals — including accounting, construction and engineering, wholesale distributing and investment firms — have been affected.ConstructionTalos identified that users in organizations across several business verticals — including accounting, construction and engineering, wholesale distributing and investment firms — have been affected. However, theEngineeringthat users in organizations across several business verticals — including accounting, construction and engineering, wholesale distributing and investment firms — have been affected. However, the attacker uses HorabotInvestmentbusiness verticals — including accounting, construction and engineering, wholesale distributing and investment firms — have been affected. However, the attacker uses Horabot and the spam tool in this campaign toWholesale distributingacross several business verticals — including accounting, construction and engineering, wholesale distributing and investment firms — have been affected. However, the attacker uses Horabot and the spam tool