{
  "name": "Info Stealing Campaign Uses DLL Sideloading Through Legitimate Cisco Webex\u2019s Binaries for Initial Execution and Defense Evasion",
  "slug": "info-stealing-campaign-uses-dll-sideloading-through-legitimate-cisco-webexs-binaries-for-initial-execution-and-defense-evasion",
  "description": "In March 2024, researchers at the Trellix Advanced Research Center uncovered a sophisticated and evasive attack campaign targeting users in Latin America and Asia Pacific through trojanized copies of the Cisco Webex Meetings App. This campaign employed a stealthy malware loader, known as HijackLoader, and an information-stealing module identified as Vidar Stealer, to siphon off credentials and sensitive data undetected by leveraging legitimate processes.",
  "published": "2024-06-20T10:18:57+00:00",
  "created_at": "2024-06-20T10:18:57+00:00",
  "modified_at": "2024-06-20T12:41:39+00:00",
  "created_at_opencti": "2024-06-20T10:18:57+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-06-20",
    "autoit3",
    "cisco webex",
    "meetings app",
    "module",
    "pe payload",
    "service",
    "systems",
    "vt executed",
    "vt powershell",
    "vt sustained"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "78.47.78.87"
      },
      {
        "id": "",
        "name": "50.7.22.10"
      },
      {
        "id": "",
        "name": "185.172.128.87"
      },
      {
        "id": "",
        "name": "185.172.128.212"
      },
      {
        "id": "",
        "name": "144.76.154.59"
      },
      {
        "id": "",
        "name": "139.99.16.105"
      },
      {
        "id": "",
        "name": "keningsberguersfax.com"
      },
      {
        "id": "",
        "name": "fdb3d86c512adff90967cb860d02a4682850ab96727f0376e4d4836504c50e47"
      },
      {
        "id": "",
        "name": "f9675304d13efaee32e6b4a3317b64231a59b684532a898d12b4e7ed88518afd"
      },
      {
        "id": "",
        "name": "f5151914cbffe70c53b1d85873b0da88349f46cc4aa36e915142bc3929fc75f9"
      },
      {
        "id": "",
        "name": "ee32f4cbba3a601d57064695a8ed5955e1b9af984110d34504b8d5ebb132c084"
      },
      {
        "id": "",
        "name": "e958f4ed8272a96e599ff9f0a79331e7b5109104a9d20d3f760c7eb162daf7e0"
      },
      {
        "id": "",
        "name": "db46b6106dc1b30041ce3f287ded91166895ff3f1928250fc79dd46c444b1e45"
      },
      {
        "id": "",
        "name": "d4a0db913fa555808ce627114fe6e2725970499c70364edbedf47d907d52242d"
      },
      {
        "id": "",
        "name": "d3ba1adbfeef8f19e4aa570299c06d39a87dfc5fe3d85946270b722e44dacda7"
      },
      {
        "id": "",
        "name": "d0c3b82f1e0df8cc683adc42a2272ecf85cb46508a9bfb06c2478b7b125651aa"
      },
      {
        "id": "",
        "name": "ca53407b356fcdea51a6d536447ed6b88ad14c87facf421080d141cae837eedc"
      },
      {
        "id": "",
        "name": "c26db97858c427d92e393396f7cb7f9e7ed8f9ce616adcc123d0ec6b055b99c9"
      },
      {
        "id": "",
        "name": "bd8486225884900084a82273ead6716ee5e52c6ad0f35cdfc487f422188ea30f"
      },
      {
        "id": "",
        "name": "979851cac4a2a0e394f06ca7139d7402911048b094f550dd9b33d1203ae92862"
      },
      {
        "id": "",
        "name": "9309fb2a3f326d0f2cc3f2ab837cfd02e4f8cb6b923b3b2be265591fd38f4961"
      },
      {
        "id": "",
        "name": "8acf6eea851ccd43a33eee9840794b9944eed61e5be0a7c403b79d3baa48940c"
      },
      {
        "id": "",
        "name": "88378c228d7827974fe6ec827837af7571290e129082e7070d4bff7a42f4ba67"
      },
      {
        "id": "",
        "name": "7dbc0aa8fff43581f4c81695c3ea1dedbe57a13e4f76c3ecb5c0009917f331f0"
      },
      {
        "id": "",
        "name": "8103f2cce6a864ceefe6c5b0c05087ac85ab04a2abf150e93bc9db90c54d9d20"
      },
      {
        "id": "",
        "name": "725f50650cb9490027b633a1ff0ae166cb6fc42037dbe72d9a09dd65be323a1f"
      },
      {
        "id": "",
        "name": "629b4cef2c394c6a1fad37e5ac6f497b3bdac489270d54f4e98c5dfc925ea883"
      },
      {
        "id": "",
        "name": "5d447f1fe007dae3b9ad0687212e71cdec0343f6385fcc2db4ee3e0198e995c0"
      },
      {
        "id": "",
        "name": "58cc0c31514e89a743c9b96c7892c256cd9daaa18bdcff784b8ddb1d5c15a163"
      },
      {
        "id": "",
        "name": "4d0e4540a57cb447356e1684f2d2f069eccb185ce798843d90a41e115472332b"
      },
      {
        "id": "",
        "name": "346f72c9a7584c2ab6ce65cd38a616c77ebddc0bbab2274c4e89dd5e62237517"
      },
      {
        "id": "",
        "name": "33286a66f457328432180f9a7d2b82e456aacef6b2aa0833d74ecd1d51687f55"
      },
      {
        "id": "",
        "name": "27cf1ecb18d6f669dfbd4cf4dd552c4db87ab8727a873a580166411f93aabaa5"
      },
      {
        "id": "",
        "name": "239ee815e006884993f263688f3627064ba406bfa234eebb0068ee82b7170396"
      },
      {
        "id": "",
        "name": "15600ccdef5a64b40d206d89234a51be1e11bd878dcefc5986590bcf40d9d571"
      },
      {
        "id": "",
        "name": "0f2b3d012a9abe420bc36c62847bba6ca4478ceebc018bad2b19f22d481fcc10"
      }
    ],
    "malware": [
      {
        "id": "57274e51-ee19-426a-a7bc-bb7cb9e1f937",
        "name": "Trojan:Win32/Amadey",
        "slug": "trojanwin32amadey"
      },
      {
        "id": "8efc03b1-ab7d-4973-a931-7ad3b5c34b23",
        "name": "Trojan:Win32/VidarStealer",
        "slug": "trojanwin32vidarstealer"
      },
      {
        "id": "5a707c14-0cb1-4113-a7f6-02c0c32699e3",
        "name": "HijackLoader",
        "slug": "hijackloader"
      }
    ],
    "intrusion_sets": [
      {
        "id": "fccaa42c-58bf-4a81-8f60-f98c543182c8",
        "name": "Unknown",
        "slug": "unknown"
      }
    ],
    "attack_patterns": [
      {
        "id": "f92393c4-4cf8-49ad-8bce-c7b907ba23ce",
        "name": "T1127.001"
      },
      {
        "id": "7da151b8-315c-4726-be18-0b571f2760c2",
        "name": "T1559.001"
      },
      {
        "id": "b63bc0df-8e11-42ed-a9a9-13e19b148dbf",
        "name": "T1073"
      },
      {
        "id": "e8422fc8-8365-4a6a-a556-d6ec16cb4e5d",
        "name": "T1574.002"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "c9ee9b30-ba84-4c24-95e9-e8242d42af3f",
        "name": "T1071.001"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "7364ca96-72bf-4b7f-afef-ce2583b1ed58",
        "name": "T1562.001"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "6d618903-d9f6-4747-aec2-7630f43c1908",
        "name": "T1496"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      },
      {
        "id": "9b6064e6-a05b-4e95-baf5-34d180bc9221",
        "name": "T1059"
      }
    ]
  },
  "external_refs": [
    "https://www.trellix.com/blogs/research/how-attackers-repackaged-a-threat-into-something-that-looked-benign/",
    "https://otx.alienvault.com/pulse/66741e317c3c49898c2e2638"
  ]
}