Trusted Design

Malware Meets SysAdmin – Automation Tools Gone Bad

概要

Talos recently spotted a targeted phishing attack with several unique characteristics that are not normally seen. While we monitor phishing campaigns used to distribute threats such as Dridex, Upatre, and Cryptowall, targeted phishing attacks are more convincing because the format of the message is personalized to the targeted user. This targeted attack was more difficult to detect because adversaries chose to leverage AutoIT, a well known freeware administration tool for automating system management in corporate environments. This notable characteristic made this attack worthy of further analysis. Utilizing AutoIT within a payload is unique because it is a legitimate management tool. In this attack, AutoIT was utilized to install a Remote Access Trojan (RAT) and maintain persistence on the host in a manner that’s similar to normal administration activity.

Created: 2026-02-23

Indicators

• FileHash-SHA256 - 71b1fdcd5eae228a576c37d028d61e1fb907e20cbb8af595e5f69e772ada4773 -
• FileHash-SHA256 - d2f71b349b6a5e20bc660b62a04209074a2ad3d3460c113b04a28c1c20f57713 -
• FileHash-SHA256 - 0bcfe9255c6308ddd36f8838ec248d8f342b0eb8bcfe248e1904e36f30a1f668 -
• FileHash-SHA256 - eab0589c372e980ac50fadd5ffb42da978000e216e5a5a0cf4547646d6c8dcc9 -
• hostname - apananco.no-ip.biz -
• FileHash-SHA256 - a086a7ca8149d010ae1236c3bac16496d366de0080cee37ba6b9e8ab56aac08f -
• FileHash-SHA256 - 7c919199f2dd490714f9f64666025509b8fa4d596c80aed3fd56f532555c0679 -
• FileHash-SHA256 - f50d9134a76e3b8509d855712d66b690faff0a249c3d55ddcfc9eb74a7743970 -
• URL - http://frontlinegulf.com/tmp/adobefile.exe -
• domain - frontlinegulf.com -
• FileHash-SHA256 - 8035104e69f097393ee96c85d80c16c60c0706b6a330c1cf34d98e5fa162968d -

類似Pulses

• Malware leverages Windows Management Instrumentation (WMI) (score: 0.63)
• TrendLabs: Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind (score: 0.62)
• Threat Spotlight: Spin to Win...Malware (score: 0.61)
• Blurring of Commodity and Targeted Attack Malware (score: 0.60)
• Adwind: another payload for botnet-based malspam (score: 0.60)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る