CurlBack RATMalware

“…Evasion, Reflective Code LoadingA malicious LNK file used [System.Reflection.Assembly]::Load() to reflectively load a .NET assembly.T1027.013Defense Evasion, Obfuscated Files or Information: Encrypted/Encoded FileThe SHEETCREEP backdoor uses TripleDES to encrypt its configur…”

“… visible window.The SHEETCREEP backdoor creates a hidden cmd.exe process in the background to execute commands received from the C2.T1036.008Defense Evasion, Masquerading: Masquerade File TypeThe initial payload is a .NET binary disguised with a PNG extension.T1620Defense Ev…”

“…1204.002Execution, User Execution: Malicious FileThe victim was required to execute a malicious LNK file to initiate the infection chain.T1053.005Persistence, Scheduled Task/Job: Scheduled TaskThe initial payload dropped a loader script, GServices.vbs, and registered it as a…”

“…ps the backdoor to disk at C:\Users\Public\Documents\details.png, as well as a loader (GServices.vbs), which is registered as a scheduled task.”

“…pearphishing LinkThe threat actor used phishing PDFs which contained a ‘Download Document’ button that linked to a malicious ZIP archive.T1059.001Execution, Command and Scripting Interpreter: PowerShellAmalicious LNK file executed a PowerShell command to read a file named de…”

“…EP backdoor encrypts the output of executed commands using the TripleDES implementation from .NET’s System.Security.Cryptography library.T1071.001Command and Control, Application Layer Protocol: Web ProtocolsThe SHEETCREEP backdoor uses the Google Sheets API over HTTPS for its C2…”