The binary then proceeds to download a malware dropper that extracts two more components - a loader and a downloader - the latter of which is injected into one of the Windows processes ("svchost.exe") by the loader. "However, VeraPort only verifies that the digital signature is valid, without checking to whom it belongs."
"WIZVERA VeraPort configurations contain an option to verify the digital signature of downloaded binaries before they are executed, and in most cases this option is enabled by default," the researchers noted.
Stating that the attacks target websites that use VeraPort - which also comes with a base64-encoded XML configuration file containing a list of software to install and their associated download URLs - ESET researchers said the adversaries replaced the software to be delivered to VeraPort users by compromising a legitimate website with malicious binaries that were then signed with illicitly acquired code-signing certificates to deliver the payloads.
0 kommentar(er)
