Fake Invoice Tries To Deliver Remcos RAT

Fake Invoice Tries To Deliver Remcos RAT

This is a strange & slightly more difficult than usual to analyse malware, mainly because the bad actor appears to have made a total mess of the distribution.

I do not know if this will actually run on a proper computer, it obviously doesn’t like a sandbox / VM .
The email was received with a .dat extension, which is what Outlook or the mail server often changes unknown extensions to. This dat file is actually a zip file. It does extract to a .pif and a jpg image file of an invoice.

The pif is not a windows shortcut file & is actually a renamed or wrongly named .exe file. I couldn’t get this to run properly in Anyrun at first using windows 7 but after renaming the .pif inside the zip to a .exe & then extracting the renamed file I could eventually run it on Anyrun where it crashed or rebooted the computer 3 times using windows 7. However it didn’t do much except try to connect to the C2, but I never got any response. It was only on the 3rd reboot that it was detected as Remcos when using a Windows 7 VM on anyrun .

It did not crash in Windows 10 on anyrun. all it did was drop the same files it drops on W7 and continually try to contact the C2.

Invoice.dat : Extracts to: INOGQ190 pif / exe Current Virus total detections [1] [2] [3] [4] [5] : Anyrun [email W7] [ W7 renamed.pif to .exe ] [W10 .exe]

The C2 is myhousedubem.ddns.net 79.134.225.116

You can now submit suspicious sites, emails and files via our Submissions system

One of the emails looks like:
From: GHAZAL TOUBAH <sales@ekhtong.com>
Date: Wed 18/09/2021 03:59
Subject: RE: Invoice victim@victimsdomain.com
Attachment: Invoice.dat

Body Content:

Dear victim@victimsdomain.com
Enclosed is the pro-forma invoice sent to us. We had to immediately write you directly as it is not workable for us. please review

Kindly please double check and confirm by return the following:

  1. We agreed on 30% advance but PI is stated 50% advance.
  2. Expected time of delivery is different from earlier agreed shipment date.
  3. Pay attention to the Question marks we added to the PI to draw your attention to complete these parts.

Kindly amend and send back the revised PI so we can make the down payment
immediately.

Thanks & Regards
GHAZAL TOUBAH
(Purchasing Manager)
ghazal.toubah@casdollar.com
NRG SERVICES W.L.L  -AN ISO 9001:2008 Certified Company
PO Box: 200131| Industrial Area | No.55 FuXingMenNei Street, Xicheng District, Beijing, P.R.C 100140  Email: info@casdollar.com | Website: www.casdollar.com
——————————————————————————
  P Save a Tree! Do not Print this Email if not Essential.
 This e-mail and any attachments are confidential to the addressee and may also be privileged. If you are not the addressee of this e-mail, you may not copy, forward, disclose or otherwise use it in any way what so ever. If you have received this e-mail by mistake, please e-mail the sender by replying to this message, and delete the original and any print out thereof.

Screenshot:

Fake Invoice Email

Email Headers:

IP Hostname City Region Country Organisation
104.131.213.159  mta.ekhtong.com Gramercy Park New York US AS14061 DigitalOcean, LLC

 

Received: from [104.131.213.159] (port=53888 helo=slot0.ekhtong.com)
	by knight.knighthosting.co.uk with esmtps (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256)
	(Exim 4.92)
	(envelope-from <sales@ekhtong.com>)
	id 1iAQBH-0002UX-Ks
	for security@myonlinesecurity.co.uk; Wed, 18 Sep 2021 03:59:00 +0100
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=dkim; d=ekhtong.com;
 h=Reply-To:From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; i=sales@ekhtong.com;
 bh=dWp6Mur2B6IK2z4NslcLqih9i5g=;
 b=VNoRSYEYZXkk832WbPoayHoLrN9bSWSf6Zl9BF3cDGwydUxK7rgLaaNhoi4u0OUjhss9oprI2um7
   +v4dqWeGQlIJwEKSUutz4NZstb3ReQ2FigzGPNfBl5FHKaCxBuQSEj/xrM/M1d/NXL/J+hM8e6Dd
   kmmiu/EYdgHKaHXMeAUuTYuZvpKnbBNsoh6MDBp+YueJ4jc6SDHqnPO8D0hEpl6c3WwTYEe2hULu
   zQCVU9f2UIalbhJVhxB1K32+N2arfmM0jfVp0+yaPOi5OK85kqIm5uh613T5te6oaMrarg8uFTDM
   S/qUk0KhU2cpUfmseR/cE8aiY7QYYijNr1wGjw==
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=dkim; d=ekhtong.com;
 b=cQKRYQpEw9pUoWkCc1rIdIPWIQrJMXWdTrc6oxqkR1NYgBINPlP6h+1+4xnDsjQt8G9aq8O6L1A6
   kmwG+z+g5cD9rxxRQYFdS/68heFdOsLCRim4bqexP9fWHWbz88fr3k6xhrodJ50rqrUgAv5ZoNjP
   v2DEx14WeAupBAXop++W9pJGv2L6E0Ab+1Fd6B3SDzHOntPOEKeTZ8Uidxzu8ERskgCMFAs0XJYY
   0XEVTMrE7PjGBCdwyqKmcUvB6/oSw8pw8THV3kGggfIUU2IRKxaOYNN8WBXrDrJtMxGBb1EWon3A
   2kRna+wi/KnlJwxy4Vozfx3lB2AXkl5UaMw4PA==;
Reply-To: ghazal.toubah@casdollar.com
From: GHAZAL TOUBAH<sales@ekhtong.com>
To: security@myonlinesecurity.co.uk
Subject: RE: Invoice security@myonlinesecurity.co.uk
Date: 17 Sep 2021 19:58:56 -0700
Message-ID: <20190917195856.82AA8FD0B0FD8305@ekhtong.com>
MIME-Version: 1.0
Disposition-Notification-To: ghazal.toubah@casdollar.com
Content-Type: multipart/mixed;
	boundary="----=_NextPart_000_0012_38A72117.EBE6FBB2"


These malicious attachments normally have a password stealing component, with the aim of stealing your bank, PayPal or other financial details along with your email or FTP ( web space) log in credentials. Many of them are also designed to specifically steal your Facebook and other social network log in details. A very high proportion are Ransomware versions that encrypt your files and demand money ( about £350/$400) to recover the files.

All the alleged senders, amounts, reference numbers, Bank codes, companies, names of employees, employee positions, email addresses and phone numbers mentioned in the emails are all random. Some of these companies will exist and some won’t. Don’t try to respond by phone or email, all you will do is end up with an innocent person or company who have had their details spoofed and picked at random from a long list that the bad guys have previously found. The bad guys choose companies, Government departments and organisations with subjects that are designed to entice you or alarm you into blindly opening the attachment or clicking the link in the email to see what is happening.

Please read our How to protect yourselves page for simple, sensible advice on how to avoid being infected by this sort of socially engineered malware.

This is another one of the files that unless you have “show known file extensions enabled“, can easily be mistaken for a genuine DOC / PDF / JPG or other common file instead of the .EXE / .JS file it really is, so making it much more likely for you to accidentally open it and be infected.

Be very careful with email attachments. All of these emails use Social engineering tricks to persuade you to open the attachments that come with the email. Whether it is a message saying “look at this picture of me I took last night” and it appears to come from a friend or is more targeted at somebody who regularly is likely to receive PDF attachments or Word .doc attachments or any other common file that you use every day.

The basic rule is NEVER open any attachment to an email, unless you are expecting it. Now that is very easy to say but quite hard to put into practice, because we all get emails with files attached to them. Our friends and family love to send us pictures of them doing silly things, or even cute pictures of the children or pets.

Never just blindly click on the file in your email program. Always save the file to your downloads folder, so you can check it first. Many malicious files that are attached to emails will have a faked extension. That is the 3 letters at the end of the file name.

Unfortunately windows by default hides the file extensions so you need to Set your folder options to “show known file types. Then when you unzip the zip file that is supposed to contain the pictures of “Sally’s dog catching a ball” or a report in word document format that work has supposedly sent you to finish working on at the weekend, or an invoice or order confirmation from some company, you can easily see if it is a picture or document & not a malicious program.

If you see JS or .EXE or .COM or .PIF or .SCR or .HTA .vbs, .wsf , .jse .jar at the end of the file name DO NOT click on it or try to open it, it will infect you.

While the malicious program is inside the zip file, it cannot harm you or automatically run. When it is just sitting unzipped in your downloads folder it won’t infect you, provided you don’t click it to run it. Just delete the zip and any extracted file and everything will be OK.

You can always run a scan with your antivirus to be sure. There are some zip files that can be configured by the bad guys to automatically run the malware file when you double click the zip to extract the file. If you right click any suspicious zip file received, and select extract here or extract to folder ( after saving the zip to a folder on the computer) that risk is virtually eliminated.

Never attempt to open a zip directly from your email, that is a guaranteed way to get infected. The best way is to just delete the unexpected zip and not risk any infection.
:
IOC:
Secure.doc
MD5: b2e0d468b82b1de92829817b1292907e
SHA-1: 2364a75570bab29a5ef1e780bae03f0ff6935f57
Download URLs
http://ballparkjerseys.com/bo.bin 212.53.86.192
http://asifapparels.com/bo.bin 173.249.54.230
MD5: 11458b0259a54c0a8146e7c16d1595e4
SHA1: 1ce8d815703dc9bfce0053d3b1c27f2d9bcdff39
Email from: service@santander-sm.co.uk
santander-sm.co.uk
5.79.84.120
79.142.72.119
212.8.250.162
108.170.10.24

Derek

Derek