#ParsedReport
07-12-2022
Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE)
https://asec.ahnlab.com/en/43518
Threats:
Laplas_clipper
Redline_stealer
Tron
Trojan/win.rtlo.x2172
Dropper/win.agent.c5317732
Trojan/win.injection.c5313120
Trojan/win.generic.c535472
Trojan/win.generic.c5310136
Raccoon_stealer
Industry:
Financial
IOCs:
File: 3
Hash: 6
IP: 1
Softs:
zcash
Languages:
php
07-12-2022
Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE)
https://asec.ahnlab.com/en/43518
Threats:
Laplas_clipper
Redline_stealer
Tron
Trojan/win.rtlo.x2172
Dropper/win.agent.c5317732
Trojan/win.injection.c5313120
Trojan/win.generic.c535472
Trojan/win.generic.c5310136
Raccoon_stealer
Industry:
Financial
IOCs:
File: 3
Hash: 6
IP: 1
Softs:
zcash
Languages:
php
ASEC BLOG
Malware Distributed with Disguised Filenames (RIGHT-TO-LEFT OVERRIDE) - ASEC BLOG
In August, the ASEC analysis team made a post on the malware being distributed with filenames that utilize RTLO (Right-To-Left Override). RTLO is a unicode that makes an override from right to left. This type of malware induces users to execute its files…
#ParsedReport
07-12-2022
Resume.xll File Being Distributed in Korea (LockBit 2.0)
https://asec.ahnlab.com/en/43332
Threats:
Lockbit
Geo:
Korea
IOCs:
File: 3
Url: 1
Path: 1
Hash: 2
Softs:
microsoft excel
07-12-2022
Resume.xll File Being Distributed in Korea (LockBit 2.0)
https://asec.ahnlab.com/en/43332
Threats:
Lockbit
Geo:
Korea
IOCs:
File: 3
Url: 1
Path: 1
Hash: 2
Softs:
microsoft excel
ASEC BLOG
'Resume.xll' File Being Distributed in Korea (LockBit 2.0) - ASEC BLOG
In mid-2022, the ASEC analysis team shared that malware with the XLL file format (file extension: .xll) was being distributed via email. The XLL file has a DLL form of a PE (Portable Executable) file but is executed with Microsoft Excel. Since then, this…
#ParsedReport
07-12-2022
An upsurge of new Android Banking Trojan Zanubis
https://labs.k7computing.com/index.php/an-upsurge-of-new-android-banking-trojan-zanubis
Threats:
Zanubis
Cyberchef_tool
Industry:
Financial, Government
Geo:
Peru, Peruvian
TTPs:
Tactics: 4
Technics: 0
IOCs:
Url: 1
File: 22
IP: 1
Hash: 1
Softs:
android
07-12-2022
An upsurge of new Android Banking Trojan Zanubis
https://labs.k7computing.com/index.php/an-upsurge-of-new-android-banking-trojan-zanubis
Threats:
Zanubis
Cyberchef_tool
Industry:
Financial, Government
Geo:
Peru, Peruvian
TTPs:
Tactics: 4
Technics: 0
IOCs:
Url: 1
File: 22
IP: 1
Hash: 1
Softs:
android
K7 Labs
An upsurge of new Android Banking Trojan “Zanubis”
We came across the tweet of an Android malware sample, a banking trojan that mainly targets Peru banks by […]
#ParsedReport
07-12-2022
A Closer look at BlackMagic ransomware
https://blog.cyble.com/2022/12/07/a-closer-look-at-blackmagic-ransomware
Threats:
Blackmagic
Anydesk_tool
Mosesstaff
Industry:
Logistic, Transport, Financial
Geo:
Israeli, Australia, India, Georgia, Israel, Israels, Singapore, Dubai, Iran
TTPs:
Tactics: 4
Technics: 8
IOCs:
Url: 2
File: 7
Path: 1
Registry: 1
IP: 2
Hash: 2
Softs:
nginx, docker, qemu, cpanel, virtualbox
Functions:
Sleep
Win API:
GetLogicalDriveStringsA
Win Services:
powerpnt
Languages:
java, python
07-12-2022
A Closer look at BlackMagic ransomware
https://blog.cyble.com/2022/12/07/a-closer-look-at-blackmagic-ransomware
Threats:
Blackmagic
Anydesk_tool
Mosesstaff
Industry:
Logistic, Transport, Financial
Geo:
Israeli, Australia, India, Georgia, Israel, Israels, Singapore, Dubai, Iran
TTPs:
Tactics: 4
Technics: 8
IOCs:
Url: 2
File: 7
Path: 1
Registry: 1
IP: 2
Hash: 2
Softs:
nginx, docker, qemu, cpanel, virtualbox
Functions:
Sleep
Win API:
GetLogicalDriveStringsA
Win Services:
powerpnt
Languages:
java, python
#ParsedReport
07-12-2022
Securonix Threat Labs Security Advisory: ProxyNotShell Revisited: Detecting Latest Exploits Using Security Analytics
https://www.securonix.com/blog/proxynotshell-revisited
Actors/Campaigns:
Steep_maverick
Threats:
Proxynotshell_vuln
Proxyshell_vuln
Chinachopper
Havoc
Qakbot
CVEs:
CVE-2022-41040 [Vulners]
Vulners: Score: Unknown, CVSS: 3.2,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2016, 2019, 2019, 2016)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 3.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 1.7,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2022-41082 [Vulners]
Vulners: Score: Unknown, CVSS: 2.8,
Vulners: Exploitation: Unknown
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2016, 2019, 2019, 2016)
TTPs:
Tactics: 3
Technics: 3
IOCs:
File: 10
Path: 2
Command: 2
Softs:
microsoft exchange, microsoft exchange server, msexchange
Win API:
WmiCreateProcess
Languages:
python
07-12-2022
Securonix Threat Labs Security Advisory: ProxyNotShell Revisited: Detecting Latest Exploits Using Security Analytics
https://www.securonix.com/blog/proxynotshell-revisited
Actors/Campaigns:
Steep_maverick
Threats:
Proxynotshell_vuln
Proxyshell_vuln
Chinachopper
Havoc
Qakbot
CVEs:
CVE-2022-41040 [Vulners]
Vulners: Score: Unknown, CVSS: 3.2,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2016, 2019, 2019, 2016)
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 3.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 1.7,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2022-41082 [Vulners]
Vulners: Score: Unknown, CVSS: 2.8,
Vulners: Exploitation: Unknown
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2016, 2019, 2019, 2016)
TTPs:
Tactics: 3
Technics: 3
IOCs:
File: 10
Path: 2
Command: 2
Softs:
microsoft exchange, microsoft exchange server, msexchange
Win API:
WmiCreateProcess
Languages:
python
Securonix
Securonix Threat Labs Security Advisory: ProxyNotShell Revisited: Detecting Latest Exploits Using Security Analytics
Detect and mitigate ProxyNotShell exploits on Microsoft Exchange Servers with insights on vulnerabilities, attack chains, and defense strategies.
#ParsedReport
07-12-2022
Zerobot New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities
Threats:
Zerobot
Spring4shell
Hostile
Industry:
Iot
IOCs:
Url: 2
IP: 3
File: 2
Hash: 30
Languages:
golang
Softs:
phpadmin
Platforms:
arm, riscv64, ppc64, mips, amd64
07-12-2022
Zerobot New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
https://www.fortinet.com/blog/threat-research/zerobot-new-go-based-botnet-campaign-targets-multiple-vulnerabilities
Threats:
Zerobot
Spring4shell
Hostile
Industry:
Iot
IOCs:
Url: 2
IP: 3
File: 2
Hash: 30
Languages:
golang
Softs:
phpadmin
Platforms:
arm, riscv64, ppc64, mips, amd64
Fortinet Blog
Zerobot – New Go-Based Botnet Campaign Targets Multiple Vulnerabilities
FortiGuardLabs examines a botnet known as Zerobot written in the Go language targeting IoT vulnerabilities. Read our blog to learn about how it evolves, including self-replication, attacks for diff…
#ParsedReport
07-12-2022
Magniber (11/29 ). Suspension of the dissemination of Magniber ransomware (after 11/29)
https://asec.ahnlab.com/ko/43442
Threats:
Magniber
Uac_bypass_technique
Ransomware/win.magniberxg20
Ransom/mdp.edit.m1947
07-12-2022
Magniber (11/29 ). Suspension of the dissemination of Magniber ransomware (after 11/29)
https://asec.ahnlab.com/ko/43442
Threats:
Magniber
Uac_bypass_technique
Ransomware/win.magniberxg20
Ransom/mdp.edit.m1947
ASEC BLOG
Magniber 랜섬웨어의 유포 중단 (11/29 이후) - ASEC BLOG
안랩 ASEC 분석팀은 도메인 오탈자를 악용한 타이포스쿼팅(Typosquatting) 방식을 통해 활발하게 유포되는 대표적인 악성코드인 매그니베르(Magniber) 랜섬웨어의 유포를 지속적인 모니터링 과정을 통해 신속하게 대응하고 있다. 이와 같은 지속적 대응을 통해 11/29일자 기준으로 매그니베르 랜섬웨어의 유포 중단 현황을 포착하였다. 최근 매그니베르 랜섬웨어 제작자는 확장자 변경, 인젝션, UAC 우회 기법 등의 다양한 백신 탐지 회피를 위한 시도를…
#ParsedReport
07-12-2022
An Update on HIVE Ransomware
https://www.avertium.com/resources/threat-reports/an-update-on-hive-ransomware
Threats:
Hive
Vssadmin_tool
Industry:
Energy, Financial, Government, Retail, Healthcare
Geo:
Quebec, Indias, Canada, Ontario
CVEs:
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 3.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 1.7,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
IOCs:
Domain: 4
Softs:
esxi, microsoft exchange server, macos
Algorithms:
zip
Languages:
golang
Links:
07-12-2022
An Update on HIVE Ransomware
https://www.avertium.com/resources/threat-reports/an-update-on-hive-ransomware
Threats:
Hive
Vssadmin_tool
Industry:
Energy, Financial, Government, Retail, Healthcare
Geo:
Quebec, Indias, Canada, Ontario
CVEs:
CVE-2021-34523 [Vulners]
Vulners: Score: 7.5, CVSS: 3.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-31207 [Vulners]
Vulners: Score: 6.5, CVSS: 1.7,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
CVE-2021-34473 [Vulners]
Vulners: Score: 10.0, CVSS: 2.8,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- microsoft exchange server (2013, 2019, 2016, 2016, 2019)
IOCs:
Domain: 4
Softs:
esxi, microsoft exchange server, macos
Algorithms:
zip
Languages:
golang
Links:
https://github.com/reecdeep/HiveV5\_file\_decryptor/blob/main/README.mdAvertium
An Update on HIVE Ransomware
Last month, CISA & the FBI released an advisory stating that HIVE ransomware attacks have continued, and they have attacked over 1300 businesses since 2021
#ParsedReport
07-12-2022
Torii. Reference materials:
https://mp.weixin.qq.com/s/2RluW4O56UWiNSQB2hQtGA
Actors/Campaigns:
Oceanlotus
Threats:
Torii_botnet
Mirai
Rotajakiro
Phantomlance
Kerrdown
Cobalt_strike
Industry:
Iot, Government
Geo:
China
TTPs:
Tactics: 3
Technics: 0
IOCs:
File: 6
Softs:
android, macos, crontab
Algorithms:
aes, gzip, aes-128, rc4
Platforms:
arm, x86, mips, x64
07-12-2022
Torii. Reference materials:
https://mp.weixin.qq.com/s/2RluW4O56UWiNSQB2hQtGA
Actors/Campaigns:
Oceanlotus
Threats:
Torii_botnet
Mirai
Rotajakiro
Phantomlance
Kerrdown
Cobalt_strike
Industry:
Iot, Government
Geo:
China
TTPs:
Tactics: 3
Technics: 0
IOCs:
File: 6
Softs:
android, macos, crontab
Algorithms:
aes, gzip, aes-128, rc4
Platforms:
arm, x86, mips, x64
Weixin Official Accounts Platform
海莲花组织Torii远控的网络攻击活动分析
海莲花组织使用Torii远控家族针对物联网设备的窃密控制活动。
#ParsedReport
07-12-2022
AndroxGh0st the python malware exploiting your AWS keys
https://www.lacework.com/blog/androxghost-the-python-malware-exploiting-your-aws-keys
Threats:
Androxgh0st
Xcatze_actor
Redline_stealer
IOCs:
IP: 1
Hash: 7
Url: 2
Softs:
laravel
Functions:
GetSendQuota, CreateUser-, CreateLoginProfile-, DeleteAccessKey-, CreateUser, CreateLoginProfile, DeleteAccessKey
Languages:
php, python
Platforms:
intel
Links:
07-12-2022
AndroxGh0st the python malware exploiting your AWS keys
https://www.lacework.com/blog/androxghost-the-python-malware-exploiting-your-aws-keys
Threats:
Androxgh0st
Xcatze_actor
Redline_stealer
IOCs:
IP: 1
Hash: 7
Url: 2
Softs:
laravel
Functions:
GetSendQuota, CreateUser-, CreateLoginProfile-, DeleteAccessKey-, CreateUser, CreateLoginProfile, DeleteAccessKey
Languages:
php, python
Platforms:
intel
Links:
https://github.com/search?q=%22androxgh0st%22&type=codehttps://github.com/lacework/lacework-labs/blob/master/blog/androxgh0st\_IOCs.csvFortinet
Cloud-Native Application Protection Platform (CNAPP)
Lacework FortiCNAPP is the most comprehensive cloud-native application protection platform available. AI-driven and organically developed, it empowers organizations to easily secure everything from code to cloud.
#ParsedReport
07-12-2022
Mustang Panda Uses the Russian-Ukrainian War to Attack Europe and Asia Pacific Targets
https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets
Actors/Campaigns:
Red_delta (motivation: cyber_espionage)
Threats:
Plugx_rat
Dll_sideloading_technique
Crashoverride
Romcom_rat
Industry:
Ngo, Telco, Education, Government, Financial
Geo:
Chinese, Vietnam, Pacific, Ukraine, China, Apac, Asia, Myanmar
TTPs:
Tactics: 6
Technics: 21
IOCs:
File: 6
Command: 1
Path: 1
IP: 11
Hash: 4
Softs:
component object model, keepass
Win API:
EnumThreadWindows, EnumSystemCodePagesW
Platforms:
intel
07-12-2022
Mustang Panda Uses the Russian-Ukrainian War to Attack Europe and Asia Pacific Targets
https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets
Actors/Campaigns:
Red_delta (motivation: cyber_espionage)
Threats:
Plugx_rat
Dll_sideloading_technique
Crashoverride
Romcom_rat
Industry:
Ngo, Telco, Education, Government, Financial
Geo:
Chinese, Vietnam, Pacific, Ukraine, China, Apac, Asia, Myanmar
TTPs:
Tactics: 6
Technics: 21
IOCs:
File: 6
Command: 1
Path: 1
IP: 11
Hash: 4
Softs:
component object model, keepass
Win API:
EnumThreadWindows, EnumSystemCodePagesW
Platforms:
intel
BlackBerry
Mustang Panda Uses the Russian-Ukrainian War to Attack Europe and Asia Pacific Targets
APT group Mustang Panda now appears to have Europe and Asia Pacific targets in its sights. The BlackBerry Research and Intelligence team recently unearthed evidence that the group may be using global interest in the Russian-Ukraine war to deliver PlugX malware…
#ParsedReport
07-12-2022
Top 10 macOS Malware Discoveries in 2022
https://www.sentinelone.com/blog/top-10-macos-malware-discoveries-in-2022
Actors/Campaigns:
Lazarus
Earth_berberoka
Emissary_panda
Threats:
Alchimist_tool
Chromeloader
Cloudmensis
Cratedepression
Dazzlespy
Gimmick
Pymafka
Pkexec_tool
Poseidon
Macma
Typosquatting_technique
Cobalt_strike
Upx_tool
Sliver_tool
Xcsset
Pirrit
Bundlore
Adload_loader
Geo:
Chinese, Asia, Korean
CVEs:
CVE-2021-4034 [Vulners]
Vulners: Score: 7.2, CVSS: 4.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- polkit project polkit (*)
- redhat enterprise linux desktop (7.0)
- redhat enterprise linux workstation (7.0)
- redhat enterprise linux for scientific computing (7.0)
- redhat enterprise linux server (7.0, 6.0)
have more...
CVE-2020-9934 [Vulners]
Vulners: Score: 2.1, CVSS: 2.3,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- apple ipad os (<13.6)
- apple iphone os (<13.6)
- apple mac os x (<10.15.6)
IOCs:
Hash: 29
File: 12
Url: 3
Domain: 4
IP: 1
Softs:
macos, unix, chrome, keychain, coinbase
Algorithms:
zip
Languages:
rust, objective_c, python
Platforms:
intel, apple, x86
07-12-2022
Top 10 macOS Malware Discoveries in 2022
https://www.sentinelone.com/blog/top-10-macos-malware-discoveries-in-2022
Actors/Campaigns:
Lazarus
Earth_berberoka
Emissary_panda
Threats:
Alchimist_tool
Chromeloader
Cloudmensis
Cratedepression
Dazzlespy
Gimmick
Pymafka
Pkexec_tool
Poseidon
Macma
Typosquatting_technique
Cobalt_strike
Upx_tool
Sliver_tool
Xcsset
Pirrit
Bundlore
Adload_loader
Geo:
Chinese, Asia, Korean
CVEs:
CVE-2021-4034 [Vulners]
Vulners: Score: 7.2, CVSS: 4.4,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- polkit project polkit (*)
- redhat enterprise linux desktop (7.0)
- redhat enterprise linux workstation (7.0)
- redhat enterprise linux for scientific computing (7.0)
- redhat enterprise linux server (7.0, 6.0)
have more...
CVE-2020-9934 [Vulners]
Vulners: Score: 2.1, CVSS: 2.3,
Vulners: Exploitation: True
X-Force: Risk: Unknown
X-Force: Patch: Unknown
Soft:
- apple ipad os (<13.6)
- apple iphone os (<13.6)
- apple mac os x (<10.15.6)
IOCs:
Hash: 29
File: 12
Url: 3
Domain: 4
IP: 1
Softs:
macos, unix, chrome, keychain, coinbase
Algorithms:
zip
Languages:
rust, objective_c, python
Platforms:
intel, apple, x86
SentinelOne
Top 10 macOS Malware Discoveries in 2022
Learn about all the new malware targeting macOS users in 2022 and how to stay safe from the latest Mac-focused campaigns.
#ParsedReport
08-12-2022
Phishing Email Impersonating Quasi-governmental Organization Being Distributed
https://asec.ahnlab.com/en/43596
Geo:
Korea
IOCs:
Url: 2
08-12-2022
Phishing Email Impersonating Quasi-governmental Organization Being Distributed
https://asec.ahnlab.com/en/43596
Geo:
Korea
IOCs:
Url: 2
ASEC BLOG
Phishing Email Impersonating Quasi-governmental Organization Being Distributed - ASEC BLOG
The ASEC analysis team has recently detected the distribution of a phishing email impersonating a non-profit quasi-governmental organization. Since the email is using a webpage disguised as a login page of GobizKOREA serviced by Korea SMEs and Startups Agency…
#ParsedReport
08-12-2022
ASEC Weekly Malware Statistics (November 28th, 2022 December 4th, 2022)
https://asec.ahnlab.com/en/43544
Threats:
Smokeloader
Agent_tesla
Vidar_stealer
Clipbanker
Redline_stealer
Beamwinhttp_loader
Industry:
Financial
Geo:
Korea
IOCs:
File: 9
Email: 5
Url: 9
IP: 6
Softs:
telegram
Languages:
php
08-12-2022
ASEC Weekly Malware Statistics (November 28th, 2022 December 4th, 2022)
https://asec.ahnlab.com/en/43544
Threats:
Smokeloader
Agent_tesla
Vidar_stealer
Clipbanker
Redline_stealer
Beamwinhttp_loader
Industry:
Financial
Geo:
Korea
IOCs:
File: 9
Email: 5
Url: 9
IP: 6
Softs:
telegram
Languages:
php
ASEC BLOG
ASEC Weekly Malware Statistics (November 28th, 2022 – December 4th, 2022) - ASEC BLOG
The ASEC analysis team uses the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from November 28th, 2022 (Monday) to December 4th, 2022 (Sunday). For the main category, Infostealer…
#ParsedReport
08-12-2022
ASEC Weekly Phishing Email Threat Trend (November 20th, 2022 November 26th, 2022)
https://asec.ahnlab.com/en/43570
Threats:
Agent_tesla
Formbook
Purecrypter
Industry:
Financial, Transport
Geo:
Mongolian, Korean
TTPs:
IOCs:
File: 43
Url: 9
Algorithms:
zip
08-12-2022
ASEC Weekly Phishing Email Threat Trend (November 20th, 2022 November 26th, 2022)
https://asec.ahnlab.com/en/43570
Threats:
Agent_tesla
Formbook
Purecrypter
Industry:
Financial, Transport
Geo:
Mongolian, Korean
TTPs:
IOCs:
File: 43
Url: 9
Algorithms:
zip
ASEC BLOG
ASEC Weekly Phishing Email Threat Trend (November 20th, 2022 – November 26th, 2022) - ASEC BLOG
The ASEC analysis team monitors phishing email threats with the ASEC automatic sample analysis system (RAPIT) and Honeypot. This post will cover the cases of distribution of phishing emails during the week from November 20th, 2022 to November 26th, 2022 and…
#ParsedReport
08-12-2022
DeathStalker targets legal entities with new Janicab variant
https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131
Actors/Campaigns:
Evilnum
Threats:
Janicab
Dead_drop_technique
Powersing
Powerpepper
Plink
Beacon
Icmpshell_tool
Procdump_tool
Industry:
Financial
Geo:
Egypt, Emirates, Georgia, Bulgaria
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 26
Registry: 1
IP: 4
Hash: 19
Url: 3
Softs:
macos, virtualbox, internet explorer, sysinternals
Algorithms:
base64, zip
Functions:
isVmDrivers, isVmMAC, isVmProduct, InternetExplorer, checkRunningProcess, delFFcookies, delGCcookies, delIEcookies, isMalwb, HandleCCleaner, have more...
Languages:
php, python
Platforms:
apple, intel
Links:
08-12-2022
DeathStalker targets legal entities with new Janicab variant
https://securelist.com/deathstalker-targets-legal-entities-with-new-janicab-variant/108131
Actors/Campaigns:
Evilnum
Threats:
Janicab
Dead_drop_technique
Powersing
Powerpepper
Plink
Beacon
Icmpshell_tool
Procdump_tool
Industry:
Financial
Geo:
Egypt, Emirates, Georgia, Bulgaria
TTPs:
Tactics: 1
Technics: 0
IOCs:
File: 26
Registry: 1
IP: 4
Hash: 19
Url: 3
Softs:
macos, virtualbox, internet explorer, sysinternals
Algorithms:
base64, zip
Functions:
isVmDrivers, isVmMAC, isVmProduct, InternetExplorer, checkRunningProcess, delFFcookies, delGCcookies, delIEcookies, isMalwb, HandleCCleaner, have more...
Languages:
php, python
Platforms:
apple, intel
Links:
https://github.com/bdamele/icmpshSecurelist
DeathStalker targets legal entities with new Janicab variant
While hunting for less common Deathstalker intrusions, we identified a new Janicab variant used in targeting legal entities in the Middle East throughout 2020.
#ParsedReport
08-12-2022
STOP. Stop ransomware domestic distribution
https://asec.ahnlab.com/ko/43680
Threats:
Smokeloader
Trojan/win.generic.r533564
Raccoon_stealer
Ransomware/win.extensions.c5314354
Beamwinhttp_loader
Industry:
Financial
Geo:
Uzbekistan, Russia, Azerbaijan, Belarus, Tajikistan, Armenia, Ukraine, Kazakhstan, Syria, Kyrgyzstan
IOCs:
File: 7
Path: 6
Registry: 1
Hash: 7
Url: 3
Softs:
task scheduler
Languages:
php
Platforms:
intel, x86
08-12-2022
STOP. Stop ransomware domestic distribution
https://asec.ahnlab.com/ko/43680
Threats:
Smokeloader
Trojan/win.generic.r533564
Raccoon_stealer
Ransomware/win.extensions.c5314354
Beamwinhttp_loader
Industry:
Financial
Geo:
Uzbekistan, Russia, Azerbaijan, Belarus, Tajikistan, Armenia, Ukraine, Kazakhstan, Syria, Kyrgyzstan
IOCs:
File: 7
Path: 6
Registry: 1
Hash: 7
Url: 3
Softs:
task scheduler
Languages:
php
Platforms:
intel, x86
ASEC BLOG
STOP 랜섬웨어 국내 유포 중 - ASEC BLOG
ASEC 분석팀은 STOP 랜섬웨어가 국내에 유포되고 있음을 확인하였다. 해당 랜섬웨어는 ASEC 주간 악성코드 통계 (20221128 ~ 20221204)에서 Top3를 차지하고 있을 정도로 다수 유포되고 있다. 최근 유포되는 파일은 SmokeLoader, Vidar와 같이 MalPe 외형을 지니는 것이 특징이다. STOP 랜섬웨어는 실행 시 먼저 hxxps://api.2ip.ua/geo.json에 접속하여 country code를 확인한다. 아래에…
#ParsedReport
08-12-2022
Multiple Indian Entities Targeted by the Khalifah Cyber Crew Under the #OpsBantaiKaw2 Campaign
https://cloudsek.com/threatintelligence/multiple-indian-entities-targeted-by-the-khalifah-cyber-crew-under-the-opsbantaikaw2-campaign/
Actors/Campaigns:
Khalifah_cybercrew
Opsbantaikaw
Geo:
Indian
08-12-2022
Multiple Indian Entities Targeted by the Khalifah Cyber Crew Under the #OpsBantaiKaw2 Campaign
https://cloudsek.com/threatintelligence/multiple-indian-entities-targeted-by-the-khalifah-cyber-crew-under-the-opsbantaikaw2-campaign/
Actors/Campaigns:
Khalifah_cybercrew
Opsbantaikaw
Geo:
Indian
Cloudsek
Multiple Indian Entities Targeted by the Khalifah Cyber Crew Under the #OpsBantaiKaw2 Campaign | Threat Intelligence | CloudSEK
CloudSEK’s contextual AI digital risk platform XVigil discovered a tweet by the threat group “Khalifah Cyber Crew” announcing a new campaign “OpsBantaiKaw2” for targeting Indian websites.
#ParsedReport
08-12-2022
Lazarus group uses fake cryptocurrency apps to plant AppleJeus malware
https://www.malwarebytes.com/blog/news/2022/12/lazarus-group-uses-fake-cryptocurrency-apps-to-plant-applejeus-malware
Actors/Campaigns:
Lazarus
Threats:
Applejeus
Dll_sideloading_technique
Industry:
Government, Financial
Geo:
Korean
IOCs:
Domain: 6
File: 4
Path: 4
Softs:
microsoft office, qtbitcointrader
Functions:
OpenDrive
Links:
08-12-2022
Lazarus group uses fake cryptocurrency apps to plant AppleJeus malware
https://www.malwarebytes.com/blog/news/2022/12/lazarus-group-uses-fake-cryptocurrency-apps-to-plant-applejeus-malware
Actors/Campaigns:
Lazarus
Threats:
Applejeus
Dll_sideloading_technique
Industry:
Government, Financial
Geo:
Korean
IOCs:
Domain: 6
File: 4
Path: 4
Softs:
microsoft office, qtbitcointrader
Functions:
OpenDrive
Links:
https://github.com/JulyIGHOR/QtBitcoinTraderMalwarebytes
Lazarus group uses fake cryptocurrency apps to plant AppleJeus malware
Researchers have found a new Lazarus campaign, once again targeting cryptocurrency users and organizations by deploying a fake website and malicious documents.
#ParsedReport
08-12-2022
SpiderLabs Blog. Trojanized OneNote Document Leads to Formbook Malware
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware
Threats:
Formbook
IOCs:
File: 2
Domain: 1
Hash: 3
Softs:
onenote
08-12-2022
SpiderLabs Blog. Trojanized OneNote Document Leads to Formbook Malware
https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware
Threats:
Formbook
IOCs:
File: 2
Domain: 1
Hash: 3
Softs:
onenote
Trustwave
Trojanized OneNote Document Leads to Formbook Malware | Trustwave
Cybercriminals have long used Microsoft documents to pass along malware and they are always experimenting with new ways to deliver malicious packages. As defenders, Trustwave SpiderLabs’ researchers are always looking out for new or unusual file types, and…
#ParsedReport
08-12-2022
APT-C-56. 1. Analysis of attack activities
https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w
Actors/Campaigns:
Transparenttribe
Comment_crew
Manling_flower
Threats:
Spynote_rat
Sonicspy
Ahmyth_rat
Metasploit_tool
Asyncrat_rat
Beacon
Industry:
Government
Geo:
Syrian, Pakistan, Pakistani, Asia
IOCs:
File: 6
Hash: 23
Softs:
android
08-12-2022
APT-C-56. 1. Analysis of attack activities
https://mp.weixin.qq.com/s/J_A12SOX0k5TOYFAegBv_w
Actors/Campaigns:
Transparenttribe
Comment_crew
Manling_flower
Threats:
Spynote_rat
Sonicspy
Ahmyth_rat
Metasploit_tool
Asyncrat_rat
Beacon
Industry:
Government
Geo:
Syrian, Pakistan, Pakistani, Asia
IOCs:
File: 6
Hash: 23
Softs:
android
Weixin Official Accounts Platform
疑似APT-C-56（透明部落）针对恐怖主义的攻击活动分析
360烽火实验发现了一批疑似APT-C-56（透明部落）针对恐怖主义发起攻击的恶意样本，通过溯源关联分析发现，攻击活动至少开始于2018年6月，至今仍处于活跃状态