{"id":6176,"date":"2021-03-29T11:10:13","date_gmt":"2021-03-29T18:10:13","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=6176"},"modified":"2024-04-26T13:20:48","modified_gmt":"2024-04-26T20:20:48","slug":"malspam-campaign-delivers-burkina-trojan","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-campaign-briefs\/malspam-campaign-delivers-burkina-trojan\/","title":{"rendered":"Malspam Campaign Delivers Burkina Trojan"},"content":{"rendered":"

Author: Jeremy Ware<\/strong><\/h3>\n

TLP: WHITE\u00a0<\/strong><\/h3>\n

 <\/p>\n

Overview<\/h3>\n

From 21 to 23 March, we observed a malspam campaign distributing the Burkina trojan. First seen in October 2017, Burkina is a trojan distributed through executable (EXE) files sent via email.<\/p>\n

Customer Impact<\/h3>\n

Burkina infects a victim\u2019s computer and attempts to harvest credentials, interrupt standard processes, conceal network connections, and other malicious actions. The malware then reaches out to a command and control (C&C) server to receive additional instructions.<\/p>\n

The threat actor can use the stolen credentials to carry out additional malicious acts, including dropping a ransomware package or distributing additional payloads such as Trickbot.1<\/sup><\/p>\n

Campaign Analysis<\/h3>\n

The campaign we observed delivered Burkina via spam emails. Both the subject line – WG:Re:AG:Re:New order.<\/em> – and body – See attached PDF<\/em> – of each message were identical. The emails carried a malicious EXE attachment masquerading as a PDF with the filename SPL6677.pdf.exe<\/em>.<\/p>\n

Attack Chain<\/h3>\n

Once the user opens the attached file, the executable will present the message \u201cSimpleGameLib has stopped working\u201d to the user.<\/p>\n

Burkina drops another executable file named WerFault.exe<\/em> and updates the AutoRun Registry to include itself. It then attempts to harvest credentials and saved passwords once the user opens a browser. Finally, the malware attempts to connect to a C&C server to receive further instructions as well as to exfiltrate the stolen data.<\/p>\n

Vulnerabilities & Mitigation<\/h3>\n

Infoblox recommends the following precautions to reduce the possibility of infection by Burkina:<\/p>\n