Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds
Apple sues spyware-maker NSO Group, notifies iOS exploit targets
Germany to force ISPs to give discounts for slow Internet speeds
Microsoft Defender for Endpoint fails to start on Windows Server
Customize Windows 11 experience with these free apps
This CISSP course is 70% off in the final hours of Black Friday
Get unlimited access to 210 top Mac apps for $42 this Black Friday
The Best Cyber Monday 2021 Security, IT, VPN, & Antivirus Deals
Qualys BrowserCheck
Junkware Removal Tool
How to remove the PBlock+ adware browser extension
Remove the Toksearches.xyz Search Redirect
Remove the Smashapps.net Search Redirect
Remove the Smashappsearch.com Search Redirect
Remove Security Tool and SecurityTool (Uninstall Guide)
How to remove Antivirus 2009 (Uninstall Instructions)
How to Remove WinFixer / Virtumonde / Msevents / Trojan.vundo
How to remove Google Redirects or the TDSS, TDL3, or Alureon rootkit using TDSSKiller
Locky Ransomware Information, Help Guide, and FAQ
CryptoLocker Ransomware Information Guide and FAQ
CryptorBit and HowDecrypt Information Guide and FAQ
CryptoDefense and How_Decrypt Ransomware Information Guide and FAQ
How to make the Start menu full screen in Windows 10
How to install the Microsoft Visual C++ 2015 Runtime
How to open an elevated PowerShell Admin prompt in Windows 10
How to Translate a Web Page in Google Chrome
How to start Windows in Safe Mode
How to remove a Trojan, Virus, Worm, or other Malware
How to show hidden files in Windows 7
How to see hidden files in Windows
IT Certification Courses
Gear + Gadgets

The TrickBot malware operators have been using a new method to check the screen resolution of a victim system to evade detection of security software and analysis by researchers.
Last year, the TrickBot gang added a new feature to their malware that terminated the infection chain if a device was using non-standard screen resolutions of 800×600 and 1024×768.
In a new variation spotted by threat researchers, the verification code has been added to the HTML attachment of the malspam delivered to the potential victim.
Researchers usually analyze malware in virtual machines that come with certain particularities – especially on default configurations – such as running services, name of the machine, network card, CPU features, and screen resolution.
Malware developers are aware of these characteristics and take advantage of implementing methods that stop the infection process on systems identified as virtual machines.
In TrickBot malware samples found last year, the executable included JavaScript code that verified the screen resolution of the system it was running on.
Recently, TheAnalyst – a threat hunter and member of the Cryptolaemus security research group, found that the HTML attachment from a TrickBot malspam campaign behaved differently on a real machine than on a virtual one.
The attachment downloaded a malicious ZIP archive on a physical system but redirected to the ABC’s (American Broadcasting Company) website in a virtual environment.
If the target opens the HTML in their web browser, the malicious script is decoded and the payload is deployed on their device.
The email carrying the attachment was a fake alert for purchasing insurance, with details added to an HTML attachment.
Opening the attachment launched the HTML file in the default web browser, displaying a message asking for patience for the document to load and providing a password to access it.
On a regular user’s machine, the infection chain would continue with downloading a ZIP archive that included the TrickBot executable, just as seen in the image below, published by TheAnalyst:
Downloading malware this way is a technique known as HTML smuggling. It allows a threat actor to bypass a browser’s content filters and sneak malicious files on a target computer by including encoded JavaScript into an HTML file.
While this appears to be an innovation from TrickBot operators, the trick is not new and has been seen before in attacks luring victims to phishing sites.
Security researcher MalwareHunterTeam found in March this year a phishing kit that included code for checking the system’s screen resolution.
Since then, the researcher told BleepingComputer that he saw the tactic being used multiple times in various phishing campaigns as a means to avoid investigators.
The script determines if the user landing on the phishing page uses a virtual machine or a physical one by checking if the web browser uses a software renderer like as SwiftShaderLLVMpipe, or VirtualBox, which typically means that a virtual environment.
As seen above, the script also checks if the color depth of the visitor’s screen is less than 24-bits, or if the screen height and width are less than 100 pixels.
TrickBot is not using the same script as the one above but relies on the same tactic to detect a researcher’s sandbox. However, it’s a premiere for the gang to use such a script in an HTML attachment.
This may also be the first time malware uses an attachment to run a screen resolution check rather than doing it on the landing page serving the malware executable.
Previously, the malware checked for non-standard screen resolutions 800×600 and 1024×768, which are indicative of a virtual machine.
Microsoft warns of surge in HTML smuggling phishing attacks
TrickBot teams up with Shatak phishers for Conti ransomware attacks
Windows Finger command abused by phishing to download malware
IKEA email systems hit by ongoing cyberattack
How cybercriminals adjusted their scams for Black Friday 2021
Not a member yet? Register Now
IKEA email systems hit by ongoing cyberattack
New Windows 10 zero-day gives admin rights, gets unofficial patch
To receive periodic updates and news from BleepingComputer, please use the form below.
Terms of Use Privacy PolicyEthics Statement
Copyright @ 2003 – 2021 Bleeping Computer® LLC – All Rights Reserved
Not a member yet? Register Now
Read our posting guidelinese to learn what content is prohibited.


You May Also Like

Upgraded to log4j 2.16? Surprise, there's a 2.17 fixing DoS

TellYouThePass ransomware revived in Linux, Windows Log4j attacksCredit card info of 1.8…

NPM fixes private package names leak, serious authorization bug

Windows 10 21H2 is released, here are the new featuresNew Rowhammer technique…

Microsoft Exchange servers hacked in internal reply-chain attacks

Microsoft: Office 365 will boost default protection for all usersMicrosoft increases Windows…

Medical software firm urges password resets after ransomware attack

State hackers breach defense, energy, healthcare orgs worldwideMediaMarkt hit by Hive ransomware,…