Golang-based Malware Campaign Relies on James Webb Telescope’s Image

A new hacking marketing campaign is exploiting the notorious deep discipline image taken from the James Webb telescope alongside obfuscated Go programming language payloads to infect techniques.

The malware was noticed by the Securonix Risk investigation staff, who is monitoring the marketing campaign as GO#WEBBFUSCATOR.

“Initial an infection commences with a phishing email containing a Microsoft Business office attachment,” the security industry experts wrote in an advisory. “The document includes an external reference hidden inside of the document’s metadata which downloads a destructive template file.”

Securonix claimed that, in a way comparable to that of a classic Place of work macro, the template file contains a VB script (an Lively Scripting language produced by Microsoft and modeled on Visual Standard) that will mechanically start off the initially phase of code execution for this attack after the user enables macros.

After deobfuscating the code, the security gurus noticed the malware execute a command that downloaded an graphic file, utilized certutil.exe (a Windows command-line application set up as aspect of Certification Services) to decode it into a binary and then ultimately executed it.

The graphic file alone executed as a standard .jpg file and showcased a deep area image taken from the James Webb telescope. Even so, when inspected with a textual content editor, Securonix observed the image contained destructive Foundation64 code camouflaged as an incorporated certification. 

“At the time of publication, this individual file is undetected by all antivirus vendors according to VirusTotal,” the advisory reads.

The security scientists also discussed that employing a authentic picture to build a Golang binary with Certutil is not incredibly popular and, thus, some thing the team is tracking closely. 

“It’s crystal clear that the authentic author of the binary intended the payload with equally some trivial counter-forensics and anti-endpoint detection and response (EDR) detection methodologies in mind,” wrote Securonix.

The malware also demonstrates that Golang is continue to well known between hackers. In truth, the advisory detailing its discovery arrives days following Pattern Micro spotted a new piece of targeted ransomware established in the Go programming language.

Some elements of this report are sourced from:
www.infosecurity-magazine.com