Hey there.
Welcome back to our lab environment.
Now that you know the basics of macro_pack,
I want to show you one more interesting feature of this tool.
Instead of embedding a malicious code into the Microsoft Office file,
we can create a dropper file.
A dropper is basically a file that does not contain any malicious code in it.
Instead,
what a dropper does is to connect to a remote server
and download the payload from there.
And then after downloading it, the dropper executes in the victim computer.
The difference here is that a malicious code is not stored in the Excel file.
Instead,
the Excel file will only connect to the server and then
download the malicious code from there.
So let's say I create my own malware.
In our case, it's this one here called malicious.exe.
Instead of putting this malware inside of an Excel
spreadsheet and send to the victim,
I'll create a dropper that connects to my server and then
download the malicious.exe from a remote server.
So okay, let's get started.
First I need to create an HTTP server where my malicious file will be hosted.
And there are several ways of doing that,
but I think the easiest one is using a Python HTTP server.
So let me open the command terminal with admin privileges,
and then let me go to the folder where my malware is stored.
And then in here let me start a Python HTTP server. For that I type
python then ‑m, which means module, and then http.server.
After that,
all I have to do is put the port that I want to my server
to run. In my case, I'll put port 8080.
Perfect.
The Python HTTP server is now listening.
Just as a test, I will open my browser and try to access it.
So I put in my IP address here and then port 8080.
Awesome, it works.
As you can see, I can access the files from that folder via the browser.
And this means that the server is ready. Now the next step is
to create our dropper file. For that, let me use this command
here. First I'll type echo,
and then between double quotes I'll put the URL to my malicious file. And
very important, don't forget to put the port here too.
After that I'll put which name I want the temporary file to be called, and
this will be the name of the file in the victim machine.
Personally, I suggest you put in something not suspicious.
So here I'll call non‑malicious.exe.
Now that we have the URL set up and the name of the file that I want to save,
all I have to do is put a pipe and then I use the macro_pack.exe followed
by the option ‑t to specify that I want a DROPPER file, and then the option
‑o to specify that I want obfuscate the code, and ‑g to specify the name of
my output file, which I will call important‑spreadsheet.xls. Perfect. When
I execute this, macro_pack will create an Excel file that will connect to
my Python HTTP server and download the malicious file to the victim
computer.
Now all I have to do is craft a really good phishing
email and send this to my victim.
And again I will leave this part to you.
So we're here in the victim computer. In here I already have
the malicious spreadsheet in my desktop.
So let's open this file. And then as usual, let's enable the content.
Take a look.
It seems nothing is happening, right?
You might think that this failed, but let's open the Task Manager,
and let's go to the top Details to see what is running. Perfect, take a look.
That's my malware running in the background.
That's very cool, right? Again, in less than 10 minutes,
we created a dropper that downloads malware from a remote server and executes it
in the victim machine without the person knowing about it,
and that's really interesting.