Monitor for newly constructed network connections associated with pings/scans that may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for lateral movement [DS0029].


Monitor for newly executed processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession [DS0009]. System Network Configuration Discovery: Internet Connection Discovery T1016.001 The actors’ malware tests for internet connectivity by pinging 8.8.8.8. Mitigation: Monitor executed commands, arguments [DS0017] and executed processes (e.g., tracert or ping)

AA22320A Iranian GovernmentSponsored APT Actors Compromise Federal Network Deploy Crypto Miner Credential Harvester


[DS0009] that may check for internet connectivity on compromised systems.


Lateral Movement Technique Title ID Use Recommendations Remote Services:


Remote Desktop Protocol T1021.001 The actors used RDP to move laterally to multiple hosts on the network.


Mitigation: Use MFA for remote logins [M1032].


Mitigation: Disable the RDP service if it is unnecessary [M1042].


Mitigation: Do not leave RDP accessible from the internet.


Enable firewall rules to block RDP traffic between network security zones within a network [M1030].


Mitigation: Consider removing the local Administrators group from the list of groups allowed to log in through RDP


Monitor for user accounts logged into systems associated with RDP (ex: Windows EID 4624 Logon Type 10).


Other factors, such as access patterns (ex: multiple systems over a relatively short period of time) and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP [DS0028]. Command and Control Technique Title ID Use Recommendations Proxy T1090 The actors used Ngrok to proxy RDP connections and to perform command and control.


Mitigation: Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists


[M1037]. Detection:


Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g., extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure)


[DS0029]. Ingress Tool Transfer T1105


The actors downloaded malware and multiple tools to the network, including PsExec, Mimikatz, and Ngrok.


INCIDENT RESPONSE If suspected initial access or compromise is detected based on IOCs or TTPs in this CSA, CISA encourages organizations to assume lateral movement by threat actors and investigate connected systems and the DC.


CISA recommends organizations apply the following steps before applying any mitigations, including patching.


Immediately isolate affected systems.


Collect and review relevant logs, data, and artifacts.


Take a memory capture of the device(s) and a forensic image capture for detailed analysis.


Consider soliciting support from a third-party incident response organization that can provide subject matter expertise to ensure the actor is eradicated from the network and to avoid residual issues that could enable follow-on exploitation.


Report incidents to CISA via CISA’s 24/7 Operations Center (report@cisa.gov or 888-282-0870) or your local FBI field office, or


FBI’s 24/7 Cyber Watch (CyWatch) at (855) 292-3937 or by e-mail at CyWatch@fbi.gov. MitigationsCISA and FBI recommend implementing the mitigations below and in Table 1 to improve your organization's cybersecurity posture on the basis of threat actor behaviors.


Install updated builds to ensure affected VMware Horizon and UAG systems are updated to the latest version.


If updates or workarounds were not promptly applied following VMware’s release of updates for Log4Shell in December 2021, treat those VMware Horizon systems as compromised.


Follow the pro-active incident response procedures outlined above prior to applying updates.


If no compromise is detected, apply these updates as soon as possible.


See VMware Security Advisory VMSA-2021-0028.13 and VMware Knowledge Base (KB) 87073 to determine which VMware Horizon components are vulnerable.


Note: Until the update is fully implemented, consider removing vulnerable components from the internet to limit the scope of traffic.


While installing the updates, ensure network perimeter access controls are as restrictive as possible.


If upgrading is not immediately feasible, see KB87073 and KB87092 for vendor-provided temporary workarounds.


Implement temporary solutions using an account with administrative privileges.


Note that these temporary solutions should not be treated as permanent fixes; vulnerable components should be upgraded to the latest build as soon as possible.


Prior to implementing any temporary solution, ensure appropriate backups have been completed.


Verify successful implementation of mitigations by executing the vendor supplied script without parameters to ensure that no vulnerabilities remain.


See KB87073 for details.


Keep all software up to date and prioritize patching known exploited vulnerabilities (KEVs).


Minimize the internet-facing attack surface by hosting essential services on a segregated DMZ, ensuring strict network perimeter access controls, and not hosting internet-facing services that are not essential to business operations.


Where possible, implement regularly updated web application firewalls (WAF) in front of public-facing services.


WAFs can protect against web-based exploitation using signatures and heuristics that are likely to block or alert on malicious traffic.


Use best practices for identity and access management (IAM) by implementing phishing resistant multifactor authentication (MFA), enforcing use of strong passwords, regularly auditing administrator accounts and permissions, and limiting user access through the principle of least privilege.


Disable inactive accounts uniformly across the AD, MFA systems, etc.


If using Windows 10 version 1607 or Windows Server 2016 or later, monitor or disable Windows , also known as the Default System Managed Account (DSMA).


Audit domain controllers to log successful Kerberos Ticket Granting Service (TGS) requests and ensure the events are monitored for anomalous activity.


Secure accounts.


Enforce the principle of least privilege.


Administrator accounts should have the minimum permission necessary to complete their tasks.


Ensure there are unique and distinct administrative accounts for each set of administrative tasks.


Create non-privileged accounts for privileged users and ensure they use the non-privileged accounts for all non-privileged access (e.g., web browsing, email access).


Create a deny list of known compromised credentials and prevent users from using known-compromised passwords.


Secure credentials by restricting where accounts and credentials can be used and by using local device credential protection features.


Use virtualizing solutions on modern hardware and software to ensure credentials are securely stored.


Ensure storage of clear text passwords in LSASS memory is disabled.


Note: For Windows 8, this is enabled by default.


For more information see Microsoft Security Advisory Update to Improve Credentials Protection and Management. Consider disabling or limiting NTLM and WDigest Authentication.


Implement Credential Guard for Windows 10 and Server 2016 (refer to Microsoft: Manage Windows Defender Credential Guard for more information).


For Windows Server 2012R2, enable Protected Process Light for Local Security Authority (LSA).


Minimize the AD attack surface to reduce malicious ticket-granting activity.


Malicious activity such as “Kerberoasting” takes advantage of Kerberos’ TGS and can be used to obtain hashed credentials that threat actors attempt to crack.


VALIDATE SECURITY CONTROLS


In addition to applying mitigations, CISA and FBI recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK for Enterprise framework in this advisory.


CISA and FBI recommend testing your existing security controls inventory to assess how they perform against the ATT&CK techniques described in this advisory.


To get started: Select an ATT&CK technique described in this advisory (see table 1).


Align your security technologies against the technique.


Test your technologies against the technique.


Analyze your detection and prevention technologies performance.


Repeat the process for all security technologies to obtain a set of comprehensive performance data.


Tune your security program, including people, processes, and technologies, based on the data generated by this process.


CISA and FBI recommend continually testing your security program, at scale, in a production environment to ensure optimal performance against the MITRE ATT&CK techniques identified in this advisory.


References [1] MITRE ATT&CK Version 11: Software – Ngrok Revisions Initial Version: November 16, 2022


This product is provided subject to this Notification and this Privacy & Use policy.


By SOCRadar Research Security concerns grow day by day with the rise of cyberattacks.


Among the threats, cyber espionage is one of the prominent activities.


It can be used to get a hold of sensitive or classified data that may be intellectual property, government, or trade secrets.


The threat actors’ goals might be financial gain, reputational harm, political interests, or cyberwarfare.


Today, we’ll review a high-profile cyber espionage group MuddyWater.


Who is MuddyWater? Stuxnet was a big hit on Iran’s nuclear program in 2010.


Iran took that as a wake-up call and began investing in and improving its cyberwarfare capabilities.


In 2011, Iranian threat actors began to be involved in sophisticated attacks.


One area they focused on is cyber espionage campaigns.


The first major campaign was observed in 2012, called the Madi campaign.


Operation categories of MuddyWater MuddyWater, also known as Static Kitten, UNC3313, or MERCURY, is an Iranian state-sponsored APT group.


According to the FBI and other US and UK-based agencies, they operate as a subordinate element of the Iranian Ministry of Intelligence and Security (MOIS).


It is believed that they have been active since late 2017 and have been in close contact with MOIS since 2018.


MuddyWater was observed to be conducting malicious activities across Europe, Asia, Africa, and North America.


However, their main focus primarily resides on the middle east, per other Iranian threat actors.


They are targeting private and government organizations listed below: Defense Education Energy Financial Services Government and administration agencies Healthcare High-Tech International Organizations Media Countries affected by MuddyWater


They are primarily conducting cyber espionage activities and intellectual property (IP) theft attacks, but on some occasions, they have deployed ransomware on the targets.


However, it is believed they deployed ransomware to cover their tracks.


How does MuddyWater Attack?


MuddyWater’s arsenal is vast.


The group exploits various known vulnerabilities and uses a wide range of tools.


For initial access, the group commonly leverages spear-phishing and tries to trick the victims into opening malicious documents hosted in commercial file-sharing services.


After obtaining initial access, they usually drop web shell and gain local administrator access on the infected machine.


On the compromised machine, they use tools such as Mimikatz to dump credentials.


To broaden the compromise, they laterally move by leveraging in-built or deployed tools within the network.


MuddyWater generally uses DNS to communicate with their C2 servers while using tools such as PowerShell, vpnui[.]exe (a unique version of Ligolo), and remote monitoring software such as ScreenConnect, Remote Utilities, and eHorus.


The figure below shows an instance of the MuddyWater attack chain observed by Microsoft.


MuddyWater attack chain (Source: Microsoft)


Which Tools and Vulnerabilities MuddyWater Use? PowGoop DLL Loader: PowGoop malware is a malicious DLL loader.


It disguises itself as a legitimate Google Update executable.


Small Sieve:


Small Sieve is a simple Python backdoor used to distribute Nullsoft Scriptable Install System (NSIS) installer.


Canopy: Canopy is a spyware.


It collects the victim’s username, computer name, and IP address and sends it to the MuddyWater group.


Canopy malware is also known as Starwhale malware.


Mori: Mori is a backdoor that uses Domain Name System tunneling to communicate with the group’s C2 infrastructure.


POWERSTATS:


POWERSTATS is a backdoor that runs PowerShell scripts to maintain persistent access on the victim systems.


MuddyWater-associated tools & vulnerabilities provided by SOCRadar Who Did MuddyWater Target in Their Campaigns? MuddyWater campaign timeline MuddyWater’s targets are mostly the neighbors of Iran in the middle east region.


If we analyze the graphic below, we can see that Turkey, Israel, Iraq, UAE, and Pakistan are among the top targets of MuddyWater.


Observations may show that MuddyWater acts according to the political interests of the Iranian state through the connection of MOIS.


So, countries in which Iran has political interests should be aware of MuddyWater’s cyber espionage campaigns.


Countries targeted by MuddyWater Motivations Behind MuddWater’s Attacks in the Last 2 Years


In September 2020, a series of agreements called the Abraham Accords were signed between Israel, United Arab Emirates, and Bahrain.


These countries signed these agreements intending to normalize diplomatic relations in the region.


The US brokered the agreements, a major diplomatic breakthrough in the Middle East.


The Abraham Accords can be an improvement in the region from a neutral point of view, but some may feel uneasy about these agreements.


In particular, Iran may have felt concerned about the Abraham Accords because they could lead to closer ties between Israel and other countries in the region, potentially undermining Iran’s influence.


With these developments in mind, we may deduce that the cyber-espionage activities carried out by MuddyWater between September 2020 and March 2021 were a reaction to these agreements.


MuddyWater, as far as known, primarily conducted campaigns in the middle east and its neighboring regions in late 2020 and early 2021.


September 2020 – Operation Quicksand – Israel: According to ClearSky, MuddyWater targeted many prominent Israeli organizations.


In this specific campaign, security researchers observed that the threat actor used a variant of Shamoon to encrypt data.


However, it is believed that the intent of using Shamoon was not to deploy ransomware but to disrupt operations.


Operation Quicksand (Source: SOCRadar) March 2021 – Earth Vetala Campaign:


According to Trend Micro, Azerbaijan, Bahrain, Israel, Saudi Arabia, and the United Arab Emirates were the targets of the campaign.


Government agencies, academia, and tourism were some of the targeted sectors.


Latest Attacks of the Threat Actor In January 2022, cybersecurity researchers reported that MuddyWater targeted Turkish private organizations and governmental agencies.


They used multiple malicious PDFs and MS Office documents during the campaign.


With the spear phishing technique, the threat actors tried to convince the victims that the documents were from the Turkish Health and Internal Affairs Ministries.


Malicious PDF used in Turkey campaign (Source: Cisco Talos)


In another incident on December 2022, Deep Instinct reported that MuddyWater, conducted malicious activities, again using spear phishing through emails.


Israeli insurance companies were the targets of the attacks.


As an evolving threat actor, they added a new tool for remote access, Syncro, to their arsenal.


Email from MuddyWater’s Israel attack (Source: Deep Instinct) Conclusion Observations of MuddyWater’s cyber espionage activities can lead to a conclusion that they act according to Iran’s political strategies through MOIS.


Whether it is because of the political implications, or another reason, Israel and Turkey seem to be significant targets for the MuddyWater.


If you are an organization residing in the middle east, there might be a possibility of being a target of MuddyWater.


What can you do to defend against them?


Excluding the technical mitigations, keeping up with the political climate of the middle east region might give a heads-up if the tension rises.


On the technical side, MuddyWater evolves with each attack they perform, but they still bear similar techniques.


You can apply the following recommendations per your needs.


Security Recommendations Against MuddyWater MuddyWater leverages spear phishing.


Provide necessary training to your employees for security awareness.


Gain visibility into external-facing digital assets with an Attack Surface Management solution.


Regularly apply security patches and software updates.


Apply the least privilege principle across the network, especially to critical systems and services Secure domain controllers (DC) using best practices.


Enable multifactor authentication (MFA) to prevent lateral movement.


Refer to IOCs and take necessary actions toward mitigation.


SOCRadar’s Attack Surface Management provides visibility into external-facing digital assets.


SOCRadar has a predictive, preventive, and proactive approach toward security at its core.


With SOCRadar’s Attack Surface Management, security teams can track which CVEs are present in the environment.


Knowing which CVEs are present in the organization can give the organization an advantage in defending against MuddyWater.


SOCRadar Attack Surface Management Most threat actors specializing in cyber espionage widely leverage spear phishing, just as MuddyWater does.


If you receive any suspicious email, you can use free SOC Tools on SOCRadar Labs to analyze it.


SOCRadar SOC Tools provided by SOCRadar Labs MITRE ATT&CK Techniques Techniques ID Reconnaissance Gather Victim Identity Information: Email Addresses T1589.002 Resource Development Acquire Infrastructure: Web Services T1583.006 Obtain Capabilities: Tool T1588.002 Initial Access Phishing:


Spearphishing Attachment T1566.001


Spearphishing Link T1566.002 Execution Windows Management Instrumentation T1047 Command and Scripting Interpreter:


PowerShell T1059.001 Command and Scripting Interpreter:


Windows Command Shell 1.059.003 Command and Scripting Interpreter:


Visual Basic T1059.005 Command and Scripting Interpreter: Python T1059.006 Command and Scripting Interpreter:


JavaScript T1059.007 Exploitation for Client Execution T1203 User Execution: Malicious Link T1204.001 User Execution: Malicious File T1204.002 Inter-Process Communication: Component Object Model T1559.001 Inter-Process Communication: Dynamic Data Exchange T1559.002 Persistence Scheduled Task/Job: Scheduled Task T1053.005 Office Application Startup: Office Template Macros T1137.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1547.001 Privilege Escalation Abuse Elevation Control Mechanism: Bypass User Account Control T1548.002 Credentials from Password Stores T1555 Credentials from Web Browsers T1555.003 Defense Evasion Obfuscated Files or Information T1027 Steganography T1027.003 Compile


After Delivery T1027.004 Masquerading: Match Legitimate Name or Location T1036.005 Deobfuscate/Decode Files or Information T1140 Signed Binary Proxy Execution: CMSTP T1218.003 Signed Binary Proxy Execution: Mshta T1218.005 Signed Binary Proxy Execution: Rundll32 T1218.011 Execution Guardrails T1480 Impair Defenses:


Disable or Modify Tools T1562.001 Credential Access OS Credential Dumping: LSASS Memory T1003.001 OS Credential Dumping: LSA Secrets T1003.004 OS Credential Dumping: Cached Domain Credentials T1003.005 Unsecured Credentials: Credentials In Files T1552.001 Discovery System Network Configuration Discovery T1016 System Owner/User Discovery T1033 System Network Connections Discovery T1049 Process Discovery T1057 System Information Discovery T1082 File and Directory Discovery T1083 Account Discovery: Domain Account T1087.002 Software Discovery T1518 Security Software Discovery T1518.001 Collection Screen Capture T1113 Archive Collected Data: Archive via Utility T1560.001 Command and Control Application Layer Protocol: Web Protocols T1071.001 Proxy: External Proxy T1090.002 Web Service:


Bidirectional Communication T1102.002 Multi-Stage Channels T1104 Ingress Tool Transfer T1105 Data Encoding: Standard Encoding T1132.001 Data Encoding: Non-Standard Encoding T1132.002 Remote Access Software T1219 Exfiltration Exfiltration Over C2 Channel T1041 Appendix: Appendix 1: IOCs of PowGoop goopdate[.]dll MD5: a27655d14b0aabec8db70ae08a623317 SHA-1: 7649c554e87f6ea21ba86bb26ea39521d5d18151 SHA-256: 2c92da2721466bfbdaff7fedd9f3e8334b688a88ee54d7cab491e1a9df41258f File type: Win32 DLL File size: 88.50 KB (90624 bytes) vcruntime140[.]dll MD5: cec48bcdedebc962ce45b63e201c0624 SHA-1: 81f46998c92427032378e5dead48bdfc9128b225 SHA-256: dd7ee54b12a55bcc67da4ceaed6e636b7bd30d4db6f6c594e9510e1e605ade92 File type: Win32 DLL File size: 91.50 KB (93696 bytes) IOCs 104.208.16[.]94:443 (TCP) 20.42.65[.]92:443 (TCP) 20.42.73[.]29:443 (TCP) libpcre2-8-0[.]dll MD5: 860f5c2345e8f5c268c9746337ade8b7 SHA-1: 6c55d3acdc2d8d331f0d13024f736bc28ef5a7e1 SHA-256: 9d50fcb2c4df4c502db0cac84bef96c2a36d33ef98c454165808ecace4dd2051 File type: Win32 DLL File size: 94.50 KB (96768 bytes) IOCs 20.189.173[.]20:443 (TCP) 20.189.173[.]21:443 (TCP) 20.42.73[.]29:443 (TCP) Appendix 2: IOCs of Small Sieve gram_app[.]exe MD5: 15fa3b32539d7453a9a85958b77d4c95 SHA-1: 11d594f3b3cf8525682f6214acb7b7782056d282 SHA-256: b75208393fa17c0bcbc1a07857686b8c0d7e0471d00a167a07fd0d52e1fc9054 File type: Win32 EXE File size: 16.21 MB (16999598 bytes) IOCs 13.107.4[.]50:80 (TCP) 149.154[.]167.220:443 (TCP) 192.168.0[.]15:137 (UDP) 23.216.147[.]64:443 (TCP) 23.216.147[.]76:443 (TCP) a83f:8110:0:0:1400:1400:2800[:]3800:53 (UDP)


index[.]exe MD5: 5763530f25ed0ec08fb26a30c04009f1 SHA-1: 2a6ddf89a8366a262b56a251b00aafaed5321992 SHA-256: bf090cf7078414c9e157da7002ca727f06053b39fa4e377f9a0050f2af37d3a2 File type: Win32 EXE File size: 16.46 MB (17263089 bytes) IOCs 13.107.4[.]50:80 (TCP) 192.168.0[.]1:137 (UDP) 192.168.0[.]25:137 (UDP) 20.99.132[.]105:443 (TCP) 209.197.3[.]8:80 (TCP) 23.216.147[.]64:443 (TCP) a83f:8110:0:0:7f00:0:0[:]0:53 (UDP) a83f:8110:492a:


d801:d1df:1328:492a[:]d801:53 (UDP) a83f:8110:5067:d801:beac:bf78:cce1[:]d301:53 (UDP) Appendix 3: IOCs of Canopy Cooperation terms[.]xls MD5: b0ab12a5a4c232c902cdeba421872c37 SHA-1: a8e7659942cc19f422678181ee23297efa55fa09 SHA-256: 026868713d60e6790f41dc7046deb4e6795825faa903113d2f22b644f0d21141 File type: MS Excel Spreadsheet File size: 247.00 KB (252928 bytes) IOCs 88.119.170[.]124:80 (TCP) ZaibCb15Ak[.]xls MD5: 6cef87a6ffb254bfeb61372d24e1970a SHA-1: e21d95b648944ad2287c6bc01fcc12b05530e455 SHA-256: 4b2862a1665a62706f88304406b071a5c9a6b3093daadc073e174ac6d493f26c File type: MS Excel Spreadsheet File size: 249.00 KB (254976 bytes) IOCs 5.199.133[.]149:80 (TCP) Appendix 4:IOCs of Mori FML[.]dll MD5: 0431445d6d6e5802c207c8bc6a6402ea SHA-1: 3765c1ad8a1d936aad88255aef5d6d4ce24f94e8 SHA-256: 3098dd53da40947a82e59265a47059e69b2925bc49c679e6555d102d1c6cbbc8 File type: Win32 DLL File size: 200.65 MB (210397496 bytes)


Appendix 5:IOCs of POWERSTATS LisfonService[.]exe MD5: f5dee1f9cd47dc7bae468da9732c862e SHA-1: 5273ee897e67fc01ee5fef08c37400cb4ee15958 SHA-256: 6f8226d890350943a9ef4cc81598e0e953d8ba9746694c0b7e3d99e418701b39 File type: Win32 EXE File size: 119.00 KB (121856 bytes) TestService[.]exe MD5: e75443a5e825f69c75380b6dc76c6b50 SHA-1: 142b5753c608c65e702e41b52abdeb96cb2f9294 SHA-256: c514c3f293f0cb4c23662a5ab962b158cb97580b03a22b82e21fa3b26d64809c File type: Win32 EXE File size: 92.50 KB (94720 bytes) IOCs 13.107.4.50:80 (TCP) a83f:8110:e0:ffff:e0:ffff:e0[:]ffff:53 (UDP) The post Dark Web Profile: MuddyWater APT Group appeared first on SOCRadar:registered: Cyber Intelligence Inc..


The cryptocurrency market is now worth more than $2.5 trillion.

Babadeda Crypter targeting crypto NFT and DeFi communities


Unfortunately, this fact is not lost on threat actors.


As well as using cryptocurrency themselves to extract ransoms, cybercriminals are now also tailoring malware to exploit the booming market for NFTs and crypto games.


In a discovery of critical importance to anyone familiar with this space, Morphisec Labs has encountered a new campaign of malware targeting cryptocurrency enthusiasts through Discord.


Crucially, the crypter that this campaign deploys, which we have termed Babadeda (a Russian language placeholder used by the crypter itself which translates to “Grandma-Grandpa”), is able to bypass signature-based antivirus solutions.


Although some variants of this crypter have been noted by other vendors, Morphisec is the first to fully disclose how it works.


For victims, this makes infections highly likely — and dangerous.


We know that this malware installer has been used in a variety of recent campaigns to deliver information stealers, RATs, and even LockBit ransomware.


Fortunately, however, even as the threat level for cryptocurrency users rises, we also know that Morphisec’s Moving Target Defense technology is capable of both seeing and stopping Babadeda.


In this blog post, we will explore how Babadeda is being delivered, what an in-depth technical analysis of this malware tells us about it, and how it can be stopped.


Crypto and NFT Communities Are Prime Targets Since May 2021, we have observed several malware distribution campaigns.


However, many of the recent infections we have seen appear to be related to a sophisticated campaign that exclusively targets the Crypto, NFT, and DeFi communities.


It is precisely for this reason, as well as the fact that NFTs are rising in popularity, that we have decided to take a look at this particular campaign distribution in more detail.


For those who are not familiar with NFTs (Non-fungible token): the term refers to unique tokens that provide proof of ownership on data that is stored on the blockchain technology.


In recent years, NFTs have exploded in popularity, and are now starting to enter the mainstream consciousness.


Naturally, this growing trend in the crypto space has opened up a new vector for threat actors to exploit.


The DElivery Chain The vast majority of today's NFT and crypto communities are based on Discord (a group chatting platform) channels.


Discord channels are publicly accessible and allow users to send private messages to one another within a channel.


In the campaign that we observed, a threat actor took advantage of these features in order to phish victims.


The threat actor sent users a private message inviting them to download a related application that would supposedly grant the user access to new features and/or additional benefits.


Because the actor created a Discord bot account on the official company discord channel, they were able to successfully impersonate the channel’s official account.


Below is an example of a phishing message that targeted users of “Mines of Dalarna”, a PC game built on the blockchain.


Figure 1: Fake message on the discord channel.


If a user clicks on the URL within the message, it will direct them to a decoy site.


There, the user will be encouraged to download a malicious installer that embeds the Crypter with the payload.


Figure 2: Original and decoy sites comparison As you can see from the example above, the threat actor took extended measures to ensure that the delivery chain looks legitimate even to technical users.


Typically: Cybersquatting - the domain names of the decoy sites look a lot like the domain names of the original sites Threat actors will usually remove/add a letter from/to the domain name or change the top-level domain.


The domains are signed with a certificate (via LetsEncrypt), which enables an HTTPS connection.


The UI of the decoy pages is very similar to the UI of the original pages.


Upon clicking “Download APP”, the site will generally navigate to /downland.php, which will redirect the download request to a different domain (this makes it less likely that someone will detect a decoy site).


Interestingly, on one of these decoy sites, we noticed an HTML object written in Russian.


This suggests that the threat actor's origins may be in a Russian-speaking country since they most likely forgot to translate the HTML object from their native language into English Figure 3: Lost in translation?


Decoy site examples The following table shows a few examples of the decoy sites used in the campaigns we have observed.


Original Domain Decoy Domain Description IP Resolved Installer Name opensea.io openseea[.]netopenseaio[.]net The most popular NFT marketplace 185.117.2[.]82 OpenSea-App_v2.1-setup.exe larvalabs.com larvaslab[.]comlarva-labs[.]net The creators of CryptoPunks - The most popular PFP NFTs 185.117.2[.]81185.117.2[.]8245.142.182[.]160 LarvaLabs-App_v2.1.1-setup.exe boredapeyachtclub.com boredpeyachtclub[.]com BAYC - one of the most popular PFP NFTs 185.117.2[.]4 185.212.130[.]64 BAYC-App-v2.1-release.exe We have identified at least 82 domains created between July 24, 2021, and November 17, 2021, with the following registration time distribution (credit to @msuiche).


The Payloads The following table tracks the RATs used by this specific campaign’s threat actor


: Dates Observed RAT C2 11 Nov 2021 - 22 Nov 2021 Remcos 65.21.127.164[:]4449 14 Oct 2021 - 22 Oct 2021 BitRAT 135.181.6.215[:]7777 09 Sep 2021 - 14 Oct 2021 BitRAT 135.181.140.153[:]7777 24 Aug 2021 - 07 Sep 2021 BitRAT 135.181.140.182[:]7777 Technical Analysis of the Babadeda Crypter Figure 4: Execution flow diagram During our research, we found different variants of the same Crypter — all of which contain the same main execution flow (denoted by the figure above).


While investigating the Crypter, we saw how important it was for the threat actor to hide its malicious intentions inside legitimate applications in order to avoid detection.


The following figure emphasizes the complexity of the evasive techniques that are implemented in the Crypter. Figure 5: Low detection rate on VT The Installer Once downloaded and executed, the malicious installer copies its compressed files into a newly created folder with a legitimate-looking name (i.e., IIS Application Health Monitor) in one of the following directory paths: C:\Users\<user>\AppData\Roaming\C:\Users\<user>\AppData\Local\ The malicious files are copied along with many other open-source or free application-related files.


At first glance, the files within the directory may seem legitimate.


However, looking at these files carefully it becomes apparent that some of them are suspicious and should be inspected, as shown by the figure below.


Figure 6: The compressed files (malware files selected with stage numbers) Crypter Execution After dropping the mentioned files, the Installer starts execution via the main executable (number 1 in the figure above).


We have noticed that at this point, some variants display a fake error message that stops the execution until the user interacts with the message.


This fake message might be used as a security solutions evasion technique.


Alternatively, its role may be to deceive the user into thinking that the application has failed to execute, even as it silently continues the malicious execution in the background.


Figure 7: Fake error message By analyzing the two different variants, we can see the implementation of this message box: Figure 8: Comparison between variants As we can see in the figure below, the function’s code is much longer compared to the actual DLL loading code.


That’s because the actor has implanted its actions within a legitimate application code in order to confuse analysts, obfuscate its real intentions, and make it harder for antivirus solutions to detect.


Figure 9: Left - the full function.


Right - the DLL loading code The Shellcode's Loader DLL


The threat actor generally embeds the next stages of the execution inside an additional file, usually an XML or a PDF file.


Nonetheless, we have also observed additional file types such as JavaScript, Text, and PNG.


Here, just like before, the actor embeds the malicious code inside different legitimate codes.


We have extracted the relevant sections to clearly demonstrate the malware’s activity: Figure 10: Exported function logic The malicious logic starts by reading the additional file (in this case an XML file) and calling kernel32!Sleep for 35 seconds (the duration changes between variants).


Next, it loads this entire file to memory and starts its parsing task.


The first piece that is parsed from the file is a shellcode located in a pre-calculated offset (in this case, 0x88D8C and overwrites the executable at offset 0x1600).


Figure 11: The shellcode bytes inside the XML file The executable .text section’s characteristics are configured to RWE (Read-Write-Execute) -- that way the actor doesn't need to use VirtualAlloc or VirtualProtect in order to copy the shellcode and transfer the execution.


This helps with evasion since those functions are highly monitored by security solutions.


Once the shellcode is copied to the executable, the DLL calls to the shellcode’s entry point (shellcode_address).


Persistency Implementation If the crypter is configured to install persistence, the loader DLL will execute a new thread that loads another DLL (from the compressed files) that will handle this task. Figure 12: New thread creation for calling the persistent mechanism The newly loaded DLL will either use one of the following logics or both of them to implement the persistency: Write a.lnk file in the startup folder that executes the Crypter’s main executable.


Figure 13: .lnk file persistence implementation Write a registry Run key that executes the Crypter’s main executable.


Figure 14: registry run key persistence implementation The Decryption Shellcode The XML file (or any other file type used by the crypter) contains the following components: The first shellcode (referred to in this section).


An encrypted additional shellcode (referred to in the next section, the Loader shellcode) An encrypted payload.


The Decryption shellcode has three main tasks: first, it extracts the Loader shellcode and the payload, then it decrypts them, and finally, it transfers the execution to the decrypted Loader shellcode.


Figure 15: Decryption shellcode execution flow The Decryption shellcode begins with dynamically locating the configuration structure by searching for a sequence of six or more identical bytes.


This configuration holds pointers to the loader shellcode and the final payload; these are encrypted and split inside the XML. Figure 16: Configuration and XML file’s structures Based on this, we can identify the configuration inside the XML file: Figure 17: Configuration structure Using this configuration the malware iterates over each chunk copies it, and decrypts it using the denoted decryption key (the configuration changes between samples).


Then, the shellcode searches for two DWORD placeholders, 0xBABADEDA and 0xDEADBEAF.


It replaces the first placeholder with the address of the decrypted payload and the latter with the size of the payload.


This data is used in the next stage, the Loader shellcode.


The Loader Shellcode The purpose of the Loader shellcode is to inject the decrypted payload within the currently running process (itself).


We can divide the loading mechanism into three stages: initialization, injection, and correction.


Initialization This stage is responsible for setting the relevant data that will be used during the injection and correction stages.


Figure 18: Extracting the data for injection and correction stages To start initializing, the Loader first saves the decrypted payload address and payload size according to the placeholder’s addresses.


Next, it parses the PE headers of the payload to extract the image size and the entry point according to the current executable’s base address.


The Loader parses the _PEB structure in order to find the base address of the current executable and the LDR_DATA_TABLE_ENTRY which will be used later.


Finally, it dynamically loads the VirtualProtect function using a pre-calculated hash value (0xF1C25B45 in our case).


Injection This stage is pretty straightforward.


Within it, the Loader overwrites the current PE with the final payload’s PE.


It does so by copying the PE headers and each section according to the current executable’s base address.


Figure 19: Change headers protection and clear memory bytes for the new PE Once previous bytes have been cleared, the Loader copies the new PE headers to the base address and each section to the relevant location according to the IMAGE_SECTION_HEADER.


Correction The final stage is responsible for fixing the import address table and relocation table of the newly injected PE.


Figure 20: Fix tables and remove altering evidence mw_construct_IAT Load GetModuleHandleA, LoadLibraryA and GetProcAddress functions by hash (0x9FE4FCE1, 0x85557334 and 0xF23B576D respectively).


Iterate over the IAT of the new PE.


Load each function and update its address.


mw_construct_RELOC Calculate the delta between the previous image base and the current one.


Iterate over each entry in the relocation table.


Add the delta to the entry value.


In addition to fixing the import address and relocation tables, the Loader removes evidence of injection by using the following methods: Update the LDR data table entry to match the injected PE.


Remove the injected PE headers from memory.


These steps attempt to evade memory scanners that seek mismatching LDR data and in-memory PEs.


Finally, the malware jumps to the entry point of the newly injected PE with the original command-line arguments.


Conclusion As demonstrated above, Babadeda is a highly dangerous crypter.


Targeting cryptocurrency users through trusted attack vectors gives its distributors a fast-growing selection of potential victims.


Once on a victim's machine, masquerading as a known application with a complex obfuscation also means that anyone relying on signature-based malware effectively has no way of knowing Babadeda is on their machine — or of stopping it from executing.


Mitigating the threat posed by Babadeda requires securing the device memory it targets.


Morphisec does this through Moving Target Defence, a technology that morphs process memory trapping crypters like Babadeda before they are able to deploy.


IOCs The sample used in the blog post: File SHA256 Installer 99e6b46a1eba6fd60b9568622a2a27b4ae1ac02e55ab8b13709f38455345aaff difserver.exe 358211210e0bb34dd77073bb0de64bb80723f3434594caf1a95d0ed164ee87a1 libfont-0.6.dll ce3758d494132e7bef7ea87bb8379bb9f4b0c82768d65881139e1ec1838f236c libxml3.dll 0ceead2afcdee2a35dfa14e2054806231325dd291f9aa714af44a0495b677efc menu.xml 080340cb4ced8a16cad2131dc2ac89e1516d0ebe5507d91b3e8fb341bfcfe7d8 YARA Rule rule BABADEDA_Crypter { meta: description = "Detects BABADEDA Crypter" author = "Morphisec labs" reference = "https://blog.morphisec.com/the-babadeda-crypter-targeting-crypto-nft--defi-communities" strings: $entry_shellcode = {55 8B EC 83 EC 58 53 E8 F8 03 00 00 89 45 FC 8B 45 FC 83 C0 11 89 45 CC 8B 45 FC 8B 40 09 8B 4D CC 8D 04} $placeholder_1 = {8138DADEBABA} $placeholder_2 = {8138AFBEADDE} condition: $entry_shellcode and all of ($placeholder_*) } Decoy Domains aave-v3[.]comabracodabra[.]netalchemixfi[.]comapeswaps[.]netapp.sushi-v3[.]comarbitrums[.]comartblocks[.]usastar-network[.]comavalanche-network[.]comavax-bridge[.]comavax-bridge[.]netavax-network[.]netavax.wallet-bridge[.]netavax.wallet-network[.]netavax.wallet-network[.]orgbabydogescoin[.]comboredpeyachtclub[.]combridge-avax[.]combridge-avax[.]netbridge-avax[.]usc-nft[.]netcasper-network[.]comcompoundfinance[.]netcryptoblade[.]netdecentralands[.]netdiviprojects[.]comdydxexchange[.]netgalagamesapp[.]comhedera[.]runilluviums[.]comkeep-network[.]netklimadao[.]netlarva-labs[.]netlarvaslab[.]comlooprings[.]netluckybuddhaluckyclub[.]commangomarkets[.]netmineofdalarnia[.]netmonstasinfinite[.]netmoonebeam[.]comnear-protocol[.]comnetwork-avax[.]netnetwork-avax[.]orgnft-opensee[.]comolympusdao[.]fundopenseaio[.]netopenseea[.]netoptinism[.]netpolkadot-network[.]comprojectseeds[.]netprojectsserum[.]netrareble[.]netrocketspool[.]netsecretswaps[.]netsia-tech[.]netsolanarts[.]comsolsoulnft[.]comsushi-app[.]comsushi-v3[.]comsushi-v3app[.]comterra-money[.]netthetatokenfund[.]comwallet-avalanche[.]comwallet-avalanche[.]netwallet-avalanche[.]orgwallet-avax[.]comwallet-avax[.]infowallet-avax[.]netwallet-bridge[.]netwallet-network[.]netwallet-network[.]orgwa let.bridge-avax[.]uswallet.network-avax[.]orgwonderlaned[.]comzed-run[.]net Hashes 0098b2c38a69132bfde02d329d6c1c6e2b529d32d7b775a2ac78a369c0d108530115ba0f26a7b7ca3748699f782538fa761f7be4845a9dc56a679acea7b76cd3062f019515bff366fcbf49cca3f776c21e2beb81c043a45eea81044a9391fd97112282b873bdbeb5614fc8658934a99d666ba06c4e2840a21cd4458b426a4cad120213353ac7bd835086e081fb85dfa4959f11d20466fd05789ded3bff30bb111252c9103805e02324d2aecb5219e6a071c77b72477eba961621cb09a2138972140d9a4a2ec5507edf7db37dcc58f2176a0e704e8f91c28a60a7f3773e85e1aa14da3566bc9f211528c1824330c46789396447c83c3c830bb91490d873025df818c01e1f6e0185752dbf8c9352d74ade56ac40d25ae701d4a5954b74d0c7aeea196ec622eb7d9420b1c04b3856467abeb3ca565d841f34c3c9a628afc10775c8214d6681f5d82d4fa43e7a8676935ef01ddab8d0847eb3018530aedffe7ebb552e5455e268cf12ebc0213aa5dacb2239358c316dda3ec0f99d0f36074f41fb092fc8dedf82997894bb31a0eca96ae3c589863ec9bf4d1e2af0a84f2e9c3ef3013270599801099d3b5399eb898f79d7b7ec0d728c71d5177244b8110757365ade39b4dc69dd29011135732a881152f99dc19310cb906b7255a3e9ef367258094d3c844e66f0dafdced0861a8e2ff54fd762ba170bf5082fb2c38cdbbac5a7fecb3e52c251dc8683e0f374bcbea27b4b700c05dc39db13336859acbbd32590fe7c3e6a29c04270a4b62375946fdb4c392a1c9b3f64ef391f85bdd67cb78426889f44e00bef4b6d3f03a845208b925c129a5fe1b9ef6ed8cd27144c5e94176aaa6e462f7543326630d209b6433936f0c54f8920d6b5505e88d802ee060320ea81064e6eed44594054ea42f9860c1e53744649a319788e2cb7f1f624e435cbdec43d54391ff27b632a36430889dda51cfa46b694badcae2f0ce952065642c94d89df6342d9c9e087945651b11cec4903f083a20d31182e0be5b2b6030df0a980ff6865363debbbb9a691838e823c34807a9770db30c2af616c5574231af2b16d6aef6e4d56a438062210ba8ca68dee690c1692960ff36936c96586f74ee194e1c8216f247a74aa62fea0577da869fda841170ce6f1fe0e1b9f3b0d8172d336bb7dc671d0c5b5916cc5f91370f42fbfd249795e7c40526ae204becdd20fe453b53e8d72df0397893e1ac981063fbcc0ad048543ba7143ba824f2bb0aa5dfb61538ce67c8242812137aad072fe1cb78d49d01187b869d43ebcfcd87eb590c1bc9f12467e827e1981d2ccaec16a5b646976b0d492d555a20b9ba5dd4ba0d605dfcab2f786b1cf4e6952db195842809ffd7e88e5fdaca8b2b2c0005e995d34cbe9d157ad8b9120fc400510de52fb5c6689f403e5c0aaba3ff58e2ee114286c2cf09615b58ce8c448b5958da3c59874594de428b783116d8c1cf440ab804633799d88af8e90faf9b85d96a09cb689be3a52669a58df2e9ea53b150a97d05de641e624f63495d226710f37a870a338344afac6350b48c5d70c7ac8518c42f694eb0f6aa7c59b132e1d883c4f513d4ac3a5735a28a1917cfde837ee4a4b632a66cce5aa8be2a2545370b390e52376d12776152aff9285b9b3fe6610d2f8dd24b11ccb14c5b3a2e090192bf0b3b00f5bbef0b81858bc17861fedd82e93f0ab6d60777ca6820eaf0c213a2cfb62e6a9ce788c3860c627e035401b75df7f60eb64d4f4bc196aa2b5fe6db30b741f515df94238c8d1a3c51a84fe72f218751c86a254801c3233eeb6dc8341fd38dacb7a2a38a14a21afbab8e7e3f31f2fd29f0bcd7d4eb83e203cbcaaab0cd2178acdf025c7f23f10ab01906a99aca5d07e3a7e261928f8f91695c21e2be7324afb67f1e5cf9fbc95dc346db2ec62d9d8db7b0da9377a00346f41c97893d936b5e1203fb926e7ab612ffd488578e9791f07be4a6eabc83645fb5bca70f7b046f5909f0134a1c465fda3794344f45055ba2dfa802623bd326fe5b6d360daf106314561e9ec57075dd4f544ad52680678a644e186758650a405b765d548c2e3479c6c7a20ffa8a8402aa00c45aaef24102daf5c94c54a8a6013f370d76e7a14ab20d3f28de1ecef803d8b1629ed077495db5ec7b7f5828ed33c684ede644e637da7cd117517b1bb96ee0f58131515013a322366d680f613afa31bc4e5f55a5ecd7315c9e028738ced66d42852569dd061e15610a054c2121c9ed4d9e99d32952bda84f32425681229ec544849156e479b7247e3e480f3a23a39c915f24492ceab91f70c3dd3c5040184dae3bc38804c872ae948ed1ee6906a890b16fb04bc486bf7b6574b5b7caf1ed4f1a21e9e7463adf312219f767a58e8fb2be1fde7bd78e2085f364e0eb145c77b57b8bfa5bacf6a3e6eaed4b9e3a97c065a80fde8ca7c729a25e723a3738a1b5520f29ef2100ba2d9a2739aa30176b039f511 Crypter hashes amadey stealer 4d02224a7dadfc2d8a1343fdc51e4634a98bd073f867bfd091e667efd112108a384292cad1c05552ccbd691de48865ce75375f7e601db66b3f5cad0f8f294d6c5dd0e9ef811c199a06758d65b66d051d3b0057971b021df0928ede727fe17371e312af68203fd80a2dd86a69460941ce29709424310abffd66fd7323a2b8ef6e Cryptbot 83aa33a24f0751cae8342045071638739981304b37fc036da342f15ccebaf482c69fd2882bcda2ae6b24235babcc570f31774a45698edbaaea70e1b9d9fd315e58fba0f609b5363b1fbb792e0b2def924b770b2f57329f383cf691ef5988055e1a31f5a7bc1c5782ab9e7a401a2a474ee75e571adfa1f7685c13258653e8af7d2dc6785721bc9369090ce77d47b6b85eb4c9fba88d4c29675b5c98195c653f3c89d3acf2cfd33516f0aaaf901226c1c8936c33ded480115cbb56b4d11fc0d4053f3f0c883ada23e33685a015dbd59a08668fa80bf3248b4fbc3b00dac1fb430566b5d71b2ae6f7569b050130ccb548785925d4ff14ccfd5fa9738e8b444cbd97d2fc2159debd0a2222673cdc028c5f88ca5cc6c72f5665d60c5d27806757cff28e113203dd97f0f33562db9086b0eadeb5ea1242738abd80ae872ac3552a259958b3a4ec25d09191c9f5cb064a4ac4ea35a51cf1dd5e26e5d5bc63662c49c2ce3fdd54336ae1400d16fd36013844953d8cbfa2982516f3d40ed2a18f58f826092b7425ae37127535adf331bdba2e4b126dc7a67890f2974fa95624b06b3ff248a49d63a099d6499875e6b46268054b63d582303c7eac93a65ff00537ab22f487d69e8d0678be5a8da741058f0ae2a6f99ffb8e3326ac50fda54336b23a546fc6e51597f0749cbb7b8b53795383f891158ab7a5af350d803f8bba787ba1d3af87240e6edb33f1d5578084bd8422792770d3bafea1581b58e45eb6f89a889f41bddd5f6a8a3f255be6e5b8c7402be7059298bcfea15931752e10ea0be59ad080633b0cf91645b6ac772fc518bd5d145db4e7750af4e8239cc46734350ddf4595bd85c2e909efb713bdb2fb402dd380ada3bcc5ff92776ab95cafaeda7e47ea6dc494f8745d09bc73fa393b77c944bb7230fc68235fd5049c32c31612eb31747224fe828cf68e77f09d903d17e4318e585ca5753b5cc1a8e7fdb081244ee6e2946436cba5140248916ece6706fee52c892e7284b8c1dde007b273cf8adf1e2565ae979a0dd895e91925b1664d6e475f5046c1b0243a9999b6d15c96480437ddf93165a1fe7f19a41fbf7ac6196d5e54900558c948603a86de7e49201295562937237c34b54d3dd6d4b36587667cb52201ca8412ec23e0a6d062cceddb703104d0c9ca00f9b232a297b1896a96c01b4835cafa0b050d62b6b891b74d6c799e6e6d263f6c89a650f439f01b2435425946f5b5eab475da42ee04088fd552bc59644613fd274f7faace98d5660ea1a13dd74cade60626bf10cc5e4a66c0c76d8e018ad8496e1715c87a07b92d9214810bcd3fc6880b88b93246e94ad9421f34340766606ff84a220c1f0d6c078de2bc9961dcda11ea21eabebc86576798f5d1a0548e113d59fa24db23fb548796b2632a3c94ea6be2c2a64236b470bcbcb5bfc6e1d9158a217e632ef9f099bae955699c9eb497c6227a642486f64c903a336fdd0f3ac503b9c509e7ff704be0431c541a3571360b52edac361b3d9ce627b4e93c53be17bbe8ee94ed612d25d1378980dbe529ad018f1a2ed0521c0621f81ae54bc2d516c885a22bdd7d046c4a616e639cc91dc94cabb972108bdc2d9540fcbe393241d11ef9df7881ad13c6865aa6161390df6580eb648c3c05a35db706c7b5d7a238f56009bf01b6ede3fd35ef88aee476c1cb77ed32c54fd467b2d6173b59af8510c2d90f581c543cba58332c5c67e2a464387142e72bb9d6960bcc9dd52ef2a948f4db9b014740b96a6b7e277cf456a19260533dadf8b36652d05e374b098c93f63cdf7f07f9b0c6ff27b0011f3a6daa5ca4b73f554b6a1ed319dce05919c3c4e18cdc5ffac866a06926359e00872ce7cc7b85d2ddf09abdc3371ac101be4e7ed46e98110cbc2802dc27b9d9fe5ba5ceeece06cf3ed93974dfeb1ce26f2b5c43e23c75837a43d3df5f8ec3117279edcfc255c69be9aaf2eed9d0d3cc98bf3b06ae01ae0cd5b88a754affa47410a0fa9d9b38582c21b8e06c32273206fa15551efdb3beb4c0c6486545826c2ec5fa5ba44d02abeb20558e55f47c51366523cacdde2750f424ee3a86842df558da44cc247fd7bd4d1d7bf5439b8732883aa840a9fceb0bf886695f19c711bd63d145518301270e247830259eb29c83bd0ee135f53ee7aa2e234a48e1f19d8dfd1885aa7ea0c73b1d22faee0f3b208dc65762e6ba374d49caac5d027dadb4db266ac999842ed7ea10b245750f8b31af738b4bfdcc5ade464f8fc360e64cdf07c837d5911f93b60cb99ee0ff531ffb0422652c7d6124d60ef94ff905ef764a4aab4cc90d657dd681b434e13df35c01c6473ee3813dd34e64b451280c906afb57198e787eaa18780abd3932bc7cf3742a5e58ccb1ccf204 lockbit 778eb09cac51aa75b6e3c32e78adfe0e9292af40d0f800fb3ae569198945a9ef5b9e6d9275e9523aa3945be891745442a07b936ee5236e23934250ba3844f65f17c6f4e45d44bd4c06212139f521976b87ed5a6ddcd0e4e5e978e64dabb3883f237bc833db8c72cedf0a09bd642567aa31cc74dd6bcfe5b67871f375d617ec85446736e381fa8942f8d32cb4f2ae8fb6a9245fa0e70b7f7298ee7a5cb6fe9f32668434940877f747a5d3adc745548bcfdcc881418f02e705204df2ad54a311cb74b4d14d2d1af6642d5867eb89c277aa02f5e4ac667d87b5aca380f40eabe1bfc920b2de025019e9a406e9b2f0ac2cbbfc18d65eac15f59ca8921c5fb4bfa240d25116f1fe5c9a22fcf73c4c7358f93f1ad445bb9a602d18ff69f8fa29d0be0fe80579baf175626787070bf61f75b4b810eb9d9bdb653972ad40797ee5ff82cc1ee311c3f24397de3f6671b67a263206e78f8040f5ac2fc0182d0ee171c532284b3a396f8230fc87b7fc47aa1d7ed19c78867f3dd43fd570ea93748390be58d5 ursnif 04595c3111276f02b6dc2ece0778cb5829c086484aeafa24e0aac3d8479deb4be2c83783d6ab57ac91d99bfb9d607d0b5537e305661406bbf2347c3af92d3464676a540a91b9ffb4a18af0f4355561f3579ee4cbbf0740a80e482af92e8cdc07716ce7fe411f352686b4071074aa96e1456ab7a67445b3cf1c475e18a4e5ac25ceba6a7f9a2c25a35090470c6209aefed808786c47194a18415a7898390c20cbe203345d8120bd6d29e667bbceb92083ebb55e36b21cd22d669aa2f91830a656 smokeloader 79ae89733257378139cf3bdce3a30802818ca1a12bb2343e0b9d0f51f8af1f101ae5c809ea8fabce9c699c87416d73ba5ab619accef6deeb26c2c38f39323181ee8f0ff6b0ee6072a30d45c135228108d4c032807810006ec77f2bf72856e04a fickerstealer bd8d1264a88d5cdd701a4ee909b70beaec39d216c988b33bfb30f25aee3540ee1f53d6f4fb02c8663b9d377570953d07c56df297674b7c3847d1697f0e5f8165cf88923b7d0287884870af999a8d64f90c7deeb4c4d09feed406472ff259b30d Metasploit Reverse HTTP b8990f204ca595e23562aa8063fd163651771626ba4acf45890f25315616fc1e quasarrat e8a8581cd3594a3937762f90d20ab889e7868bb88e9249f96222bd48643d7dea


This post is also available in: 日本語 (Japanese)Executive Summary BlackCat (aka ALPHV) is a ransomware family that surfaced in mid-November 2021 and quickly gained notoriety for its sophistication and innovation.


Operating a ransomware-as-a-service (RaaS) business model, BlackCat was observed soliciting for affiliates in known cybercrime forums, offering to allow affiliates to leverage the ransomware and keep 80-90% of the ransom payment.


The remainder would be paid to the BlackCat author.


BlackCat has taken an aggressive approach to naming and shaming victims, listing more than a dozen on their leak site in a little over a month.


The largest number of the group’s victims so far are U.S. organizations, but BlackCat and its affiliates have also attacked organizations in Europe, the Philippines and other locations.


Victims include organizations in the following sectors: construction and engineering, retail, transportation, commercial services, insurance, machinery, professional services, telecommunication, auto components and pharmaceuticals.


Use of BlackCat ransomware has grown quickly for a variety of reasons (for comparison, AvosLocker had only listed a handful of victims publicly within two months of becoming known).


Effective marketing to affiliates is a likely factor – in addition to offering an enticing share of ransom payments, the group has solicited affiliates by posting ads on forums such as Ransomware Anonymous Market Place (RAMP).


The malware itself is written in Russian and coded in the Rust programming language.


Though this is not the first piece of malware to use Rust, it is one of the first, if not the first, piece of ransomware to use it.


By leveraging this programming language, the malware authors are able to easily compile it against various operating system architectures.


Given its numerous native options, Rust is highly customizable, which facilitates the ability to pivot and individualize attacks.


The threat actors leveraging BlackCat, often referred to as the "BlackCat gang,” utilize numerous tactics that are becoming increasingly commonplace in the ransomware space.


Notably, they use multiple extortion techniques in some cases, including the siphoning of victim data before ransomware deployment, threats to release data if the ransom is not paid and distributed denial-of-service (DDoS) attacks.


Palo Alto Networks detects and prevents BlackCat ransomware with the following products and services: Cortex XDR and Next-Generation Firewalls (including cloud-delivered security subscriptions such as WildFire).


Due to the surge of this malicious activity, we’ve created this threat assessment for overall awareness.


Full visualization of the techniques observed, relevant courses of action and IOCs can be viewed in the Unit 42 ATOM viewer.


Table of Contents BlackCat Ransomware OverviewTechnical Details • BlackCat Config • Associated ToolsPost-compromise ActivitiesCourses of ActionConclusionAdditional ResourcesAcknowledgments BlackCat Ransomware Overview Soliciting via known cybercrime forums, BlackCat is seeking affiliates to deploy its ransomware.


Affiliates keep an 80-90% share of the ransom payment, with the remainder going to the BlackCat author.


These affiliates are interviewed and vetted before being accepted into the RaaS group.


Once the affiliate is confirmed, they are given unique access to a Tor-based control panel that hosts the affiliate’s access.


Written in the Russian language, the control panel gives the affiliate updates and announcements about deploying and operating the ransomware as well as troubleshooting tips to help the affiliate be more successful in their campaigns.


Along with the control panel, a name and shame blog is also hosted, targeting victims who have either ignored or refused to pay the ransom.


This site has been regularly updated with new victims since the initial discovery of the group.


As shown in Figure 1 below, many RaaS operators use the double-extortion technique of exfiltrating data prior to encryption, which provides them greater leverage in negotiating ransom funds.


As of December 2021, BlackCat has the seventh largest number of victims listed on their leak site among ransomware groups tracked by Unit 42 – impressive considering that this group has only been publicly known since November 2021.


While Conti (ranked second) has been around in various guises for almost two years, it is surrounded at the top of the chart by emerging families.


LockBit 2.0 and Hive both have at least six months’ head start on BlackCat, but this highlights a worrying trend that newcomers (or reformed groups) can attack many victims in a short space of time. Figure 1.


Leak site/name and shame blog statistics, December 2021.Using the leak site information, we can understand the location and types of victims affected by BlackCat attacks.


Figure 2 breaks down the victims by country.


However, the so-far sporadic spread of the attacks may indicate a somewhat opportunistic approach, as with most contemporary ransomware families.


BlackCat leak site victims by country.


Technical Details BlackCat is positioned to pivot to individualized, customized attacks due to the numerous options available when coding in Rust (Figure 3).


Rust programming has gained momentum due to its fast and high performance, powerful web application development, low overhead for embedded programming, and memory management resolution.


Rust also facilitates the BlackCat author due to its efficiency regarding algorithms that power the encryption capability of the ransomware.


Because of its efficiency and adaptability, BlackCat has been seen targeting both Windows and Linux systems.


BlackCat execution options.


In an effort to maintain longevity, the use of the --access-token flag is required to execute the ransomware, which can make it harder to analyze in sandboxed environments.


BlackCat Config While analyzing the ransomware configurations, we observed numerous evasion tactics deployed.


These evasion techniques are used in an effort to impair or disable system defenses as well as to stop certain applications that may lock files open on disk, causing problems when trying to encrypt them.


BlackCat attempts to kill several processes and services to hinder or prevent security solutions and backups.


The process list checked is as follows: agntsvc, dbeng50, dbsnmp, encsvc, excel, firefox, infopath, isqlplussvc, msaccess, mspub, mydesktopqos, mydesktopservice, notepad, ocautoupds, ocomm, ocssd, onenote, oracle, outlook, powerpnt, sqbcoreservice, sql, steam, synctime, tbirdconfig, thebat, thunderbird, visio, winword, wordpad, xfssvccon, *sql*, bedbh, vxmon, benetns, bengien, pvlsvr, beserver, raw_agent_svc, vsnapvss, CagService, QBIDPService, QBDBMgrN, QBCFMonitorService, SAP, TeamViewer_Service, TeamViewer, tv_w32, tv_x64, CVMountd, cvd, cvfwd, CVODS, saphostexec, saposcol, sapstartsrv, avagent, avscc, DellSystemDetect, EnterpriseClient, VeeamNFSSvc, VeeamTransportSvc, VeeamDeploymentSvc


The services running on the compromised system are checked against the following list: mepocs, memtas, veeam, svc$, backup, sql, vss, msexchange, sql$, mysql, mysql$, sophos, MSExchange, MSExchange$, WSBExchange, PDVFSService, BackupExecVSSProvider, BackupExecAgentAccelerator, BackupExecAgentBrowser, BackupExecDiveciMediaService, BackupExecJobEngine, BackupExecManagementService, BackupExecRPCService, GxBlr, GxVss, GxClMgrS, GxCVD, GxCIMgr, GXMMM, GxVssHWProv, GxFWD, SAPService, SAP, SAP$, SAPD$, SAPHostControl, SAPHostExec, QBCFMonitorService, QBDBMgrN, QBIDPService, AcronisAgent, VeeamNFSSvc, VeeamDeploymentService, VeeamTransportSvc, MVArmor, MVarmor64, VSNAPVSS, AcrSch2Svc In an effort to maintain persistence, the BlackCat ransomware excludes key system and application folders – as well as key components – from encryption so as not to render the system and ransomware inoperative.


The folders excluded are as follows: system volume information, intel, $windows.~ws, application data, $recycle.bin, mozilla, $windows.~bt, public, msocache, windows, default, all users, tor browser, programdata, boot, config.msi, google, perflogs, appdata, windows.old Excluded file names are as follows: desktop.ini, autorun.inf, ntldr, bootsect.bak, thumbs.db, boot.ini, ntuser.dat, iconcache.db, bootfont.bin, ntuser.ini, ntuser.dat.log Any file with an extension matching the following list will also be avoided: themepack, nls, diagpkg, msi, lnk, exe, cab, scr, bat, drv, rtp, msp, prf, msc, ico, key, ocx, diagcab, diagcfg, pdb, wpx, hlp, icns, rom, dll, msstyles, mod, ps1, ics, hta, bin, cmd, ani, 386, lock, cur, idx, sys, com, deskthemepack, shs, ldf, theme, mpa, nomedia, spl, cpl, adv, icl, msu Hardcoded credentials stored within the BlackCat ransomware config lend credence to the likelihood that specific victims are being targeted.


The credentials also allow BlackCat to move laterally within the victim’s system and/or network, often with administrative privileges.


Credential access permits the ransomware to deploy additional tools that further propagate the attack.


These observations have also been confirmed by Symantec.


Associated Tools BlackCat has been observed using multiple – often legitimate – tools throughout their attacks, such as Mimikatz, LaZagne and WebBrowserPassView to recover stored passwords, as well as GO Simple Tunnel (GOST) and MEGAsync to exfiltrate data.


Additionally, anti-forensics tools like fileshredder, an application to securely delete unwanted files beyond recovery, have also been leveraged during some BlackCat ransomware attacks investigated by Unit 42.


Post-compromise Activities Once candidate systems have been identified for encryption by the threat actors, the ransomware deployment occurs and all viable files will be encrypted.


This process often involves renaming files to include another or a different file extension, such as wpzlbji, in the example shown in Figure 4.


As is commonplace with other ransomware strains, BlackCat ransomware will drop ransom notes on the compromised system(s) to inform the victim of what has happened and how to go about getting their data restored.


Text files with the name RECOVER-[RANDOM]-FILES.txt (where [RANDOM] refers to the aforementioned file extension name) will be found on the compromised system containing information and instructions such as those in the example below: Figure 4.


An example of a BlackCat ransom note dropped on a compromised system.


BlackCat utilizes a unique onion domain with a victim-specific access key for the victim to use to learn more about the attack, their data, and what the threat actors want the victim to do next.


The following example URL highlights the notation used by BlackCat ransomware: http://2cuqgeerjdba2rhdiviezodpu3lc4qz2sjf4qin6f7std2evleqlzjid[.]onion/?access-key=${ACCESS_KEY}","note_short_text":"Important Once the victim navigates to the onion site provided, they will see something similar to Figure 5 below.


This site reiterates the problem and that the actor's Decrypt App private key is the only way to get their data back.


The portal also provides chat facilities, the ransom amounts – which can differ depending on when the payment is sent – how to pay, and a way to test that the decryption works.


Example onion site information for BlackCat victims.


Unit 42 has observed BlackCat affiliates asking for ransom amounts of up to $14 million, though they offered to discount this demand to $9 million if paid before the established time.


Interestingly, the ransom demand gives the victim the option to pay not only in Bitcoin (the most common option) but also in Monero.


In some cases, BlackCat operators use the chat to threaten the victim, claiming they will perform a DDoS attack on the victims' infrastructure if the ransom is not paid.


When it appears in addition to the use of a leak site, this practice is known as triple extortion, a tactic that was observed being used by groups like Avaddon and Suncrypt in the past.


One unique feature of BlackCat ransomware is that negotiation chats can only be accessed by those holding an access token key or ransom note – the group has made efforts to avoid third-party snooping.


Courses of Action This section documents the relevant tactics, techniques and procedures (TTPs) used by BlackCat ransomware and operators, mapping them directly to the Palo Alto Networks product(s) and service(s) protecting against them.


It also further instructs customers on how to ensure their devices are appropriately configured.


Product / Service Course of Action Discovery


The below courses of action mitigate the following techniques: Process Discovery [T1057], File and Directory Discovery [T1083] CORTEX XDR PREVENT Configure Behavioral Threat Protection under the Malware Security Profile Lateral Movement


The below courses of action mitigate the following techniques: Lateral Tool Transfer [T1570] THREAT PREVENTION† Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3' Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories and threats Ensure a secure antivirus profile is applied to all relevant security policies Command and Control


The below courses of action mitigate the following techniques: Multi-hop


Proxy [T1090.003] THREAT PREVENTION† Ensure passive DNS monitoring is set to enabled on all anti-spyware profiles in use Ensure an anti-spyware profile is configured to block on all spyware severity levels, categories and threats Ensure a secure anti-spyware profile is applied to all security policies permitting traffic to the internet Ensure that antivirus profiles are set to block on all decoders except 'imap' and 'pop3' Ensure DNS sinkholing is configured on all anti-spyware profiles in use Ensure a secure antivirus profile is applied to all relevant security policies ADVANCED URL FILTERING†


Ensure that URL Filtering uses the action of “block” or “override” on the URL categories Ensure secure URL filtering is enabled for all security policies allowing traffic to the internet


Ensure that Advanced URL Filtering is used Ensure that access to every URL is logged Ensure all HTTP Header Logging options are enabled CORTEX XSOAR Deploy XSOAR Playbook - PAN-OS Query Logs for Indicators Deploy XSOAR Playbook - Palo Alto Networks - Hunting And Threat Detection NEXT-GENERATION FIREWALLS Ensure 'SSL Forward Proxy Policy' for traffic destined to the internet is configured Ensure 'SSL Inbound Inspection' is required for all untrusted traffic destined for servers using SSL or TLS Ensure application security policies exist when allowing traffic from an untrusted zone to a more trusted zone Ensure 'Service setting of ANY' in a security policy allowing traffic does not exist Ensure 'Security Policy' denying any/all traffic to/from IP addresses on Trusted Threat Intelligence Sources exists Ensure that the Certificate used for Decryption is Trusted Exfiltration


The below courses of action mitigate the following techniques: Exfiltration to Cloud Storage


[T1567.002] URL FILTERING† Ensure secure URL filtering is enabled for all security policies allowing traffic to the internet Ensure all HTTP Header Logging options are enabled Ensure that URL Filtering uses the action of ‘block’ or ‘override’ on the URL categories Ensure that access to every URL is logged Ensure that Advanced URL Filtering is used Impact The below courses of action mitigate the following techniques: Data Encrypted for Impact [T1486], Service Stop [T1489],


Deploy XSOAR Playbook - Palo Alto Networks Endpoint Malware Investigation Table 1.


Courses of Action for BlackCat ransomware.†These capabilities are part of the NGFW security subscriptions service Conclusion BlackCat is an innovative and sophisticated ransomware family that is rapidly forming a reputation for its highly customized and individualized attacks.


By leveraging the Rust programming language, the malware authors are able to easily compile it against various operating system architectures, which facilitates the group’s ability to pivot from one victim to the next.


As seen with other ransomware families, BlackCat operates with a RaaS model and utilizes multiple extortion techniques, then publishes a leak site to further pressure victims into paying the ransom.


Palo Alto Networks detects and prevents BlackCat ransomware in the following ways: WildFire: All known samples are identified as malware.


Cortex XDR with: Indicators for BlackCat.


Anti-Ransomware Module to detect BlackCat encryption behaviors on Windows.


Local Analysis detection for BlackCat binaries on Windows.


BTP rule prevents Ransomware activity on Linux.


DNS Signatures detect the known command and control (C2) domains, which are also categorized as malware in URL Filtering. Indicators of compromise and BlackCat-associated TTPs can be found in the BlackCat ATOM.


If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call North America Toll-Free: 866.486.4842 (866.4.UNIT42), EMEA: +31.20.299.3130, APAC: +65.6983.8730, or Japan: +81.50.1790.0200. Palo Alto Networks has shared our findings, including file samples and indicators of compromise, in this report with our fellow Cyber Threat Alliance (CTA) members.


Additional Resources Acknowledgements We would like to thank Simon Conant for his help with sample collection, and malware and infrastructure analysis.


Get updates from Palo Alto Networks!


Defending Users’ NAS Devices From Evolving Threats In our latest research, we analyze the threats targeting well-known brands of network-attached storage (NAS) devices.

Defending Users NAS Devices From Evolving Threats


By: Stephen Hilt, Fernando Merces January 20, 2022Read time: ( words) Save to Folio Subscribe Threats to the internet of things (IoT) continue to evolve as users and businesses grow increasingly reliant on these tools for constant connectivity, access to information and data, and workflow continuity.


Cybercriminals have taken notice of this dependence and now regularly update their known tools and routines to include network-attached storage (NAS) devices to their list of targets, knowing full well that users rely on these devices for storing and backing up files in both modern homes and businesses.


More importantly, cybercriminals are aware that these tools hold valuable information and have only minimal security measures.


In our latest research paper, “Backing Your Backup: Defending NAS Devices Against Evolving Threats,” we studied the current infrastructure, environment, threats, and recommendations for defending systems against current threats targeting NAS devices.


To emphasize the importance of mitigating the risks of malware infection and targeted attacks on NAS devices, we analyzed the technical details of two malware families that potentially included NAS devices in their existing business models, the REvil ransomware and StealthWorker botnets.


REvil


While the disappearance of REvil (aka Sodinokibi) in mid-2021 is filled with uncertainty, security researchers have found a Linux version of the REvil ransomware that they have dubbed as Revix.


After analyzing the samples, we found four different versions of the malware, all of which rely on an embedded JavaScript Observed Notation (JSON)-based configuration to set parameters before encrypting files.


Revix’s JSON-based configuration While some parameters are ignored by the ransomware, these are most important ones that we observed: pk: A 64-byte key nbody: The ransomware note text-encoded in base64 nname: The ransomware note name ext: The extension added to encrypted files After compromising the system, the malicious actors execute it manually on a NAS device to encrypt files and create a ransom note with a unique key per victim.


Revix encrypting a QNAP NAS device Figure 3.


Revix ransom note While the differences between the versions are minor, the group advertised the capability of encrypting NAS devices as early as May 2021 in underground forums.


Given the vulnerability of NAS devices that are directly connected to the internet, we can expect a new wave of ransomware attacks affecting these gadgets in the future.


StealthWorker In 2021, security researchers found brute-force attacks launched from the StealthWorker botnet on Synology NAS devices.


We found multiple samples for this botnet and confirmed that newer versions are capable of brute-forcing and compromising servers running on several products and systems such as WooCommerce and WordPress.


This botnet is also designed to generally attack any web server using HTTP authentication and other NAS devices like QNAP.


Valid credentials found during compromise are then uploaded to the command-and-control (C&C) server, usually at port 5028/TCP. Figure 4.


StealthWorker brute-force function targeting QNAP devices Figure 5.


Infected Linux device connected to a C&C server How to protect NAS devices Without proper security implemented in NAS devices, users and businesses will continue to be targeted since these tools can be used as entry points for information theft, malware infection, and the disruption of operations, among others.


Here are some best practices to protect your systems against threats that leverage the gaps in your NAS devices: Avoid connecting a NAS device directly to the internet.


Regularly change the credentials for accessing an NAS device.


Never use the preset default credentials that come with the device as these are well-known to malicious actors.


Enable two-factor authentication (2FA) for additional security.


Regularly check NAS manufacturers’ online security guides, such as Synology’s recommended best practices and QNAP’s recently released suggestions on how to help defend their devices against additional exposure on the internet.


To find more technical details, threats, insights, and recommendations in protecting your NAS device, download our research “Backing Your Backup: Defending NAS Devices Against Evolving Threats.” Authors Stephen Hilt Sr. Threat Researcher Fernando Merces Sr. Threat Researcher


This blog was made possible through contributions from Christopher Caridi.

ExConti and FIN7 Actors Collaborate with New Domino Backdoor


IBM Security X-Force recently discovered a new malware family we have called “Domino,” which we assess was created by developers associated with the cybercriminal group that X-Force tracks as ITG14, also known as FIN7.


Former members of the Trickbot/Conti syndicate which X-Force tracks as ITG23 have been using Domino since at least late February 2023 to deliver either the Project Nemesis information stealer or more capable backdoors such as Cobalt Strike.


Background This discovery highlights the intricate nature of cooperation among cybercriminal groups and their members: Since late February 2023, Domino Backdoor campaigns have been observed using the Dave Loader, which we have linked to the Trickbot/Conti syndicate and its former members.


Domino’s code shows overlap with the Lizar (aka Tirion, Diceloader) malware family, leading us to suspect that it was created by current or former ITG14 developers.


One of Domino’s final payloads is the Project Nemesis infostealer.


Project Nemesis was first advertised on the dark web in December 2021, though has been rarely used since then.


Analysis Ex-Conti Members Deploy Domino in Recent Campaigns Former members of ITG23 (aka the Trickbot/Conti syndicate) are likely behind recent campaigns using the Dave Loader to load Domino Backdoor and probably collaborated with current or former ITG14 developers to purchase or use the new malware family.


X-Force previously assessed that Dave is one of several loaders or crypters developed by members of the Trickbot/Conti group.


Although the group has fractured, many of its loaders/crypters — including Dave — have been maintained and continue to be used by factions composed of former Trickbot/Conti members, including Quantum, Royal, BlackBasta, and Zeon.


The Dave Loader has been used recently with several Cobalt Strike samples with the watermark “206546002,” which X-Force and other security researchers — here and here — have associated with groups composed of former members of the Trickbot/Conti syndicate, including Quantum and Royal.


X-Force observed Dave-loaded Cobalt Strike samples using this watermark in suspected Royal attacks in fall 2022.


Dave Loader has also been used this year to load IcedID and Emotet, both of which serve as initial access vectors for ransomware attacks from former Trickbot/Conti-affiliated factions.


Recently observed Dave samples were discovered loading a new malware, which we have named Domino Backdoor.


This new backdoor gathers basic system information, which it then sends to the C2, and in return receives an AES encrypted payload.


In most instances, the received payload was a second loader that was found to have code overlap with Domino Backdoor, and as such we have dubbed it Domino Loader.


This loader contains an encrypted payload within its resources, which it decrypts using AES.


The decrypted payload is a .NET infostealer, which identifies itself as ‘Nemesis Project.’


The Domino Backdoor is designed to contact a different C2 address for domain-joined systems, suggesting a more capable backdoor, such as Cobalt Strike, will be downloaded on higher value targets instead of Project Nemesis.


Domino’s Connections to ITG14 Analysis revealed that both the Domino Backdoor and Loader share code overlap with the Lizar Malware, also known as Tirion and DiceLoader, which is attributed to the threat group ITG14 (FIN7).


In addition to having similar coding styles and functionality, both Domino and DiceLoader share the same configuration structure and have similar bot ID formats.


Lizar was reportedly first used in March 2020, when it was originally named Tirion, and has been observed in numerous ITG14 campaigns up to the end of 2022.


Domino has been active in the wild since at least October 2022, which notably is when Lizar observations began to decrease.


X-Force researchers found additional evidence connecting Domino Backdoor to ITG14’s Carbanak Backdoor.


We identified Domino Backdoor samples from December 2022, which used a different loader that we have dubbed NewWorldOrder Loader.


The samples used the name ThunderboltService.exe and downloaded and loaded the Project Nemesis Stealer.


Around the same time, we also uncovered NewWorldOrder Loader samples, with the same filename ThunderboltService.exe, used to load the Carbanak Backdoor.


Carbanak has been used by ITG14 since late 2015.


Finally, X-Force analysts also observed that two of the Domino Backdoor C2 addresses belonging to MivoCloud: 94.158.247[.]72 and 185.225.17[.]202 are very close to C2 addresses ITG14 has used previously for SSH-based Backdoors such as 94.158.247[.]23 and 185.225.17[.]220.


While such overlap is insufficient for attribution, it is nonetheless consistent with other evidence linking Domino to an ITG14 developer and may indicate the latter’s preference for MivoCloud for at least some of their C2 addresses.


MivoCloud has also been used to host Diceloader and Carbanak C2 servers.


Collaboration between members of ITG14 and former members of ITG23 is not without precedent.


Other researchers — here and here — observed ITG14 attacks using Ryuk ransomware in 2020, which has been attributed to the Trickbot/Conti cybercrime syndicate, while others have also identified connections between a FIN7 developer and tools used by the BlackBasta group, whose members also have ties to the former Trickbot/Conti syndicate.


Project Nemesis The Project Nemesis infostealer has been active in the wild since December 2021, when it was offered for sale on several Dark Web forums.


It can collect data from a range of web browsers, as well as applications including Steam, Telegram, Discord, crypto wallets, and VPN providers.


Domino has been used to install Project Nemesis since at least October 2022 — prior to its use in late February 2023 by ex-Conti actors.


This leads us to assess that the ITG14 members responsible for developing Domino probably had a relationship with Project Nemesis and offered Domino and the infostealer to the ex-Conti threat actors as a package.


The ex-Conti members in turn likely used the Project Nemesis infostealer against lower value targets.


The use of infostealers by former Trickbot/Conti members and their distributors is not without precedent — other security researchers observed the Vidar infostealer delivered during DEV-0569 Batloader campaigns that also led in some cases to Cobalt Strike and Royal ransomware.


We assess that infostealers may often be deployed during lower priority infections, e.g., on personal computers or those not belonging to an Active Directory domain, while higher priority infections receive other backdoors such as Cobalt Strike.


Malware Deep Dive This section contains a deeper look at the Dave Loader, Domino Backdoor, Domino Loader, and Project Nemesis Infostealer malware.


Dave Loader The sample analysed for the purpose of this report is a 64-bit executable with MD5 hash 2CC79806701F1A6E877C29B93F06F1BB and a reported compile date of 28 February 2023.


This sample is identified as a variant of Dave Loader, a crypter linked to threat group ITG23 and more commonly observed with payloads such as Emotet.


This sample has two encrypted resources within a resource directory named “XKLKLCRTE.”


Dave Loader loads the resources using the API calls LdrFindResource_U and LdrAccessResource, and decrypts them using XOR and the key mh8ZqMlTsaDYBZe7ma\x00.


The smaller payload, with resource ID 3412, is a shellcode blob that contains code designed to load a PE file.


The second payload, with resource ID 6732, is a PE file.


Dave Loader executes the decrypted shellcode and passes the PE payload to it, which the shellcode then loads and executes.


Domino Backdoor The loaded payload is a 64-bit DLL written in Visual C++, with MD5 hash CDBE0FEB82B1CAF164C7DA42CB9A20BE.


The payload was found to be a hitherto unknown backdoor, which will be referred to as Domino Backdoor.


Upon execution, Domino Backdoor starts by generating a Bot ID for the infected system by gathering the username and hostname and creating a hash of the collected data, to which it then appends its current process id.


For example, a648628c13d928dc-4480.


This bot ID format is similar to that generated by Lizar, which also used a checksum of system information, combined with the process ID.


However, Lizar used a CRC algorithm to create its hash, whereas Domino uses a custom algorithm which XOR’s multiple values together.


Interestingly, Lizar used a similar XOR-based algorithm as part of its encryption mechanisms during communication with the C2. Fig 1 — Domino Backdoor system ID generation The malware then proceeds to decrypt its configuration block, which is stored in the data section of the binary.


The config is decrypted using XOR and a 16-byte key which is stored immediately before the encrypted config block.


In this case the key is {03 9B 54 72 17 D3 5E E6 E0 E9 EF E0 DF 36 0D 79}.


Fig 2 — Domino Backdoor config decryption In the analysed sample the decrypted config contains two pipe-delimited IP addresses, 88.119.175[.]124 and 94.158.247[.]72.


This is the same format used by Lizar to store its configuration. 00000000 38 38 2e 31 31 39 2e 31 37 35 2e 31 32 34 7c 39 |88.119.175.124|9| 00000010 34 2e 31 35 38 2e 32 34 37 2e 37 32 00 6e ee 99 |4.158.247.72.nî.| 00000020 37 b1 2d 84 e5 8d 6a 70 21 3e d5 21 2c c1 37 b5 |7±-.å.jp!>Õ!,Á7µ| 00000030 1f b7 09 f3 9b 0a c7 fe 53 32 23 6a 8c b0 4e 22 |.·.ó..ÇþS2#j.°N”| Scroll to view full table


A second config block, which is decrypted separately, contains an RSA public key.


The malware generates a random 32-byte key, which it encrypts using the RSA key.


It then attempts to connect to the C2 via TCP port 443 and send the encrypted key.


Prior to the C2 connection, the malware checks whether the host system is connected to a domain.


If the system is detected as being domain joined, then the malware uses the second IP address from the config to connect to the C2, otherwise, it defaults to the first.


If the initial connection is successful, the malware then proceeds to gather basic system information, including username, computer name, and OS version, which it then encrypts using AES-256-CBC and the generated, shared key (null bytes used for IV).


An example of the unencrypted data structure, which the malware sends to the C2, can be seen below. 00000000 39 00 00 00 0b 15 61 36 34 38 36 32 38 63 31 33 |9…..


a648628c13| 00000010 64 39 32 38 64 63 2d 34 34 38 30 03 01 0a 00 00 |d928dc-4480…..| 00000020 00


5a 29 00 00 0c 32 39 46 65 58 73 6b 64 70 4c |.Z)…29FeXskdpL| 00000030 59 67 0a 76 6e 50 78 53 46 65 6f 4e 4e |Yg.vnPxSFeoNN| Scroll to view full table


This structure breaks down as follows: Offset Size (bytes) Contents Description 0x0 4 0x00000039 Size of structure 0x4 1 0x0B Hardcoded value 0xB (11) 0x5 1 0x15 Size of system id string 0x6 21 a648628c13d928dc-4480 System ID string 0x1B 1 0x03 Value indicating presence of domain string 0x1C 1 0x01 Unknown 0x1D 1 0x0A OS Major version (10) 0x1E 1 0x00 OS Minor version 0x1F


2 0x0000 Unknown 0x21 4 0x5a290000 OS Build Number (0x295A = 10586) 0x25 1 0x0C Size of computer name string 0x26 12 29FeXskdpL Computer Name 0x32 1 0x0A Size of username string 0x33 10 vnPxSFeoNN Username Scroll to view full table


The malware first sends 4 bytes to the C2 that contain a XOR-encrypted value, which is the size of the data to follow, and then sends the AES-encrypted system data.


The malware then begins a loop of checking in with the C2 by first sending a 4-byte encrypted size, followed by a 16-byte AES-encrypted block, which decrypts to the following 5 bytes {01 00 00 00 ff}.


It continues this every second until it receives a response from the C2.


When it receives a response, the malware expects the C2 to send 4 bytes containing the payload size, followed by the payload itself.


The malware then decrypts the received payload using AES and the shared key.


The decrypted data consists of a 4 byte size, followed by a single byte indicating either a command or the load method that the malware should use for the payload, followed by the payload data itself, if applicable.


If the command byte is 0x3, then the malware exits.


If the command byte is 0x7, then the malware enumerates the running processes on the system and compiles a list of process names and IDs.


This data is then encrypted using AES and returned to the C2.


Otherwise, the malware proceeds to load and execute the received payload using the method indicated by the load/command byte.


The following methods are supported:


0x1 — Copy the payload into allocated memory within the current process and create a new thread to execute an export named ReflectiveLoader within the payload DLL. 0x4 — Save the payload to the %Temp% directory with a filename generated via GetTempFileNameA, and execute the file using CreateProcessA. 0x5, 0x6 — Open process with process id provided with the downloaded data.


Allocate space within the process and write the payload data to the process memory.


Then create a new thread in the remote process to execute an export named ReflectiveLoader within the copied payload DLL.


This method is likely intended to be used following command 0x7.


In the case of the analysed sample, the received payload contained a DLL binary, and command 0x1 was specified.


Fig 3 — Domino Backdoor command structure Overlap with Lizar Toolkit Domino Backdoor shares a lot of overlap with malware associated with the Lizar Toolkit, which is attributed to threat group ITG14.


The Lizar Toolkit consists of a backdoor/loader, a collection of modules/plugins which can be executed by the loader, and C2 client and server applications.


A detailed report on the Lizar Toolkit can be found here.


In addition to having similar coding styles and utilising similar API calls, Domino Backdoor uses the same configuration structure as the Lizar Loader.


In both cases, a configuration block containing a pipe-delimited list of IP addresses is decrypted using XOR and a 16-byte key which is stored immediately before the encrypted config.


Both malware families also generate system IDs in very similar manners.


In the case of Domino Backdoor a hash is generated from the system username and hostname and the process ID is appended.


The hashing algorithm is custom and appears to be based on an encryption algorithm used previously in the Lizar Loader.


Lizar Loader also generates a system ID which consists of a hash of system data followed by the current process ID, however, it uses a CRC algorithm to create its hash.


Domino Backdoor also incorporates elements that appear in some of Lizar’s plugins.


For example, the system information gathered by Domino Backdoor and sent to the C2 matches the reported functionality of Lizar’s Info32/Info64.dll plugin.


Also, the function within Domino Backdoor to enumerate running processes and send a list of process names and IDs back to the C2 is very similar to the functionality of Lizar’s ListProcesses32/ListProcesses64.dll plugin.


Finally, Lizar’s Jumper32/Jumper64.dll plugin resembles the code within Domino Backdoor, which is able to load a payload using several different methods, with the required one specified using a command ID number.


Domino Loader The payload received by the Domino backdoor from the C2 during this analysis was a 64-bit DLL, written in C++, with MD5 hash 2373BE26018075847AEA51636B739F66 and an internal filename of MultiRunDll64.dll.


The payload was found to be a Loader with similarities to Domino Backdoor, and will be referred to as Domino Loader.


Domino Loader has one export named ReflectiveLoader that contains code taken from the well-known ReflectiveDLLInjection project.


When run, this code performs the steps needed to properly load the DLL into memory, and allows for DLL payloads to load themselves directly from memory into a host process.


Once loaded, Domino Loader starts by loading an encrypted payload from its resources and decrypting it using AES-256-CBC and a hardcoded key.


The Microsoft WinCrypt library is used for AES encryption and decryption by both Domino Backdoor and Loader.


The decrypted data consists of 4 bytes containing the payload size, followed by a further 4 bytes containing either the entry point offset for the payload or a value indicating the load method which should be used, followed by the payload itself.


If the entry point/load field contains a positive value, then the loader allocates memory within the current process space, copies the payload data to it, and then executes it at the specified offset indicated by the field value.


This option is most likely used for shellcode payloads or further DLLs with ReflectiveLoader exports.


If the value of the load field is -1 then the loader allocates memory within the current process and then loads the PE payload into it using the full PE loading procedure.


It copies the headers, maps the individual PE sections, processes any relocations, loads the PE’s imports, and then executes the PE from its internally specified entry point.


Finally, if the load field is equal to zero or another negative number, the payload is loaded as a .NET assembly.


Nemesis Project Infostealer The final payload loaded by Domino Loader is a .NET assembly with MD5 hash D9FFB202D6B679E5AD7303C0334CD000 and identified as a ‘Project Nemesis’ infostealer.


Project Nemesis is a commodity malware written in .NET which was first advertised for sale on the dark web in December 2021, though it does not seem to be widely known and it is not frequently observed in the wild.


The sample was initially advertised with the following text: !


The Steeler was originally developed for personal purposes, in the future for sale. !


Will be sold in one hand.


Price $ 1300 (bargaining is appropriate) !


STRICTLY THROUGH THE GUARANTOR DESCRIPTION : – Stealer is based on .Net[C#] – 4.5 .


The code is written from scratch, neat and clear, there are comments everywhere.


– Selling together with all sources (build, builder, panel) FUNCTIONALITY : Spoiler: STEALER – Log collection takes place in memory – Collection of data from Chromium browsers (Cookies/CC/Passwords/Autofills/Bookmars/History) v80+ – Collection of data from Gecko browsers (Cookies/Passwords/Bookmark/History) v80+ – Collection of RDP/FTP sessions – Grabbink files from the desktop (by extension) – Collection of UserAgent – Collection of information about the system in HTML format – Collect Vpn (NordVpn/OpenVpn/ProtonVpn) –


Collecting Steam – Collection of the Telegram session (including the Portable version) – Collecting Discord tokens List of crypto wallets:


Electrum,Electrum-Dash,Ethereum,Exodus,Atomic,Jaxx,Coinomi,Guarda,Armory,Zcash,Bytecoin List of supported crypto plugins: TronLink, MetaMask, Binance Chain Wallet Anti-sniffer: All programs that catch http/https data transfer are closed [even if the name is changed] – Self-delete after sending data (on/off) – CIS(Lock start in CIS countries) (on/off) – Blocking startup on virtual machines (on/off) – Sending data to the Web-panel (IP logger is on the side of the panel)


Scroll to view full table Data collected by Nemesis can be accessed by the operator via a web-based control panel.


Fig 4 — Nemesis Control Panel Login Screen Fig 5 — Nemesis Dashboard Static Analysis Upon execution Nemesis starts by creating a mutex to ensure only one instance of the malware is running: Local\\751E355F-B066-4547-B13E-B185D9176390 The malware keeps a log of its activity, mostly written in the Russian language, and the following is written upon its startup: Logger.


Write(“~[NEMESIS INIZIALIZE]~”); Logger.


Write(“Запуск задачи EngineTask”); Scroll to view full table Fig 6 — Nemesis Start-up Code Nemesis then immediately proceeds with infostealing activities, and collects the following data in order: Chromium-based browsers: Steals stored credentials, cookies, credit cards, bookmarks, autofill data, and history.


Browsers include: “\\Chromium\\User Data\\”, “\\Google\\Chrome\\User Data\\”, “\\Google(x86)\\Chrome\\User Data\\”, “\\Opera Software\\”, “\\MapleStudio\\ChromePlus\\User Data\\”, “\\Iridium\\User Data\\”, “\\7Star\\7Star\\User Data\\”, “\\CentBrowser\\User Data\\”, “\\Chedot\\User Data\\”, “\\Vivaldi\\User Data\\”, “\\Kometa\\User Data\\”, “\\Elements Browser\\User Data\\”, “\\Epic Privacy Browser\\User Data\\”, “\\Microsoft\\Edge\\User Data\\”, “\\uCozMedia\\Uran\\User Data\\”, “\\Fenrir Inc\\Sleipnir5\\setting\\modules\\ChromiumViewer\\”, “\\CatalinaGroup\\Citrio\\User Data\\”, “\\Coowon\\Coowon\\User Data\\”, “\\liebao\\User Data\\”, “\\QIP Surf\\User Data\\”, “\\Orbitum\\User Data\\”, “\\Comodo\\Dragon\\User Data\\”, “\\Amigo\\User\\User Data\\”, “\\Torch\\User Data\\”, “\\Yandex\\YandexBrowser\\User Data\\”, “\\Comodo\\User Data\\”, “\\360Browser\\Browser\\User Data\\”, “\\Maxthon3\\User Data\\”, “\\K-Melon\\User Data\\”, “\\Sputnik\\Sputnik\\User Data\\”, “\\Nichrome\\User Data\\”, “\\CocCoc\\Browser\\User Data\\”, “\\Uran\\User Data\\”, “\\Chromodo\\User Data\\”, “\\Mail.Ru\\Atom\\User


Data\\”, “\\BraveSoftware\\Brave-Browser\\User Data\\” Gecko-based browsers: Steals stored credentials, cookies, bookmarks, and history.


Browsers include: “\\Mozilla\\Firefox”, “\\Comodo\\IceDragon”, “\\Mozilla\\SeaMonkey”, “\\Moonchild Productions\\Pale Moon”, “\\Waterfox”, “\\K-Meleon”, “\\Thunderbird”, “\\8pecxstudios\\Cyberfox”, “\\NETGATE Technologies\\BlackHaw” CryptoWallet data from browser extensions MetaMask, TronLink, and Binance Clipboard data The following data collection tasks are then all set to run in parallel. CryptoWallets on disk from apps including: Electrum, Electrum-Dash, Ethereum, Exodus, Atomic, Jaxx, Coinomi, Guarda, Armory, Zcash, Bytecoin System info, including both hardware and OS info.


Enumerates running processes Enumerates IDs from Steam application Enumerates files under Steam application directory Gets a list of installed browsers by looping through entries under registry key SOFTWARE\\Clients\\StartMenuInternet and SOFTWARE\\WOW6432Node\\Clients\\StartMenuInternet, and then recording the contents of subkey shell\\open\\command for each.


Enumerate files on desktop Discord Tokens FoxMail data DynDNS credentials FileZilla connection credentials + hosts.


NordVPN credentials OpenVPN files KerioVPN files Proton VPN credentials User-agents Pidgin credentials Telegram data files Telegram portable files RDP connection files (.rdp)


The malware then collates all the data and adds it to a Zip archive which it then transfers back to the C2.


Fig 7 — Nemesis waits for data collection tasks to complete, then adds the data to a zip archive to be sent to the C2 Fig 8 — Nemesis uploads data to the C2 via a HTTP POST request The C2 address for the analysed sample is https[:]//es-megadom[.]com Fig 9 — Nemesis Configuration A Tangled Web Provides Opportunities This analysis highlights the intricate relationships between cybercriminal groups and their members.


Domino Backdoor shares code overlap with the Lizar (aka Tirion, Diceloader) family of malware, developed by ITG14.


Since late February 2023, former members of ITG23 have been observed using Dave Loader with Domino Backdoor during their campaigns, suggesting at least some level of collaboration between the two groups.


The use of malware with ties to multiple groups in a single campaign — such as Dave Loader, Domino Backdoor and Project Nemesis Infostealer — highlights the complexity involved in tracking threat actors but also provides insight into how and with whom they operate.


Indicators of Compromise Indicator Indicator Type Context de9b3c01991e357a349083f0db6af3e782f15e981e2bf0a16ba618252585923a SHA256 Hash Dave Loader / Domino Backdoor b14ab379ff43c7382c1aa881b2be39275c1594954746ef58f6a9a3535e8dc1a8 SHA256 Hash Dave Loader / Domino Backdoor dbdfc3ca5afa186c1a9a9c03129773f7bc17fb7988fe0ca40fc3c5bedb201978 SHA256 Hash Dave Loader /Domino


Backdoor ce99b4c0d75811ce70610d39b1007f99560e6dea887a451e08916a4f8cf33678 SHA256 Hash Dave Loader /Domino


Backdoor f1817665ea2831f775e23cbda27cbeb06d03e6c39bbfad920b50f40712dd37cb SHA256 Hash NewWorldOrder Loader / Carbanak Backdoor 51e0512a54640be8e3477363c8d72d893c6edd20399bddf71e95eec3ddfdb42e SHA256 Hash NewWorldOrder Loader / Carbanak Backdoor f4ebd59fb578a0184abf6870fc652210d63e078a35dace0a48c5f273e417c13d SHA256 Hash NewWorldOrder Loader / Domino Backdoor 92651f9418625e5281b84cccb817e94e6294b36c949b00fcd4046770b87f10e4 SHA256 Hash NewWorldOrder Loader / Domino Backdoor e5af0b9f4650dc0193c9884507e6202b04bb87ac5ed261be3f4ecfa3b6911af8 SHA256 Hash Domino Backdoor hxxp://170.130.55[.]250/x64.exe URL Staging URL for Domino Backdoor hxxps://upperdunk[.]com/mr64.exe URL Staging URL for Domino Backdoor 88.119.175[.]124 IP Address Domino Backdoor C2 94.158.247[.]72 IP Address Domino Backdoor C2 178.23.190[.]73 IP Address Carbanak C2 es-megadom[.]com Domain Project Nemesis C2 185.225.17[.]202 IP Address Domino Backdoor C2 5.182.37[.]118 IP Address Domino Backdoor C2 45.67.34[.]236 IP Address Project Nemesis C2 Scroll to view full table To learn how IBM X-Force can help you with anything regarding cybersecurity including incident response, threat intelligence, or offensive security services schedule a meeting here: IBM X-Force Scheduler If you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 Global hotline (+001) 312-212-8034.


The post Ex-Conti and FIN7 Actors Collaborate with New Domino Backdoor appeared first on Security Intelligence.


Executive summary 2022 has experienced an increase in the number of wiper variants targeting Ukrainian entities.

Analysis on recent wiper attacks examples and how wiper malware works


This blog post looks to explain how wipers work, what makes them so effective and provides a short overview of the most recent samples that appeared in the eastern Europe geopolitical conflict.


How does wiper malware work?


Wiper’s main objective is to destroy data from any storage device and make the information unavailable (T1485).


There are two ways of removing files, logical and physical.


Logical file removal is the most common way of erasing a file, performed by users daily when a file is sent to (and emptied from) the Recycle bin, or when it is removed with the command line or terminal with the commands del/rm.


This action deletes the pointer to the file but not the file data, making it recoverable with forensic tools as long as the Operative System does not write any other file in the same physical location.


However, malware wipers aim to make the data irrecoverable, so they tend to remove the data from the physical level of the disk.


The most effective way to remove the data/file is by overwriting the specific physical location with other data (usually a repeated byte like 0xFF).


This process usually involves writing to disk several Gigabytes (or Terabytes) of data and can be time consuming.