K7 Antivirus

  We at K7 Labs recently came across this twitter post about Coper, a banking Trojan. The main infection vector of Coper was found on the official Google Play Store where it posed as UniFile manager – PDF viewer app with 10,000+ downloads as shown in Figure 1. Figure 1: UniFile manager – PDF viewer from Google Play Store Once launched, this app requests the user to enable unknown apps source as shown in Figure 2. Figure 2: Enable unknown apps source popup When the user enables “Allow from this source”, this application downloads malicious Coper malware file com.lastcarn_PlayMarket.apk and saves it to the device download folder as PlayMarketUpdate.apk. From the ADB Logcat report we noticed that the malware file “com.lastcarn_PlayMarket.apk” gets downloaded from a GitHub repository as shown in Figure 3. Figure 3: ADB Logcat shows malware sample download URL Figure 4 shows that the repository was created by Johmeffer. At the time of writing this blog the GitHub repository was still ...

  ESXiArgs Ransomware targeting exposed ESXi servers has been making headlines since the start of Feb 2023. VMWare has also requested their customers to upgrade ESXi servers to the latest version. In this blog, we will briefly discuss details of the ongoing cyber attacks. ESXiArgs Ransomware has been reported to be exploiting CVE-2021-21974. In Feb 2021, VMWare patched [2] CVE-2021-21974 in multiple versions of ESXi and Cloud Foundation servers. Vulnerable ESXi Version 6.5, 6.7 and 7.0 Vulnerable Cloud Foundation Versions 3.x, 4.x Service Location Protocol (SLP) is a protocol which allows devices to discover other services and devices in the network they are connected to. It works on port 427. CVE-2021-21974 is a heap overflow vulnerability in the SLP implementation of VMWare resulting in Remote Code Execution. The vulnerability exists in the SLPParseSrvUrl() function. Figure 1: Vulnerable SLPParseSrvURL() Source:  ZDI   Recommendations Keep your ESXi servers patched and ...

  Recently OneNote files are being abused a lot to carry malware and users are being tricked to execute the same. This count has increased in the last couple of weeks. The sample under consideration was a .one file in the wild carrying the RedLine info stealer. Figure 1 – VT detection The .one file just had a simple dialog box saying ‘Double click to view’. Figure 2 – Batch file hiding behind the dialog box However, when we drag that dialog box we see a batch file named xxx.bat under it. Placing the cursor over it shows the desktop name of the machine where it was inserted into the .one file. Figure 3 – Malicious batch file The contents of the batch file are not straight forward. Variables present were combined during the runtime into the actual command to be executed. Figure 4 – Contents of the batch file The following are the commands that are decoded at the run time. Figure 5 – Decoded commands After this, in the following section of the file another command that gets decoded i...