New Malware Exploiting Outlook As a Communication Channel via The Microsoft Graph API

🧠 Introduction

Cybersecurity researchers have identified a new malware family that cleverly uses Microsoft Outlook as a communication channel by leveraging the Microsoft Graph API. This sophisticated campaign, which includes the components PATHLOADER and FINALDRAFT, is primarily focused on espionage, suggesting state-sponsored or highly motivated cybercrime groups behind the scenes.

PATHLOADER acts as a lightweight loader, while FINALDRAFT serves as the primary backdoor for data exfiltration and process manipulation. This malware’s advanced techniques for sandbox evasion and covert communication highlight the increasing complexity of modern cyber threats.

---

🛠️ Understanding Microsoft Graph API

🔍 What is Microsoft Graph API?

The Microsoft Graph API is a unified interface allowing applications to interact with Microsoft 365 services like Outlook, Teams, and OneDrive. This API is an attractive target for cybercriminals due to its access to email, calendar, and other sensitive user information.

🎯 Why is it Targeted by Malware?

• Access to Outlook: Malware can leverage Outlook drafts for communication.
• Trusted Infrastructure: Microsoft services are often whitelisted, making detection harder.
• Persistent Communication: Access tokens can maintain C2 communication long-term.

---

💥 The Malware Family: An Overview

This newly discovered malware family exhibits characteristics aligned with espionage campaigns. It features advanced evasion techniques and prolonged, low-profile operations. The primary components are:

• PATHLOADER: A shellcode loader.
• FINALDRAFT: A backdoor for data theft and command execution.

---

🧩 PATHLOADER: The Custom Loader

🛠️ What is PATHLOADER?

PATHLOADER is a lightweight executable designed to download and execute encrypted shellcode from command-and-control (C2) servers. It is engineered to evade static analysis using various obfuscation techniques.

---

🕵️ Technical Insights: Code Execution & Obfuscation

The malware employs API hashing with the Fowler-Noll-Vo (FNV) algorithm to obfuscate its imported functions. This approach complicates malware analysis by security researchers.

Example of API Hashing:

c

CopyEdit

uint64_t api_hash = 0;

do {

    api_hash = *data_source++ + 31 * api_hash;

} while (data_source != &data_source[data_source_length]);

---

🛑 API Hashing & Evasion Techniques

• API Hashing: Encodes API calls to avoid detection by signature-based tools.
• String Encryption: Critical strings are encrypted to obscure functionality.
• Sandbox Evasion: Delays execution using GetTickCount64 and Sleep functions.

These methods make static and dynamic malware analysis significantly harder.

---

🔍 PATHLOADER Execution Flow

PATHLOADER follows a structured execution process:

1. Initialization: Extracts configuration from the .data section.
2. C2 Communication: Connects to predefined domains via HTTPS.
3. Shellcode Execution: Decrypts and executes the downloaded shellcode.

Its use of HTTPS ensures traffic appears as legitimate web activity, further complicating detection.

---

🖥️ FINALDRAFT: The Data Exfiltration Backdoor

🚨 How FINALDRAFT Operates

FINALDRAFT, written in C++, is responsible for maintaining persistent C2 communication and exfiltrating sensitive data. It leverages the Microsoft Graph API to access Outlook drafts for covert communication.

---

🛠️ Command Execution Methods

The malware processes commands embedded in Outlook drafts. Commands may include:

• Process Injection: Injects malicious code into legitimate processes.
• File Exfiltration: Extracts critical documents.
• Network Proxy Activation: Sets up proxy servers for further attacks.

---

📧 Communication Through Outlook Drafts

The malware creates and monitors Outlook email drafts as a communication channel. Commands from the C2 server appear as draft emails, while malware responses are recorded as new drafts.

---

⚙️ Session Data Structure Explained

Configuration Structure

c

CopyEdit

struct Configuration {

    char c2_hosts_or_refresh_token[5000];

    char pastebin_url[200];

    char guid[36];

    uint16_t build_id;

    uint32_t sleep_value;

    uint8_t aes_encryption_key[16];

};

---

🔗 Understanding the Communication Protocol

The communication protocol relies on Outlook drafts to mask malicious traffic as normal email-related activity.

1. Session Initiation: A unique session ID is generated.
2. Command Retrieval: The malware reads drafts for C2 instructions.
3. Command Execution: Executes commands like data exfiltration or process injection.
4. Response Recording: Results are stored as new drafts.

---

🛑 Key Commands Used by FINALDRAFT

FINALDRAFT registers 37 command handlers, with some notable examples:

Command Name	Function
GatherComputerInformation	Collect system info like IP & OS
StartTcpServerProxyToC2	Launch TCP proxy for covert access
DoProcessInjectionSendOutputEx	Inject malware into running processes

---

📂 Targeted Information and Data Theft

The malware collects:

• User & Machine Info: Username, computer name, process ID.
• Network Details: Internal & external IP addresses.
• System Specifications: OS version, build number.

---

🛡️ Defensive Strategies for Organizations

👁️ Monitoring Microsoft Graph API Usage

1. API Activity Logs: Regularly audit logs for unusual requests.
2. Access Token Behavior: Monitor refresh token usage patterns.
3. Anomaly Detection: Implement behavior-based monitoring tools.

---

🔍 Implementing Network-Level Protections

• Restrict API Access: Grant permissions using the principle of least privilege.
• Secure C2 Communication Paths: Block access to known malicious domains.
• Deploy Advanced Threat Protection: Use solutions that detect encrypted C2 traffic.

---

🔒 Proactive Malware Detection Techniques

⚙️ Behavioral Analysis Tools

• Endpoint Detection and Response (EDR): Monitors suspicious processes.
• Sandbox Environments: Analyze samples in isolated conditions.
• Threat Intelligence Feeds: Stay updated on emerging malware trends.

🔁 Regular Security Audits

Frequent security assessments can uncover subtle signs of ongoing malware activity.

---

🎯 Conclusion

The discovery of malware leveraging the Microsoft Graph API for Outlook communication underscores the evolving sophistication of cyberattacks. By exploiting trusted platforms like Microsoft 365, attackers can establish covert, persistent communication channels while evading detection.

Organizations must prioritize robust API monitoring, implement advanced detection solutions, and foster a proactive security culture to defend against these sophisticated threats.

---

❓ FAQs

1. What is the primary function of the FINALDRAFT malware?

FINALDRAFT primarily functions as a backdoor to exfiltrate data, execute commands, and inject malicious code into running processes using Microsoft Graph API communication.

---

2. How does the malware use Microsoft Outlook for communication?

The malware creates and monitors draft emails in Outlook. It uses these drafts to send and receive commands via the Microsoft Graph API, bypassing traditional detection methods.

---

3. What makes PATHLOADER difficult to detect?

PATHLOADER uses techniques like API hashing, string encryption, and sandbox evasion, making it challenging for traditional antivirus tools to identify.

---

4. Can regular users detect this malware in Outlook?

No, the malware operates stealthily by creating drafts that are not visible to users without deep system analysis.

---

5. What are the recommended security measures against such malware?

Organizations should monitor Microsoft Graph API activity, deploy advanced endpoint protection, and regularly audit access permissions.

---

6. Why is the use of Microsoft Graph API significant in this attack?

The Microsoft Graph API provides access to Outlook and other Microsoft 365 services. Malware can use this trusted infrastructure to blend malicious traffic with legitimate communication.

---

🌐 About Us: Your Trusted IT Partner Since 1972

At Electronic Corporation of America, we’ve been empowering businesses with reliable, innovative IT solutions for over 50 years. From small business equipment and server support services to VoIP communication systems and outsourced server monitoring, we help businesses stay efficient, secure, and connected.

Our services include:

• 🛠️ Professional Server Support – 24/7 monitoring, proactive server management, and disaster recovery.
• ☎️ VoIP Solutions – As a top business VoIP provider, we offer advanced, cost-effective communication tools to improve efficiency.
• 💻 Small Business Equipment & Financing: Flexible leasing options and equipment financing for startups to support growth.

With proactive strategies and cutting-edge technology, we simplify IT so you can focus on growing your business.

📲 Contact us today to learn how our reliable IT solutions can drive your business forward!