New Serpent Malware Uses Unusual Infiltration Tactics

Security researchers discovered a recent campaign to spread a novel strain of malware that was named Serpent. The tools and methods used to infiltrate its victims are what sets Serpent apart from more pedestrian malware.

A research team with security company Proofpoint tracks the malware campaign spreading Serpent to targets in France. The team describes Serpent as "advanced" malware that uses unusual tactics.

Serpent starts boring, evolves into the unusual

The Serpent malware is being spread using email lures and garden-variety malicious files to deliver its payload. This is not where things get interesting. However, between the point of initial penetration and delivering the final payload, Serpent does a lot of snaking around to avoid detection and uses tactics that researchers say they haven't encountered before.

Serpent starts off its infection chain in a very mundane way - emails containing lures and malicious attachments with VB macros in them. The social engineering lure used in titles and body text of the malicious emails uses the General Data Protection Regulations of the European Union.

Once the macro executes, it hits a URL that appears to be an image but uses steganography to hide a PowerShell script among its data. The script is further encoded using base64.

The first thing the script does is download and install Chocolatey - a software automation tool running on Windows used to produce wrappers for executable files. There is no malicious payload at this point - the Chocolatey download is a legitimate tool that will almost certainly bypass automated security.

Chocolatey is employed to install Python and a specific component named pip and used for package management. The next step is to install different dependencies on the targeted system, including one that allows for data transfer over proxy servers.

The same PowerShell script hits another image URL, once again using steganography to hide a Python script, again encoded in base64. The script is named to mimic a Microsoft security component, bearing the name "MicrosoftSecurityUpdate.py". The Python script is in turn executed through a batch file created by the original PowerShell script.

The malware's further behavior is more conventional as well, but the unusual tactics and the installation of several legitimate tools to facilitate the delivery of the final payload make Serpent noteworthy. The final payload is also a unique new piece of malware.