K7 LabsPublished
Threat actors target recent Election Results
Excerpt
Recently, we saw a tweet about a document claiming to be reporting about the recent “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing credentials and other sensitive information. While checking the IOC’s related to this Crimson RAT, we also noticed that there was another Excel file which was disguised as “Syllabus of a University in Delhi”.
This blog gets into the technical details of this document having a Crimson RAT payload.
Figure 1: Tweet
Transparent Tribe APT
Transparent Tribe, a group believed to operate out of Pakistan, has been active since 2013. The…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by K7 Labs on labs.k7computing.com.
More from K7 Labs2
- From Registry-Stored PowerShell to In-Memory Cryptocurrency Mining: A Multi-Stage Infection ChainK7 Labs · Published 18 Sep
- Fake Microsoft Teams Campaign Delivers ValleyRAT via NSIS Installer and DLL SideloadingK7 Labs · Published 20 May
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Animal Farm APT and the Shadow of French IntelligenceInfosec Institute · Published 8 Jul 2015
- Darktrace Malware Analysis: Unpacking SnappyBeeDarktrace · Published 3 Feb
