Log in Request a demo

Ransomware

[Research Summary]: Rugmi Loader

Rugmi loader technical analysis: phishing delivery, DLL hijacking, direct syscalls, Heaven's Gate evasion, process injection, a stealer payload and defenses

Brandefense logo Updated 3 Min Read
rugmi loader technical analysis report

Rugmi loader is a Windows malware loader that arrives through phishing and uses DLL hijacking to run its payload. In the analyzed sample, an executable that looks legitimate loads malicious DLLs, injects code into cmd.exe and then delivers a stealer through explorer.exe. It was first seen on 2023-10-11.

This blog post comes from the Rugmi Loader Technical Analysis report. If you want to read more details, download it as a PDFclick here

What is Rugmi Loader?

This report aims to provide a comprehensive technical analysis of Rugmi Loader. Through this analysis, we aim to provide valuable insights into how it functions, ultimately contributing to the enhancement of cybersecurity measures against these sophisticated threats.

The latest DLL hijacking technique utilizes phishing to distribute an executable that appears legitimate, accompanied by a .png file containing configuration data and DLLs with various purposes. The decrypted configuration data, facilitated by the DLL, then triggers the loading of multiple DLLs onto the system. Additionally, as an evasion tactic, direct system calls are observed, along with the use of the Heaven’s Gate technique. The malicious DLL is injected into seemingly legitimate programs such as cmd.exe, paving the way for the final payload—stealer types—to manifest malicious activity within the system via explorer.exe.

Scope

FilenameBur_Oil_Company.zip
FiletypeZIP
Written Language–
MD57981e2f467362b08d22fad773e24df3b
SHA13cd4952c6b2c192a41f7f625d9b94d27a869858e
SHA2563ccf4a79e6dc06def1c928e1378a9ea64274089d0d6c4da758d0c9acab20324e
First Seen / Detection Date2023-10-11
Initial Infection VectorPhishing Mail
Table 1: File Fingerprints
FilenameBur_Oil_Company.exe
FiletypeWin64 EXE
Written LanguageC/C++
MD564e3c6d6a396836e3c57b81e4c7c8f3b
SHA1f689e6995c85817193282163a18ec917c5f8d5c2
SHA256f2b4ca304f3d9d3305ae595e19906c545601f8c9e215a9b598036e89155daf85
First Seen / Detection Date2023-10-11
Initial Infection VectorPhishing Mail
Table 2: File Fingerprints
Filenamemozglue.dll
FiletypeWin32 DLL
Written LanguageC/C++
MD59f827d15fe257543fa8c8c42c33e389a
SHA176ab3458d75986bd1be148a5ca2d22318622b7c5
SHA2567f8f310241aa93dee7b4c0e97c1d30b8e50e96ffec619288de13f25d2ca555c7
First Seen / Detection Date2023-10-11
Initial Infection VectorPhishing Mail
Table 3: File Fingerprints

Infection Chain

Visual diagram of Brandefense cybersecurity process and malware detection.
Figure 1: Infection Chain

MITRE ATTA&CK Threat Matrix

  1. TA0001 Initial Access
    1. T1566 Phishing
  2. TA0002 Execution
    1. T1204 User Execution
      • T1204.002 Malicious File
    2. T1106 Native API
  3. TA0005 Defense Evasion
    1. T1140 Deobfuscate/Decode Files or Information
    2. T1036 Masquerading
    3. T1055 Process Injection

How can you reduce the risk of DLL hijacking and phishing?

  • Configure systems to use secure DLL search paths, reducing the risk of DLL search order hijacking. This can involve specifying the full path for loading DLLs.
  • Keep operating systems, applications, and security software up to date with the latest patches and updates.
  • Employ advanced email filtering solutions to identify and block phishing emails.
  • Participate in threat intelligence-sharing communities to stay informed about emerging phishing threats.

This blog post comes from the Rugmi Loader Technical Analysis report. If you want to read more details, download it as a PDFclick here

Frequently Asked Questions.

What is Rugmi loader?

Rugmi loader is a malware loader delivered by phishing. It uses DLL hijacking to load several DLLs, then drops a stealer as the final payload.

What is DLL hijacking?

MITRE ATT&CK describes it as abusing DLL files, through side-loading or search order hijacking, so a program loads a malicious library instead of the legitimate one.

How does Rugmi loader evade detection?

The analysis reports direct system calls, the Heaven's Gate technique, and injection into seemingly legitimate programs such as cmd.exe.

How can you defend against DLL hijacking?

MITRE ATT&CK lists restricting library loading with Safe DLL Search Mode, application control and regular patching as mitigations.

Sources

  1. 1 MITRE ATT&CK: Hijack Execution Flow: DLL (T1574.001)
  2. 2 MITRE ATT&CK: Phishing (T1566)
  3. 3 MITRE ATT&CK: Process Injection (T1055)
#in depth analysis #Malware #malware analysis #Ransomware #rugmi #rugmi loader
Share

In This Article

TechniquesDLL TechniquesPhishing (T1566): ATT&CK Technique TechniquesUser Execution TechniquesDeobfuscate/Decode Files or Information TechniquesMasquerading TechniquesProcess Injection TermsMalware loader TermsInitial access

Where To Next.

All Ransomware Articles
In plain words · Glossary term Malware loader

A malware loader is a program whose main job is to get other malware onto a computer.

Open → Keep reading · Article KageNoHitobito Ransomware Technical Analysis

KageNoHitobito ransomware encrypts local files with a .hitobito extension and uses TOR.

Open → Keep reading · Article Stone Gaze: In-Depth Analysis of Medusa Ransomware

Medusa ransomware is a RaaS group active since 2021.

Open →
Next in the in depth analysis file · 3 of 4KageNoHitobito Ransomware Technical Analysis Continue →

Knowledge HubRansomware groups in depth analysisMalwaremalware analysis