Rubella Macro Builder Crimeware Kit Price Drops to $40

Crime might not pay, but it also doesnt have to be expensive to try. Flashpoint researchers have found that the monthly fee for the Rubella Macro Builder crimeware kit dropped to $40 on the underground market.

Up until now, Malware creators have had to be somewhat skilled in coding the vagaries of effective malicious software. While the skills necessary to do this have been discussed in many dark Internet forums, malware-as-a-service (MaaS) has remained fairly limited.
Those offering such a service have usually asked for an upfront fee for it large enough to dissuade the more casual criminal. (See
Cybercrime: More Like Facebooks Model Than Traditional Criminal Enterprise
.)
However, that may be changing.
Researchers at Flashpoint have discovered a crimeware kit
called the Rubella Macro Builder, which has the functionality to create a macro that will drop some other weaponized malware through social engineering techniques. Not only does it only cost the malfeasers $40 a month to use at last check -- down from a three-month fee of $500 when it was first offered -- but it has been improved since its introduction.
Macro settings of the Rubella Macro Builder

(Source:
Flashpoint
)
The enhanced features that are present in the latest, 1.4 Version of the kit include encryption algorithm choices (XOR and Base64), a choice of download methods (PowerShell, Bitsadmin, Microsoft.XMLHTTP, MSXML2.XMLHTTP), custom PowerShell payload, payload execution methods (executable, JavaScript, Visual Basic Script) and the ability to easily deploy social engineering decoy themes with an Enable Content feature that can be turned on by the socially engineered user in order to actually run the macro.
The Builder runs on Windows machines and does not utilize any vulnerabilities for its functionality. It can generate Microsoft Word (.DOC) and Microsoft Excel (.XLS) payloads.
Flashpoint found that the macro junk and substitution method appeared to be relatively primitive, since it relied on basic string substitutions. The copy/paste implementation of the Base64 algorithm is displayed in Visual Basic Script (VBS) code implementation, which is also unsophisticated. The code is obfuscated through general Chr ASCII values.
Rubella-originated macros can evade anti-virus software as well.
The macro can get its payload from a server, which is contacted via the IXMLHTTPRequest method.
Flashpoint found that Rubella was used as the first-stage loader by two criminal gangs in two recent but separate campaigns that used the Panda and Gootkit banking malware.
The fundamentals of network security are being redefined -- dont get left in the dark by a DDoS attack! Join us in Austin from May 14-16 at the fifth annual
Big Communications Event
. Theres still time to register and communications service providers get in free!
Researchers believe that these gangs were customers of the actor that is offering Rubella on the underground Russian forums. The attackers targeted customers through social media platforms, along with an Australian financial institution, using Pandas webinject functionality.
Mitigation for Rubella-generated macros are the standard ones: dont open it if you dont know for a fact its legit is always a good rule.
But the dead giveaway here will be the request to enable macros that will show up with a security warning. Even though there may be a great-looking splash screen that comes up as well urging you to do so, dont do it. Just say nyet.
As the price of the Rubella kit drops, wider use of it can be expected by criminals that are looking for their payoff. The aware user can defeat it, but the price of liberty is eternal vigilance.
Related posts:
Malwarebytes: Cryptomining Surges as Ransomware Declines
Andromeda Botnet Dismantled by International Law Enforcement Coalition
Microsoft: Tech Support Scams on the Rise
5 New Network Attack Techniques That Will Keep You Awake at Night
— Larry Loeb has written for many of the last centurys major dead tree computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Rubella Macro Builder Crimeware Kit Price Drops to $40