Hello, welcome to the Thursday, February 25th, 2021 edition of the Sandcent Storm Center's Stormcast. My name is Johannes Ulrich.

And I'm recording from Jacksonville, Florida. These last two weeks, we had a number of high-profile

takedowns of Malware groups, like, for example, Emotet, but you probably noticed

there's still plenty of malware arriving in your inboxes, and Brad took a look at a recent

sample. What he found was G.U. Loader. Now, this sample arrived in an email that claimed to come from Lowe's Canada.

And looks like the attacker here went through the lengths to actually register a domain

to impersonate this home improvement chain Lz-ca.org.

Did hatchment?

Well, it was a word document masquerading a little bit as an Excel file, and for a change,

it actually did not rely on macros in order to execute the malicious code.

Instead, it used an older vulnerability, CVE 2017, 11882, so approximately four-year-old vulnerability that will then execute the malicious code and download

GEO loader. Geoloader itself then, of course, can do whatever it wants, once it execute the malicious code and download GULTER.

Geoloader itself then of course can do whatever it wants once it's installed.

In this case it ended up installing Remco's RAT, the remote admin tool that then provides the attacker with persistent access to the compromised system. So any system that was patched within the last

three to four years should be safe from this particular attachment. And remember yesterday I

talked about a patch for VMware V-Center and told you you better update quickly. Well, I hope you followed the

advice because proof of concept exploit is available and additional details about this particular

vulnerability. Researcher Mikhail Kaczynikov, who originally discovered the vulnerability

and reported it to Vienbeer,

did publish a blog post with quite a bit of technical detail after a proof-of-concept remote code

execution exploit for this vulnerability was made publicly available. Exploitation is also not really all that difficult.

The root problem here is an unauthenticated file upload via a Rest API.

...