More_eggs

More_eggs, also known as Golden Chickens, is a malware suite utilized by financially motivated cybercrime actors such as Cobalt Group and FIN6. This malware-as-a-service (MaaS) offering has been identified as the "cyber weapon of choice" by Russia-based cyber gangs. It was first seen in email campaigns targeting Russian businesses as early as 2017, and later in 2019, its distribution expanded to campaigns aimed at job seekers with fake job offers. The identity of the malware provider, a Romanian man known as VENOM SPIDER, was uncovered by eSentire earlier this year. The malware operates through a social engineering campaign, where the threat actor initially targets recruiters with benign content before infecting their machines with More_Eggs. Once successfully installed, More_Eggs collects information about the victim's machine and serves as a downloader for additional malware payloads. It uses a fileless approach to evade anti-virus detection, making it particularly challenging to mitigate. The malware takes advantage of legitimate software functions to establish a backdoor and gather more information about the victim's system. Threat Response Unit (TRU) of eSentire has discovered dangerous cyber threats and nation-state attacks associated with More_Eggs. Notably, the TRU found that More_Eggs was used in a scam involving fake LinkedIn job offers. After the malware installation process, the DLL drops the More_Eggs backdoor alongside another legitimate utility program and uses WMI to initiate the creation of an MSXSL process before deleting itself. Its sophisticated evasion techniques include using a loop to retrieve the RC4 key needed to decrypt the More_Eggs backdoor and extending its execution time to avoid sandbox environments.