QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: If elevated privileges are not obtained, the malware falls back to using the same Windows registry run key as the older mode variant for persistence HKCU\Software\Microsoft\Windows\CurrentVersion\Run. For each service, the malware attempts to take control of the service’s executable — first using icacls.exe with the /reset flag to reset the executable’s permissions, then using takeown.exe with the /F flag to take ownership of the executable
MITRE ATT&CK techniques:
- T1222.001: File and Directory Permissions Modification - Windows File and Directory Permissions Modification
Threat description: Microsoft discovered these new attacker tools and capabilities in some compromised customer networks and observed them to be in use from August to September 2020. Further analysis has revealed these may have been on compromised systems as early as June 2020
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: Ebury v1.4 has a fallback mechanism whereby a domain generation algorithm (DGA) is used when the attacker doesn’t connect to the infected system via the OpenSSH backdoor for three days. Under these conditions, Ebury will exfiltrate the collected data using the generated domain. Ebury v1.6 has the same mechanism, but there is a minor change to the DGA itself
MITRE ATT&CK techniques:
- T1008: Fallback Channels
- T1568.002: Dynamic Resolution - Domain Generation Algorithms
Threat description: Figure 7: Dropbox-themed landing page with a lure asking users to click a button that links to the malicious document
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. All these builds exhibit common functionality.Agent.btz is a DLL file. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. It will drop its copy on it and it will create autorun.inf file with an instruction to run that file. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\winview.ocx.This file is also encrypted with the same XOR mask. Note: an attempt to run a valid thumb.db file, which is an OLE-type container has no effect.Files thumb.dd and mssysmgr.ocxAgent.btz is capable to create a binary file thumb.dd on a newly connected drive
MITRE ATT&CK techniques:
- T1560.003: Archive Collected Data - Archive via Custom Method
Threat description: In cases where spam attachments could be verified — once a user has opened the attachment and enabled macro functionality — a PowerShell script downloads either Emotet, Bokbot or Trickbot, with the end payload being TrickBot
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: There are likely differences in the Skeleton Key malware documented by Dell SecureWorks and the Mimikatz skeleton key functionality. If all the DCs don’t have skeleton key configured, the master password won’t work when the client authenticates to a DC without skeleton key. Scenario: Either the attacker exploits MS14-068 or has the KRBTGT NTLM password hash and uses it to generate a Kerberos Golden Ticket to impersonate a valid Domain Admin account. Domain Controller Security Events When Implanting the Mimikatz Skeleton Key: When implanting the skeleton key remotely using Mimikatz the following events are logged on the Domain Controller. Authenticating with the Mimikatz Skeleton Key: Testing user password and user account with skeleton key password. Note that both passwords are accepted – the valid user password and the skeleton key master password. Testing Domain Admin account with password &amp; skeleton key password. Note that both passwords are accepted – the valid user password and the skeleton key master password. Skeleton Key Mitigation: - Protect domain-level admin (DLA) accounts (Domain Admin, Administrators, etc) which reduces the risk of attackers gaining access to these credentials. Don’t let DLA accounts logon to systems at a different security level from Domain Controllers
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: The Updater.exe program has the same program icon as CelasTradePro.exe. When run, it checks for the CheckUpdate parameter, collects the victim’s host information (System Owner/User Discovery [T1033]), encrypts the collected information with a hardcoded XOR encryption, and sends information to a C2 website (Exfiltration Over C2 Channel [T1041
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1041: Exfiltration Over C2 Channel
Threat description: Poseidon utilizes a variety of tools. Their main infection tool has been steadily evolving since 2005, with code remnants remaining the same to this day, while others have been altered to fit the requirements of new operating systems and specific campaigns. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: As with other adversaries that mine cryptocurrency opportunistically, Blue Mockingbird likes to move laterally and distribute mining payloads across an enterprise
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
- T1021.002: Remote Services - SMB/Windows Admin Shares
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: In our analysis we could observe how the adversary ensures persistence by delivering an LNK file into the startup folder
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: ESET researchers have dissected some of the latest additions to the malicious toolkit of the Advanced Persistent Threat (APT) group known as OceanLotus, also dubbed APT32 and APT-C-00
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Executes VBScript using Process.Start. The third-stage DLL proceeds by loading the "AdvancedRun" resource into memory, decompressing it and dropping it as "AdvancedRun.exe" into the %TEMP% directory. Drops AdvancedRun.exe using File.WriteAllBytes. AdvancedRun.exe" is a tool provided by Nirsoft to execute a program with different settings. Once the tool is dropped, the third stage DLL will leverage it to execute two commands in the context of the Windows TrustedInstaller group. The TrustedInstaller group was an addition to Windows beginning in Windows 7 with the goal of preventing accidental damage to critical system files. AdvanceRun is one of the tools that can be used to execute commands in the context of the TrustedInstaller user. This functionality is only available via CLI and requires the flag of "/RunAs 8", which is shown in the commands below. The tool will be deleted from the %TEMP% directory after executing both commands. The first command leverages the Windows service control application (sc.exe) to disable Windows Defender
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1078.001: Valid Accounts - Default Accounts
Threat description: Services may be created with administrator privileges but are executed under system privileges, so an adversary can also use a service to escalate privileges from Administrator to System. They can also directly start services through Service Execution. 29],[30(link is external)] - During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. 32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
Threat description: The QuietSieve malware family refers to a series of heavily-obfuscated .NET binaries specifically designed to steal information from the target host. If this check succeeds, a randomly-generated alphanumeric prefix is created and combined with the callback domain as a subdomain before an initial request is made over HTTPS
MITRE ATT&CK techniques:
- T1016.001: System Network Configuration Discovery - Internet Connection Discovery
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. In particular, review network access for use of mobile USB modems on corporate systems
MITRE ATT&CK techniques:
- T1102.001: Web Service - Dead Drop Resolver
Threat description: The decrypted result is saved as “%APPDATA%\\Microsoft\Windows\Cookies.exe” (T1001) 6) If the file size of “%APPDATA%\\Microsoft\Windows\Cookies.exe” exceeds 4,485 bytes, it is executed
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Executive summary . The PROMETHIUM threat actor — active since 2012 — has been exposed multiple times over the past several years.. However, this has not deterred this actor from continuing and expanding their activities. The trojanized setup will install the malware and the legitimate application, which is a good way to disguise its activities. PROMETHIUM has been resilient over the years. We have no evidence that the websites of the real applications were compromised to host the malicious installer. The usage of the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key has a persistence mechanism that has been replaced by the creation of a service. If it is executed with the "help" parameter, it will install a service to execute itself as a service. This has a notable side effect: if rmaserv.exe is executed isolated on a sandbox (so without the parameter), the service is not created. Document search module: Mssqldbserv.xml . This module has been described before in the article here. The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\DOCUME~1\&lt;USER&gt;~1\LOCALS~1\Temp\4CA-B25C11-A27BC\, each selected file will be compressed into the file kr.zp
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: With domain administrator privileges obtained, the threat actors then moved laterally throughout the network using SMB and RDP to deploy Cobalt Strike beacons on the domain controllers around 1 hour after the initial execution of Bazar. On the domain controllers, some additional discovery was done using the PowerShell Active Directory module. After establishing Cobalt Strike beacons on those they felt ready to proceed to their final objectives
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: In order to encrypt network shares, BitPaymer will attempt to enumerate the sessions for each user logged onto the infected host and create a new process, using the token of each user. These new processes will first spawn a net.exe processing with the view argument to gather a list of network accessible hosts. For each host, BitPaymer spawns another net.exe process with command net view &lt;host&gt; using the newly discovered host as a parameter. This will return a list of network shares available to the impersonated user on the host. Once a list of all available shares has been gathered, BitPaymer attempts to mount them to be encrypted
MITRE ATT&CK techniques:
- T1134.001: Access Token Manipulation - Token Impersonation/Theft
- T1135: Network Share Discovery
Threat description: This hardens the encryption of the network communication, as a single RC4 key will not decrypt the entire payload. Leverages existing Windows registry key that is enabled by default in Windows 10 to store configuration data. Generates unique session keys for each connection to the C2 server. Employs polymorphic code, changing its runtime footprint during code execution to thwart memory analysis and evade signaturing. Encrypts or decrypts function blocks (code blocks) during runtime, as needed, to evade detection. Uses position independent code (PIC) to throw off static analysis tools
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: Upon execution, MCMD spawns a console process (cmd.exe) with redirected standard input and output (I/O) handles. Immediately after execution, the window properties of both the MCMD and cmd.exe processes are modified to prevent them from being visible on the active user's desktop. MCMD utilizes the shared I/O handles to send and receive data between the C2 server and the command shell (see Figure 1
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: 1) The malicious .rtf file exploits CVE-2017-11882. 3) The malware creates a child process, “mshta.exe,” which downloads a file from: hxxp://mumbai-m[.]site/b.txt. 4) b.txt contains a PowerShell command to download a dropper from: hxxp://dns-update[.]club/v.txt. The PowerShell command also renames the downloaded file from v.txt to v.vbs and executes the script
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1140: Deobfuscate/Decode Files or Information
Threat description: These mechanisms are used to attempt installation and execution of perfc.dat on other devices to spread laterally. For systems that have not had MS17-010 applied, the EternalBlue and EternalRomance exploits are leveraged to compromise systems. The exploit launched against the victim system depends on the operating system of the intended target
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Commands received from the control server are encoded DWORDs - After decoding, these DWORDs should be in the range 123459h to 123490h
MITRE ATT&CK techniques:
- T1132.002: Data Encoding - Non-Standard Encoding
Threat description: Turla has many names in the information security industry — it is also known as Snake, Venomous Bear, Uroburos and WhiteBear. Turla likes to use compromised web servers and hijacked satellite connections for their command and control (C2) infrastructure. Instead, they use a compromised system inside the targeted network as a proxy, which forwards the traffic to the real C2 server. Well-known malware like Crutch or Kazuar are attributed to Turla. Lately, we have also seen research that has shown potential links between the Sunburst backdoor and Turla. Not every campaign run by Turla can clearly be attributed to them
MITRE ATT&CK techniques:
- T1090.001: Proxy - Internal Proxy
Threat description: The C2 server will respond to the HTTP requests to the “bat&amp;m=d” URL with a batch script that update.vbs will save to the “dn” folder and execute. The output of the downloaded batch script is saved to a text file in the “up” folder and uploaded to the C2 server via an HTTP POST request to the following URL
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
Threat description: This final cluster appears to serve as the C2 infrastructure for a custom remote administration tool called Pteranodon. Gamaredon has used, maintained and updated development of this code for years. Its code contains anti-detection functions specifically designed to identify sandbox environments in order to thwart antivirus detection attempts
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: Archive files that contain a legitimate executable and a malicious DLL, to be used in a DLL hijacking technique, taking advantage of legitimate executables such as Outlook and Avast proxy, to load a malicious DLL
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: Embedded Trojan This Trojan loaded by the first payload contains several embedded executables that it uses to ultimately download and execute a secondary payload, as well as downloading and opening a decoy document. Upon execution, this Trojan checks to see if it was configured with "BINDERON" to determine if it should extract an embedded payload from a resource named "B", save it to %TEMP%\%BIND1%, and create a new process with the embedded payload. While the Trojan was configured to carry out this activity, the actor did not embed a payload within the "B" resource, so this functionality does not carry out any activities, rather it just causes an exception and continues running. Another configuration option encountered by this Trojan is a check for '%STARTUPON%'. This sample was not configured to execute with this option enabled, however, should this option be enabled, the Trojan would attempt to install itself to the system at a specific location by writing its contents in base64-encoded format to the following file
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: On November 9, 2018, we observed a relatively small email campaign (thousands of messages) delivering a new malware family that we call “ServHelper” based on file names associated with infection. The campaign primarily targeted financial institutions and was attributed to the threat actor TA505. The messages (Figure 1) contained Microsoft Word or Publisher attachments with macros that, when enabled, downloaded and executed the malware. This campaign used the “tunnel” variant of ServHelper, described in the “Malware Analysis” section
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
Threat description: Contains two DLL function exports: start and ss2 - Not dropped to the disk - Responsible for terminating processes and stopping/disabling services related to endpoint security - Responsible for file encryption - Responsible for creating multiple worker threads for encryption - Responsible for creating the ransom notes - No longer uses the process rundll32.exe as a loader, but instead uses the MegaCortex binary as the DLL loader - Responsible for deleting volume shadow copies using vssadmin.exe and wiping deleted data from all drives using cipher.exe
MITRE ATT&CK techniques:
- T1561.001: Disk Wipe - Disk Content Wipe
Threat description: Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that are spreading malware to users at both a large and small scale. In this blog post, we analyze several of those campaigns and their tactics, techniques and procedures (TTPs). These campaigns were all observed between mid-May and early July of this year, and can likely be attributed to one, or possibly two, groups. Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. Simple campaigns typically use a single technique and often embed the final executable payload into the exploit document. The malicious emails display a strong command of the English language, and their content may have been taken from legitimate emails relevant to the business of the targeted organization. The emails either contain a URL pointing to one of the three document types or have initial attack stages attached outright
MITRE ATT&CK techniques:
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: If I open up the WebCacheV01.dat file in ESEDatabaseView or BrowsingHistoryView, I see browsing history leading up to my testing. Initially, I thought it was grabbing a copy of the file from a previous Volume Shadow Copy (VSC) but that isn’t the case. Esentutl.exe is able to use the Volume Shadow Copy service to make a backup of a locked file
MITRE ATT&CK techniques:
- T1003.003: OS Credential Dumping - NTDS
Threat description: 1) These lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange (DDE) protocol in order to gain access to victim machines. 2) Once the Gallmaker attackers gain access to a device, they execute various tools, including
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1559.002: Inter-Process Communication - Dynamic Data Exchange
Threat description: The GoldMax malware was discovered persisting on networks as a scheduled task impersonating systems management software. In the instances it was encountered, the scheduled task was named after software that existed in the environment, and pointed to a subfolder in ProgramData named after that software, with a similar executable name. The executable, however, was the GoldMax implant
MITRE ATT&CK techniques:
- T1036.004: Masquerading - Masquerade Task or Service
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: Prior to execution of any recon command to gather information from the target machine, the default codepage of the console is changed to “65001” (utf-8
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: APT40 uses a mix of custom and publicly available credential harvesting tools to escalate privileges and dump password hashes
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Scheduled tasks enable administrators to run tasks or “jobs” at designated times rather than every time the system is booted or the user logs in. This feature can be implemented via the Windows COM API, which the first versions of Ramsay have tailored. Based on the high ratio of similarity with Carberp’s implementation, it’s highly probable that Ramsay’s implementation was adapted from Carberp’s publicly available source code
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1559.001: Inter-Process Communication - Component Object Model
Threat description: MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks
MITRE ATT&CK techniques:
- T1020: Automated Exfiltration
Threat description: Interestingly, the server mapped to kneeexercises[.]net listens for incoming HTTPS connections on several ports and uses common names seen on other C2 domains. For example, ports 2083 and 8443 had CN firstohiobank[.]com, and TCP port 2087 had a TLS certificate with the common name dentalmatrix[.]net. We observed use of these non-standard ports during some of the older intrusions, while the newer ones mostly use port 443
MITRE ATT&CK techniques:
- T1571: Non-Standard Port
Threat description: The malware sample contains some interesting static artifacts including self-signed digital certificates used to sign the executable purporting to be software from the Foxit Software Incorporated company based in California. It is not known why the actors picked this company -- and others listed in Table 1 below -- to impersonate but, as previously mentioned, their use of filenames and URLs makes their payloads appear benign and trustworthy
MITRE ATT&CK techniques:
- T1587.002: Develop Capabilities - Code Signing Certificates
Threat description: persistence: Somewhat interestingly, OSX/Dok persists in two phases. First as a Login Item, then as Launch Agents. When Dok is (naively) launched by the user, it will executed logic to persist as a Login Item. As their name implies, Login Items will execute an application when the user logs in. Apple describes how to create a Login Item both manually and programmatically
MITRE ATT&CK techniques:
- T1059.002: Command and Scripting Interpreter - AppleScript
Threat description: Prior to privilege escalation, Egregor proceeds to Active Directory reconnaissance using tools such as Sharphound or AdFind. These tools are used to gather information about users, groups, computers, and so on
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url. This is a dynamic DNS, meaning the actual IP changes quite frequently. Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell
MITRE ATT&CK techniques:
- T1568.001: Dynamic Resolution - Fast Flux DNS
Threat description: Ahnlab, a South Korean software company, simultaneously published a paper regarding Bisonal's activity in South Korea. The initial stage is a binary that drops a decoy document (Powerpoint or Excel document), a VisualBasic script and the packed Bisonal payload. The payload is dropped with a .jpg extension that's been renamed to ".exe. Here is an example decoy document: The purpose of the VisualBasic script is to execute the payload. Although the malicious part of the binary is only 2MB, the final file is more than 120MB in size, padded out with random data. The payload has been packed with a new packer. The code of Bisonal is similar to the version of 2019
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: The code then uses the identified functions to add persistency through registry and add next stages file names identifier through the following locations
MITRE ATT&CK techniques:
- T1037.001: Boot or Logon Initialization Scripts - Logon Script (Windows)
Threat description: Listing the C:/ drive contents using cd C:/; ls; - Listing the specific Wi-Fi profile details using netsh wlan show profiles name='&lt;Name&gt;' key=clear; - Listing the drives using Get-PSDrive
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
- T1083: File and Directory Discovery
Threat description: 1) Use of zip file that contains a “.lnk” (Windows Shortcut) file. 2) Utilization of double extension trick (sample.doc.lnk) to convince users to open the file. 3) HTA (HTML Application) with VBScript embedded in the “.lnk” file 4) VBScript drops payloads and opens a decoy document or PDF to the user
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: The malware’s second functionality is to gain persistence on an infected machine. After obtaining persistence, the next functionality of Linux Rabbit is to brute force SSH passwords which ultimately allows the malware to install the cryptocurrency miner onto the server. The SSH brute forcing begins by the malware first generating a random IPv4 string and checking its geolocation to see where it is located. If the IP is located within a country that is “blacklisted,” it will stop and move on until it finds an IP that is located in an allowed geolocation, which for this malware are Russia, South Korea, the UK, and the US. Once an allowed IP location is discovered, Linux Rabbit will check to see if an SSH server is listening on Port 22. The malware will open a socket to see if it receives a response, and if it does, it will attempt to obtain the machine’s hostname. If the TLD is not blacklisted, the malware will run through a process of authentication utilizing a list of hard-coded credentials it has
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: txt,log} and is also a "cryptojacker," which is a tool that uses a victim’s computer to mine cryptocurrency
MITRE ATT&CK techniques:
- T1557: Adversary-in-the-Middle
- T1056.001: Input Capture - Keylogging
Threat description: 1) Communicate with the C2, try to forward ports with UPnP and determine available ports and report them to the C2. The usual C2 communication protocol used here is HTTP POST RC4-ciphered JSON data. Instead of saving the downloaded file, QakBot measures the download speed and deletes the received file. 3) Set up external PROXY-C2 connection that was received with command 37 (update config)/module 274 (proxy) by the stager
MITRE ATT&CK techniques:
- T1071.001: Application Layer Protocol - Web Protocols
Threat description: To start, the implant looks for the AHNLAB V3 Antivirus software's class name "49B46336-BA4D-4905-9824-D282F05F6576". If the software is found, the implant will hide the AV software window from the view of the infected user
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1564.003: Hide Artifacts - Hidden Window
Threat description: Exfiltrated data is encrypted using an RSA public key, preventing third parties from decrypting it. An example exfiltration request is below
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: Poseidon utilizes a variety of tools. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. After a few minutes, execute the malicious file on the system. Use malware to upload the large list of enumerated files to the C2 server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
Threat description: cmd /c tasklist: Executes this command to collect a list of running processes on victim’s machine and store them in a tmp file
MITRE ATT&CK techniques:
- T1005: Data from Local System
- T1082: System Information Discovery
Threat description: The malware will actually search through the /Users/ folder looking for executable files. When it finds one, it will prepend malicious code to the beginning of the file. This means that when the file is executed, the malicious code is executed first. That code will then copy the legit file content into a new, invisible file and execute that
MITRE ATT&CK techniques:
- T1554: Compromise Host Software Binary
- T1036.005: Masquerading - Match Legitimate Name or Location
Threat description: The OilRig group remains highly active in their attack campaigns while they continue to evolve their toolset. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: As with much of the malware distributed by TA505, The Trick has appeared in frequent, high-volume campaigns. The campaigns used a mix of attached zipped scripts (WSF, VBS), malicious Microsoft Office documents (Word, Excel), HTML attachments, password-protected Microsoft Word documents, links to malicious JavaScript, and other vectors. The last TA505 campaigns featuring The Trick appeared in mid-September 2017 with payloads alternating between Locky and The Trick
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1204.001: User Execution - Malicious Link
- T1027: Obfuscated Files or Information
Threat description: Cisco Talos' previous research has mainly linked this group to CrimsonRAT, but new campaigns show they are expanding their Windows malware arsenal with ObliqueRAT. The victim is encouraged to click on an embedded URL hosted on sharingmymedia[.]com, which then downloads ObliqueRAT, the trojan discovered by Talos in 2020 associated with threat activity targeting entities in South Asia. We cannot confirm how the maldocs were delivered to victims, but we suspect they were probably sent as attachments to phishing emails based on previous threat actor behavior and the targeted nature of this particular lure. In such cases, adversaries would deliver phishing maldocs to targets containing a malicious VBA macro that extracted either the CrimsonRAT executable or a ZIP archive embedded in the maldoc. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. After enabling macros, the file executes CrimsonRAT on the endpoint.Figure 4: The "Download Now" button contains a link to a malicious XLS with CrimsonRAT embedded in it. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. In a few of these instances, the malicious executables in the archives contained honeytrap-themed icons to entice the victims into executing them
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description: The results are Gzipped and saved under random file in the temp folder. Following successful collection of information, the data is send back to the C2 and the file is deleted
MITRE ATT&CK techniques:
- T1074.001: Data Staged - Local Data Staging
- T1560.001: Archive Collected Data - Archive via Utility
Threat description: POWRUNER may also receive batch commands from the C2 server to collect host information from the system. An example batch command is provided in Figure 11
MITRE ATT&CK techniques:
- T1069.001: Permission Groups Discovery - Local Groups
- T1087.002: Account Discovery - Domain Account
- T1069.002: Permission Groups Discovery - Domain Groups
Threat description: First, just like the Gh0st in the dshell paper from SANS, the decrypted protocol consists of a 5 byte header (ngLGX), a 4byte packet length field, and finally another 4 byte uncompressed length field. This is where the similarity ends as the Opcode and the data are compressed using ZLib, instead of just the data. Additionally, the entire packet is encrypted with an algorithm making visual analysis of the Wireshark data challenging. However, as the packet header is static, you can use the encrypted header as an identifier, like I did in my script. The encrypted header is: “\xEA\xEE\xCC\xD3\xB8” and is unchanged throughout the malware’s runthrough
MITRE ATT&CK techniques:
- T1132.001: Data Encoding - Standard Encoding
Threat description: Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateway. Decryption password is provided in the mail body and inside the attachment it is a MHTML macro based document with the .doc suffix. Its purpose is to implant Imminent backdoor and gain a foothold into the target network which may make the follow up lateral movement easier to implement
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: This cabinet file is then extracted to the previously identified file path. Again, a shortcut file is written to the %TEMP% path with a name of ‘~Update.lnk’, which is in turn copied to the identified startup path with a filename of ‘Windows help.lnk’. This shortcut file calls the built-in ‘control.exe’ utility to in turn load the previously dropped malicious CPL file of ‘winhelp.cpl’. Finally, the malware calls the ‘winhelp.cpl’ file in a new process via the following command
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: It moves the property list (plist) file com.dorusio.pkg.wallet.plist from the Installer package to the /Library/LaunchDaemons/ folder (Scheduled Task/Job: Launchd [T1053.004]). Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches Dorusio_upgrade and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004
MITRE ATT&CK techniques:
- T1543.004: Create or Modify System Process - Launch Daemon
Threat description: The VBScript also uploads the output of the provided batch scripts to the command and control (C2) server, which provides threat actors a functional remote shell to the system
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: It uses virtualization software – QEMU on macOS and VirtualBox on Windows – to mine cryptocurrency on a Tiny Core Linux virtual machine, making it cross platform. The admins of the site also frequently update the applications with newer versions, making it difficult to track the very first version of the miner. 2) Shell scripts used to launch the QEMU images. qemuservice shell script . After the dependencies are copied over, all miner-related daemons are launched and then the actual software is installed: - qemuservice won’t launch the image if the Activity Monitor process is running. In fact, if it is running, it will unload the plist that it was launched by. Before installation, version 1 of the miner is removed along with executing the command: rm -rf /usr/local/* . As seen in the listing in Script 2, it only does so when it detects a running qemu-system-x86_64 process. Launching the Linux image . All versions use multiple shell scripts to launch the images. Version 1 executes the following binaries (copies of qemu-system-x86_64) to launch the QEMU images: qemu-system-x86_64, system-monitor, tools-service. All versions use the following switches: - -M accel=hvf to use the Hypervisor framework as an accelerator. There are, however, some hints that can help you to identify when an application contains unwanted code: - A trust popup from an unexpected, “additional” installer (in this case the Oracle network adapter). - High CPU consumption by a process you did not install (QEMU or VirtualBox in this case). - A new service added to the startup services list (Windows) or a new Launch Daemon (macOS). - Network connections to curious domain names (such as system-update[.]info or system-check[.]services here). Indicators of Compromise (IoCs) . Hashes . macOS “cracked” applications (versions 1-3) . Windows “cracked” applications (version 4) . Linux images . Filenames . macOS . Windows . Hostnames . Download hosts (via HTTP on port 80) . Update hosts (via SCP) . Mining hosts . MITRE ATT&amp;CK techniques . 20 Jun 2019 - 11:00AM . Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center . Newsletter . Similar Articles . ESET Research . Watering hole deploys new macOS malware, DazzleSpy, in Asia . Virus Bulletin: Old malware never dies – it just gets more targeted . Anatomy of native IIS malware . Some URL shortener services distribute Android malware, including banking or SMS trojans . Discussion
MITRE ATT&CK techniques:
- T1569.001: System Services - Launchctl
Threat description: Kimsuky is a highly motivated threat actor targeting a number of entities in South Korea. This group has been relentlessly creating new infection chains to deliver different types of malware to their victims. This campaign relies on the abuse of Blogspot to host attacker-operated blogs serving malicious VB based scripts to their targets. We've found preliminary malicious components from initial access beacons to file exfiltrators being deployed to victims. In many cases, the content of these preliminary components was combined to serve special scripts to victims.The final implants utilized by the actors in this campaign are derivatives of the Gold Dragon/Brave Prince malware families. Such targeted attacks can result in the leak of restricted research, unauthorized access for espionage and even destructive attacks against target organizations
MITRE ATT&CK techniques:
- T1608.001: Stage Capabilities - Upload Malware
Threat description: If the user opens the file and the exploitation is successful, a backdoor Trojan is installed on the system that gives the attacker access and a decoy document is displayed to the victim. The main module is also responsible for communicating with its C2 servers and handling commands issued by the C2 server. Figure 8: FakeM Architecture . All FakeM variants initiate communications with its C2 server and check the C2’s response for a command. After sending the acknowledgement packet, the Trojan will gather local system information and include it in a beacon to the C2 server. The Trojan uses AES to encrypt the communication channel its C2 server, which will provide one of three commands to carry out activities on the compromised system, as seen in Table 4. Unit 42 tracks this mobile Trojan as MobileOrder, as the authors specifically refer to commands within the app as orders. MobileOrder acts on instructions provided by its C2 server, which it communicates with over TCP port 3728. The C2 server will respond to requests from MobileOrder with commands that the Trojan refers to as “orders”. MobileOrder contains a command handler with functionality that provides a fairly robust set of commands, as seen in Table 6. Table 6: MobileOrder command handler . Infrastructure Overlap and Related Tools . There is some infrastructure overlap in the C2 servers used by almost all of the FakeM variants, as well other Trojans such as MobileOrder, Psylo, and CallMe. Actors will run HTRAN on a server and configure their malware to interact with that server; however, the actor will configure HTRAN to forward traffic to another server where the actual C2 server exists
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: So far, our telemetry hasn’t provided any concrete evidence that shows us how the Remexi malware spread. However, we think it’s worth mentioning that for one victim we found a correlation between the execution of Remexi´s main module and the execution of an AutoIt script compiled as PE, which we believe may have dropped the malware. This dropper used an FTP with hardcoded credentials to receive its payload
MITRE ATT&CK techniques:
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Second technique: FIN6 also leveraged the creation of Windows services (named with a random 16-character string such as IXiCDtPbtGWnrAGQ) to execute encoded PowerShell commands. The randomly named service is a by-product of using Metasploit, which creates the 16-character service by default. The encoded command contained a Metasploit reverse HTTP shellcode payload stored in a byte-array like the first technique. This C2 URL contained shellcode that would make an HTTPS request for an additional download
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: PowerShell Cobalt Strike Beacon - New payload + new C2 domain - PowerShell Obfuscator - All the new PowerShell payloads are obfuscated using a publicly available script adapted from a Daniel Bohannon’s GitHub project. Using this tool, the attackers could overcome a password reset. Customized Windows Credentials Dumper - A PowerShell password dumper that is based on a known password dumping tool, using PowerShell bypass and reflective loading. The attackers specifically used it to obtain Outlook passwords. Customized Outlook Credentials Dumper - Inspired by known Outlook credentials dumpers
MITRE ATT&CK techniques:
- T1552.002: Unsecured Credentials - Credentials in Registry
Threat description: During the first C&amp;C call, the backdoor sends a pack with the victim’s system information. All further information sent to the C&amp;C is encrypted with a public key framework, making decryption impossible. The commands from the C&amp;C are encrypted in a simpler manner and can be decrypted if intercepted because the secret key is hardcoded in the malware
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1012: Query Registry