{"id":6365,"date":"2021-05-27T08:48:18","date_gmt":"2021-05-27T15:48:18","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=6365"},"modified":"2024-04-26T13:20:40","modified_gmt":"2024-04-26T20:20:40","slug":"graftor-adware-still-circulating","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-campaign-briefs\/graftor-adware-still-circulating\/","title":{"rendered":"Graftor Adware Still Circulating"},"content":{"rendered":"

Author: Nathan Toporek<\/strong><\/h3>\n

TLP: WHITE<\/strong><\/h3>\n

 <\/p>\n

Overview<\/h3>\n

On May 21 Infoblox observed a malicious spam campaign delivering Graftor malware via malicious file attachments. The threat actor(s) used a generic Invoice theme to lure victims into opening a weaponized Excel Spreadsheet.<\/p>\n

Customer Impact<\/h3>\n

Graftor, a.k.a LoadMoney, is a family of adware that has been used by threat actors for more than nine years.1<\/sup> Once a victim is infected, it will install unwanted software on their machine.<\/p>\n

While our samples no longer fully executed, past versions of Graftor were capable of browser hijacking, injecting advertising banners, installing other unwanted applications, changing a user\u2019s homepage and search provider, and launching other adware. They also had anti-detection capabilities such as antivirus and sandbox detection.2<\/sup>\u00a0<\/strong><\/p>\n

Campaign Analysis<\/h3>\n

Over the years, threat actors have distributed Graftor via malicious spam emails, as well as via free software (freeware) installers.3<\/sup><\/p>\n

In this campaign, threat actor(s) used a subject line of RE:Fwd: REQUOTE PENDING ORDER<\/em> to lure victims to open the email. Individual messages were empty, but all emails had a malicious attachment named INVOCE#4587.xlsx<\/em>.<\/p>\n

Attack Chain<\/h3>\n

When the victim opens the file attachment it will exploit CVE-11882 to download and execute the Graftor binary.<\/p>\n

Vulnerabilities & Mitigation<\/h3>\n

This campaign relies on both social engineering tactics and software exploits to infect victims with Graftor malware. As such, Infoblox recommends the following precautions:<\/p>\n