{"id":90,"date":"2018-08-29T16:19:40","date_gmt":"2018-08-29T15:19:40","guid":{"rendered":"http:\/\/fortgale.com\/news\/?p=90"},"modified":"2026-06-08T22:31:52","modified_gmt":"2026-06-08T22:31:52","slug":"neutrino-malware-campaign-infections","status":"publish","type":"post","link":"https:\/\/fortgale.com\/blog\/emerging-threats\/neutrino-malware-campaign-infections\/","title":{"rendered":"Malware campaign \u2014 Neutrino infections"},"content":{"rendered":"

Below is an analysis of the Neutrino Trojan. Among recent malware campaigns employing Neutrino, in which an Office suite attachment serves as the initial infection stage, a technique has recently been introduced to increase message reliability and bypass automated malware analysis systems.<\/p>\n

Delivery Method<\/h2>\n

The infection technique and malware campaign typology present no novelty in the context of malware infections, having been well documented for some time.<\/a><\/p>\n

Infection occurs via email with a password-protected malicious attachment. The password is contained within the email body. This compels the user to treat the attachment as trustworthy.<\/p>\n

\"\"<\/p>\n

Upon entering the password, the document appears as follows:<\/p>\n

\"\"<\/p>\n

Should the user enable the Macro, it proceeds to download and execute additional malware components on the now-compromised system.<\/p>\n

Network Analysis<\/h2>\n

From a network security perspective, infection within a controlled virtual environment generated a significant volume of IDS (Intrusion Detection System) alerts with precise signatures identifying the threat typology:<\/p>\n

\"\"<\/p>\n

Alerts were also generated regarding the download of an executable file (.exe) and its download directly from an IP address (dotted-quad).<\/p>\n

More precise is the anomaly “ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016,” which allows us to identify a typical malicious behavior frequently employed in these campaigns: malware download via MACRO.<\/p>\n

IDS signature details:<\/p>\n

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:”ET CURRENT_EVENTS Possible Malicious Macro DL EXE Feb 2016″; flow:established,to_server; content:”GET”; http_method; content:”.exe”; http_uri; nocase; fast_pattern:only; content:”Accept|3a 20|*\/*|0d 0a|”; depth:13; http_header; content:”Accept-Encoding|3a 20|gzip, deflate|0d 0a|”; http_header; content:”User-Agent|3a 20|Mozilla\/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT”; http_header; content:!”Referer|3a|”; http_header; content:!”Cookie|3a|”; pcre:”\/(?:\\\/(?:(?:p(?:lugins\\\/content\\\/vote\\\/\\.ssl\\\/[a-z0-9]|a(?:nel\\\/includes\\\/[^\\x2f]+|tric)|o(?:sts?\\\/[a-z0-9]+|ny[a-z]*)|rogcicicic|m\\d{1,2})|s(?:ystem\\\/(?:logs|engine)\\\/[^\\x2f]+?|e(?:rv(?:au|er)|ct)|vchost[^\\x2f]*|gau\\\/.*?|alam|ucks|can|ke)|(?=[a-z]*[0-9])(?=[0-9]*[a-z])(?!setup\\d+\\.exe$)[a-z0-9]{5,10}|in(?:voice(?:\\\/[^\\x2f]+|[^\\x2f]*)|st\\d+|fos?)|a(?:d(?:min\\\/images\\\/\\w+|obe)|salam|live|us)|m(?:edia\\\/files\\\/\\w+|a(?:cros?|rch)|soffice)|d(?:o(?:c(?:\\\/[a-z0-9]+)?|ne)|bust)|(?:~.+?\\\/\\.[^\\x2f]+|\\.css)\\\/.+?|c(?:onfig|hris|alc)|u(?:swinz\\w+|pdate)|xml\\\/load\\\/[^\\x2f]+|(?:[Dd]ocumen|ve)t|Ozonecrytedserver|w(?:or[dk]|insys)|t(?:mp\\\/.+?|est)|fa(?:cture|soo)|n(?:otepad|ach)|k(?:be|ey|is)|ArfBtxz|office|yhaooo|[a-z]|etna|link|\\d+)\\.exe$|(?:(?=[a-z0-9]*?[3456789][a-z0-9]*?[3456789])(?=[a-z0-9]*?[h-z])[a-z0-9]{3,31}\\+|PasswordRecovery|RemoveWAT|Dejdisc|Host\\d+|Msword)\\.exe)|(?:^\\\/(?:image\\\/.+?\\\/[^\\x2f]+|x\\\/setup)|[\\x2f\\s]order|keem)\\.exe$)\/Ui”; content:!”.bloomberg.com|0d 0a|”; http_header; nocase; content:!”.bitdefender.com|0d 0a|”; http_header; classtype:trojan-activity; sid:2022550; rev:15; metadata:affected_product MS_Office, attack_target Client_Endpoint, deployment Perimeter, tag <\/span>MalDoc?<\/a><\/span>, signature_severity Major, created_at 2016_02_18, malware_family <\/span>MalDocGeneric?<\/a><\/span>, performance_impact Low, updated_at 2016_07_01;)<\/span><\/p><\/blockquote>\n

The details just presented are those an analyst considers during the initial analysis phases, obtaining important information regarding the infection process and what is occurring.<\/p>\n

Going into greater detail, it is possible to extract information regarding threat typology and extract IOCs (Indicators of Compromise) for extended searching within systems and infrastructures. Through Cyber Threat Intelligence<\/a> capabilities, these indicators are shared within the MISP Community of the EthicalSec<\/a> association.<\/p>\n

During analysis, 2 distinct servers belonging to the attacker’s infrastructure were identified:<\/p>\n