QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Table 2 Sandbox evasion checks in the C# variant of RogueRobin Like the original version, the C# variant of RogueRobin uses DNS tunneling to communicate with its C2 server using a variety of different DNS query types
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Character  Digit   h 0   i 1   j 2   k 3   l 4   m 5   n 6   o 7   p 8   q 9    Table 4 Character substitution used in RogueRobin The Trojan will use future DNS requests to retrieve jobs from the C2 server, which the Trojan will handle as commands
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Background From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE, a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Similar to RIPTIDE and HIGHTIDE, the WATERSPOUT backdoor is an HTTP-based backdoor that communicates with its C2 server
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 11/1/18 sahro.bella7 trala.cosh2 Bishtr.cam47 Lobrek.chizh Cervot.woprov    Table 5 Gathered C# Cannon samples As mentioned in our initial blog, the actor controlled email address acting as the C2 was sahro.bella7[at]post.cz, but all previous samples of Cannon used sym777.g[at]post.cz
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28…) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings:  Figure 8 inf method used by Cannon When comparing the two Cannon variants, we found a method within a Delphi Cannon sample (SHA256: 5a02d4e5f6…) showing the use of Running place and Logical_Drivers as header strings to the system information it is collecting and sending to the C2 via email
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The shellcode retrieves an additional payload by connecting to the following C2 server using DNS: aaa.stage.14919005.www1.proslr3[.]com Once a successful reply is received from the command and control (C2) server, the PowerShell script executes the embedded Cobalt Strike shellcode
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Retriever uses .NET web services and the SoapHttpClientProtocol class to communicate with its C2 server, which generates HTTP requests resembling the example request in Figure 4
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Table 3: FELIXROOT backdoor parameters  Cryptography All data is transferred to C2 servers using AES encryption and the IbindCtx COM interface using HTTP or HTTPS protocol
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: http://www.cankayasrc[.]com/style/js/main.php http://ektamservis[.]com/includes/main.php http://gtme[.]ae/font-awesome/css/main.php  Recommendations for organizations Effective protection from targeted attacks focuses on advanced detective, preventive and investigative capabilities via solutions and training, allowing an organization to control any activities on their network or suspicious files on user systems
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: tfvn[.]com[.]vnshirkeswitch[.]netguideofgeorgia[.]orggulfclouds[.]sitejhssourcingltd[.]comkamagra4uk[.]compioneerfitting[.]compositronicsindia[.]comscseguros[.]ptspldernet[.]comtoshioco[.]comwww[.]happytohelpyou[.]inIP addressesThe following IP addresses have been observed to be associated with malware campaigns.112.213.89[.]4067.23.254[.]6162.212.33[.]98153.92.5[.]124185.117.22[.]19723.94.188[.]24667.23.254[.]17072.52.150[.]218148.66.136[.]62107.180.24[.]253108.179.246[.]13818.221.35[.]21494.46.15[.]20066.23.237[.]18672.52.150[.]218URLs:The following URLs have been observed to be associated with malware campaigns.https[:]//a[.]pomf[.]cat/http[:]//pomf[.]cat/upload[.]php
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The initial DNS query sent by the payload to obtain the system specific identifier uses the following structure, which includes the current process identifier (PID) as the subdomain of the C2 domain: <current process id>.<c2 domain> The C2 server will provide the system specific identifier within the answer portion of the DNS response
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: This command will automatically set the DNS type to use for actual C2   $showconfig Uploads the current configuration of the payload to the C2   slpx:\d+ Sets the sleep interval between outbound DNS requests   $fileUpload Downloads contents from the C2 server and writes them to a specified file    Table 3 Commands available to payload Campaign Analysis The following domains are configured within the payload to be used as C2s
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: If that HTTPS request is not successful, the downloader will issue an HTTP request
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: [1] https://www.clearskysec.com/report-the-copykittens-are-targeting-israelis/ [2] https://www.clearskysec.com/copykitten-jpost/
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: After the C2 information has been collected, BADNEWS leverages HTTP for communication with the remote servers
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Exfiltrate data using HTTP over HTTP over AES over XOR, or any combination of the available transports
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Deep Discovery Inspector protects customers from these threats via this DDI Rule:  DDI Rule 18 : DNS response of a queried malware Command and Control domain DDI Rule 15 : Many unsuccessful logon attempts (nbt_scan.exe) DDI Rule 38 : Multiple unsuccessful logon attempts (nbt_scan.exe)  TippingPoint customers are protected from these threats via these ThreatDV filters:  27218: HTTP: TROJ_RATANKBA_A Checkin 28219: HTTP: TROJ_RATANKBA_A Checkin 02 27220: HTTPS: TROJ_RATANKBA_A Checkin 27221: HTTP: Sundown EK Flash Exploit (SWF_EXPLOYT.YYRQ)  A list of related Indicators of Compromise (IoCs) can be found in this appendix
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: IcedCoffee is a fairly basic backdoor which uses WMI to collect a variety of system and user information from the system, which is then encoded with base64, encrypted with RC4 and submitted via HTTP POST to the C2 server
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The resulting HTTP POST request looks like the following: POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1 Host: 185.25.50[.]93 Content-Type: application/x-www-form-urlencoded Content-Length: 21 porg=44908AE0524f422d We have not seen a C2 server respond to our requests during our analysis, however, we do know how the Trojan will parse the C2’s response for specific data
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Victim Registration SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C which is the compromised website of speakupomaha[.]com
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Command & Control  The malware communicates with the Naver email platform in order to communicate with the operator
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Domains  http://mdzz2019.noip[.]cn:19931 http://mdzz2019.noip[.]cn:3654/  From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url.  This is a dynamic DNS, meaning the actual IP changes quite frequently
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The Trojan uses HTTP POST requests, as seen in Figure 1 to send data to the C2 server, and GET requests to receive commands from the server, as seen in Figure 2
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Figure 1 XAgent macOS HTTP POST request  Figure 2 XAgent mscOS HTTP GET request The C2 URLs generated by XAgentOSX are very similar to those created by its Windows-based counterpart
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: HAWKBALL is a backdoor that communicates to a single hard-coded C2 server using HTTP
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: The RunAtLoad key will command launchd to run the daemon when the operating system starts up, while the KeepAlive key will command launchd to let the process run indefinitely
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: When each file is encrypted, registry keys are created under HKU\{SID}\Software\Microsoft\ RestartManager \ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: When the .lnk file is initialized, it spawns a CMD process
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: This round of FIN7 phishing lures implements hidden shortcut files (LNK files) to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: In this ongoing campaign, FIN7 is targeting organizations with spear phishing emails containing either a malicious DOCX or RTF file – two versions of the same LNK file and VBScript technique
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: The LNK file is moved to the startup directory
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: This shortcut file points to the path of the previously written ‘Applet.cpl’ file
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: The communication and exfiltration of data was detected in a real-world scenario using the Cybereason platform
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: The optional HTTP data with king.jpg looks like a beacon to inform the control server that the malware is ready to accept new commands:  Commands received from the control server are encoded DWORDs After decoding, these DWORDs should be in the range 123459h to 123490h  Malware checking to make sure a received command is in the correct range
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: In response to this request, the C2 server responds with a Base64-encoded RSA public key (seen in Figure 12)
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: Data that is sent is compressed and then base64-encoded before being included in the requests
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: The script gathers system specific data, such as the domain the system belongs to and the current username, that it constructs in the following format:   <domain>\<username>:pass   The above string is encoded using a custom base64 encoder to strip out non-alphanumeric characters (=, / and +) from the data and replaces them with domain safe values (01, 02 and 03 respectively)
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: A notable characteristic of CopyKittens is the use of DNS for command and control communication (C&C) and for data exfiltration
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: Note: CTU researchers frequently observe threat actors renaming archiving tools and storing data for exfiltration in uncommon directories
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic, poisoning the NetBIOS Name Service, and spreading laterally via the EternalBlue exploit.  APT28 Uses Malicious Document to Target Hospitality Industry FireEye has uncovered a malicious document sent in spear phishing emails to multiple companies in the hospitality industry, including hotels in at least seven European countries and one Middle Eastern country in early July
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Malware Delivery Method  In all emails sent to these government officials, the actor used the same attachment: a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Figure 1: Contents of the Email A review of the email header data from the spear phishing messages showed that the threat actors sent the emails using the same infrastructure they have used in the past
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Looking at earlier attacks between 2013 and 2016, we believe Comnie was also used in targeted attacks against the following individuals or organizations:  Taiwan government IT service vendor in Asia Journalist of a Tibetan radio station   Figure 6 Email sent to Journalist of Tibetan radio station   Malicious Macros The malicious macro documents used to deliver Comnie initially hide the content inside and requests that the user enables macros prior to viewing the document
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: APT32 actors continue to deliver the malicious attachments via spear-phishing emails
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Phishing emails with political themes were used in the majority of the observed attack emails
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Figure 2: Excerpt of an APT33 malicious .hta file We assess APT33 used a built-in phishing module within the publicly available ALFA TEaM Shell (aka ALFASHELL) to send hundreds of spear phishing emails to targeted individuals in 2016
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: The spear phishing emails and attached malicious macro documents typically have geopolitical themes
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: The attackers used spear phishing emails combined with malicious HWP documents created using Hancom Hangul Office Suite
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: We suspect the attacker was trying to generate sympathy by reminding the reader that Munchon and the province it is in, Kangwon, were part of a unified province that included South Korea's Gangwon-do prior to the division of Korea in 1945.A second email contained a story about a person called 'Ewing Kim' who was looking for help:The email's attachments are two different HWP documents, both leveraging same vulnerability (CVE-2013-0808)
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy)
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Zebrocy is delivered primarily via phishing attacks that contain malicious Microsoft Office documents with macros as well as simple executable file attachments
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Malicious Document   Decoy Document  The attack starts with a spear-phishing email containing the HWP document named "미북 정상회담 전망 및 대비.hwp" (Prospects for US-North Korea Summit .hwp)
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: The case we found arrived through a targeted email that contained a document file (in docx format).
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: APT32 likely used COVID-19-themed malicious attachments against Chinese speaking targets.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: Once the password (delivered in the body of the email) is entered, the users are presented with a document that will request users to enable the malicious macro, as shown in Figure 3
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Successful execution of the macro within the malicious document results in the installation of APT28’s signature GAMEFISH malware
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Once the user enables macros, the macro will perform the following actions:  Displays decoy content Checks for the existence of a file at %APPDATA%\wscript.exe If %APPDATA%\wscript.exe does not exist, the macro converts an embedded hex-encoded string into bytes and saves this data to the %APPDATA%\wscript.exe
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Figure 1: Malicious FIN7 lure asking victim to double click to unlock contents The malicious LNK launches “mshta.exe” with the following arguments passed to it: vbscript:Execute("On Error Resume Next:set w=GetObject(,""Word.Application""):execute w.ActiveDocument.Shapes(2).TextFrame.TextRange.Text:close") The script in the argument combines all the textbox contents in the document and executes them, as seen in Figure 2
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Malicious processes are marked red (click image to enlarge):  The following malicious files are dropped and run:  C:\ProgramData\{2ED05C38-D464-4188-BC7F-F6915DE8D764}\OFFLINE\9A189DFE\C7B7C186\main.vbs dcac79d7dc4365c6d742a49244e81fd0 C:\Users\Public\Libraries\RecordedTV\DnE.ps1 7fe0cb5edc11861bc4313a6b04aeedb2 C:\Users\Public\Libraries\RecordedTV\DnS.ps1 3920c11797ed7d489ca2a40201c66dd4 “C:\Windows\System32\schtasks.exe” /create /F /sc minute /mo 3 /tn “GoogleUpdateTasksMachineUI” /tr C:\Users\Public\Libraries\RecordedTV\backup.vbs 7528c387f853d96420cf7e20f2ad1d32  Command and control server is located in the following domain: tecsupport[.]in A detailed analysis of the malware is provided in two posts by Palo Alto networks and in a post by FireEye, which wrote about previous campaigns by this threat agent
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Additionally, a small number of campaigns over this same period also made use of various file-sharing platforms like Dropbox for hosting the malicious documents rather than directly attaching them to the messages themselves.Figure 2: Example malicious Excel documentSimilar to the technique described in our previous blog about Remcos, the contents of the documents have been intentionally made to appear as if they are blurry, with the user being prompted to enable editing to have a clearer view of the contents
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: By default, Excel does not allow the download of data from the remote server, but will ask for the user’s consent by presenting the dialog box in Figure 2:  Figure 2 Excel security notice for .iqy files By enabling this data connection, the user allows Excel to obtain content from the URL in the .iqy file
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: The document also contained a lure image, similar to ones commonly found in malicious macro documents which ask the user to click on “Enable Content” as seen in Figure 2
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Message 3:    Headers Received: by mailcenter.support   Sender Mercator Institute for China Studies <publications@mericcs.org>   Subject Authoritarian advance Responding to Chinas growing political influence in Europe   Body Content and images included within the e-mail body were a direct copy of the following MERICS report:  https://www.merics.org/sites/default/files/2018-02/GPPi_MERICS_Authoritarian_Advance_2018_1.pdf   Notes The hyperlinked text Click here to download the report within the e-mail body lead to a malicious RTF document located at the URL hxxp://www.mericcs.org/GPPi_MERICS_Authoritarian_Advance_2018_1Q.doc
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Once a user has double-clicked the embedded image, the form executes a VB setup script
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: The threat actors also took additional steps to replace some variable strings in the more recent samples, likely in an attempt to avoid signature-based detection from Yara rules. Once the document was opened, it prompted the user to enable the macro titled "BlackWater.bas".
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: Many of this APT’s components are signed with phony Intel and AMD digital certificates
MITRE ATT&CK techniques:
- T1553.002: Subvert Trust Controls - Code Signing
Threat description: Based upon the instructional guide and the provided tools, this package appears consistent with the methodologies FireEye outlined in their research on how these attacks were executed, including specific details such as the use of ICAP via a proxy passthrough, in this case specifically squid, and using certbot to create a Let’s Encrypt SSL certificate
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Encrypting communications using AES and RSA public key cryptography   5
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Figure 19. Scrambling ‘Mac OSX 10.12’  Encryption  The scrambled byte sequence is passed onto the constructor of the class Packet::Packet, which creates a random AES256 key and encrypts the buffer with this key
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: It first grabs an encrypted blob stored away in a global variable and pulls out 381 bytes of this encrypted data:  The standard win32 api CryptDecrypt uses rc4 to decrypt this blob into a hardcoded c2, url path, and url parameters listed below with a simple 140-bit key “\x8B\xFF\x55\x8B\xEC\x83\xEC\x50\xA1\x84\x18\x03\x68\x33\xC9\x66\xF7\x45\x10\xE8\x1F\x89\x45\xFC\x8B\x45\x14\x56″
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: In addition, multiple APT40 command and control (C2) domains were initially registered by China based domain resellers and had Whois records with Chinese location information, suggesting a China based infrastructure procurement process
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: This RAT communicates with 5.189.145.248, a command and control (C2) IP address that this group has used previously with other malware, including DarkComet and NJRAT
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: The string is formatted as “<domain list>|<minimum query size>|<maximum query size>|<hasGarbage>|<sleepPerRequest>|<maximum requests>|<query types>|<hibridMode>|<current query mode>”   ^slp Sets the sleep and jitter values   ^exit Exits the Trojan    Table 5 Commands available within the C# variant of RogueRobin Using Google Drive for C2 A command that was not available in the original PowerShell variant of RogueRobin but is available with the new C# variant is the x_mode
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Lastly, the new variant of RogueRobin is capable of using the Google Drive cloud service for its C2 channel, suggesting that DarkHydrus may be shifting to abusing legitimate cloud services for their infrastructure
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: The Delphi variant of Cannon does not use legitimate web-based email services for its C2 communications, instead opting to use email accounts at an actor owned domain, ambcomission[.]com
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: The command index table and command handler address table.  Implant Capabilities Based on the responses received from the control server, the malware can carry out the following malicious tasks:  Recursively generate a list of files in a directory and send to the control server Terminate a specific process
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: The majority of documents used the name “gerry knight” for the author field in the document metadata, and the embedded macros largely used direct IP connections to command and control (C2) servers rather than using domain names
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: This can be seen in the following images taken from hxxp:// feeds.rapidfeeds[.]com/88604/, which is one of the dead drop resolvers we encountered in this sample:  Figure 7 Dead drop resolver used by BADNEWS   In order to decrypt this data, the authors have included additional steps from previous versions
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: Additional tools were recovered during the incident, including a network scanning/enumeration tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as 'spwebmember'
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: At a high-level, their targeting of financial organizations and subsequent heists have followed the same general pattern:   Information Gathering: Conducted research into an organization’s personnel and targeted third party vendors with likely access to SWIFT transaction systems to understand the mechanics of SWIFT transactions on victim networks (Please note: The systems in question are those used by the victim to conduct SWIFT transactions
MITRE ATT&CK techniques:
- T1018: Remote System Discovery
Threat description: APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: During privilege escalation, freely available tools such as Mimikatz and Ncrack have been observed, in addition to legitimate tools such as Windows Credential Editor and ProcDump
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: APT40 leverages custom credential theft utilities such as HOMEFRY, a password dumper/cracker used alongside the AIRBREAK and BADFLICK backdoors
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: The datasets included:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Script to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  We analyzed each type of dataset other than the documents containing detailed information on alleged OilRig operators and they remain consistent with previously observed OilRig tactics, techniques, and procedures (TTPs)
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: It appears to us that one organization had its entire Active Directory dumped out, making up most of the credentials we found in the data dump
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Assuming the lists of credentials are valid, the mass collection confirms our hypothesis that the OilRig group maintains a heavy emphasis on credential based attacks along with the other types of attacks they deploy
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Credential Harvesting Attack On June 24, 2018, Unit 42 observed DarkHydrus carrying out a credential harvesting attack on an educational institution in the Middle East
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Figure 6 Authentication dialog box with fake credentials entered On the C2 server, we observed Phishery receiving the inbound request and capturing the credentials, as seen in Figure 7
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: (Source: Dell SecureWorks)   TG-3390 actors have also used the following publicly available tools:  Windows Credential Editor (WCE) — obtains passwords from memory gsecdump — obtains passwords from memory winrar — compresses data for exfiltration nbtscan — scans NetBIOS name servers  Tactics, techniques, and procedures Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 15 Database dump Decoded, it reveals a detailed log of each affected machine
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: It was heavily modified, with almost all original code stripped out aside from its sekurlsa::logonpasswords credential stealing feature
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: Domains The RoyalCli backdoor was attempting to communicate to the following domains:  News.memozilla[.]org video.memozilla[.]org  The BS2005 backdoor utilised the following domains for C2:  Run.linodepower[.]com Singa.linodepower[.]com log.autocount[.]org  RoyalDNS backdoor was seen communicating to the domain:  andspurs[.]com  Possible linked APT15 domains include:  Micakiz.wikaba[.]org cavanic9[.]net ridingduck[.]com zipcodeterm[.]com dnsapp[.]info   Published date:  10 March 2018   Written by:  Rob Smallridge
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Indicators of Compromise (IoCs)    C&C servers    Ssl[.]arkouthrie[.]com   s3[.]hiahornber[.]com   widget[.]shoreoa[.]com       SHA256   Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a   Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4   Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f   The post New MacOS Backdoor Linked to OceanLotus Found appeared first on
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Additionally malware reports itself to its hardcoded command and control servers and established a backdoor connection, so the attacker may have a permanent remote connection
MITRE ATT&CK techniques:
- T1008: Fallback Channels
Threat description: Business and government personnel who are traveling, especially in a foreign country, often rely on systems to conduct business other than those at their home office, and may be unfamiliar with threats posed while abroad
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: These files are downloaded to a directory (C:\Users\Public\Libraries\tempsys) on the infected machine by Bxaki() and xparis()
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: The body of the POST request may contain files contained in the cabinet format
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Figure 3 – A list of file extensions targeted for destruction by new variant of KillDisk component As well as being able to delete system files to make the system unbootable – functionality typical for such destructive trojans – the KillDisk variant detected in the electricity distribution companies also appears to contain some additional functionality specifically intended to sabotage industrial systems
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: This is the only instance we observed where a hardcoded Google Drive URL was included in RogueRobin, which may suggest that the author may have overlooked this during testing
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: It mimics the icon Finder usually applies to JPEG or text files to increase the likelihood the recipient will double-click the file
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: PHOTO: a DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 17-3 Function names To target specific victims, Astaroth is locale aware; any attempts to run the malware without locale spoofing will result in failed downloads and the inability to run the .dll files
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: This document exploited a newer vulnerability, CVE-2017-0199
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Exploited Vulnerabilities: Frequent exploitation of vulnerabilities in Hangul Word Processor (HWP), as well as Adobe Flash
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: APT40 leverages exploits in their phishing operations, often weaponizing vulnerabilities within days of their disclosure
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: All zero-day exploits known, or suspected, to have been used by this group are for vulnerabilities in Internet Explorer and Flash
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: McAfee detects these threats as:  RDN/Generic Exploit RDN/Generic.dx Generic PWS.y Generic.hbg Exploit-CVE2018-4878  McAfee customers are also covered by McAfee Global Threat Intelligence Web Reputation classification, which rate these URLs as High Risk
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: The database is located in the “/usr/lib/cva-ssys/My_BD” folder (“~/.local/cva-ssys/My_BD”—if the Trojan does not have root privileges)
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: OfficeScan’s Vulnerability Protection shields endpoints from identified and unknown vulnerability exploits even before patches are even deployed. Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to attacks using exploits and other similar threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect these attacks even without any engine or pattern update
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: When combined with email tracking software, APT32 was able to closely track phishing delivery, success rate, and conduct further analysis about victim organizations while monitoring the interest of security firms
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Types of attacks possibly averted include Structured Query Language (SQL) injection, cross-site scripting, and command injection.Use stringent file reputation settings – Tune the file reputation systems of your anti-virus software to the most aggressive setting possible
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: We would like to thank White-Hat, Tom Lancaster of Palo Alto Networks, Michael Yip of Stroz Friedberg, security researcher Marcus, and other security researchers and organizations who shared information and provided feedback
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Figure 14: System shut down upon discovery of security tools  Ability to receive PowerShell script from the C2 server and execute on the machine
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Given the regional file format used there is a chance that some security software suites may not handle them well, and this may have provided an evasion case for the attacker.The documents sent to the targets were titled "Analysis of "Northern New Year in 2017" and used the official logo of the Korean Ministry of Unification
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called “Rocket Kitten” (AKA Operation Saffron Rose, Ajax Security Team, Operation Woolen-Goldfish) as well as an older attack campaign called Newscasters
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: As seen below, the relational analysis proved to be quite fruitful:  Figure 1 Overview of relationships We rapidly discovered a different set of tools communicating to the exact same C2 servers as those two Word documents, in addition to other tools communicating to other subdomain variations of chrome-up[.]date as seen in the following graphic:  Figure 2 Command and control overlaps From there, we were able to map out a large infrastructure separating out into four categories of tools: downloaders, droppers, loaders, and payloads
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: The toolset used by the Magic Hound campaign was an assortment of custom tools, as well as open sourced tools available to the general public
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Mitigation Security and system/IT administrators must practice due diligence in protecting their websites and web-based applications from threats that can undermine their security, and hijack them to do the bad guys’ bidding—delivering malware to their victims
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: Mitigation As this sample installs itself through the use of EternalBlue, the targeted protocol is SMB.  Because of this, in order to best mitigate and avoid possible installations, you need your system updated to the latest security patches.  Specifically, you’d want to make sure that you have MS17-010 installed, as this is the security patch that patches the EternalBlue vulnerability
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: The RIPTIDE exploit document drops its executable file into the C:\Documents and Settings\{user}\Application Data\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\ folder
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: Additionally, VALUEVAULT will call Windows PowerShell to extract browser history in order to match browser passwords with visited sites.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: In green, functions from Keychaindump C&C communication Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&C server
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Containment provided by enclaving also makes incident cleanup significantly less costly.Configure firewalls to disallow Remote Desktop Protocol (RDP) traffic coming from outside of the network boundary, except for in specific configurations such as when tunneled through a secondary virtual private network (VPN) with lower privileges.Audit existing firewall rules and close all ports that are not explicitly needed for business
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: FIN6 used another set of compromised credentials with membership to additional groups in the domain to RDP to other hosts
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
Threat description: This crafted zip archive exploited a WinRAR flaw that makes files in zip archives appear to have a different name and file extension
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: On September 24, 2018, we observed an organization targeted by OilRig attempting to download a Zip archive from the following URL: hxxp://193.111.152[.]13/[redacted]-ITsoftwareUpdate.zip This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: RARM Creates RAR files per logical drive containing data with timestamps for the past 30 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: RARW Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: When exfiltrating the keychain, the keychain field is used instead of data
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Sometimes it is a high profile, legitimate site such as “diplomacy.pl”, hosting a ZIP archive
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: The ZIP archive contains a RAR SFX which installs the malware and shows an empty PDF decoy
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: The entire command structure gets compressed with zlib and then encrypted using a custom stream cipher.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: Internal Reconnaissance APT40 uses compromised credentials to log on to other connected systems and conduct reconnaissance
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: Figure 4 – Backdoored authentication function in SSH server As you can see in Figure 4, this version of Dropbear SSH will authenticate the user if the password passDs5Bu9Te7 was entered
MITRE ATT&CK techniques:
- T1021: Remote Services
Threat description: We were able to brute force the actor-provided key using the inverse arithmetic operations using the embedded salt and embedded ciphertext, so we were able to extract the embedded webshells with ease
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: It then takes note of the infected machine’s IP address, user, domain, hostname, OS and Service Pack, and the username and password combination that worked during the brute force routine
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: We found a brute-force tool called NLBrute , with configuration files that tell us it had been set up to use an included set of username and passwords to try to break in to machines that have Remote Desktop enabled
MITRE ATT&CK techniques:
- T1110: Brute Force
Threat description: Common TCP ports 80 and 443 are used to blend in with routine network traffic
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: Resulting script on the compromised government websites Users were redirected to https://google-updata[.]tk:443/hook.js, a BEeF instance, and https://windows-updata[.]tk:443/scanv1.8/i/?1, an empty ScanBox instance that answered a small piece of JavaScript code
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: PUPY LOADER The Pupy RAT comes packaged by default with loaders that can run the RAT on a variety of platforms such as Windows, macOS, Linux and Android
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
- T1571: Non-Standard Port