Phishing Email Uses the Tragic Boeing 737 Crashes
The second crash of a Boeing 737 occurred in March 2019, killing all passengers onboard just five months after the first crash. And a attack has been found to be exploiting the worldwide attention on this tragedy.
[Figure 1] Phishing Email Trying to Exploit the Boeing 737 Crashes
This attachment uses the phishing email to distribute malware. As shown in Figure 1, this email gives some brief information on the Boeing 737 accidents and seemingly includes an attachment containing a list of airlines operating the specific model. However, the attachment is not a real list but rather a malicious Java file - MP4_142019.jar.
Once executed, this file conducts malicious activities as shown Figure 2.
[Figure 2] Activities Diagram of MP4_142019.jar
The files MP4_142019.jar, alzmmgkrzd.vbs, and ntfsmgr.jar in Figure 2 only download and run the malware. The attacker has designed the malware to use a detection evasion technique because repeated downloads are not flagged as malware by many anti-malware products.
In the end, HOUDINI, a VMA malware, is downloaded to conduct various malicious actions through the attacker's server via HTTP communication.
[Figure 3] Part of the HOUDINI Source Code
The HOUDINI malware is made up of 13 different functions, including execution, information extraction, and updating. It also sets itself to start automatically on system boot up.
AhnLab’s V3 products detect the malware under the following alias:
<V3 Product Alias>
- JAVA/Adwind
