PULLBAIT (Dropper) – Malware

Overview

In the ever-evolving landscape of cyber threats, Pullbait malware has emerged as a significant concern for both individual users and organizations alike. This sophisticated form of malware, often delivered through phishing campaigns, is designed to lure victims into a false sense of security before carrying out its malicious activities. Pullbait’s name itself reflects its primary mechanism: baiting users into taking actions that lead to system compromise. The malware’s ability to exploit human behavior, combined with its evasive techniques, makes it a potent weapon in the hands of cybercriminals.

Pullbait typically relies on deceptive social engineering tactics to initiate its attack. Victims are often targeted through phishing emails that appear legitimate, luring them into clicking on malicious links or downloading infected attachments. These seemingly harmless files or messages may masquerade as notifications from trusted services, such as banks, tech support, or government agencies, making the attack even more insidious. Once the user interacts with the bait, the malware is triggered, often leading to further compromise, data theft, or system manipulation.

Targets

Information

How they operate

The attack typically begins with an email phishing campaign or a malvertising strategy that delivers the malicious payload. These emails often appear to be legitimate, with subjects and content designed to trick the recipient into clicking a link or opening an attachment. Once executed, the malware typically exploits a vulnerability in the victim’s software, such as a browser or email client, allowing it to run without detection. In some cases, it might use an exploit for a known zero-day vulnerability to bypass security mechanisms. The malware often operates stealthily, hiding its activity by using obfuscation techniques, such as packing or encryption, to avoid detection by antivirus programs or security systems.

After the malware is executed, it attempts to establish persistence on the infected machine. This is commonly done by modifying the system’s registry or adding entries to startup folders to ensure that the malware is automatically executed upon system reboot or user login. In some cases, the malware can also create scheduled tasks or use Windows Management Instrumentation (WMI) to maintain its presence. By doing so, Pullbait malware ensures that it can survive system restarts, making it harder to remove and providing cybercriminals with ongoing access to the compromised system.

One of the primary objectives of Pullbait malware is credential theft and system reconnaissance. The malware often searches for stored credentials or sensitive files on the victim’s system. For instance, it can dump credentials from the system’s Local Security Authority Subsystem Service (LSASS) or from web browsers where passwords may be saved. By obtaining this information, attackers can escalate their access within the network, targeting higher-value systems or users. The malware may also attempt lateral movement, using these credentials to infect other devices or systems connected to the same network.

Once the attacker has gathered valuable information, the next phase involves exfiltrating the stolen data. Pullbait malware commonly sends the captured data back to a command-and-control (C2) server via encrypted channels, ensuring that the communications are hidden from security systems. The data can include login credentials, financial information, or even personal documents, depending on the attacker’s objectives. In some cases, the malware may even install additional malicious software, such as ransomware or keyloggers, to further compromise the system or create additional opportunities for data theft.

In summary, Pullbait malware operates by using phishing techniques to gain initial access, exploiting vulnerabilities to execute payloads, and establishing persistence to maintain long-term access to compromised systems. It focuses on credential theft, data exfiltration, and network exploration, often making it a tool of choice for attackers seeking to escalate privileges and expand their reach within a victim’s infrastructure. The malware’s use of stealth, persistence, and social engineering makes it a significant threat to individuals and organizations alike. The evolving tactics and techniques used by Pullbait malware highlight the need for continuous vigilance, advanced security measures, and awareness of phishing risks.

MITRE Tactics and Techniques

Initial Access (T1071: Application Layer Protocol)

Pullbait malware often relies on phishing emails and social engineering tactics to achieve initial access to the victim’s system. These emails may contain malicious links or attachments that, when clicked or opened, trigger the malware’s download and execution. This tactic can be categorized under the use of application layer protocols, as attackers may use commonly trusted communication channels like email or web-based platforms.

Execution (T1203: Exploitation for Client Execution)

The malware typically exploits vulnerabilities in legitimate software, such as browsers or email clients, to execute payloads when a victim interacts with malicious content. The execution might occur through the exploitation of software flaws, allowing the malware to run without user consent or awareness.

Persistence (T1547: Boot or Logon Autostart Execution)

To maintain persistence on the compromised system, Pullbait malware may create or modify registry keys or use scheduled tasks to ensure that it runs every time the system starts or the user logs in. This ensures the malware remains active and can survive reboots or other attempts to remove it.

Privilege Escalation (T1078: Valid Accounts)

Pullbait may attempt to escalate privileges or gain further access to critical systems by using valid credentials that were either obtained from the victim during the attack or pre-existing ones. This tactic helps ensure the malware can execute tasks with higher permissions, such as data exfiltration or network traversal.

Credential Dumping (T1003: Credential Dumping)

Pullbait may collect and exfiltrate credentials, allowing attackers to use them for further compromise or lateral movement across the network. This technique can involve dumping credentials stored in various locations such as Windows Security Accounts Manager (SAM) or browser password stores.

Discovery (T1083: File and Directory Discovery)

Once inside the system, Pullbait may explore the file system to gather information about the victim’s environment, including sensitive files or configurations that could be valuable. This reconnaissance helps attackers understand the scope of the attack and determine the best method of proceeding.

Exfiltration (T1041: Exfiltration Over Command and Control Channel)

Pullbait malware may send stolen data, including user credentials, personal information, or other sensitive files, back to the attacker via encrypted command and control (C2) channels. This tactic involves sending exfiltrated data out of the compromised network, typically through covert methods to avoid detection.

Impact (T1486: Data Encrypted for Impact)

While the primary purpose of Pullbait malware may not be to encrypt data, it could carry out actions that affect the integrity of victim systems. For example, it might drop ransomware or trigger actions that disrupt the operation of critical systems, leading to data loss or unavailability.

References:

• Earth Preta Evolves its Attacks with New Malware and Strategies