Managed XDR Exposes Spear-Phishing Campaign Targeting Hospitality Industry Using RedLine Stealer

Unfortunately, some users were lured into unwittingly downloading malware via these malicious emails. During analysis, we noticed the file sizes of the extracted malware samples. Malware file sizes typically range from just a kilobyte to a few megabytes. However, the samples we obtained had atypically large file sizes, ranging from 494.7 MB to as large as 929.7 MB.

Technical analysis

We analyzed a sample spear-phishing email sent by a malicious actor pretending to be an older adult who is asking for someone from the hotel to verify if his route is correct. At first glance, it appears to be a typical one-off spam email that contains a shortened URL that drops malware. In a sample spear-phishing email we analyzed, a malicious actor pretends to be an elderly man asking for help from hotel staff to validate his overland route. He provides a shortened link, supposedly to images of his route for hotel staff to validate.

As previously mentioned, we believe this to be a spear-phishing campaign that specifically targets members of the hospitality industry. In Figure 3, the malicious actor responds to the hotel employee in a polite and helpless manner to influence them to select a link that does not lead to a route diagram but actually leads to the malware payload.

Unfortunately, the employee fell victim to this spear-phishing campaign. Using the Trend Micro Vision One™ solution, we saw that the employee opened the link using outlook.exe, which downloaded a zip file named “Christian-Robinson-Route.zip.” This zip file contained a file with a double extension, “Christian-Robinson-Route.jpg.exe,” which is a tactic that malicious actors use to trick victims into downloading and executing malicious files.

The extracted and launched “Christian-Robinson-Route.jpg.exe” file triggered a chain of events. Figure 5 shows the entire execution chain as observed in Trend Micro Vision One:

The campaign can be divided into four stages:

Stage 1: “Christian-Robinson-Route.jpg.exe” drops “setupsoftwarefile_v7.7.exe”

 “Christian-Robinson-Route.jpg.exe” is a cabinet file that contains a large amount of padding. This is an old technique used by malware authors to bypass antivirus detection, sandbox analysis, and YARA rules. The paddings we observed were either random bytes or repeated strings, which is possibly because of the builder or packer that was used to add the large overlays. As previously mentioned, the samples we obtained range from 494.7 MB to as large as 929.7 MB in size.

Upon execution, it drops an MSIL file, “setupsoftwarefile_v7.7.exe”, and executes it via cmd.exe. This file will then decrypt and execute a PowerShell script.

Stage 2: The PowerShell script retrieves an encrypted file from hxxp://45.93.201[.]62/docs/

The PowerShell script will connect to hxxp://45.93.201[.]114/docs/fzLJerifqJwFtnjbrlnJPNrfnupnYg[.]txt to get another MSIL file named Ferriteswarmed.exe, which will then be AES-decrypted, GZIP-decompressed, and loaded in PowerShell via .NET reflective loading. It has a debugger check that will exit once a debugger is found.

Based on the samples we have obtained, other encrypted files are hosted on hxxp://45.93.201[.]114/docs/.

Stage 3: The “Ferriteswarmed.exe” MSIL file decrypts image files that form RedLine Stealer payload

A portable executable (PE) file’s resource section contains the resource information of a module. In many cases, it shows icons and images that are part of a file’s resources. In this case, the new MSIL file, “Ferriteswarmed.exe,” will decrypt another payload that is disguised as encrypted images from its resources — the Redline Stealer. The RedLine Stealer will then be injected into “aspnet_compiler.exe”.

Stage 4: RedLine Stealer sends stolen info to C&C server

Using Trend Micro Vision One, we were able to observe the kind of information that RedLine Stealer collects, which include operating system, video controller, processor, antivirus, processes, and disk drive data via the Windows Management Instrumentation (WMI). The stolen data is sent to its C&C server, 77.73.134[.]13:12785.

It is also capable of collecting data from browsers, cryptocurrency wallets, VPN applications, and other  installed applications such as Discord.

Security Scorecard published a detailed report about RedLine Stealer that includes a comprehensive list of data that this infostealer collects. We observed a marked difference in the RedLine Stealer samples they analyzed compared to ours — their malware samples created a BasicHttpBinding object that uses HTTP as the transport for sending SOAP messages to its C&C server, while the samples we obtained use NetTcpBinding for message delivery. The commands in our samples are also not named.