Security researchers at Fortinet have uncovered a sophisticated cyber attack utilizing malware with deliberately corrupted DOS and PE headers – critical components that normally help Windows identify and execute program files.

The FortiGuard Incident Response Team discovered the malware running undetected on a compromised system for several weeks. According to researchers Xiaopeng Zhang and John Simmons, “The threat actor had executed a batch of scripts and PowerShell to run the malware in a Windows process.”

While the distribution method and scope of these attacks remain unknown, Fortinet’s analysis revealed several key findings:

– The malware operated within a dllhost.exe process as a 64-bit PE file
– Corrupted headers were specifically designed to hinder analysis and reconstruction
– Despite these obstacles, researchers successfully analyzed the payload by replicating the compromised environment

Once executed, the malware functions as a remote access trojan (RAT) with multiple capabilities:
– Decrypting command-and-control domain information stored in memory
– Establishing encrypted communication with its C2 server (“rushpapers.com”) using TLS
– Capturing screenshots
– Enumerating and manipulating system services
– Acting as a server to accept incoming connections

“It implements a multi-threaded socket architecture,” Fortinet explained. “Each time a new client connects, the malware spawns a new thread to handle the communication.” This design effectively transforms the compromised system into a remote-access platform for attackers to launch further operations.