Cybercriminals Impersonating U.S. Investment Bank

ASEC analysis team has been introducing malicious activities that involve the distribution of North Korea or public institution related materials. 

In this post, the team will analyze a recently discovered word document that impersonates a well-known investment bank to target employees in the global investment bank industry.

▶ To read the full analysis, visit ASEC Blog.

These malicious document that was recently discovered by ASEC analysis team was distributed using social engineering techniques to impersonate a famous investement bank headquartered in the U.S.  

The word document (.doc) operates in MAC OS environment and installs a backdoor on the victim's PC upon infiltration. A sample of the document is shown in Figure 1.

Figure 1. Document Details

As shown in Figure 2, the malicious  document has an external URL. Upon opening the document file, an additional malicious document is downloaded and executed from the URL through external connection. Then, the attacker’s VBA macro code included in that document is executed.

 Figure 2. settings.xml.rels (including the download URL of the malicious document)

Figure 3 shows the attacker’s VBA macro code included in the additional malicious document. Through the macro code, a malicious Javascript (acme.js) that has a backdoor feature is downloaded and executed.

 Figure 3. VBA macro code in the additional malicious document

Figure 4 is the main code for the malicious Javascript (acme.js). When it is run, the code randomly performs Sleep and regularly communicates with the C2 URL shown in Figure 5. Through the config file downloaded by C2, an attacker can register autorun, run additional Javascript, run additional programs, and lookup the infected PC’s environment. There are also additional features which are shown in Figure 6.

Figure 4. The main code of acme.js that gets downloaded

 Figure 5. Backdoor Javascript’s C2 URL

Figure 6. Additional features of the downloaded acme.js

AhnLab’s anti-malware solutions detect and block the files using the aliases mentioned in ASEC Blog.​​