EXECUTIVE SUMMARY
Researchers identified a previously unknown malware family that utilizes Outlook as a communication channel via the Microsoft Graph API. This post-exploitation framework includes a loader, a backdoor, and several modules designed for advanced intrusion activities. Analysis revealed both a Linux variant and an older PE variant, each with distinct versions indicating prolonged development. The engineering quality and extended operational period suggest a well-organized effort, likely tied to espionage.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY
Researchers identified a previously unknown malware family that utilizes Outlook as a communication channel via the Microsoft Graph API. This post-exploitation framework includes a loader, a backdoor, and several modules designed for advanced intrusion activities. Analysis revealed both a Linux variant and an older PE variant, each with distinct versions indicating prolonged development. The engineering quality and extended operational period suggest a well-organized effort, likely tied to espionage.[emaillocker id="1283"]
The malware consists of two key components: PATHLOADER and FINALDRAFT. PATHLOADER is a lightweight Windows executable responsible for downloading and executing encrypted shellcode from an external source. It embeds an obfuscated configuration, including command-and-control domains that impersonate security vendors. To hinder analysis, it employs API hashing, string obfuscation, and anti-analysis techniques. Upon execution, PATHLOADER retrieves encrypted shellcode, decrypts it, and loads FINALDRAFT. This secondary payload, written in C++, specializes in data exfiltration and process injection. FINALDRAFT loads its configuration from an encrypted section, decrypting it using identifiers from the infected system. It establishes communication through Microsoft Graph API, using email drafts for command execution and data exchange.
FINALDRAFT registers multiple commands focused on reconnaissance, process injection, and proxying data. It gathers system information, including network details, and uses various injection techniques to execute payloads within trusted processes. Additionally, it supports network communication via TCP, UDP, and named pipes, facilitating covert data exfiltration. A unique feature is its ability to create firewall rules dynamically, ensuring uninterrupted communication. The malware's reliance on Outlook-based communication highlights the evolution of stealthy tactics designed to evade detection. This campaign exemplifies the increasing sophistication of intrusion techniques targeting critical infrastructure.
THREAT PROFILE:
| Tactic | Technique Id | Technique |
| Initial Access | T1078 | Valid Accounts |
| Execution | T1204 | User Execution |
| Persistence | T1547 | Boot or Logon Autostart Execution |
| Privilege Escalation | T1055 | Process Injection |
| Defense Evasion | T1140 | Deobfuscate Decode Files or Information |
| T1036 | Masquerading | |
| Credential Access | T1555 | Credentials from Web Browsers |
| Discovery | T1016 | System Network Configuration Discovery |
| T1082 | System Information Discovery | |
| T1120 | Peripheral Device Discovery | |
| Lateral Movement | T1570 | Lateral Tool Transfer |
| Command and Control | T1090 | Proxy |
| T1071 | Application Layer Protocol | |
| Exfiltration | T1041 | Exfiltration Over C2 Channel |
REFERENCES:
The following reports contain further technical details:
https://thehackernews.com/2025/02/finaldraft-malware-exploits-microsoft.html