Experts at the 360 Threat Intelligence Center uncovered a new malspam campaign that leverages the tragic Boeing 737 Max crash to spread malware.
Crooks always attempt to exploit the attention of the people on the events that made the headlines. In the last days, two events captured the attention of the media, the New Zealand mosque shooting and the tragic crash of the Boeing 737 Max in Ethiopia,
In the wake of the New Zealand mosque shooting, US CISA is recommending users to remain vigilant on possible scams and malware attacks.
Now experts at the 360 Threat Intelligence Center have uncovered a new malspam campaign that leverages the tragic Boeing 737 Max crash to spread malware. Crooks used spam messages that pretend to be leaked documents about possible crashes of the Boeing 737 Max.
Attackers are using topics regarding #Boeing 737 MAX 8 crash and seems an email account from @IsgecPresses has been abused to deliver the mails. The attachment is a JAR file which drops H-WORM RAT.
C2: pm2bitcoin[.]com
brothersjoy[.]nlhttps://t.co/qs6XhKMU3k pic.twitter.com/3aJWTKO2bT— RedDrip Team (@RedDrip7) March 15, 2019
Crooks are using #Boeing hashtag in their campaign, spam messages were sent by the allegedly compromised email account at @IsgecPresses ([email protected]).
Threat actors are using a JAR file as an attachment (i.e. MP4_142019.jar) that acts as a dropper for the Houdini H-WORM RAT, spam emails have subject lines similar to “Fwd: Airlines plane crash Boeing 737 Max 8“.
These emails pretend to be from a private intelligence analyst who found a leaked document on the dark web. This document pretends to contain information about other airline companies will be affected by similar crashes soon.
Below the text used by crooks that was shared by BleepingComputer.
Greetings
I believe you have heard about the latest crash Boeing 737 MAX 8 which happen on sunday 10 march 2019, All passengers and crew were killed in the accident
Ethiopian Airlines Flight ET302 from Addis Ababa, Ethiopia, to Nairobi, Kenya, crashed shortly after takeoff
The dead were of 35 different nationalities, including eight Americans.
On 29 October 2018, the Boeing 737 MAX 8 operating the route crashed into the Java Sea 12 minutes after takeoff.
All 189 passengers and crew were killed in the accident.
note: there was a leak information from Darkweb which listed all the airline companies that will go down soon.
kindly notify your love ones about the informations on these file.
Regards
Joshua Berlinger
private inteligent analyst
If a user attempts to open the JAR file, it will be executed by JAVA on the computer. This attachment was originally thought to only install the Houdini H-worm Remote Access Trojan, but security
Security researcher Racco42 analyzed the JAR file after noticing its anomalous size and discovered running it through Any.Run that the malware was also installing the Adwind data-stealer Trojan.
Its too big for H_worm only, it will also probably drop adwind/jrat
— Racco42 (@Racco42) March 15, 2019
