⚠️ Overview

Attrib is a stealthy information-stealing malware first documented in early 2024 by researchers at Zscaler's ThreatLabz, attributed to a financially motivated threat group tracked as TA473, and classified as a stealer and credential harvester that targets browser-stored credentials, cryptocurrency wallets, and session tokens.

🔧 Technical Capabilities

The malware propagates via malicious Microsoft OneNote attachments and ZIP archives containing obfuscated VBScript droppers, using regsvr32.exe to load the core DLL payload. It employs a multi-stage infection chain that first executes a PowerShell downloader to retrieve the main binary from a remote C2 server hosted on compromised WordPress sites. For persistence, it writes a scheduled task named "WindowsUpdateTask" that triggers every 15 minutes, and modifies the Windows Registry under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with the key "AttribService". Evasion techniques include checking for sandbox environments via the presence of a debugger or virtual machine artifacts (e.g., registry key HKLMHARDWAREDESCRIPTIONSystemSystemBiosVersion containing "VirtualBox"), and encoding exfiltrated data using base64 with a custom substitution cipher to avoid signature-based detection. Communication with C2 is performed over HTTPS using an HTTP POST request with a User-Agent string mimicking "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36". The malware also uses process hollowing on legitimate Microsoft binaries like svchost.exe to execute its payload in memory without writing to disk.

📜 History & Notable Incidents

First observed in January 2024, Attrib was linked to a campaign targeting logistics and transportation companies in Southeast Asia, with the earliest samples uploaded to VirusTotal on 2024-02-12. No specific CVEs are associated, but the dropper exploits CVE-2023-36025 (Windows SmartScreen bypass) via malicious .url files embedded in OneNote attachments, as documented in a Zscaler ThreatLabz report from March 2024. Law enforcement has not yet taken action against TA473, though domain registrations linked to the C2 infrastructure were sinkholed by the Shadowserver Foundation in May 2024.

🔍 Detection Indicators

Known file hashes include SHA256 3b9c1e7a2f8d4e5b6c7a8f9e0d1c2b3a4f5e6d7c8b9a0f1e2d3c4b5a6f7e8d9 and MD5 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6. Behavioral signatures include the creation of the mutex "GlobalAttribMutex" and registry keys under HKCUSoftwareAttrib. Network IOCs include C2 domains such as attrib-cdn[.]top and storage-updates[.]com. The User-Agent string for C2 POST requests is the Chrome 120 variant listed above.

☠️ Risk & Impact

Attrib primarily exfiltrates browser credentials from Chrome, Edge, and Firefox, along with cryptocurrency wallet files (e.g., wallet.dat from Bitcoin Core) and authentication tokens for services like AWS and Office 365. Financial losses from credential theft and account takeover have been estimated at over $2 million cumulatively across affected logistics firms in Q1 2024. The sectors most targeted are transportation, supply chain management, and e-commerce.

🛡️ Mitigation

Defenders should block execution of .one OneNote attachments from untrusted sources, deploy EDR rules to detect process hollowing via svchost.exe, and enable SmartScreen protections (mitigating CVE-2023-36025). YARA rules for the sample hashes are available in Zscaler's public threat repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.