Attenzione alle fatture elettroniche ricevute tramite Posta Certificata, potrebbero contenere il Malware sLoad

In questi giorno il nostro Team ha riscontrato diversi file maligni contenuti in messaggi ricevuti tramite posta certificata provenienti da pec.it.

l messaggio, apparentemente innocuo, contiente un file allegato compresso (.ZIP) denominato 00CODICEFISCALE.zip. All’interno dello stesso è presente un file “nuovo_documento.txt” e un ulteriore archivio ZIP contenente un documento XML (00CODICEFISCALE.xml) e un file di script VBScript (00CODICEFISCALE.vbs)

L’infezione ha inizio nel momento in cui la vittima clicca sul file di script VBScript (00CODICEFISCALE.vbs)

Lo script ha il compito di scaricare il payload PowerShell con BitsAdmin ed eseguirlo.
A quanto pare sLoad resta in esecuzione in attesa di ricevere ulteriore payload da eseguire

Il CERT-AGID ha già condiviso gli IoC attraverso la sue piattaforme per favorirne la loro diffusione.
Al fine di rendere pubblici i dettagli di questa campagna si riportano di seguito gli indicatori rilevati:

{
    "774cb9dc-eca1-46ff-9c68-51a6f99d1b97": {
        "event_id": 10699,
        "created_at": "2021-02-08T09:08:33.897237+00:00",
        "updated_at": "2021-02-08T11:02:16.417124+00:00",
        "name": "Campagna sLoad italiana via PEC",
        "description": "",
        "subject": "Comunicazione [RAGIONE SOCIALE]",
        "tlp": "0",
        "campaign_type": "malware",
        "method": "attached",
        "country": "italy",
        "file_type": [
            "zip",
            "vbs"
        ],
        "theme": "Pagamenti",
        "malware": "sLoad",
        "phishing": null,
        "tag": [],
        "ioc_list": {
            "md5": [
                "8fa02a04e059a3c42c8f3b658dd42db8",
                "d4a04547d7506e87943f0414ca594051",
                "485df362a1694345301337ac914bfb17",
                "ec6bdd211de6b8698f1cf9072219e42c",
                "b1e4bb15cd7c3bb8faa27d9259060d6e",
                "f67a42c91e94b6b1845f2991ee588196",
                "080ac65752ca97d06a3de503ed45252d",
                "6801c7af2238946a05cf9fecf86bd11c",
                "1008c3ae9aa7e65e0bd97f40a2ff2d60",
                "b793bd2a0aebcf4aff95c491bf924a2c",
                "cfc8143df954351681e7c18802130092",
                "d14ae3fffe89a3cda612e293fa66b775"
            ],
            "sha1": [
                "ef835b98047094eed80d68b294550cbb956f9346",
                "201e7d7629b99c472fcbdd10a9424a40116ec503",
                "eb01c7a3ee45c75ff0430c418a9a0c8ade389a38",
                "445d00c002a7748c072acd437e60e16d8bd768cc",
                "f22e0e7128ebc6f4afab820df61a3b2f7b789135",
                "7b9443ba17a4a1b2c8960e6872811803dc9d6e61",
                "977c1c3f66121186ec621fb2faf88751486cb976",
                "1dc36500c1ecf233c2738091fecb8fafc315e5c4",
                "3ed4dbf4f910c36a970e196ccb8cda9c19c48cd8",
                "164798f5e726d040ba50dbea16506e73d1899124",
                "22548a14a8f750d11df3af6a5b49f1333c2e5a2b",
                "427fe1e67766b2846db7afea92e6761c0457c35e"
            ],
            "sha256": [
                "f2590e00c1edd7d80a72b892191d86dfd7580713d7610569a8f1161ce19ffc72",
                "0c08fa278baf3c874c7280a6b05eb71d99836f25117ab2b72ace45babba2a6fb",
                "901dcc6f1bdc72c3407fcb0f4be2bc8bbab10fbf4c25d71af2ed4c2496ea5f23",
                "e078302658aaa40deea837a33cd29e4feaa27b620e635f50deaad3f4c178fea6",
                "eaafda0f59c154a3f017c92d05d56ab942f8e25adff122c0971ad179c48bdf76",
                "bfc4e538f66206ae7303986954b966c224d9b58daa26106f8226dc23ec651ad1",
                "439d17ecd0dfba98a4de6d93bbc57f547d10bc16bfebe97f788026e0f9b02ee6",
                "5892d0da637ad58bcce67c1b78ca9b1ba3ee701c3884207c0f71cf6a45a321e6",
                "840658c1f5599074779263a97e44d39ad0a0e5b62d499d1c855c83687187acc4",
                "5fe98f58969b72c6a8aa89fd02268f2cac5873e8196672054ca3682f1bcc4c57",
                "6ec8d36bfb96ea6022e6b9937ce4a36d29bc1548579cda241d31202a803ee717",
                "fcd3af70069806dd582ef5037649893e5a5c46ba2e4fbc44422e53c1287e546b"
            ],
            "imphash": [],
            "domain": [
                "raeyb10.eu",
                "raeyb25.eu",
                "rbutkj21.eu",
                "raeyb12.eu",
                "rbutkj16.eu",
                "rbutkj14.eu",
                "rbutkj8.eu",
                "rbutkj22.eu",
                "rbutkj4.eu",
                "raeyb20.eu",
                "rbutkj9.eu",
                "raeyb3.eu",
                "raeyb26.eu",
                "rbutkj25.eu",
                "raeyb23.eu",
                "rbutkj19.eu",
                "raeyb7.eu",
                "raeyb1.eu",
                "rbutkj17.eu",
                "raeyb4.eu",
                "rbutkj3.eu",
                "rbutkj11.eu",
                "raeyb29.eu",
                "fakedepth.com",
                "raeyb28.eu",
                "rbutkj5.eu",
                "rbutkj12.eu",
                "raeyb11.eu",
                "raeyb9.eu",
                "marthayfabrizio.com",
                "rbutkj29.eu",
                "raeyb18.eu",
                "raeyb8.eu",
                "raeyb19.eu",
                "rbutkj1.eu",
                "raeyb27.eu",
                "raeyb15.eu",
                "raeyb17.eu",
                "rbutkj7.eu",
                "raeyb6.eu",
                "raeyb22.eu",
                "rbutkj10.eu",
                "rbutkj30.eu",
                "rbutkj18.eu",
                "rbutkj6.eu",
                "academianv.com",
                "rbutkj20.eu",
                "linderosinmobiliaria.com",
                "myriamherman.com",
                "rbutkj13.eu",
                "raeyb24.eu",
                "raeyb5.eu",
                "raeyb2.eu",
                "raeyb30.eu",
                "raeyb16.eu",
                "rbutkj15.eu",
                "rbutkj2.eu",
                "raeyb21.eu",
                "analyzare.com",
                "rbutkj26.eu",
                "rbutkj27.eu",
                "rbutkj23.eu",
                "raeyb14.eu",
                "rbutkj28.eu",
                "rbutkj24.eu",
                "raeyb13.eu"
            ],
            "url": [
                "https://raeyb23.eu/topic/",
                "https://rbutkj10.eu/topic/",
                "https://raeyb15.eu/topic/",
                "https://raeyb22.eu/topic/",
                "https://academianv.com/denubi/",
                "https://rbutkj.eu/topic/",
                "https://raeyb.eu/topic/",
                "https://myriamherman.com/whooma/",
                "https://analyzare.com/annalisa/",
                "https://raeyb25.eu/topic/",
                "https://rbutkj14.eu/topic/",
                "https://raeyb20.eu/topic/",
                "https://rbutkj20.eu/topic/",
                "https://rbutkj25.eu/topic/",
                "https://rbutkj11.eu/topic/",
                "https://raeyb12.eu/topic/",
                "https://rbutkj1.eu/topic/",
                "https://raeyb26.eu/topic/",
                "https://raeyb28.eu/topic/",
                "https://rbutkj9.eu/topic/",
                "https://rbutkj13.eu/topic/",
                "https://raeyb4.eu/topic/",
                "https://rbutkj4.eu/topic/",
                "https://rbutkj6.eu/topic/",
                "https://rbutkj18.eu/topic/",
                "https://rbutkj16.eu/topic/",
                "https://rbutkj12.eu/topic/",
                "https://rbutkj23.eu/topic/",
                "https://raeyb3.eu/topic/",
                "https://raeyb21.eu/topic/",
                "https://raeyb17.eu/topic/",
                "https://rbutkj17.eu/topic/",
                "https://raeyb7.eu/topic/",
                "https://rbutkj26.eu/topic/",
                "https://rbutkj7.eu/topic/",
                "https://rbutkj21.eu/topic/",
                "https://rbutkj27.eu/topic/",
                "https://raeyb2.eu/topic/",
                "https://raeyb6.eu/topic/",
                "https://rbutkj29.eu/topic/",
                "https://raeyb13.eu/topic/",
                "https://raeyb8.eu/topic/",
                "https://rbutkj30.eu/topic/",
                "https://rbutkj2.eu/topic/",
                "https://raeyb18.eu/topic/",
                "https://rbutkj22.eu/topic/",
                "https://raeyb9.eu/topic/",
                "https://rbutkj24.eu/topic/",
                "https://raeyb24.eu/topic/",
                "https://rbutkj19.eu/topic/",
                "https://rbutkj5.eu/topic/",
                "https://raeyb11.eu/topic/",
                "https://raeyb5.eu/topic/",
                "https://rbutkj15.eu/topic/",
                "https://raeyb19.eu/topic/",
                "https://raeyb1.eu/topic/",
                "https://raeyb30.eu/topic/",
                "https://rbutkj3.eu/topic/",
                "https://rbutkj28.eu/topic/",
                "https://rbutkj8.eu/topic/",
                "https://raeyb16.eu/topic/",
                "https://raeyb27.eu/topic/",
                "https://raeyb29.eu/topic/",
                "https://raeyb10.eu/topic/",
                "https://raeyb14.eu/topic/"
            ],
            "ipv4": [
                "79.141.164.56"
            ],
            "email": []
        },
        "email_victim": [],
        "ioca_version": "1.0",
        "organization": "cert-agid"
    }
}