TL;DR The Trellix Threat Response Team uncovered a multistage attack that uses fake FedEx tax invoices in Korean to deploy the Sirius Backdoor. Inside an attached ZIP archive, a blank PDF triggers an in-memory PowerShell chain that blinds endpoint sensors and hollows legitimate Windows processes. Furthermore, this fileless Sirius Backdoor drops a custom Windows provisioning package so the malware can survive a full operating system reset.

TL;DR The Trellix Threat Response Team uncovered a multistage attack that uses fake FedEx tax invoices in Korean to deploy the Sirius Backdoor. Inside an attached ZIP archive, a blank PDF triggers an in-memory PowerShell chain that blinds endpoint sensors and hollows legitimate Windows processes. Furthermore, this fileless Sirius Backdoor drops a custom Windows provisioning package so the malware can survive a full operating system reset.

At a Glance Malware family DCRat (DarkCrystal RAT) Threat actor Not attributed by Trellix; DCRat is a malware-as-a-service tool Target Users lured with a Colombian judicial theme Delivery vector Phishing email with a malicious SVG attachment Key capabilities Remote access, DLL sideloading, process hollowing, encrypted C2 Source Trellix Advanced Research Center (ARC) TL;DR Trellix analysts uncovered an active DCRat campaign that starts with a booby-trapped SVG file.

An online platform for learning and teaching cyber security, all through your browser.

An online platform for learning and teaching cyber security, all through your browser.

Process Hollowing (a.k.a. RunPE) is probably the oldest, and the most popular process impersonation technique (it allows to run a malicious executable under the cover of a benign process). It is us…