Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV //

Malware

4/30/2018
08:05 AM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Rubella Macro Builder Crimeware Kit Price Drops to $40

Crime might not pay, but it also doesn't have to be expensive to try. Flashpoint researchers have found that the monthly fee for the Rubella Macro Builder crimeware kit dropped to $40 on the underground market.

Up until now, Malware creators have had to be somewhat skilled in coding the vagaries of effective malicious software. While the skills necessary to do this have been discussed in many dark Internet forums, malware-as-a-service (MaaS) has remained fairly limited.

Those offering such a "service" have usually asked for an upfront fee for it large enough to dissuade the more casual criminal. (See Cybercrime: More Like Facebook's Model Than Traditional Criminal Enterprise.)

However, that may be changing.

Researchers at Flashpoint have discovered a crimeware kit called the Rubella Macro Builder, which has the functionality to create a macro that will drop some other weaponized malware through social engineering techniques. Not only does it only cost the malfeasers $40 a month to use at last check -- down from a three-month fee of $500 when it was first offered -- but it has been improved since its introduction.

The enhanced features that are present in the latest, 1.4 Version of the kit include encryption algorithm choices (XOR and Base64), a choice of download methods (PowerShell, Bitsadmin, Microsoft.XMLHTTP, MSXML2.XMLHTTP), custom PowerShell payload, payload execution methods (executable, JavaScript, Visual Basic Script) and the ability to easily deploy social engineering decoy themes with an "Enable Content" feature that can be turned on by the socially engineered user in order to actually run the macro.

The Builder runs on Windows machines and does not utilize any vulnerabilities for its functionality. It can generate Microsoft Word (.DOC) and Microsoft Excel (.XLS) payloads.

Flashpoint found that the macro junk and substitution method appeared to be relatively primitive, since it relied on basic string substitutions. The copy/paste implementation of the Base64 algorithm is displayed in Visual Basic Script (VBS) code implementation, which is also unsophisticated. The code is obfuscated through general Chr ASCII values.

Rubella-originated macros can evade anti-virus software as well.

The macro can get its payload from a server, which is contacted via the IXMLHTTPRequest method.

Flashpoint found that Rubella was used as the first-stage loader by two criminal gangs in two recent but separate campaigns that used the Panda and Gootkit banking malware.


The fundamentals of network security are being redefined -- don't get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual Big Communications Event. There's still time to register and communications service providers get in free!

Researchers believe that these gangs were customers of the actor that is offering Rubella on the underground Russian forums. The attackers targeted customers through social media platforms, along with an Australian financial institution, using Panda's webinject functionality.

Mitigation for Rubella-generated macros are the standard ones: don't open it if you don't know for a fact it's legit is always a good rule.

But the dead giveaway here will be the request to enable macros that will show up with a security warning. Even though there may be a great-looking splash screen that comes up as well urging you to do so, don't do it. Just say "nyet."

As the price of the Rubella kit drops, wider use of it can be expected by criminals that are looking for their payoff. The aware user can defeat it, but the price of liberty is eternal vigilance.

Related posts:

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
4 Security Tips as the July 15 Tax-Day Extension Draws Near
Shane Buckley, President & Chief Operating Officer, Gigamon,  7/10/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15105
PUBLISHED: 2020-07-10
Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authenticati...
CVE-2020-11061
PUBLISHED: 2020-07-10
In Bareos Director less than or equal to 16.2.10, 17.2.9, 18.2.8, and 19.2.7, a heap overflow allows a malicious client to corrupt the director's memory via oversized digest strings sent during initialization of a verify job. Disabling verify jobs mitigates the problem. This issue is also patched in...
CVE-2020-4042
PUBLISHED: 2020-07-10
Bareos before version 19.2.8 and earlier allows a malicious client to communicate with the director without knowledge of the shared secret if the director allows client initiated connection and connects to the client itself. The malicious client can replay the Bareos director's cram-md5 challenge to...
CVE-2020-11081
PUBLISHED: 2020-07-10
osquery before version 4.4.0 enables a priviledge escalation vulnerability. If a Window system is configured with a PATH that contains a user-writable directory then a local user may write a zlib1.dll DLL, which osquery will attempt to load. Since osquery runs with elevated privileges this enables l...
CVE-2020-6114
PUBLISHED: 2020-07-10
An exploitable SQL injection vulnerability exists in the Admin Reports functionality of Glacies IceHRM v26.6.0.OS (Commit bb274de1751ffb9d09482fd2538f9950a94c510a) . A specially crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerabi...