Description of Campaign
An Excel spreadsheet that appeared to include NFT-related information was distributed to entities in Israel. The fake document contained a malicious macro that used PowerShell to start the infection process and infect the end system with the BitRAT remote access trojan. The malicious software contained Hidden VNC (HVNC) code to provide remote access along with capabilities to perform DDoS attacks, steal credentials, mine cryptocurrency, log keystrokes, gather audio through the microphone, and upload and download files.

Our ATR Team gathers and analyzes information from multiple open and closed sources before disseminating intelligence reports.

This campaign was researched by Fortinet and shared publicly.

This Knowledge Base article discusses a specific threat that's being tracked. The list of IOCs will change over time; check MVISION Insights for the latest IOCs.

How to use this article:

1. If a Threat Hunting table has been created, use the rules contained to search for malware related to this campaign. 
2. Review the product detection table and confirm that your environment is at least on the specified content version.
   To download the latest content versions, go to the Security Updates page.
3. Scroll down and review the "Product Countermeasures" section of this article. Consider implementing them if they are not already in place.
4. Review KB91836 - Countermeasures for entry vector threats.
5. Review KB87843 - Dynamic Application Containment rules and best practices.
6. Review KB82925 - Identify what rule corresponds to an Adaptive Threat Protection and Threat Intelligence Exchange event.

Campaign IOC 

Type	Value
SHA256	342A5102BC7EEDB62D5192F7142CCC7413DC825A3703E818CF32094638EBD17A
SHA256	88EF347AD571F74CF1A450D5DAD85A097BB29AB9B416357501CDC4C00388F796
URL	https://cdn.discordapp.com/attachments/923858595353874472/928279600659234826/NFTEXE.EXE
IP-DST	205.185.118.52

Minimum Content Versions:

Content Type	Version
V2 DAT (VirusScan Enterprise)	10234
V3 DAT (Endpoint Security)	4686

  
Detection Summary

IOC	Scanner	Detection
342A5102BC7EEDB62D5192F7142CCC7413DC825A3703E818CF32094638EBD17A	AVEngine V2	Downloader.dlh
	AVEngine V3	Downloader.dlh
	JTI (ATP Rules)	JTI/Suspect.196612!9f19c4e10e54
	RP Static	-
	RP Dynamic	-

 

IOC	Scanner	Detection
88EF347AD571F74CF1A450D5DAD85A097BB29AB9B416357501CDC4C00388F796	AVEngine V2	X97M/Downloader.mh
	AVEngine V3	X97M/Downloader.mh
	JTI (ATP Rules)	JTI/Suspect.1179887!cda48fc75952
	RP Static	-
	RP Dynamic	-

                                     
Minimum set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

Endpoint Security - Advanced Threat Protection:
Host Intrusion Prevention:
Endpoint Security - Access Protection Custom Rules:
Rule: 1
VirusScan Enterprise - Access Protection Custom Rules:
Rule: 1
Aggressive set of Manual Rules to improve protection to block this campaign:

IMPORTANT: Always follow best practices when you enable new rules and signatures.

When you implement new rules or signatures, always set them to Report mode first and check the alerts generated. Resolve any issues that arise and then set the rules to Block. This step mitigates against triggering false positives and allows you to refine your configuration.

For more information, see KB87843 - List of and best practices for Endpoint Security Dynamic Application Containment rules.

VirusScan Enterprise - Access Protection Rules:
Host Intrusion Prevention: