Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE) – ASEC BLOG

In August, the ASEC analysis team made a post on the malware being distributed with filenames that utilize RTLO (Right-To-Left Override). RTLO is a unicode that makes an override from right to left. This type of malware induces users to execute its files by mixing filenames with extensions, with its distribution still being continued to this day.

RAT Tool Disguised as Solution File (*.sln) Being Distributed on Github

As of November 30th, 2022, when the keywords based on the last blog post are entered in GitHub, 304 commit results are shown. Multiple cases of malware were registered as normal codes through a handful of accounts, and some even had everything unchanged except for the newly uploaded malware disguised as solutions.

Figure 1. Search results of filenames disguised as ‘sln’ on GitHub

According to the results identified using AhnLab’s ASD infrastructure, methods that used RTLO included compressed files, test files, and video files, as well as those disguised as solutions (.sln). The most prevalent distribution method was the disguise as pornographic videos and films, which included names such as SCR.pm4, scr.vkm, and scr.iva. We also found that files such as exe.rar disguised as utility programs were also distributed through torrents.

Figure 2. Malware with its filename disguised as rar, distributed through torrents

As seen in the figure above, the malware being distributed with its filename disguised as a software crack seemingly has its extension as ‘rar,’ but its actual extension is ‘exe.’  The icon has also been designed to imitate a compressed file for a more successful disguise. On top of that, the file is listed as an “Application” instead of an RAR file, making it hard for users to recognize it as an executable if they do not pay close attention. The actual format of the malware is a portable executable, containing the malware and a compressed file.

The malware injects itself to a normal process to receive and execute additional malware, with its identified loaders including Laplas Clipper and Redline Stelaer. Redline Stelaer is an Infostealer that has been addressed in ASEC blog several times, while Laplas Clipper is a malware that targets cryptocurrency users and changes their wallet addresses to the attacker’s when they are found in users’ clipboards.

Figure 3. The regular expression of cryptocurrency wallet address

Table 1. Cryptocurrency wallet addresses sorted by regular expressions

The malware downloads the above regular expressions and examines the clipboard to find any data that can be mapped to the expressions. When such data is found, its value is changed to the attacker’s address. The regular expressions are downloaded from the website below, and we can see that the author of the malware is still active, operating the website to this day.

Figure 4. Website run by Laplas Clipper

Users must stay alert for programs that cannot be trusted. Also, they must keep their anti-malware software updated to the latest version.  AhnLab V3 detects and blocks the malware strains using the aliases below.

[File Detection]

• Trojan/Win.RTLO.X2172 (2022.11.29.00)
• Dropper/Win.Agent.C5317732 (2022.11.30.03)
• Trojan/Win.Injection.C5313120 (2022.11.24.03)
• Trojan/Win.Generic.C535472 (2022.11.22.03)
• Trojan/Win.Generic.C5310136 (2022.11.21.01)
• Infostealer/Win.Raccoon.C534410 (2022.11.21.02)
•  Infostealer/Win.RedLine.C5155429 (2022.06.03.01)

[IOC Info]

• 64c3f928790051534889f65f33a6edaf
• 7e7f8d664dc17d08ae3084ec958070fa
• d2cbf6c0a2a55a08aa5fbacad772d63d
• 21f79006cf7560986de8ec8a60998894
• 07abdccbf7b7884f98f962b169ae86c4
• e125eb095b89b5cccc190ff727ae354d
• 79.137.206.137
• 77.73.133.53/AmnesiaBone/LearnMedal.php

Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.

Source: https://asec.ahnlab.com/en/43518/