New ClickFix campaign detected

A new ClickFix campaign was detected, tricking the victim into changing the DNS value to install the malware.

As usual, a ClickFix campaign, or tricking the victim into following a fake error screen command, usually leads to the insertion of code to install the malware directly, but this campaign is something different.

According to a report by the website Cyber Security News, it mentions the detection of a ClickFix campaign in a new way that, instead of tricking the installation of traditional malware, leads to more technical changes on the victim's machine: modifying the Domain Name System or DNS settings on the victim's machine. After the victim completes the command by placing code on Run and pressing Enter, instead of downloading malware, the script runs cmd.exe to perform DNS Lookup (domain search) to the hacker's external server instead of the DNS Resolver. It is on the victim's system. This script will execute a Parse, Request, or Request sent out, especially in the Name: field of the DNS. In this field, it is not a real server name, but a payload file in step 2. If it is successfully downloaded, it will be installed immediately.

This technique allows hackers to use the DNS as a lightweight Staging Channel, confirming the accuracy of the target (Validation) before sending a heavier malware to the victim's machine. In addition, using this channel, which is a normal channel to communicate with the network, helps evade detection.

A research team from Microsoft Defender, the cybersecurity subsidiary of Microsoft, has also said that after downloading Payload in step 2 from Trigger by DNS Response, it will lead to chain malware embedding by downloading zipped compressed files. Inside, there is a Python Bundle file. If the file is opened, it will lead to Reconnaissance in the Host and Domain section, followed by Persistence in the victim's system by releasing VBScript scripts. Come down and create a shortcut called MonitoringService.lnk inside the Windows Startup folder to ensure that malware is restarted every time a new machine is booted.

And finally, it will be the last payload that is remotely controlled by the victim's machine, or the Remote Access Trojan (RAT), called ModeloRAT, installed on the victim's machine. The good news is that Windows Defender can be blocked. The malware is recorded in the database of this protection tool under the name Trojan: Win32 / ClickFix.R! ml.

# Trending # Lemon 8 Howtoo # lemon 8 diary # freedomhack # it