Malicious Excel XLL add-ins push RedLine password-stealing malware

Cybercriminals are spamming web site contact kinds and dialogue boards to distribute Excel XLL information that obtain and set up the RedLine password and information-stealing malware.

RedLine is an information-stealing Trojan that steals cookies, consumer names and passwords, and bank cards saved in internet browsers, in addition to FTP credentials and information from an contaminated gadget.

Along with stealing information, RedLine can execute instructions, obtain and run additional malware, and create screenshots of the lively Home windows display screen.

All of this information is collected and despatched again to the attackers to be offered on legal marketplaces or used for different malicious and fraudulent exercise.

Spamming contact kinds and dialogue boards

Over the previous two weeks, BleepingComputer’s contact kinds have been spammed quite a few occasions with totally different phishing lures, together with faux promoting requests, vacation reward guides, and web site promotions.

After researching the lures, BleepingComputer has found this to be a widespread marketing campaign focusing on many web sites utilizing public boards or article remark programs.

In some phishing lures seen by BleepingComputer, the menace actors have created faux web sites to host the malicious Excel XLL information used to put in the malware.

For instance, one marketing campaign used the next spam message and a faux web site that imitated the professional Plutio web site.

The whole lot you want to run what you are promoting.  Handle tasks, create dazzling proposals  and receives a commission sooner. Black Friday! All plans are FREE, no bank card required. 

Different spam messages faux to be fee reviews, requests for promoting, or reward guides with hyperlinks to malicious XLL information hosted on Google Drive, as proven under.

Of specific curiosity is a lure focusing on web page house owners with requests to promote on their web site and asking them to evaluate the phrases of the provide. This results in a malicious ‘phrases.xll‘ file that installs the malware.

Promote us promoting house in your web site from $ 500 
You possibly can learn our phrases on the hyperlink under 
https://drive.google[.]com/file/d/xxx/view?usp=sharing

Different lures seen by BleepingComputer this week are:

Thanks for utilizing our app. Your fee has been authorised. You possibly can see your fee report on the hyperlink under https://xxx[.]hyperlink/report.xll

Google simply revealed the 100 hottest items of 2021 
 
I received $10.000. Need it too? Learn and settle for the phrases 
https://drive.google[.]com/file/d/xxx/view?usp=sharing

Abusing Excel XLL information

These spam campaigns are designed to push malicious Excel XLL information that obtain and set up the RedLine malware on victims’ Home windows gadgets.

An XLL file is an add-in that enables builders to increase the performance of Excel by studying and writing information, importing information from different sources, or creating customized features to carry out varied duties.

XLL information are merely a DLL file that features an ‘xlAutoOpen’ perform executed by Microsoft Excel when the add-in is opened.

Whereas assessments performed by BleepingComputer and safety researcher TheAnalyst, with who we mentioned the assault, are usually not appropriately loading the XLL file, they might work in different variations of Microsoft Excel.

Nonetheless, manually executing the DLL with the regsvr32.exe command or the ‘rundll32 identify.xll, xlAutoOpen‘ command will extract the wget.exe program to the %UserProfile% folder and use it to obtain the RedLine binary from a distant web site.

This malicious binary is saved as %UserProfilepercentJavaBridge32.exe [VirusTotal] after which executed.

A Registry autorun entry may also be created to robotically launch the RedLine information-stealer each time victims log into Home windows. 

As soon as the malware is executed, it should seek for invaluable information to steal, together with credentials and bank cards saved within the Chrome, Edge, Firefox, Courageous, and Opera browsers.

You probably have turn into a sufferer of this marketing campaign, it’s best to assume that your saved passwords are compromised and instantly change them. Moreover, when you’ve got bank cards saved in your browsers, it’s best to contact your bank card firm to alert them of the incident.

As XLL information are executables, menace actors can use them to carry out quite a lot of malicious habits on a tool. Subsequently, you could by no means open one except it comes from a trusted supply.

These information are usually not typically despatched as attachments however as an alternative put in by one other program or by way of your Home windows admin.

Subsequently, in the event you obtain an e-mail or different message distributing a lot of these information, merely delete the message and report it as spam.

IOCs

XLL information:

phrases.xll, report.xll, terms_of_use.xll
f6c06615e35798274dfa9c4b28aaa6d94220804e766e9a70c4f0dab4779ee1db

RedLine:

JavaBridge32.exe: 626db53138176b8a371878ebaa2dbbd724be9a74f9f82ef9ebb7b7bfc0c6b2e9