Site icon Sophos News

Trickbot campaign targets Coronavirus fears in Italy

The operators of a Trickbot spam campaign have found a new way to spread their digital infection: by using fears of a biological one. Spam targeting Italian e-mail addresses is playing on fears over the Coronavirus outbreak in that country.

The e-mail carries a document purported to be a list of precautions to take to prevent infection. But the enclosed file is in fact a weaponized Word document, carrying a Visual Basic for Applications (VBA) script that carries a dropper used to deliver a new Trickbot variant.

Hunting for a hook

The Coronavirus twist to the spam message and the Trickbot malware delivered on it may be new, but the mechanisms used to deliver it (including the spam “bots” that send the message, the enclosed scripted Word document and the JavaScript dropper) are similar or identical to those used in campaigns that have been active for at least six months.

Sophos detected other email payloads from the same spam-generating malware dating back to September of last year, spiking on October 29, 2019. But these earlier spam messages, which also carried malicious documents, carried a different variety of concern-inducing calls to action, with subject lines such as “you have email about your credit” and “you have received fax about your loan.”

Incidents of messages sent by the spambot behind the Trickbot campaign over the past six months caught by SophosLabs spam traps.

But with concerns about COVID-19 on the rise – particularly in Italy, where cases are surging – the spam campaign’s subject line is now in tune with the concerns of the day.

The emails, with the subject line “coronavirus: informazioni importanti su precauzioni” – purportedly from a “Dr. Penelope Marchetti ”—state (in Italian):

Due to the fact that cases of coronavirus infection are documented in your area, the World Health Organization has prepared a document that includes all necessary precautions against coronavirus infection. We strongly recommend that you read the document attached to this message!

The attached document is, of course, viral in a totally different sense of the word.

The chain of infection

When opened, if macros are disabled, the Word document displays a message asking the recipient to enable editing and content because “this document was created in an earlier version of Microsoft Office Word.”

If macros are already enabled, or if the targeted user complies with the instructions, the VBA script does a number of things:

The JavaScript file (detected by Sophos as JS / Agent-BCAJ ) connects back to a command and control server (in some cases, the same PHP script as the VBA script does] 1, sending back the computer name and some other data in its . request . When successful, it downloads a Base64-encoded Windows executable, saving it in the system’s set location for temporary files; For example:

 C:\Users\username\AppData\Local\Temp\320455ed.pro

Next, it creates a separate JavaScript file to decode and execute the malicious payload, and then launches it using wscript.exe, another WSH executable. In one sample tested, once launched, the dropper’s malicious payload attempts to connect to 23 [.] 19 [.] 227 [.] 235.

As with most viruses – digital or biological – this particular contagion can be prevented through good hygiene: Disable macros in Office applications for all but the most trusted documents, and train everyone in the organization what not to do with documents received via email.

IoCs

Network indicators

hxxps://185[.]234.73.125/wMB03o/Wx9u79.php

23[.]19.227.235

We analyzed the following files during this investigation:

SHA256 Filename
dd7023dd82b641c9307566b87acf0951f16b27c34094a341fa1fe7671d269bf4 RANLSOJF.JSE
58e918466a61740abe42a2d1ca29bd8d56daf53912e6d65879cbe944466fb80c ERRORFIX.BAT
8e3240a2a6b07ae8a6fde884c0e18e476ca3e92438022fe1a1ad4b2ba2334737 A.COM

 

Acknowledgments

SophosLabs would like to acknowledge the contributions to this report from analysts Richard Cohen, Brett Cove, and Suriya Natarajan.

Exit mobile version