BatCloak Malware Attacks Use Fake Invoices
Security analysts have uncovered a complex series of attacks employing phishing tactics disguised as invoice-related emails to distribute various types of malware, including Venom RAT, Remcos RAT, XWorm, NanoCore RAT, and a crypto wallet-targeting stealer.
According to a technical report by Fortinet FortiGuard Labs, the emails contain Scalable Vector Graphics (SVG) file attachments, which, when clicked, initiate the infection process.
BatCloak Uses Obfuscated Batch Scripts
The attackers utilize the BatCloak malware obfuscation tool and ScrubCrypt to conceal the malware within obfuscated batch scripts. BatCloak, derived from a tool called Jlaive and available for purchase since late 2022, is designed to load subsequent-stage payloads in a manner that evades traditional detection methods.
ScrubCrypt, initially identified by Fortinet in March 2023 during a cryptojacking campaign linked to the 8220 Gang, is believed to be a variant of BatCloak, as per research conducted by Trend Micro.
BatCloak Used to Deliver RAT Malware
In the recent campaign examined by cybersecurity experts, the SVG file acts as a conduit to deliver a ZIP archive containing a batch script likely created with BatCloak. This script then unpacks the ScrubCrypt batch file, ultimately deploying Venom RAT while establishing persistence on the host and bypassing protection mechanisms such as AMSI and ETW.
Venom RAT, a derivative of Quasar RAT, enables attackers to take control of compromised systems, gather sensitive data, and execute commands from a command-and-control (C2) server.
Cara Lin, a security researcher, noted that Venom RAT maintains communication channels with the C2 server to acquire additional plugins for various purposes, including keylogging capabilities (e.g., Venom RAT v6.0.3), NanoCore RAT, XWorm, and Remcos RAT.
Lin added that the Remcos RAT plugin was distributed from VenomRAT's C2 server using three methods: an obfuscated VBS script named 'remcos.vbs,' ScrubCrypt, and GuLoader PowerShell.
Additionally, the malware campaign includes a stealer component that collects system information and extracts data from folders associated with various wallets and applications, such as Atomic Wallet, Electrum, Ethereum, Exodus, Jaxx Liberty (retired as of March 2023), Zcash, Foxmail, and Telegram, sending the information to a remote server.
