#ParsedReport
22-07-2022
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
https://www.trendmicro.com/en_us/research/22/g/alibaba-oss-buckets-compromised-to-distribute-malicious-shell-sc.html
Actors/Campaigns:
Teamtnt
Threats:
Monero_miner
Xmrig_miner
Kinsing_miner
Geo:
Chinese
IOCs:
Domain: 1
Hash: 5
Softs:
unix, redis
Links:
22-07-2022
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
https://www.trendmicro.com/en_us/research/22/g/alibaba-oss-buckets-compromised-to-distribute-malicious-shell-sc.html
Actors/Campaigns:
Teamtnt
Threats:
Monero_miner
Xmrig_miner
Kinsing_miner
Geo:
Chinese
IOCs:
Domain: 1
Hash: 5
Softs:
unix, redis
Links:
https://github.com/xmrig/xmrigTrend Micro
Alibaba OSS Buckets Compromised to Distribute Malicious Shell Scripts via Steganography
#ParsedReport
22-07-2022
Daum. Fishing mail disguised as a domestic portal site Daum
https://asec.ahnlab.com/ko/36969
IOCs:
Url: 2
File: 1
Hash: 1
22-07-2022
Daum. Fishing mail disguised as a domestic portal site Daum
https://asec.ahnlab.com/ko/36969
IOCs:
Url: 2
File: 1
Hash: 1
ASEC BLOG
국내 포털 사이트 Daum으로 위장한 피싱 메일 - ASEC BLOG
ASEC 분석팀은 해당 블로그 작성 날짜 기준으로 전날인, 2022년 7월 21일에 국내 포털 사이트 중 하나인 Daum으로 위장한 피싱 메일이 유포되고 있는 정황을 포착하였다. 해당 피싱 메일은 제목에 RFQ를 포함하여 견적 요청서로 둔갑하였으며, 첨부 파일을 이용하여 피싱 페이지로 유도하도록 만들어졌다. 첨부 파일은 HTML 파일로 이루어져 있으며, 첨부 파일을 실행하면 자동으로 아래 주소로 리다이렉션된다. hxxps://euoi8708twufev…
#ParsedReport
22-07-2022
Qakbot Resurfaces with new Playbook
https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook
Threats:
Qakbot
Brata
Beacon
Process_injection_technique
Industry:
Financial
TTPs:
Tactics: 2
Technics: 4
IOCs:
File: 5
Hash: 5
Softs:
android
Algorithms:
base64
22-07-2022
Qakbot Resurfaces with new Playbook
https://blog.cyble.com/2022/07/21/qakbot-resurfaces-with-new-playbook
Threats:
Qakbot
Brata
Beacon
Process_injection_technique
Industry:
Financial
TTPs:
Tactics: 2
Technics: 4
IOCs:
File: 5
Hash: 5
Softs:
android
Algorithms:
base64
Всем привет.
До 1 августа уходим вместе с движком публикации TI-отчетов в отпуск.
Все индикаторы из отчетов продолжат попадать в наш фид автоматически.
До 1 августа уходим вместе с движком публикации TI-отчетов в отпуск.
Все индикаторы из отчетов продолжат попадать в наш фид автоматически.
winapi_funcs.yml
564 KB
Постепенно выхожу из стазиса.
Напарсил с https://docs.microsoft.com/en-us/windows/win32/api/ список WIN API.
Методы интерфейсов тоже собрал, но пока решил не выкладывать из-за ненадобности )
Как же я долго не хотел прикручивать HyperScan от Intel к парсеру отчетов, но теперь придется.
Напарсил с https://docs.microsoft.com/en-us/windows/win32/api/ список WIN API.
Методы интерфейсов тоже собрал, но пока решил не выкладывать из-за ненадобности )
Как же я долго не хотел прикручивать HyperScan от Intel к парсеру отчетов, но теперь придется.
Кстати ,вот регулярка, которая тоже помогает выявить название WIN API функции в тексте
(^| )((Alpc|Cc|Cm|Dbg|Dbgk|Em|Etw|Ex|FsRtl|Hv|Hvl|Io|Kd|Ke|Kse|Lsa|Mm|Nt|Ob|Pf|Po|PoFx|Pp|Ppm|Ps|Rtl|Se|SH|Sm|Tm|Ttm|Vf|Vsl|Wdi|Wfp|Whea|Wmi|Zw)([A-Z][a-z]+){3,}[A-Z]?)([., ]|$)#ParsedReport
31-07-2022
ASEC (20220718 \~ 20220724). ASEC Weekly Malware Statistics (20220718 \~ 20220724)
https://asec.ahnlab.com/ko/37092
Threats:
Agent_tesla
Azorult
Redline_stealer
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Njrat_rat
Avemaria_rat
Industry:
Transport, Financial
Geo:
Korea
IOCs:
File: 43
Domain: 8
IP: 3
Email: 6
Url: 27
Softs:
nsisinstaller, discord
Languages:
visual_basic
31-07-2022
ASEC (20220718 \~ 20220724). ASEC Weekly Malware Statistics (20220718 \~ 20220724)
https://asec.ahnlab.com/ko/37092
Threats:
Agent_tesla
Azorult
Redline_stealer
Formbook
Clipboard_grabbing_technique
Cloudeye
Remcos_rat
Nanocore_rat
Njrat_rat
Avemaria_rat
Industry:
Transport, Financial
Geo:
Korea
IOCs:
File: 43
Domain: 8
IP: 3
Email: 6
Url: 27
Softs:
nsisinstaller, discord
Languages:
visual_basic
ASEC BLOG
ASEC 주간 악성코드 통계 (20220718 ~ 20220724) - ASEC BLOG
ASEC 분석팀에서는 ASEC 자동 분석 시스템 RAPIT 을 활용하여 알려진 악성코드들에 대한 분류 및 대응을 진행하고 있다. 본 포스팅에서는 2022년 7월 18일 월요일부터 7월 24일 일요일까지 한 주간 수집된 악성코드의 통계를 정리한다. 대분류 상으로는 인포스틸러가 44.7%로 1위를 차지하였으며, 그 다음으로는 백도어 악성코드가 40.3%, 다운로더 14.5%, 랜섬웨어 0.6%로 집계되었다. Top 1 – Agent Tesla 인포스틸러 악성코드인…
#ParsedReport
31-07-2022
CHM. Malicious CHM distribution to domestic universities
https://asec.ahnlab.com/ko/37123
Threats:
Revbshell
Powershell_shell_tool
Trojan/vbs.generic
Dll_hijacking_technique
Industry:
Education
IOCs:
File: 11
Hash: 3
Domain: 1
31-07-2022
CHM. Malicious CHM distribution to domestic universities
https://asec.ahnlab.com/ko/37123
Threats:
Revbshell
Powershell_shell_tool
Trojan/vbs.generic
Dll_hijacking_technique
Industry:
Education
IOCs:
File: 11
Hash: 3
Domain: 1
ASEC BLOG
국내 대학교 대상으로 악성 CHM 유포 중 - ASEC BLOG
ASEC 분석팀은 국내 특정 대학교를 대상으로 악성 CHM 파일이 다수 유포되고 있는 정황을 포착하였다. 유포 중인 악성 CHM 파일은 지난 5월에 소개했던 유형과 동일한 유형인 것으로 확인하였다. [그림 1] 은 악성 CHM 내부에 존재하는 HTM 파일의 코드이며, 파일명 “2022년도_기초과학연구역량강화사업_착수보고회_개최_계획 Ver1.1.chm” 으로 유포 중인 것으로 추정된다. 사용자가 악성 CHM 파일을 실행하게 되면, 해당 HTM 파일의 코드가…
#ParsedReport
31-07-2022
(Kimsuky). Word document (Kimsuky) provided as an external link when replying to the attacker mail
https://asec.ahnlab.com/ko/37175
Actors/Campaigns:
Kimsuky
Geo:
Korea
IOCs:
File: 7
Path: 1
Url: 2
Hash: 2
31-07-2022
(Kimsuky). Word document (Kimsuky) provided as an external link when replying to the attacker mail
https://asec.ahnlab.com/ko/37175
Actors/Campaigns:
Kimsuky
Geo:
Korea
IOCs:
File: 7
Path: 1
Url: 2
Hash: 2
ASEC BLOG
공격자 메일에 회신한 경우에 외부 링크로 제공되는 워드문서 (Kimsuky) - ASEC BLOG
ASEC 분석팀은 대북 관련 내용의 악성 워드 문서가 꾸준히 유포되고 있음을 확인하였다. 확인된 워드 문서는 안랩 TIP에 공개된 “2021년 Kimsuky 공격 워드(word) 문서 사례 총 정리 분석 보고서” 및 ‘외교/안보 관련 내용의 워드문서 유포 중‘ 에서 공유한 워드 문서 유형과 더불어 mshta를 이용하는 유형이 확인되었다. 악성 워드 문서는 다음과 같이 다양한 파일명으로 유포되고 있다. 김** 이력서(한미**협회,220711).doc 양**_**재단…
#ParsedReport
31-07-2022
(Gwisin). Ghost (GWISIN) ransomware
https://asec.ahnlab.com/ko/37233
Threats:
Gwisin
Magniber
IOCs:
File: 5
Path: 1
Softs:
bcdedit
31-07-2022
(Gwisin). Ghost (GWISIN) ransomware
https://asec.ahnlab.com/ko/37233
Threats:
Gwisin
Magniber
IOCs:
File: 5
Path: 1
Softs:
bcdedit
ASEC BLOG
국내 기업 대상의 귀신(Gwisin) 랜섬웨어 - ASEC BLOG
최근 국내 기업을 대상으로 한 귀신(Gwisin) 랜섬웨어 피해가 증가하고 있다. 이 랜섬웨어는 특정 기업을 타겟으로 제작되어 유포되고 있으며, 매그니베르(Magniber)와 동일하게 MSI 설치 파일 형태로 동작한다. 불특정 다수를 대상으로 유포되는 매그니베르와 달리 귀신 랜섬웨어는 파일 단독 실행 만으로는 행위가 발현되지 않고, 특별한 실행 인자 값이 필요하다. 이러한 인자 값은 MSI 내부에 포함된 DLL 파일의 구동에 필요한 키 정보로 활용된다.…
#ParsedReport
31-07-2022
Ransomware Groups Ramping Up Operations
https://blog.cyble.com/2022/07/28/ransomware-groups-ramping-up-operations
Actors/Campaigns:
Blackcat
Karakurt
Threats:
Solidbit
Lockbit
Yashma
Conti
Blackcat
Industry:
Financial, Government
Languages:
rust
31-07-2022
Ransomware Groups Ramping Up Operations
https://blog.cyble.com/2022/07/28/ransomware-groups-ramping-up-operations
Actors/Campaigns:
Blackcat
Karakurt
Threats:
Solidbit
Lockbit
Yashma
Conti
Blackcat
Industry:
Financial, Government
Languages:
rust
Cyble
Ransomware Groups Ramping Up Operations
Cyble Research Labs analyzes new extortion activities used as ransomware groups resort to even more unscrupulous techniques.
#ParsedReport
31-07-2022
Targeted Attacks being carried out via DLL SideLoading
https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading
Threats:
Cobalt_strike
Beacon
Qakbot
Mimikatz
Geo:
Italy
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 4
Url: 1
Hash: 2
Softs:
microsoft teams
Algorithms:
base64
Functions:
process, EnableContent, GetParagraph, AutoOpen
31-07-2022
Targeted Attacks being carried out via DLL SideLoading
https://blog.cyble.com/2022/07/27/targeted-attacks-being-carried-out-via-dll-sideloading
Threats:
Cobalt_strike
Beacon
Qakbot
Mimikatz
Geo:
Italy
TTPs:
Tactics: 3
Technics: 5
IOCs:
File: 4
Url: 1
Hash: 2
Softs:
microsoft teams
Algorithms:
base64
Functions:
process, EnableContent, GetParagraph, AutoOpen
Cyble
Cyble - Targeted Attacks Being Carried Out Via DLL SideLoading
Cyble Analyzes how Threat Actors are leveraging Microsoft applications and DLL Sideloading to deliver Cobalt Strike Beacons
#ParsedReport
31-07-2022
Underground Clipper Malware Targeting IBAN Transactions & Cryptocurrency
https://blog.cyble.com/2022/07/28/underground-clipper-malware-targeting-iban-transactions-cryptocurrency
Threats:
Iban_clipper
Stealerium_keylogger
Industry:
Financial
Geo:
Poland
Softs:
telegram
31-07-2022
Underground Clipper Malware Targeting IBAN Transactions & Cryptocurrency
https://blog.cyble.com/2022/07/28/underground-clipper-malware-targeting-iban-transactions-cryptocurrency
Threats:
Iban_clipper
Stealerium_keylogger
Industry:
Financial
Geo:
Poland
Softs:
telegram
Cyble
Underground Clipper Malware Targeting IBAN Transactions & Cryptocurrency
Cyble Analyzes Threat Actors selling Clipper Malware targeting IBAN transactions and cryptocurrency on cybercrime forums.
#ParsedReport
01-08-2022
Heres a Simple Script to Detect the Stealthy Nation-State BPFDoor
https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor
Threats:
Bpfdoor
Red_menshen
Mangzamel
Gh0st_rat
Metasploit_tool
Timestomp_technique
Industry:
Government, Telco, Education, Logistic
Geo:
Taiwan, Asia, India, Vietnam, Myanmar, Turkey, Chinese, Korea
TTPs:
Tactics: 1
Technics: 7
IOCs:
Hash: 18
Softs:
unix
Functions:
utimes
Languages:
python, perl, lua
YARA: Found
01-08-2022
Heres a Simple Script to Detect the Stealthy Nation-State BPFDoor
https://blog.qualys.com/vulnerabilities-threat-research/2022/08/01/heres-a-simple-script-to-detect-the-stealthy-nation-state-bpfdoor
Threats:
Bpfdoor
Red_menshen
Mangzamel
Gh0st_rat
Metasploit_tool
Timestomp_technique
Industry:
Government, Telco, Education, Logistic
Geo:
Taiwan, Asia, India, Vietnam, Myanmar, Turkey, Chinese, Korea
TTPs:
Tactics: 1
Technics: 7
IOCs:
Hash: 18
Softs:
unix
Functions:
utimes
Languages:
python, perl, lua
YARA: Found
Qualys
Here’s a Simple Script to Detect the Stealthy Nation-State BPFDoor | Qualys
In this blog, the Qualys Research Team explains the mechanics of a Linux malware variant named BPFdoor. We then demonstrate the efficacy of Qualys Custom Assessment and Remediation to detect it…
#ParsedReport
01-08-2022
The TrickBot malware
https://www.telsy.com/the-trickbot-malware
Threats:
Trickbot
Ryuk
Dyre
Wannacry
Eternal_petya
Emotet
Mworm
Nworm
Eternalblue_vuln
Eternalromance_vuln
Eternalchampion_vuln
Industry:
Financial
01-08-2022
The TrickBot malware
https://www.telsy.com/the-trickbot-malware
Threats:
Trickbot
Ryuk
Dyre
Wannacry
Eternal_petya
Emotet
Mworm
Nworm
Eternalblue_vuln
Eternalromance_vuln
Eternalchampion_vuln
Industry:
Financial
Telsy
The TrickBot malware - Telsy
TrickBot è un trojan bancario che prende di mira aziende e consumatori per i loro dati, capace di adattarsi a qualsiasi ambiente o rete.
#ParsedReport
01-08-2022
Technical Analysis of Industrial SpyRansomware. Industrial Spy Market Promoter
https://www.zscaler.com/blogs/security-research/technical-analysis-industrial-spy-ransomware
Threats:
Spyransomware
Smokeloader
Cloudeye
Redline_stealer
Win32.ransom.industrialspy
Cuba
Gozi
Wastedlocker
Antidebugging_technique
Industry:
E-commerce
IOCs:
Hash: 7
File: 4
Algorithms:
3des, des
Functions:
R_RandomUpdate, R_GenerateBytes
Languages:
python
Platforms:
x86, x64
Links:
01-08-2022
Technical Analysis of Industrial SpyRansomware. Industrial Spy Market Promoter
https://www.zscaler.com/blogs/security-research/technical-analysis-industrial-spy-ransomware
Threats:
Spyransomware
Smokeloader
Cloudeye
Redline_stealer
Win32.ransom.industrialspy
Cuba
Gozi
Wastedlocker
Antidebugging_technique
Industry:
E-commerce
IOCs:
Hash: 7
File: 4
Algorithms:
3des, des
Functions:
R_RandomUpdate, R_GenerateBytes
Languages:
python
Platforms:
x86, x64
Links:
https://github.com/gbrindisi/malware/tree/667b44f64edcd1c5e8c42489b8e767813a589158/windows/gozi-isfbZscaler
Technical Analysis of Industrial Spy Ransomware | Zscaler
Industrial Spy is a relatively new ransomware group that emerged in April 2022. Their primary objective is exfiltrating data to sell on their data leak website.
#ParsedReport
01-08-2022
. Monero Coin Minor Malware, which is being distributed through Webhard
https://asec.ahnlab.com/ko/37333
Threats:
Njrat_rat
Udprat
Xmrig_miner
Trojan/win.fy.c5155016
Xmr_miner
Trojan/win.launcher.c5217400
IOCs:
File: 8
Domain: 1
Coin: 1
Hash: 5
Url: 3
01-08-2022
. Monero Coin Minor Malware, which is being distributed through Webhard
https://asec.ahnlab.com/ko/37333
Threats:
Njrat_rat
Udprat
Xmrig_miner
Trojan/win.fy.c5155016
Xmr_miner
Trojan/win.launcher.c5217400
IOCs:
File: 8
Domain: 1
Coin: 1
Hash: 5
Url: 3
ASEC BLOG
웹하드를 통해 유포 중인 모네로 코인 마이너 악성코드 - ASEC BLOG
웹하드는 국내 사용자를 대상으로 하는 공격자들이 사용하는 대표적인 악성코드 유포 플랫폼이다. ASEC 분석팀에서는 웹하드를 통해 유포되는 악성코드들을 모니터링하고 있으며 과거 다수의 블로그를 통해 정보를 공유한 바 있다. 일반적으로 공격자들은 성인 게임이나 사용 게임의 크랙 버전과 같은 불법 프로그램과 함께 악성코드를 유포한다. 이렇게 웹하드를 유포 경로로 사용하는 공격자들은 주로 njRAT이나 UdpRAT, DDoS IRC Bot과 같은 RAT 유형의…
#ParsedReport
01-08-2022
SEARCH. Threat Actor Targets Financial Entities With Evilnum Malware
https://www.proofpoint.com/us/newsroom/news/threat-actor-targets-financial-entities-evilnum-malware
Actors/Campaigns:
Evilnum (motivation: information_theft)
Ta4563
Venom_spider
Industry:
Financial
IOCs:
File: 3
Softs:
windows defender, microsoft word
01-08-2022
SEARCH. Threat Actor Targets Financial Entities With Evilnum Malware
https://www.proofpoint.com/us/newsroom/news/threat-actor-targets-financial-entities-evilnum-malware
Actors/Campaigns:
Evilnum (motivation: information_theft)
Ta4563
Venom_spider
Industry:
Financial
IOCs:
File: 3
Softs:
windows defender, microsoft word
Decipher
Threat Actor Targets Financial Entities With Evilnum Malware
The threat actor has been observed targeting companies with operations supporting foreign exchanges and cryptocurrency, and organizations in the Decentralized Finance (DeFi) industry.
#ParsedReport
31-07-2022
CUBA Ransomware Campaign Analysis. Key Takeaways
https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis
Actors/Campaigns:
Unc2596
Threats:
Cuba
Seth_locker
Credential_harvesting_technique
Process_injection_technique
Meterpreter_tool
Mimikatz
Cobalt_strike
Bughatch
Systembc
Proxylogon_exploit
Proxyshell_vuln
Bazarbackdoor
Metasploit_tool
Netsupportmanager_rat
Gotoassist_tool
Beacon
Mosquito
Zerologon_vuln
Psexec_tool
Lolbas_technique
Industry:
Financial, Retail
Geo:
Polish, American
TTPs:
Tactics: 9
Technics: 0
IOCs:
File: 15
IP: 21
Domain: 2
Url: 3
Path: 7
Hash: 14
Softs:
microsoft defender, sysinternals, mysql
YARA: Found
Links:
31-07-2022
CUBA Ransomware Campaign Analysis. Key Takeaways
https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis
Actors/Campaigns:
Unc2596
Threats:
Cuba
Seth_locker
Credential_harvesting_technique
Process_injection_technique
Meterpreter_tool
Mimikatz
Cobalt_strike
Bughatch
Systembc
Proxylogon_exploit
Proxyshell_vuln
Bazarbackdoor
Metasploit_tool
Netsupportmanager_rat
Gotoassist_tool
Beacon
Mosquito
Zerologon_vuln
Psexec_tool
Lolbas_technique
Industry:
Financial, Retail
Geo:
Polish, American
TTPs:
Tactics: 9
Technics: 0
IOCs:
File: 15
IP: 21
Domain: 2
Url: 3
Path: 7
Hash: 14
Softs:
microsoft defender, sysinternals, mysql
YARA: Found
Links:
https://github.com/rapid7/metasploit-frameworkwww.elastic.co
CUBA Ransomware Campaign Analysis — Elastic Security Labs
Elastic Security observed a ransomware and extortion campaign leveraging a combination of offensive security tools, LOLBAS, and exploits to deliver the CUBA ransomware malware.
#ParsedReport
31-07-2022
QBOT Configuration Extractor. Getting Started
https://www.elastic.co/security-labs/qbot-configuration-extractor
Threats:
Qakbot
Seth_locker
Bpfdoor
IOCs:
File: 1
Softs:
docker
Languages:
python
31-07-2022
QBOT Configuration Extractor. Getting Started
https://www.elastic.co/security-labs/qbot-configuration-extractor
Threats:
Qakbot
Seth_locker
Bpfdoor
IOCs:
File: 1
Softs:
docker
Languages:
python
www.elastic.co
QBOT Configuration Extractor — Elastic Security Labs
Python script to extract the configuration from QBOT samples.