In November, security researchers from Proofpoint discovered a nasty Trojan called August.

According to the researchers, the August malware targets customer service staff at retail companies with phishing emails designed to look like customer complaints or other normal business correspondence. The infection technique involves Word macros and Powershell, and the eventual payload attempts to steal user credentials and information-rich documents from the victim.

August Malware in November

Once launched, the macro malware conducts various automated checks to filter out sandbox environments and security researchers. It then looks for the Maxmind IP-to-geolocation application program interface (API), task counts, task names and file counts.

After it confirms that its activities are not being observed, the malware will launch a Powershell command to filelessly load the payload from a byte array hosted on a remote command-and-control (C&C) site. Since no file is actively created on the victim’s machine, defensive measures aimed at detecting file creation will fail.

Proofpoint researchers found some additional lines of Powershell code present, which would serve to clarify the array through an XOR operation before executing the main function of the payload. Again, the malicious actors can execute these Powershell commands without creating a file on the victim’s machine.

The Power of Powershell

Once launched, the Trojan tries to steal files .rdp files, wallet.dat files, cryptocurrency wallets and other files with specified extensions. It also targets File Transfer Protocol (FTP) and messenger credentials, as well as cookies and passwords from various web browsers and email services.

Symantec also released a report, “The Increased Use of Powershell in Attacks,” about the widespread use of the task automation and configuration management tool as an attack vector. The technique is so successful that 95.4 percent of the 111 malware families analyzed in the report used Powershell in some way. It seems this exploit vector is here to stay for the foreseeable future.

August malware and others like it are difficult to detect, both at the gateway and the endpoint, because of the methods that they employ. There may be no simple prevention solution here, save to educate workers about what happens when you open a suspicious Word document.