Hide Navigation Hide TOC

Edit

Tool

threat-actor-tools is an enumeration of tools used by adversaries. The list includes malware but also common software regularly used by the adversaries.

Authors

Authors and/or Contributors
Alexandre Dulaunoy
Florian Roth
Timo Steffens
Christophe Vandeplas
Dennis Rand
raw-data

Tinba

Banking Malware

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Tinba.

Known Synonyms
Hunter
TinyBanker
Zusy

Internal MISP references

UUID 75f53ead-1aee-4f91-8cb9-b4170d747cfc which can be used as unique global reference for Tinba in MISP communities and other software using the MISP galaxy

External references

• https://thehackernews.com/search/label/Zusy%20Malware - webarchive
• http://blog.trendmicro.com/trendlabs-security-intelligence/the-tinbatinybanker-malware/ - webarchive

Associated metadata

Metadata key	Value
type	['Banking']

Related clusters

To see the related clusters, click here.

PlugX

Malware

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PlugX.

Known Synonyms
Agent.dhwf
Backdoor.FSZO-5117
Korplug
Trojan.Heur.JP.juW@ayZZvMb
Trojan.Inject1.6386

Internal MISP references

UUID f4b159ea-97e5-483b-854b-c48a78d562aa which can be used as unique global reference for PlugX in MISP communities and other software using the MISP galaxy

External references

• https://www.trendmicro.com/vinfo/us/threat-encyclopedia/web-attack/112/pulling-the-plug-on-plugx - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

MSUpdater

Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009

Internal MISP references

UUID f85d2d5a-6e3c-44e4-bd3b-6100c04b4ba9 which can be used as unique global reference for MSUpdater in MISP communities and other software using the MISP galaxy

External references

• https://www.zscaler.com/pdf/whitepapers/msupdater_trojan_whitepaper.pdfx - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Lazagne

A password sthealing tool regularly used by attackers

Internal MISP references

UUID d0394d50-5316-4405-aa77-1070bdf68b6a which can be used as unique global reference for Lazagne in MISP communities and other software using the MISP galaxy

External references

• https://github.com/AlessandroZ/LaZagne - webarchive

Associated metadata

Metadata key	Value
type	['HackTool']

Related clusters

To see the related clusters, click here.

Poison Ivy

Poison Ivy is a RAT which was freely available and first released in 2005.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Poison Ivy.

Known Synonyms
Backdoor.Win32.PoisonIvy
Gen:Trojan.Heur.PT

Internal MISP references

UUID 2abe89de-46dd-4dae-ae22-b49a593aff54 which can be used as unique global reference for Poison Ivy in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-poison-ivy.pdf - webarchive
• https://www.f-secure.com/v-descs/backdoor_w32_poisonivy.shtml - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

SPIVY

In March 2016, Unit 42 observed this new Poison Ivy variant we’ve named SPIVY being deployed via weaponized documents leveraging CVE-2015-2545.

Internal MISP references

UUID a3d2e7fe-a8e4-48c7-8d47-b9430898af08 which can be used as unique global reference for SPIVY in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/04/unit42-new-poison-ivy-rat-variant-targets-hong-kong-pro-democracy-activists/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Torn RAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Torn RAT.

Known Synonyms
Anchor Panda

Internal MISP references

UUID 32a67552-3b31-47bb-8098-078099bbc813 which can be used as unique global reference for Torn RAT in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/whois-anchor-panda/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

OzoneRAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OzoneRAT.

Known Synonyms
Ozone RAT
ozonercp

Internal MISP references

UUID e3010d81-94e2-43a9-98ed-61925b02be6e which can be used as unique global reference for OzoneRAT in MISP communities and other software using the MISP galaxy

External references

• https://blog.fortinet.com/2016/08/29/german-speakers-targeted-by-spam-leading-to-ozone-rat - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

ZeGhost

ZeGhots is a RAT which was freely available and first released in 2014.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZeGhost.

Known Synonyms
BackDoor-FBZT!52D84425CDF2
Trojan.Win32.Staser.ytq
Win32/Zegost.BW

Internal MISP references

UUID c7706d12-fb62-4db6-bbe3-fef2da0181e7 which can be used as unique global reference for ZeGhost in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?Name=Backdoor%3aWin32%2fZegost.BW - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Elise Backdoor

Trojan (RAT) linked to current targeted attacks and others dating back to at least early 2009

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Elise Backdoor.

Known Synonyms
Elise

Internal MISP references

UUID d70fd29d-590e-4ed5-b72f-6ce0142019c6 which can be used as unique global reference for Elise Backdoor in MISP communities and other software using the MISP galaxy

External references

• http://thehackernews.com/2015/08/elise-malware-hacking.html - webarchive

Associated metadata

Metadata key	Value
type	['dropper', 'PWS']

Related clusters

To see the related clusters, click here.

Trojan.Laziok

A new information stealer, Trojan.Laziok, acts as a reconnaissance tool allowing attackers to gather information and tailor their attack methods for each compromised computer.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Laziok.

Known Synonyms
Laziok

Internal MISP references

UUID 7ccd3821-e825-4ff8-b4be-92c9732ce708 which can be used as unique global reference for Trojan.Laziok in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/connect/blogs/new-reconnaissance-threat-trojanlaziok-targets-energy-sector - webarchive

Associated metadata

Metadata key	Value
type	['PWS', 'reco']

Related clusters

To see the related clusters, click here.

Slempo

Android-based malware

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Slempo.

Known Synonyms
Acecard
Bankosy
GM-Bot
SlemBunk

Internal MISP references

UUID f8047de2-fefc-4ee0-825b-f1fae4b20c09 which can be used as unique global reference for Slempo in MISP communities and other software using the MISP galaxy

External references

• https://securityintelligence.com/android-malware-about-to-get-worse-gm-bot-source-code-leaked/ - webarchive

Associated metadata

Metadata key	Value
type	['Spyware', 'AndroidOS']

Related clusters

To see the related clusters, click here.

PWOBot

We have discovered a malware family named ‘PWOBot’ that is fairly unique because it is written entirely in Python, and compiled via PyInstaller to generate a Microsoft Windows executable. The malware has been witnessed affecting a number of Europe-based organizations, particularly in Poland. Additionally, the malware is delivered via a popular Polish file-sharing web service.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PWOBot.

Known Synonyms
PWOHTTPD
PWOKeyLogger
PWOLauncher
PWOMiner
PWOPyExec
PWOQuery

Internal MISP references

UUID 17de0952-3841-44d3-b03a-cc90e123d2b8 which can be used as unique global reference for PWOBot in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/04/unit42-python-based-pwobot-targets-european-organizations/ - webarchive

Associated metadata

Metadata key	Value
type	['Dropper', 'Miner', 'Spyware']

Lost Door RAT

We recently came across a cyber attack that used a remote access Trojan (RAT) called Lost Door, a tool currently offered on social media sites. What also struck us the most about this RAT (detected as BKDR_LODORAT.A) is how it abuses the Port Forward feature in routers.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Lost Door RAT.

Known Synonyms
BKDR_LODORAT
LostDoor RAT

Internal MISP references

UUID 6d0b7543-a6e5-49fc-832e-bd594460187c which can be used as unique global reference for Lost Door RAT in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/lost-door-rat-accessible-customizable-attack-tool/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

njRAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular njRAT.

Known Synonyms
Bladabindi
Jorik

Internal MISP references

UUID a860d257-4a39-47ec-9230-94cac67ebf7e which can be used as unique global reference for njRAT in MISP communities and other software using the MISP galaxy

External references

• http://www.fidelissecurity.com/files/files/FTA_1009-njRAT_Uncovered_rev2.pdf - webarchive
• https://github.com/kevthehermit/RATDecoders/blob/master/yaraRules/njRat.yar - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

NanoCoreRAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NanoCoreRAT.

Known Synonyms
Atros2.CKPN
Nancrat
NanoCore
Zurten

Internal MISP references

UUID a8111fb7-d4c4-4671-a6f9-f62fea8bad60 which can be used as unique global reference for NanoCoreRAT in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/connect/blogs/nanocore-another-rat-tries-make-it-out-gutter - webarchive
• https://nanocore.io/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Sakula

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sakula.

Known Synonyms
Sakurel

Internal MISP references

UUID f6c137f0-979c-4ce2-a0e5-2a080a5a1746 which can be used as unique global reference for Sakula in MISP communities and other software using the MISP galaxy

External references

• https://www.secureworks.com/research/sakula-malware-family - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Hi-ZOR

Internal MISP references

UUID e8fbb7b4-2f27-4028-975a-485d4c2dd977 which can be used as unique global reference for Hi-ZOR in MISP communities and other software using the MISP galaxy

External references

• http://www.threatgeek.com/2016/01/introducing-hi-zor-rat.html - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Derusbi

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Derusbi.

Known Synonyms
TROJ_DLLSERV.BE

Internal MISP references

UUID eff68b97-f36e-4827-ab1a-90523c16774c which can be used as unique global reference for Derusbi in MISP communities and other software using the MISP galaxy

External references

• http://www.novetta.com/wp-content/uploads/2014/11/Derusbi.pdf - webarchive
• https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

EvilGrab

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EvilGrab.

Known Synonyms
BKDR_EVILOGE
BKDR_HGDER
BKDR_NVICM
Wmonder

Internal MISP references

UUID c9b4ec27-0a43-4671-a967-bcac5df0e056 which can be used as unique global reference for EvilGrab in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/evilgrab-malware-family-used-in-targeted-attacks-in-asia/ - webarchive
• http://researchcenter.paloaltonetworks.com/2015/06/evilgrab-delivered-by-watering-hole-attack-on-president-of-myanmars-website/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Trojan.Naid

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Naid.

Known Synonyms
AGENT.ABQMR
AGENT.AQUP.DROPPER
AGENT.BMZA
AGENT.GUNZ
MCRAT.A
Mdmbot.E
Naid

Internal MISP references

UUID 170db76b-93f7-4fd1-97fc-55937c079b66 which can be used as unique global reference for Trojan.Naid in MISP communities and other software using the MISP galaxy

External references

• https://www.symantec.com/connect/blogs/cve-2012-1875-exploited-wild-part-1-trojannaid - webarchive
• http://telussecuritylabs.com/threats/show/TSL20120614-05 - webarchive

Associated metadata

Metadata key	Value
type	['Dropper']

Related clusters

To see the related clusters, click here.

Moudoor

Backdoor.Moudoor, a customized version of Gh0st RAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Moudoor.

Known Synonyms
KillProc.14145
SCAR

Internal MISP references

UUID 46fd9884-208c-43c7-8ec3-b9fabce30b30 which can be used as unique global reference for Moudoor in MISP communities and other software using the MISP galaxy

External references

• http://www.darkreading.com/attacks-breaches/elite-chinese-cyberspy-group-behind-bit9-hack/d/d-id/1140495 - webarchive
• https://securityledger.com/2013/09/apt-for-hire-symantec-outs-hidden-lynx-hacking-crew/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

NetTraveler

APT that infected hundreds of high profile victims in more than 40 countries. Known targets of NetTraveler include Tibetan/Uyghur activists, oil industry companies, scientific research centers and institutes, universities, private companies, governments and governmental institutions, embassies and military contractors.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NetTraveler.

Known Synonyms
Netfile
TravNet

Internal MISP references

UUID 59b70721-6fed-4805-afa5-4ff2554bef81 which can be used as unique global reference for NetTraveler in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/blog/incidents/57455/nettraveler-is-back-the-red-star-apt-returns-with-new-tricks/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Winnti

APT used As part of Operation SMN, Novetta analyzed recent versions of the Winnti malware. The samples, compiled from mid- to late 2014, exhibited minimal functional changes over the previous generations Kaspersky reported in 2013.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Winnti.

Known Synonyms
Agent.ALQHI
Etso
HIGHNOON
RbDoor
RibDoor
SUQ

Internal MISP references

UUID 9b3a4cff-1c5a-4fd6-b49c-27240b6d622c which can be used as unique global reference for Winnti in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/blog/incidents/57455/nettraveler-is-back-the-red-star-apt-returns-with-new-tricks/ - webarchive
• https://kasperskycontenthub.com/wp-content/uploads/sites/43/vlpdfs/winnti-more-than-just-a-game-130410.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Mimikatz

Ease Credential stealh and replay, A little tool to play with Windows security.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mimikatz.

Known Synonyms
Mikatz

Internal MISP references

UUID 7f3a035d-d83a-45b8-8111-412aa8ade802 which can be used as unique global reference for Mimikatz in MISP communities and other software using the MISP galaxy

External references

• https://github.com/gentilkiwi/mimikatz - webarchive
• https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/ - webarchive
• https://www.ncsc.gov.uk/content/files/protected_files/article_files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf - webarchive

Associated metadata

Metadata key	Value
type	['HackTool']

Related clusters

To see the related clusters, click here.

WEBC2

Backdoor attribued to APT1

Internal MISP references

UUID b5be84b7-bf2c-40d0-85a9-14c040881a98 which can be used as unique global reference for WEBC2 in MISP communities and other software using the MISP galaxy

External references

• https://github.com/gnaegle/cse4990-practical3 - webarchive
• https://www.securestate.com/blog/2013/02/20/apt-if-it-aint-broke - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Pirpi

Symantec has observed Buckeye activity dating back to 2009, involving attacks on various organizations in several regions. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. The group delivered Backdoor.Pirpi through malicious attachments or links in convincing spear-phishing emails.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Pirpi.

Known Synonyms
Badey
EXL

Internal MISP references

UUID 4859330d-c6a5-4b9c-b45b-536ec983cd4a which can be used as unique global reference for Pirpi in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

RARSTONE

RARSTONE is a Remote Access Tool (RAT) discovered early 2013 by TrendMicro, it’s characterized by a great affinity with the other RAT know as Plug is and was used in April for phishing campaigns that followed the dramatic attack to the Boston Marathon.

Internal MISP references

UUID 5d2dd6ad-6bb2-45d3-b295-e125d3399c8d which can be used as unique global reference for RARSTONE in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/ - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Backspace

Backspace is a Backdoor that targets the Windows platform. This malware is reportedly associated with targeted attacks against Association of Southeast Asian Nations (ASEAN) members (APT30).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Backspace.

Known Synonyms
Lecna

Internal MISP references

UUID cd6c5f27-cf7e-4529-ae9c-ab5b85102bde which can be used as unique global reference for Backspace in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/WEB-2015RPTAPT30.html - webarchive
• https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

XSControl

Backdoor user by he Naikon APT group

Internal MISP references

UUID 2e3712e3-fd7b-43d1-8b4f-2ba7fc551bbb which can be used as unique global reference for XSControl in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/analysis/publications/69953/the-naikon-apt/ - webarchive
• https://kasperskycontenthub.com/securelist/files/2015/05/TheNaikonAPT-MsnMM.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Neteagle

NETEAGLE is a backdoor developed by APT30 with compile dates as early as 2008. It has two main variants known as Scout and Norton.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Neteagle.

Known Synonyms
norton
scout

Internal MISP references

UUID 0ee08ab5-140c-44c3-9b0a-4a352500b14e which can be used as unique global reference for Neteagle in MISP communities and other software using the MISP galaxy

External references

• https://attack.mitre.org/wiki/Software/S0034 - webarchive
• https://www2.fireeye.com/rs/fireye/images/rpt-apt30.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Agent.BTZ

In November 2014, the experts of the G DATA SecurityLabs published an article about ComRAT, the Agent.BTZ successor. We explained that this case is linked to the Uroburos rootkit.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent.BTZ.

Known Synonyms
ComRat

Internal MISP references

UUID da079741-05e6-458c-b434-011263dc691c which can be used as unique global reference for Agent.BTZ in MISP communities and other software using the MISP galaxy

External references

• https://blog.gdatasoftware.com/2015/01/23927-evolution-of-sophisticated-spyware-from-agent-btz-to-comrat - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Heseber BOT

RAT bundle with standard VNC (to avoid/limit A/V detection).

Internal MISP references

UUID b1b7e7d8-3778-4783-9cc7-9ec04b146031 which can be used as unique global reference for Heseber BOT in MISP communities and other software using the MISP galaxy

Agent.dne

Internal MISP references

UUID 93fe1644-a7a6-4e5a-bc3b-88984b251fde which can be used as unique global reference for Agent.dne in MISP communities and other software using the MISP galaxy

Wipbot

Waterbug is the name given to the actors who use the malware tools Trojan.Wipbot (also known as Tavdig and Epic Turla)

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Wipbot.

Known Synonyms
Epic Turla
TadjMakhal
Tavdig
WorldCupSec

Internal MISP references

UUID 36c0faf0-428e-4e7f-93c5-824bb0495ac9 which can be used as unique global reference for Wipbot in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/analysis/publications/65545/the-epic-turla-operation/ - webarchive
• https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Turla

Family of related sophisticated backdoor software - Name comes from Microsoft detection signature – anagram of Ultra (Ultra3) was a name of the fake driver). A macOS version exists but appears incomplete and lacking features...for now!

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Turla.

Known Synonyms
Snake
Uroburos
Urouros

Internal MISP references

UUID 22332d52-c0c2-443c-9ffb-f08c0d23722c which can be used as unique global reference for Turla in MISP communities and other software using the MISP galaxy

External references

• https://www.first.org/resources/papers/tbilisi2014/turla-operations_and_development.pdf - webarchive
• https://objective-see.com/blog/blog_0x25.html#Snake - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor', 'Rootkit']

Related clusters

To see the related clusters, click here.

Winexe

Internal MISP references

UUID 811bdec0-e236-48ae-b27c-1a8fe0bfc3a9 which can be used as unique global reference for Winexe in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Dark Comet

RAT initialy identified in 2011 and still actively used.

Internal MISP references

UUID 9ad11139-e928-45cf-a0b4-937290642e92 which can be used as unique global reference for Dark Comet in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Cadelspy

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Cadelspy.

Known Synonyms
WinSpy

Internal MISP references

UUID 38d6a0a1-0388-40d4-b8f4-1d58eeb9a07d which can be used as unique global reference for Cadelspy in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CMStar

Internal MISP references

UUID e81b96a2-22e9-445e-88c7-65b67c2299ec which can be used as unique global reference for CMStar in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/03/digital-quartermaster-scenario-demonstrated-in-attacks-against-the-mongolian-government/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DHS2015

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DHS2015.

Known Synonyms
iRAT

Internal MISP references

UUID d6420953-0e85-4330-abc2-3a8b9dda046b which can be used as unique global reference for DHS2015 in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/files/2015/02/The-Desert-Falcons-targeted-attacks.pdf - webarchive

Associated metadata

Metadata key	Value

Gh0st Rat

Gh0st Rat is a well-known Chinese remote access trojan which was originally made by C.Rufus Security Team several years ago. GH0ST is a backdoor written in C++ that communicates via a custom binary protocol over TCP or UDP. It typically features a packet signature at the start of each message that varies between samples. Availability: Public

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gh0st Rat.

Known Synonyms
Gh0stRat, GhostRat

Internal MISP references

UUID cb8c8253-4024-4cc9-8989-b4a5f95f6c2f which can be used as unique global reference for Gh0st Rat in MISP communities and other software using the MISP galaxy

External references

• http://download01.norman.no/documents/ThemanyfacesofGh0stRat.pdf - webarchive
• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Fakem RAT

Fakem RAT makes their network traffic look like well-known protocols (e.g. Messenger traffic, HTML pages).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fakem RAT.

Known Synonyms
FAKEM

Internal MISP references

UUID eead5605-0d79-4942-a6c2-efa6853cdf6b which can be used as unique global reference for Fakem RAT in MISP communities and other software using the MISP galaxy

External references

• http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-fakem-rat.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MFC Huner

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MFC Huner.

Known Synonyms
BKDR_HUPIGON
Hupigon

Internal MISP references

UUID a5a48311-afbf-44c4-8045-46ffd51cd4d0 which can be used as unique global reference for MFC Huner in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/japan-us-defense-industries-among-targeted-entities-in-latest-attack/ - webarchive

Associated metadata

Metadata key	Value

Blackshades

Blackshades Remote Access Tool targets Microsoft Windows operating systems. Authors were arrested in 2012 and 2014.

Internal MISP references

UUID 8c3202d5-1671-46ec-9d42-cb50dbe2f667 which can be used as unique global reference for Blackshades in MISP communities and other software using the MISP galaxy

External references

• https://www.justice.gov/usao-sdny/pr/manhattan-us-attorney-and-fbi-assistant-director-charge-announce-charges-connection - webarchive
• https://blog.malwarebytes.org/intelligence/2012/06/you-dirty-rat-part-2-blackshades-net/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CHOPSTICK

backdoor used by apt28

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CHOPSTICK.

Known Synonyms
(.v2 fysbis)
SPLM
webhp

Internal MISP references

UUID 0a32ceea-fa66-47ab-8bde-150dbd6d2e40 which can be used as unique global reference for CHOPSTICK in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf - webarchive

Associated metadata

Metadata key	Value
possible_issues	Report tells that is could be Xagent alias (Java Rat)
type	['Backdoor']

Related clusters

To see the related clusters, click here.

EVILTOSS

backdoor used by apt28

Sedreco serves as a spying backdoor; its functionalities can be extended with dynamically loaded plugins. It is made up of two distinct components: a dropper and the persistent payload installed by this dropper. We have not seen this component since April 2016.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular EVILTOSS.

Known Synonyms
ADVSTORESHELL
AZZY
NETUI
Sedreco

Internal MISP references

UUID 6374fc53-9a0d-41ba-b9cf-2a9765d69fbb which can be used as unique global reference for EVILTOSS in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf - webarchive

Associated metadata

Metadata key	Value
possible_issues	Report tells that is could be Xagent alias (Java Rat)
type	['Backdoor']

Related clusters

To see the related clusters, click here.

GAMEFISH

backdoor

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GAMEFISH.

Known Synonyms
JHUHUGIT
Sednit
Seduploader
Sofacy

Internal MISP references

UUID 43cd8a09-9c80-48c8-9568-1992433af60a which can be used as unique global reference for GAMEFISH in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

SOURFACE

downloader - Older version of CORESHELL

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SOURFACE.

Known Synonyms
Sofacy

Internal MISP references

UUID 1de47f51-1f20-403b-a2e1-5eaabe275faa which can be used as unique global reference for SOURFACE in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

OLDBAIT

credential harvester

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OLDBAIT.

Known Synonyms
BackDoor-FDU
IEChecker
Sasfis

Internal MISP references

UUID 6d1e2736-d363-49aa-9054-9c9e4ac0c520 which can be used as unique global reference for OLDBAIT in MISP communities and other software using the MISP galaxy

External references

• https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/troj_sasfis.tl - webarchive
• https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf - webarchive

Associated metadata

Metadata key	Value
type	['PWS']

Related clusters

To see the related clusters, click here.

CORESHELL

downloader - Newer version of SOURFACE

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CORESHELL.

Known Synonyms
Sofacy

Internal MISP references

UUID 3948ce95-468e-4ce1-82b1-57439c6d6afd which can be used as unique global reference for CORESHELL in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/APT28-Center-of-Storm-2017.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Havex RAT

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Havex RAT.

Known Synonyms
Havex

Internal MISP references

UUID d7183f66-59ec-4803-be20-237b442259fc which can be used as unique global reference for Havex RAT in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

KjW0rm

RAT initially written in VB.

Internal MISP references

UUID b3f7a454-3b23-4149-99aa-0132323814d0 which can be used as unique global reference for KjW0rm in MISP communities and other software using the MISP galaxy

External references

• https://www.sentinelone.com/blog/understanding-kjw0rm-malware-we-dive-in-to-the-tv5-cyber-attack/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TinyTyphon

Internal MISP references

UUID 1b591586-e1ef-4a32-8dae-791aca5ddf41 which can be used as unique global reference for TinyTyphon in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Badnews

Internal MISP references

UUID 48ca79ff-ea36-4a47-8231-0f7f0db0e09e which can be used as unique global reference for Badnews in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

LURK

Internal MISP references

UUID fcece2f7-e0ef-44e0-aa9f-578c2a56f532 which can be used as unique global reference for LURK in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Oldrea

Internal MISP references

UUID f2e17736-9575-4a91-92ab-bb82bb0bf900 which can be used as unique global reference for Oldrea in MISP communities and other software using the MISP galaxy

AmmyAdmin

Internal MISP references

UUID d1006b04-3015-49ea-9414-a968a0f74106 which can be used as unique global reference for AmmyAdmin in MISP communities and other software using the MISP galaxy

Matryoshka

Internal MISP references

UUID cb6c49ab-b9ac-459f-b765-05cbe2e63b0d which can be used as unique global reference for Matryoshka in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

TinyZBot

Internal MISP references

UUID e2cc27a2-4146-4f08-8e80-114a99204cea which can be used as unique global reference for TinyZBot in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

GHOLE

Internal MISP references

UUID 43a0d8a7-558d-4104-8a24-55e6e7a503db which can be used as unique global reference for GHOLE in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

CWoolger

Internal MISP references

UUID 005b46a2-9498-473a-bee2-0db91e5fb327 which can be used as unique global reference for CWoolger in MISP communities and other software using the MISP galaxy

FireMalv

Internal MISP references

UUID 6ef11b6e-d81a-465b-9dce-fab5c6fe807b which can be used as unique global reference for FireMalv in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Regin

Regin (also known as Prax or WarriorPride) is a sophisticated malware toolkit revealed by Kaspersky Lab, Symantec, and The Intercept in November 2014. The malware targets specific users of Microsoft Windows-based computers and has been linked to the US intelligence gathering agency NSA and its British counterpart, the GCHQ. The Intercept provided samples of Regin for download including malware discovered at Belgian telecommunications provider, Belgacom. Kaspersky Lab says it first became aware of Regin in spring 2012, but that some of the earliest samples date from 2003. The name Regin is first found on the VirusTotal website on 9 March 2011.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Regin.

Known Synonyms
Prax
WarriorPride

Internal MISP references

UUID 0cf21558-1217-4d36-9536-2919cfd44825 which can be used as unique global reference for Regin in MISP communities and other software using the MISP galaxy

External references

• https://en.wikipedia.org/wiki/Regin_(malware) - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Duqu

Internal MISP references

UUID 809b54c3-dd6a-4ec9-8c3a-a27b9baa6732 which can be used as unique global reference for Duqu in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Flame

Internal MISP references

UUID d7963066-62ed-4494-9b8c-4b8b691a7c82 which can be used as unique global reference for Flame in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Stuxnet

Internal MISP references

UUID 1b63293f-13f0-4c25-9bf6-6ebc023fc8ff which can be used as unique global reference for Stuxnet in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

EquationLaser

Internal MISP references

UUID 21f7a57b-7778-4b3e-9b50-5289ae3b445d which can be used as unique global reference for EquationLaser in MISP communities and other software using the MISP galaxy

EquationDrug

Internal MISP references

UUID 3e0c2d35-87cb-40f9-b341-a6c8dbec697e which can be used as unique global reference for EquationDrug in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

DoubleFantasy

Internal MISP references

UUID fb8828a4-76de-467d-9f52-528984aa9b8d which can be used as unique global reference for DoubleFantasy in MISP communities and other software using the MISP galaxy

TripleFantasy

Internal MISP references

UUID a4cebcc4-9e9b-415f-aa05-dd71c4e288fe which can be used as unique global reference for TripleFantasy in MISP communities and other software using the MISP galaxy

Fanny

Internal MISP references

UUID 1e25d254-3f03-4752-b8d6-023a23e7d4ae which can be used as unique global reference for Fanny in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

GrayFish

Internal MISP references

UUID 2407bd9a-a3a4-40c4-86de-be6965243c67 which can be used as unique global reference for GrayFish in MISP communities and other software using the MISP galaxy

Babar

Internal MISP references

UUID 57b221bc-7ed6-4080-bc66-813d17009485 which can be used as unique global reference for Babar in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Bunny

Internal MISP references

UUID 5589c428-792b-4439-b0db-07862765d96b which can be used as unique global reference for Bunny in MISP communities and other software using the MISP galaxy

Casper

Internal MISP references

UUID 63b3e6fb-9bb8-43dc-9cbf-7681b049b5d6 which can be used as unique global reference for Casper in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

NBot

Internal MISP references

UUID 97fa32d6-5d1d-43df-b765-4a0e31d7f179 which can be used as unique global reference for NBot in MISP communities and other software using the MISP galaxy

Tafacalou

Internal MISP references

UUID 835943ed-75d7-4225-9075-a8e2b2136fad which can be used as unique global reference for Tafacalou in MISP communities and other software using the MISP galaxy

Tdrop

Internal MISP references

UUID 4d81c146-56e1-45d2-b0e4-75d0acec8102 which can be used as unique global reference for Tdrop in MISP communities and other software using the MISP galaxy

Troy

Internal MISP references

UUID 9825aa1f-6414-4f26-8487-605dd6c718d1 which can be used as unique global reference for Troy in MISP communities and other software using the MISP galaxy

Tdrop2

Internal MISP references

UUID aff99aad-5231-4f14-8e68-67e87fb13b5c which can be used as unique global reference for Tdrop2 in MISP communities and other software using the MISP galaxy

ZXShell

ZxShell is a remote access trojan (RAT). It was developed in 2006 by the persona "LZX", who then publicly released the source code in 2007

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZXShell.

Known Synonyms
Sensode

Internal MISP references

UUID 5b9dc67e-bae4-44f3-b58d-6d842a744104 which can be used as unique global reference for ZXShell in MISP communities and other software using the MISP galaxy

External references

• http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html - webarchive
• https://blogs.cisco.com/security/talos/opening-zxshell - webarchive
• https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

T9000

Internal MISP references

UUID 66575fb4-7f92-42d8-8c47-e68a26413081 which can be used as unique global reference for T9000 in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/02/t9000-advanced-modular-backdoor-uses-complex-anti-analysis-techniques/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

T5000

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular T5000.

Known Synonyms
Plat1

Internal MISP references

UUID e957f773-f6d2-410f-8163-5f0c17a7bde2 which can be used as unique global reference for T5000 in MISP communities and other software using the MISP galaxy

External references

• http://www.cylance.com/techblog/Grand-Theft-Auto-Panda.shtml - webarchive

Associated metadata

Metadata key	Value

Taidoor

Internal MISP references

UUID cda7d605-23d0-4f93-a585-1276f094c04a which can be used as unique global reference for Taidoor in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/connect/blogs/trojantaidoor-takes-aim-policy-think-tanks - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Swisyn

Internal MISP references

UUID 1688dc7a-0ef9-49a9-a467-5231a5552b41 which can be used as unique global reference for Swisyn in MISP communities and other software using the MISP galaxy

External references

• http://labs.alienvault.com/labs/index.php/2013/latest-adobe-pdf-exploit-used-to-target-uyghur-and-tibetan-activists/ - webarchive

Associated metadata

Metadata key	Value

Rekaf

Internal MISP references

UUID cfe948c6-b8a6-437a-9d82-d81660e0287b which can be used as unique global reference for Rekaf in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks - webarchive

Associated metadata

Metadata key	Value

Scieron

Internal MISP references

UUID 267bf78e-f430-47b6-8ba0-1ae31698c711 which can be used as unique global reference for Scieron in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

SkeletonKey

Internal MISP references

UUID 7709fedd-5083-4b54-bcd8-af3f76f6d171 which can be used as unique global reference for SkeletonKey in MISP communities and other software using the MISP galaxy

External references

• http://www.secureworks.com/cyber-threat-intelligence/threats/skeleton-key-malware-analysis/ - webarchive

Associated metadata

Metadata key	Value

Skyipot

Internal MISP references

UUID 72e2b7b5-2718-4942-9ca2-17fa6730261f which can be used as unique global reference for Skyipot in MISP communities and other software using the MISP galaxy

External references

• http://labs.alienvault.com/labs/index.php/2011/another-sykipot-sample-likely-targeting-us-federal-agencies/ - webarchive

Associated metadata

Metadata key	Value

Spindest

Internal MISP references

UUID 447735ac-82e4-4c97-b048-56b7e47203ef which can be used as unique global reference for Spindest in MISP communities and other software using the MISP galaxy

External references

• http://www.threatconnect.com/news/threatconnect-enables-healthy-networking-biomed-life-sciences-industry/ - webarchive

Associated metadata

Metadata key	Value

Preshin

Internal MISP references

UUID d87326a3-fb94-448c-9615-8ec036c1df3a which can be used as unique global reference for Preshin in MISP communities and other software using the MISP galaxy

Oficla

Internal MISP references

UUID b3ea33fd-eaa0-4bab-9bd0-12534c9aa987 which can be used as unique global reference for Oficla in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

PCClient RAT

Internal MISP references

UUID f68d2200-cb9d-42de-9e5e-be2a8f674c5e which can be used as unique global reference for PCClient RAT in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2014/10/new-indicators-compromise-apt-group-nitro-uncovered/ - webarchive

Associated metadata

Metadata key	Value

Plexor

Internal MISP references

UUID 8fb00a59-0dec-4d7f-bd53-9826b3929f39 which can be used as unique global reference for Plexor in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Mongall

Internal MISP references

UUID aa3aa21f-bc4e-4fb6-acd2-f4b6de482dfe which can be used as unique global reference for Mongall in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

NeD Worm

Internal MISP references

UUID eedcf785-d011-4e17-96c4-6ff39138ada0 which can be used as unique global reference for NeD Worm in MISP communities and other software using the MISP galaxy

External references

• http://www.clearskysec.com/dustysky/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

NewCT

Internal MISP references

UUID c5e3766c-9527-47c3-94db-f10de2c56248 which can be used as unique global reference for NewCT in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Nflog

Internal MISP references

UUID b2ec2dca-5d49-4efa-9a9e-75126346d1ed which can be used as unique global reference for Nflog in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html - webarchive

Associated metadata

Metadata key	Value

Janicab

Internal MISP references

UUID c3c20c4b-e12a-42e5-960a-eea4644014f4 which can be used as unique global reference for Janicab in MISP communities and other software using the MISP galaxy

External references

• http://blog.avast.com/2013/07/22/multisystem-trojan-janicab-attacks-windows-and-macosx-via-scripts/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Jripbot

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Jripbot.

Known Synonyms
Jiripbot

Internal MISP references

UUID 05e2ccec-7050-47cf-b925-50907f57c639 which can be used as unique global reference for Jripbot in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/butterfly-corporate-spies-out-for-financial-gain.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Jolob

Internal MISP references

UUID 4d4528ff-6260-4b5d-b2ea-6e11ca02c396 which can be used as unique global reference for Jolob in MISP communities and other software using the MISP galaxy

External references

• http://pwc.blogs.com/cyber_security_updates/2014/10/scanbox-framework-whos-affected-and-whos-using-it-1.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

IsSpace

Internal MISP references

UUID b9707a57-d15f-4937-b022-52cc17f6783f which can be used as unique global reference for IsSpace in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Emotet

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emotet.

Known Synonyms
Geodo

Internal MISP references

UUID 3f7616bd-f1de-46ee-87c2-43c0c2edaa28 which can be used as unique global reference for Emotet in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/analysis/publications/69560/the-banking-trojan-emotet-detailed-analysis/ - webarchive
• https://www.forcepoint.com/blog/security-labs/thanks-giving-emotet - webarchive
• https://www.bleepingcomputer.com/news/security/emotet-returns-with-thanksgiving-theme-and-better-phishing-tricks/ - webarchive
• https://cofense.com/major-us-financial-institutions-imitated-advanced-geodo-emotet-phishing-lures-appear-authentic-containing-proofpoint-url-wrapped-links/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Hoardy

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hoardy.

Known Synonyms
BS2005
Hoarde
Phindolp

Internal MISP references

UUID 25cd01bc-1346-4415-8f8d-d3656309ef6b which can be used as unique global reference for Hoardy in MISP communities and other software using the MISP galaxy

External references

• https://github.com/nccgroup/Royal_APT - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Htran

HUC Packet Transmitter (HTran) is a proxy tool, used to intercept and redirect Transmission Control Protocol (TCP) connections from the local host to a remote host. This makes it possible to obfuscate an attacker's communications with victim networks. The tool has been freely available on the internet since at least 2009. HTran facilitates TCP connections between the victim and a hop point controlled by an attacker. Malicious cyber actors can use this technique to redirect their packets through multiple compromised hosts running HTran, to gain greater access to hosts in a network

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Htran.

Known Synonyms
HTran
HUC Packet Transmitter

Internal MISP references

UUID f3bfe513-2a65-49b5-9d64-a66541dce697 which can be used as unique global reference for Htran in MISP communities and other software using the MISP galaxy

External references

• http://www.secureworks.com/research/threats/htran/ - webarchive
• https://www.ncsc.gov.uk/content/files/protected_files/article_files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

HTTPBrowser

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HTTPBrowser.

Known Synonyms
TokenControl

Internal MISP references

UUID 08e2c9ef-aa62-429f-a6e5-e901ff6883cd which can be used as unique global reference for HTTPBrowser in MISP communities and other software using the MISP galaxy

External references

• https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Disgufa

Internal MISP references

UUID 3a57bb24-b493-4698-bf46-6465c6cf5446 which can be used as unique global reference for Disgufa in MISP communities and other software using the MISP galaxy

Elirks

Internal MISP references

UUID c0ea7b89-d246-4eb7-8de4-b4e17e135051 which can be used as unique global reference for Elirks in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Snifula

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Snifula.

Known Synonyms
Ursnif

Internal MISP references

UUID 75b01a1e-3269-4f4c-bdba-37af4e9c3f54 which can be used as unique global reference for Snifula in MISP communities and other software using the MISP galaxy

External references

• https://www.circl.lu/pub/tr-13/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Aumlib

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aumlib.

Known Synonyms
Graftor
Yayih
mswab

Internal MISP references

UUID f3ac3d86-0fa2-4049-bfbc-1970004b8d32 which can be used as unique global reference for Aumlib in MISP communities and other software using the MISP galaxy

External references

• http://www.cybersquared.com/killing-with-a-borrowed-knife-chaining-core-cloud-service-profile-infrastructure-for-cyber-attacks - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CTRat

Internal MISP references

UUID f78cfa32-a629-421e-94f7-1e696bba2892 which can be used as unique global reference for CTRat in MISP communities and other software using the MISP galaxy

External references

• http://www.fireeye.com/blog/technical/threat-intelligence/2014/07/spy-of-the-tiger.html - webarchive

Associated metadata

Metadata key	Value

Emdivi

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Emdivi.

Known Synonyms
Newsripper

Internal MISP references

UUID a8395aae-1496-417d-98ee-3ecbcd9a94a0 which can be used as unique global reference for Emdivi in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/connect/blogs/operation-cloudyomega-ichitaro-zero-day-and-ongoing-cyberespionage-campaign-targeting-japan - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Etumbot

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Etumbot.

Known Synonyms
Exploz
RIPTIDE
Specfix

Internal MISP references

UUID 91583583-95c0-444e-8175-483cbebc640b which can be used as unique global reference for Etumbot in MISP communities and other software using the MISP galaxy

External references

• www.arbornetworks.com/asert/wp-content/uploads/2014/06/ASERT-Threat-Intelligence-Brief-2014-07-Illuminating-Etumbot-APT.pdf

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Fexel

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fexel.

Known Synonyms
Loneagent

Internal MISP references

UUID ba992105-373e-484a-ac81-2464deba93b7 which can be used as unique global reference for Fexel in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value

Fysbis

Internal MISP references

UUID bb929d1d-de95-4c3d-be79-55db3152dba1 which can be used as unique global reference for Fysbis in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/02/a-look-into-fysbis-sofacys-linux-backdoor/ - webarchive

Associated metadata

Metadata key	Value

Hikit

Internal MISP references

UUID 06953055-92ed-4936-8ffd-d9d72ab6bef6 which can be used as unique global reference for Hikit in MISP communities and other software using the MISP galaxy

External references

• https://blog.bit9.com/2013/02/25/bit9-security-incident-update/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Hancitor

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hancitor.

Known Synonyms
Chanitor
Pony
Tordal

Internal MISP references

UUID ff0404a1-465f-4dd5-8b66-ee773628ca64 which can be used as unique global reference for Hancitor in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Ruckguv

Internal MISP references

UUID d70bd6a8-5fd4-42e8-8e39-fb18daeccdb2 which can be used as unique global reference for Ruckguv in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/threat-insight/post/hancitor-ruckguv-reappear - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

HerHer Trojan

Internal MISP references

UUID 0798f8d2-1099-4122-8735-5a116264d3db which can be used as unique global reference for HerHer Trojan in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/ - webarchive

Associated metadata

Metadata key	Value

Helminth backdoor

Internal MISP references

UUID 7bc1110b-fdc5-4501-a19b-e86304da4eb9 which can be used as unique global reference for Helminth backdoor in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/05/the-oilrig-campaign-attacks-on-saudi-arabian-organizations-deliver-helminth-backdoor/ - webarchive

Associated metadata

Metadata key	Value

HDRoot

Internal MISP references

UUID d2c1a439-585a-48bc-8176-c0c46dfac270 which can be used as unique global reference for HDRoot in MISP communities and other software using the MISP galaxy

External references

• http://williamshowalter.com/a-universal-windows-bootkit/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

IRONGATE

Internal MISP references

UUID 5514e486-6158-40d8-b258-047938b8ee20 which can be used as unique global reference for IRONGATE in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2016/06/irongate_ics_malware.html - webarchive

Associated metadata

Metadata key	Value

ShimRAT

Internal MISP references

UUID 487f26a5-8531-4ec6-bfa4-691834b156b8 which can be used as unique global reference for ShimRAT in MISP communities and other software using the MISP galaxy

External references

• https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf - webarchive

Associated metadata

Metadata key	Value

X-Agent

APT28's second-stage persistent macOS backdoor. This backdoor component is known to have a modular structure featuring various espionage functionalities, such as key-logging, screen grabbing and file exfiltration. This component is available for Osx, Windows, Linux and iOS operating systems.

Xagent is a modular backdoor with spying functionalities such as keystroke logging and file exfiltration. Xagent is the group’s flagship backdoor and heavily used in their operations. Early versions for Linux and Windows were seen years ago, then in 2015 an iOS version came out. One year later, an Android version was discovered and finally, in the beginning of 2017, an Xagent sample for OS X was described.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Agent.

Known Synonyms
XAgent

Internal MISP references

UUID 3e2c99f9-66cd-48be-86e9-d7c1c164d87c which can be used as unique global reference for X-Agent in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-update-ios-espionage-app-found/ - webarchive
• https://app.box.com/s/l7n781ig6n8wlf1aff5hgwbh4qoi5jqq - webarchive
• https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ - webarchive
• https://objective-see.com/blog/blog_0x25.html#XAgent - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

X-Tunnel

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular X-Tunnel.

Known Synonyms
XTunnel

Internal MISP references

UUID 6d180bd7-3c77-4faf-b98b-dc2ab5f49101 which can be used as unique global reference for X-Tunnel in MISP communities and other software using the MISP galaxy

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Foozer

Internal MISP references

UUID e4137f66-be82-4da7-96e6-e37ab33ea34f which can be used as unique global reference for Foozer in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive

Associated metadata

Metadata key	Value

WinIDS

Internal MISP references

UUID 82875947-fafb-467a-82df-0d2e37111b97 which can be used as unique global reference for WinIDS in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive

Associated metadata

Metadata key	Value

DownRange

Internal MISP references

UUID 56349213-b73e-4a30-8188-08de1a77b960 which can be used as unique global reference for DownRange in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/ - webarchive

Associated metadata

Metadata key	Value

Mad Max

Internal MISP references

UUID d3d56dd0-3409-470a-958b-a865fdd158f9 which can be used as unique global reference for Mad Max in MISP communities and other software using the MISP galaxy

External references

• https://www.arbornetworks.com/blog/asert/mad-max-dga/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Crimson

Crimson is malware used as part of a campaign known as Operation Transparent Tribe that targeted Indian diplomatic and military victims

Internal MISP references

UUID 858edfb8-793a-430b-8acc-4310e7d2f0d3 which can be used as unique global reference for Crimson in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf - webarchive
• https://www.amnesty.org/download/Documents/ASA3383662018ENGLISH.PDF - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

Prikormka

Operation Groundbait based on our research into the Prikormka malware family. This includes detailed technical analysis of the Prikormka malware family and its spreading mechanisms, and a description of the most noteworthy attack campaigns.

Internal MISP references

UUID 67ade442-63f2-4319-bdcd-d2564b963ed6 which can be used as unique global reference for Prikormka in MISP communities and other software using the MISP galaxy

External references

• http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

NanHaiShu

This whitepaper details a malicious program we identify as NanHaiShu. Based on our analysis, the threat actor behind this malware targets government and private-sector organizations.

Internal MISP references

UUID 7abd6950-7a07-4d9e-ade1-62414fa50619 which can be used as unique global reference for NanHaiShu in MISP communities and other software using the MISP galaxy

External references

• https://www.f-secure.com/documents/996508/1030745/nanhaishu_whitepaper.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Umbreon

Umbreon (sharing the same name as the Pokémon) targets Linux systems, including systems running both Intel and ARM processors, expanding the scope of this threat to include embedded devices as well.

Internal MISP references

UUID 2a18f5dd-40fc-444b-a7c6-85f94b3eee13 which can be used as unique global reference for Umbreon in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/pokemon-themed-umbreon-linux-rootkit-hits-x86-arm-systems/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Odinaff

Odinaff is typically deployed in the first stage of an attack, to gain a foothold onto the network, providing a persistent presence and the ability to install additional tools onto the target network. These additional tools bear the hallmarks of a sophisticated attacker which has plagued the financial industry since at least 2013–Carbanak. This new wave of attacks has also used some infrastructure that has previously been used in Carbanak campaigns.

Internal MISP references

UUID e2fa7aea-fb33-4efc-b61b-ccae71b32e7d which can be used as unique global reference for Odinaff in MISP communities and other software using the MISP galaxy

External references

• https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Hworm

Unit 42 has observed a new version of Hworm (or Houdini) being used within multiple attacks. This blog outlines technical details of this new Hworm version and documents an attack campaign making use of the backdoor. Of the samples used in this attack, the first we observed were June 2016, while as-of publication we were still seeing attacks as recently as mid-October, suggesting that this is likely an active, ongoing campaign.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Hworm.

Known Synonyms
Houdini

Internal MISP references

UUID e5f7bb36-c982-4f5a-9b29-ab73d2c5f70e which can be used as unique global reference for Hworm in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/10/unit42-houdinis-magic-reappearance/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Backdoor.Dripion

Backdoor.Dripion was custom developed, deployed in a highly targeted fashion, and used command and control servers disguised as antivirus company websites.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Backdoor.Dripion.

Known Synonyms
Dripion

Internal MISP references

UUID 9dec36a3-b7df-477d-8f38-90aed47ca7cf which can be used as unique global reference for Backdoor.Dripion in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/connect/blogs/taiwan-targeted-new-cyberespionage-back-door-trojan - webarchive

Associated metadata

Metadata key	Value

Adwind

Adwind is a backdoor written purely in Java that targets system supporting the Java runtime environment. Commands that can be used, among other things, to display messages on the system, open URLs, update the malware, download/execute files, and download/load plugins. A significant amount of additional functionality can be provided through downloadable plugins, including such things as remote control options and shell command execution.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Adwind.

Known Synonyms
AlienSpy
Backdoor:Java/Adwind
Frutas
JSocket
Sockrat
Unrecom
jRat

Internal MISP references

UUID ab4694d6-7043-41f2-b328-d93bec9c1b22 which can be used as unique global reference for Adwind in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/blog/research/73660/adwind-faq/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Bedep

Internal MISP references

UUID 066f8ad3-0c99-43eb-990c-8fae2c232f62 which can be used as unique global reference for Bedep in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Cromptui

Internal MISP references

UUID c4d80484-9486-4d5f-95f3-f40cc2de45ea which can be used as unique global reference for Cromptui in MISP communities and other software using the MISP galaxy

Dridex

Dridex is a strain of banking malware that leverages macros in Microsoft Office to infect systems. Once a computer has been infected, Dridex attackers can steal banking credentials and other personal information on the system to gain access to the financial records of a user.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Dridex.

Known Synonyms
Cridex

Internal MISP references

UUID 276c2c2e-09da-44cf-a3f7-806b3feb41da which can be used as unique global reference for Dridex in MISP communities and other software using the MISP galaxy

External references

• http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/dridex-financial-trojan.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Fareit

Internal MISP references

UUID 652b5242-b790-4695-ad0e-b79bbf78f351 which can be used as unique global reference for Fareit in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Gafgyt

Internal MISP references

UUID 5fe338c6-723e-43ed-8165-43d95fa93689 which can be used as unique global reference for Gafgyt in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Gamarue

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gamarue.

Known Synonyms
Andromeda

Internal MISP references

UUID b9f00c61-6cd1-4112-a632-c8d3837a7ddd which can be used as unique global reference for Gamarue in MISP communities and other software using the MISP galaxy

External references

• https://blog.gdatasoftware.com/2015/03/24274-the-andromeda-gamarue-botnet-is-on-the-rise-again - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Necurs

The Necurs botnet is a distributor of many pieces of malware, most notably Locky.

Internal MISP references

UUID 97d34770-44cc-4ecb-bdce-ba11581c0e2a which can be used as unique global reference for Necurs in MISP communities and other software using the MISP galaxy

External references

• https://en.wikipedia.org/wiki/Necurs_botnet - webarchive
• https://www.bleepingcomputer.com/news/security/worlds-largest-spam-botnet-finds-a-new-way-to-avoid-detection-for-now/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Palevo

Internal MISP references

UUID af0ea2b8-97ae-4ec1-a2c5-8f5dd0c9537b which can be used as unique global reference for Palevo in MISP communities and other software using the MISP galaxy

Akbot

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Akbot.

Known Synonyms
PinkSlipBot
Qakbot
Qbot

Internal MISP references

UUID ac2ff27d-a7cb-46fe-ae32-cfe571dc614d which can be used as unique global reference for Akbot in MISP communities and other software using the MISP galaxy

External references

• https://en.wikipedia.org/wiki/Akbot - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Upatre

Upatre is a Trojan downloader that is used to set up other threats on the victim's PC. Upatre has been used recently in several high profile Trojan attacks involving the Gameover Trojan.

Internal MISP references

UUID 99d9110d-85a4-4819-9f85-05e4b73aa5f3 which can be used as unique global reference for Upatre in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Vawtrak

Vawtrak is an information stealing malware family that is primarily used to gain unauthorised access to bank accounts through online banking websites.

Internal MISP references

UUID e95dd1ba-7485-4c02-bf2e-14beedbcf053 which can be used as unique global reference for Vawtrak in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/medialibrary/PDFs/technical%20papers/sophos-vawtrak-international-crimeware-as-a-service-tpna.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Empire

Empire is a pure PowerShell post-exploitation agent built on cryptologically-secure communications and a flexible architecture. Empire implements the ability to run PowerShell agents without needing powershell.exe, rapidly deployable post-exploitation modules ranging from key loggers to Mimikatz, and adaptable communications to evade network detection, all wrapped up in a usability-focused framework

Internal MISP references

UUID 525ce93a-76a1-441a-9c45-0eac64d0ed12 which can be used as unique global reference for Empire in MISP communities and other software using the MISP galaxy

External references

• https://github.com/adaptivethreat/Empire - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Explosive

Beginning in late 2012, a carefully orchestrated attack campaign we call Volatile Cedar has been targeting individuals, companies and institutions worldwide. This campaign, led by a persistent attacker group, has successfully penetrated a large number of targets using various attack techniques, and specifically, a custom-made malware implant codenamed Explosive.

Internal MISP references

UUID 0155c3b1-8c7c-4176-aeda-68678dd99992 which can be used as unique global reference for Explosive in MISP communities and other software using the MISP galaxy

External references

• https://www.checkpoint.com/downloads/volatile-cedar-technical-report.pdf - webarchive

Associated metadata

Metadata key	Value

KeyBoy

The actors used a new version of “KeyBoy,” a custom backdoor first disclosed by researchers at Rapid7 in June 2013. Their work outlined the capabilities of the backdoor, and exposed the protocols and algorithms used to hide the network communication and configuration data

Internal MISP references

UUID 74167065-90b3-4c29-807a-79b6f098e45b which can be used as unique global reference for KeyBoy in MISP communities and other software using the MISP galaxy

External references

• https://citizenlab.org/2016/11/parliament-keyboy/ - webarchive
• https://community.rapid7.com/community/infosec/blog/2013/06/07/keyboy-targeted-attacks-against-vietnam-and-india - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Yahoyah

The attacks in this case are associated with a campaign called Tropic Trooper, which has been active since at least 2011 and is known for heavily targeting Taiwan. One of the attacks used their known Yahoyah malware...

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Yahoyah.

Known Synonyms
W32/Seeav

Internal MISP references

UUID 2a16a1d4-a098-4f17-80f3-3cfc6c60b539 which can be used as unique global reference for Yahoyah in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Tartine

Delphi RAT used by Sofacy.

Internal MISP references

UUID 67f0b6cb-a484-4b8c-aacb-88a7238568b0 which can be used as unique global reference for Tartine in MISP communities and other software using the MISP galaxy

Mirai

Mirai (Japanese for "the future") is malware that turns computer systems running Linux into remotely controlled "bots", that can be used as part of a botnet in large-scale network attacks. It primarily targets online consumer devices such as remote cameras and home routers. The Mirai botnet has been used in some of the largest and most disruptive distributed denial of service (DDoS) attacks, including an attack on 20 September 2016 on computer security journalist Brian Krebs's web site, an attack on French web host OVH and the October 2016 Dyn cyberattack.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Mirai.

Known Synonyms
Linux/Mirai

Internal MISP references

UUID dcbf1aaa-1fdd-4bfc-a35e-145ffdfb5ac5 which can be used as unique global reference for Mirai in MISP communities and other software using the MISP galaxy

External references

• https://en.wikipedia.org/wiki/Mirai_(malware) - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Masuta

IoT malware based on Mirai but slightly improved.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Masuta.

Known Synonyms
PureMasuta

Internal MISP references

UUID 1d4dec2c-915a-4fef-ba7a-633421bd0848 which can be used as unique global reference for Masuta in MISP communities and other software using the MISP galaxy

External references

• https://blog.newskysecurity.com/masuta-satori-creators-second-botnet-weaponizes-a-new-router-exploit-2ddc51cc52a7 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BASHLITE

Internal MISP references

UUID 55f8fb60-6339-4bc2-baa0-41e698e11f95 which can be used as unique global reference for BASHLITE in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

BlackEnergy

BlackEnergy is a trojan which has undergone significant functional changes since it was first publicly analysed by Arbor Networks in 2007. It has evolved from a relatively simple DDoS trojan into a relatively sophisticated piece of modern malware with a modular architecture, making it a suitable tool for sending spam and for online bank fraud, as well as for targeted attacks. BlackEnergy version 2, which featured rootkit techniques, was documented by SecureWorks in 2010. The targeted attacks recently discovered are proof that the trojan is still alive and kicking in 2014. We provide a technical analysis of the BlackEnergy family, focusing on novel functionality and the differences introduced by new lite variants. We describe the most notable aspects of the malware, including its techniques for bypassing UAC, defeating the signed driver requirement in Windows and a selection of BlackEnergy2 plug-ins used for parasitic file infections, network discovery and remote code execution and data collection.

Internal MISP references

UUID 5a22cad7-65fa-4b7a-a7aa-7915a6101efa which can be used as unique global reference for BlackEnergy in MISP communities and other software using the MISP galaxy

External references

• https://www.virusbulletin.com/conference/vb2014/abstracts/back-blackenergy-2014-targeted-attacks-ukraine-and-poland/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Trojan.Seaduke

Trojan.Seaduke is a Trojan horse that opens a back door on the compromised computer. It may also download potentially malicious files.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trojan.Seaduke.

Known Synonyms
Seaduke

Internal MISP references

UUID 3449215f-2650-48bb-a4fb-6549654cbccc which can be used as unique global reference for Trojan.Seaduke in MISP communities and other software using the MISP galaxy

External references

• https://www.symantec.com/security_response/writeup.jsp?docid=2015-031915-4935-99 - webarchive

Associated metadata

Metadata key	Value

Backdoor.Tinybaron

Internal MISP references

UUID 2b6b35fb-2ed4-46ce-b603-62ca2b9b2812 which can be used as unique global reference for Backdoor.Tinybaron in MISP communities and other software using the MISP galaxy

Incognito RAT

Internal MISP references

UUID 307803df-6537-4e4d-a1c8-f219f278e564 which can be used as unique global reference for Incognito RAT in MISP communities and other software using the MISP galaxy

DownRage

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DownRage.

Known Synonyms
Carberplike

Internal MISP references

UUID ab5c4362-c369-4c78-985d-04ba1226ea32 which can be used as unique global reference for DownRage in MISP communities and other software using the MISP galaxy

External references

• https://labsblog.f-secure.com/2015/09/08/sofacy-recycles-carberp-and-metasploit-code/ - webarchive
• https://twitter.com/Timo_Steffens/status/814781584536719360 - webarchive

Associated metadata

Metadata key	Value

GeminiDuke

GeminiDuke is malware that was used by APT29 from 2009 to 2012.

Internal MISP references

UUID 6a28a648-30c0-4d1d-bd67-81a8dc6486ba which can be used as unique global reference for GeminiDuke in MISP communities and other software using the MISP galaxy

External references

• https://attack.mitre.org/wiki/Software/S0049 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Zeus

Trojan.Zbot, also called Zeus, is a Trojan horse that attempts to steal confidential information from the compromised computer. It may also download configuration files and updates from the Internet. The Trojan is created using a Trojan-building toolkit.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zeus.

Known Synonyms
Trojan.Zbot
Zbot

Internal MISP references

UUID 0ce448de-c2bb-4c6e-9ad7-c4030f02b4d7 which can be used as unique global reference for Zeus in MISP communities and other software using the MISP galaxy

External references

• https://en.wikipedia.org/wiki/Zeus_(malware) - webarchive
• https://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Shifu

Shifu is a Banking Trojan first discovered in 2015. Shifu is based on the Shiz source code which incorporated techniques used by Zeus. Attackers use Shifu to steal credentials for online banking websites around the world, starting in Russia but later including the UK, Italy, and others.

Internal MISP references

UUID 67d712c8-d254-4820-83fa-9a892b87923b which can be used as unique global reference for Shifu in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2017/01/unit42-2016-updates-shifu-banking-trojan/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Shiz

The new variant of the Shiz Trojan malware targets mission-critical enterprise resource planning (ERP) applications — particularly SAP users.

Internal MISP references

UUID e6085ce0-af6d-41f7-8bcb-7f2eed246941 which can be used as unique global reference for Shiz in MISP communities and other software using the MISP galaxy

External references

• https://securityintelligence.com/tag/shiz-trojan-malware/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MM Core

Also known as “BaneChant”, MM Core is a file-less APT which is executed in memory by a downloader component. It was first reported in 2013 under the version number “2.0-LNK” where it used the tag “BaneChant” in its command-and-control (C2) network request. A second version “2.1-LNK” with the network tag “StrangeLove” was discovered shortly after.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MM Core.

Known Synonyms
BaneChant
BigBoss
MM Core backdoor
SillyGoose
StrangeLove

Internal MISP references

UUID 74bd8c09-73d5-4ad8-ab1f-e94a4853c936 which can be used as unique global reference for MM Core in MISP communities and other software using the MISP galaxy

External references

• https://blogs.forcepoint.com/security-labs/mm-core-memory-backdoor-returns-bigboss-and-sillygoose - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Shamoon

Shamoon,[a] also known as Disttrack, is a modular computer virus discovered by Seculert[1] in 2012, targeting recent NT kernel-based versions of Microsoft Windows. The virus has been used for cyber espionage in the energy sector.[2][3][4] Its discovery was announced on 16 August 2012 by Symantec,[3] Kaspersky Lab,[5] and Seculert.[6] Similarities have been highlighted by Kaspersky Lab and Seculert between Shamoon and the Flame malware.[5][6]

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Shamoon.

Known Synonyms
DistTrack

Internal MISP references

UUID 776b1849-8d5b-4762-8ba1-cbbaddb4ce3a which can be used as unique global reference for Shamoon in MISP communities and other software using the MISP galaxy

External references

• https://en.wikipedia.org/wiki/Shamoon - webarchive
• https://securityaffairs.co/wordpress/78867/breaking-news/shamoon-virustotal.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GhostAdmin

According to MalwareHunterTeam and other researchers that have looked at the malware's source code, GhostAdmin seems to be a reworked version of CrimeScene, another botnet malware family that was active around 3-4 years ago.

Internal MISP references

UUID a68f1b43-c742-4f90-974d-2e74ec703e44 which can be used as unique global reference for GhostAdmin in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/new-ghostadmin-malware-used-for-data-theft-and-exfiltration/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

EyePyramid Malware

Two Italians referred to as the “Occhionero brothers” have been arrested and accused of using malware and a carefully-prepared spear-phishing scheme to spy on high-profile politicians and businessmen. This case has been called “EyePyramid”, which we first discussed last week. (Conspiracy theories aside, the name came from a domain name and directory path that was found during the research.)

Internal MISP references

UUID 52c2499f-c74f-4bab-bad2-c278e798654c which can be used as unique global reference for EyePyramid Malware in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/uncovering-inner-workings-eyepyramid/ - webarchive

Associated metadata

Metadata key	Value
country	IT

LuminosityLink

LuminosityLink is a malware family costing $40 that purports to be a system administration utility

Internal MISP references

UUID f586d3e4-39fc-489a-808b-03f590bfe092 which can be used as unique global reference for LuminosityLink in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2016/07/unit42-investigating-the-luminositylink-remote-access-trojan-configuration/ - webarchive

Associated metadata

Metadata key	Value

Flokibot

Floki Bot, described recently by Dr. Peter Stephenson from SC Magazine, is yet another bot based on the leaked Zeus code. However, the author came up with various custom modifications that makes it more interesting.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Flokibot.

Known Synonyms
Floki
Floki Bot

Internal MISP references

UUID 8034978b-3a32-4662-b1bf-b525e59e469f which can be used as unique global reference for Flokibot in MISP communities and other software using the MISP galaxy

External references

• https://www.arbornetworks.com/blog/asert/flokibot-flock-bots/ - webarchive
• https://blog.malwarebytes.com/threat-analysis/2016/11/floki-bot-and-the-stealthy-dropper/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

ZeroT

Most recently, we have observed the same group targeting military and aerospace interests in Russia and Belarus. Since the summer of 2016, this group began using a new downloader known as ZeroT to install the PlugX remote access Trojan (RAT) and added Microsoft Compiled HTML Help (.chm) as one of the initial droppers delivered in spear-phishing emails.

Internal MISP references

UUID ff00fa92-b32e-46b6-88ca-98357ebe3f54 which can be used as unique global reference for ZeroT in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/threat-insight/post/APT-targets-russia-belarus-zerot-plugx - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

StreamEx

Cylance dubbed this family of malware StreamEx, based upon a common exported function used across all samples ‘stream’, combined with the dropper functionality to append ‘ex’ to the DLL file name. The StreamEx family has the ability to access and modify the user’s file system, modify the registry, create system services, enumerate process and system information, enumerate network resources and drive types, scan for security tools such as firewall products and antivirus products, change browser security settings, and remotely execute commands. The malware documented in this post was predominantly 64-bit, however, there are 32-bit versions of the malware in the wild.

Internal MISP references

UUID 9991ace8-1a62-498c-a9ef-19d474deb505 which can be used as unique global reference for StreamEx in MISP communities and other software using the MISP galaxy

External references

• https://blog.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

adzok

Remote Access Trojan

Internal MISP references

UUID d08201b8-9774-41a1-abdb-c7f3828139b0 which can be used as unique global reference for adzok in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

albertino

Remote Access Trojan

Internal MISP references

UUID 18c31de5-41b3-4a92-a6ee-23b74cc2797d which can be used as unique global reference for albertino in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

arcom

Remote Access Trojan

Internal MISP references

UUID 00dcba51-126f-4758-8273-9770ddf9031c which can be used as unique global reference for arcom in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

blacknix

Remote Access Trojan

Internal MISP references

UUID 0a5d5825-0ab9-48ff-a5d9-b6b131b65833 which can be used as unique global reference for blacknix in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

bluebanana

Remote Access Trojan

Internal MISP references

UUID df7deaa3-2a2c-4460-8674-20ec24e89fba which can be used as unique global reference for bluebanana in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

bozok

Remote Access Trojan

Internal MISP references

UUID cff2e174-52b8-4304-903a-012f97d70b7c which can be used as unique global reference for bozok in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

clientmesh

Remote Access Trojan

Internal MISP references

UUID 26785174-0b89-4cec-9ed0-5a72a0ff4c49 which can be used as unique global reference for clientmesh in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

cybergate

Remote Access Trojan

Internal MISP references

UUID f6e6540e-c21f-4202-ac46-185e735215db which can be used as unique global reference for cybergate in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

darkcomet

Remote Access Trojan

Internal MISP references

UUID 15949ecb-1f2b-4f59-9cf7-5751694e8fba which can be used as unique global reference for darkcomet in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

darkrat

Remote Access Trojan

Internal MISP references

UUID c9e6e42a-65c0-418e-ab77-09bcdb1214a3 which can be used as unique global reference for darkrat in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

gh0st

Remote Access Trojan

Internal MISP references

UUID 1b1ae63f-bcee-4aba-8994-6c60cee5e16f which can be used as unique global reference for gh0st in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

greame

Remote Access Trojan

Internal MISP references

UUID 43e400b3-918b-4a2c-9a69-7166c81a835b which can be used as unique global reference for greame in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

hawkeye

Remote Access Trojan

Internal MISP references

UUID 3edd9d1b-e15d-4411-a67f-01e04701e95d which can be used as unique global reference for hawkeye in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

javadropper

Remote Access Trojan

Internal MISP references

UUID 3a80cc5e-ae91-4aa4-aa2b-8f538861acbe which can be used as unique global reference for javadropper in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

lostdoor

Remote Access Trojan

Internal MISP references

UUID 3fcebce8-fb31-4edb-ae88-7fb0d90d440c which can be used as unique global reference for lostdoor in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

luxnet

Remote Access Trojan

Internal MISP references

UUID df6ccb07-a26c-427a-9d93-5fed2609a1d4 which can be used as unique global reference for luxnet in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

pandora

Remote Access Trojan

Internal MISP references

UUID 2c215062-5739-4859-bd82-9639ae1d1756 which can be used as unique global reference for pandora in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

poisonivy

Remote Access Trojan

Internal MISP references

UUID e336aeba-b61a-44e0-a0df-cd52a5839db5 which can be used as unique global reference for poisonivy in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

predatorpain

Remote Access Trojan

Internal MISP references

UUID 6762975d-ddbc-4871-ab14-4796c9f38307 which can be used as unique global reference for predatorpain in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

punisher

Remote Access Trojan

Internal MISP references

UUID 0d8d212a-d327-406e-8954-5b20158a9966 which can be used as unique global reference for punisher in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

qrat

Remote Access Trojan

Internal MISP references

UUID c3a784ee-cef7-4604-a5ba-ec7b193a5152 which can be used as unique global reference for qrat in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

shadowtech

Remote Access Trojan

Internal MISP references

UUID d5e53ee4-1114-4801-83c9-58c633049aff which can be used as unique global reference for shadowtech in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

smallnet

Remote Access Trojan

Internal MISP references

UUID 73ee15e9-ffb3-496d-ae65-fad50e675bdd which can be used as unique global reference for smallnet in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

spygate

Remote Access Trojan

Internal MISP references

UUID 408ff7f3-f30c-481f-a3e7-2c69b375f7d9 which can be used as unique global reference for spygate in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

template

Remote Access Trojan

Internal MISP references

UUID 244be9e7-4f68-4fd8-9abd-ee6ca591aa00 which can be used as unique global reference for template in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

tapaoux

Remote Access Trojan

Internal MISP references

UUID b7b4c682-090b-4da2-abc2-541fd3157579 which can be used as unique global reference for tapaoux in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

vantom

Remote Access Trojan

Internal MISP references

UUID aba90e76-ce56-4660-a498-90eeb1f0195b which can be used as unique global reference for vantom in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

virusrat

Remote Access Trojan

Internal MISP references

UUID aa054c62-3595-4c65-97ee-209029cc6004 which can be used as unique global reference for virusrat in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

xena

Remote Access Trojan

Internal MISP references

UUID 87596188-4c1f-494c-8713-21d5fa062580 which can be used as unique global reference for xena in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

xtreme

Remote Access Trojan

Internal MISP references

UUID 2d4e2910-4b25-4562-ad88-b35dd678a117 which can be used as unique global reference for xtreme in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

darkddoser

Remote Access Trojan

Internal MISP references

UUID 505629dc-6b81-424e-a452-164629a7a66f which can be used as unique global reference for darkddoser in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

jspy

Remote Access Trojan

Internal MISP references

UUID 8abd10df-2c31-4895-8ec1-270603078f47 which can be used as unique global reference for jspy in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

xrat

Remote Access Trojan

Internal MISP references

UUID c76e2ee8-52d1-4a55-81df-5542d232ca32 which can be used as unique global reference for xrat in MISP communities and other software using the MISP galaxy

External references

• https://github.com/kevthehermit/RATDecoders - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor']

Related clusters

To see the related clusters, click here.

PupyRAT

Pupy is an opensource, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool mainly written in python.

Internal MISP references

UUID 4d6dec19-b0bc-4698-87ed-272823c45d95 which can be used as unique global reference for PupyRAT in MISP communities and other software using the MISP galaxy

External references

• https://github.com/n1nj4sec/pupy - webarchive

Associated metadata

Metadata key	Value

ELF_IMEIJ

Linux Arm malware spread via RFIs in cgi-bin scripts. This backdoor executes commands from a remote malicious user, effectively compromising the affected system. It connects to a website to send and receive information.

Internal MISP references

UUID acb6ae45-d4e2-48a1-ab72-86e72004c27a which can be used as unique global reference for ELF_IMEIJ in MISP communities and other software using the MISP galaxy

External references

• https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/elf_imeij.a - webarchive

Associated metadata

Metadata key	Value

KHRAT

KHRAT is a small backdoor that has three exports (functions), namely, K1, K2, and K3. K1 checks if the current user is an administrator. If not, it uninstalls itself by calling the K2 function.

Internal MISP references

UUID 72b702d9-43c3-40b9-b004-8d0671225fb8 which can be used as unique global reference for KHRAT in MISP communities and other software using the MISP galaxy

External references

• https://blogs.forcepoint.com/security-labs/trojanized-adobe-installer-used-install-dragonok%E2%80%99s-new-custom-backdoor - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Trochilus

The Trochilus RAT is a threatening RAT (Remote Access Trojan) that may evade many anti-virus programs. The Trochilus RAT is currently being used as part of an extended threat campaign in South East Asia. The first appearance of the Trochilus RAT in this campaign, which has been active since August of 2015, was first detected in the summer of 2015. The Trochilus RAT is currently being used against civil society organizations and government computers in the South East Asia region, particularly in attacks directed towards the government of Myanmar.

Internal MISP references

UUID 5e15e4ca-0e04-4af1-ab2a-779dbcad545d which can be used as unique global reference for Trochilus in MISP communities and other software using the MISP galaxy

External references

• http://www.enigmasoftware.com/trochilusrat-removal/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MoonWind

The MoonWind sample used for this analysis was compiled with a Chinese compiler known as BlackMoon, the same compiler used for the BlackMoon banking Trojan. While a number of attributes match the BlackMoon banking Trojan, the malware is not the same. Both malware families were simply compiled using the same compiler, and it was the BlackMoon artifacts that resulted in the naming of the BlackMoon banking Trojan. But because this new sample is different from the BlackMoon banking Trojan,

Internal MISP references

UUID 76ec1827-68a1-488f-9899-2b788ea8db64 which can be used as unique global reference for MoonWind in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Chrysaor

Chrysaor is spyware believed to be created by NSO Group Technologies, specializing in the creation and sale of software and infrastructure for targeted attacks. Chrysaor is believed to be related to the Pegasus spyware that was first identified on iOS and analyzed by Citizen Lab and Lookout.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Chrysaor.

Known Synonyms
Pegasus
Pegasus spyware

Internal MISP references

UUID 9d7c772b-43f1-49cf-bc70-7a7cd2ed34c8 which can be used as unique global reference for Chrysaor in MISP communities and other software using the MISP galaxy

External references

• https://security.googleblog.com/2017/04/an-investigation-of-chrysaor-malware-on.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Sathurbot

The trojan serves as a backdoor. It can be controlled remotely.

Internal MISP references

UUID 35849d8f-5bac-475b-82f8-7d555f37de12 which can be used as unique global reference for Sathurbot in MISP communities and other software using the MISP galaxy

External references

• http://virusradar.com/en/Win32_Sathurbot.A/description - webarchive
• https://www.welivesecurity.com/2017/04/06/sathurbot-distributed-wordpress-password-attack/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

AURIGA

The AURIGA malware family shares a large amount of functionality with the BANGAT backdoor. The malware family contains functionality for keystroke logging, creating and killing processes, performing file system and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. The AURIGA malware contains a driver component which is used to inject the malware DLL into other processes. This driver can also perform process and IP connection hiding. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.

Internal MISP references

UUID 316c87d4-4404-42ab-9887-f9e321aed93c which can be used as unique global reference for AURIGA in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BANGAT

The BANGAT malware family shares a large amount of functionality with the AURIGA backdoor. The malware family contains functionality for keylogging, creating and killing processes, performing filesystem and registry modifications, spawning interactive command shells, performing process injection, logging off the current user or shutting down the local machine. In addition, the malware also implements a custom VNC like protocol which sends screenshots of the desktop to the C2 server and accepts keyboard and mouse input. The malware communicates to its C2 servers using SSL, with self signed SSL certificates. The malware family will create a copy of cmd.exe to perform its C2 activity, and replace the "Microsoft corp" strings in the cmd.exe binary with different values. The malware family typically maintains persistence through installing itself as a service.

Internal MISP references

UUID fa9b2176-1248-4d59-8da2-c31c7501a81d which can be used as unique global reference for BANGAT in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BISCUIT

BISCUIT provides attackers with full access to an infected host. BISCUIT capabilities include launching an interactive command shell, enumerating servers on a Windows network, enumerating and manipulating process, and transferring files. BISCUIT communicates using a custom protocol, which is then encrypted using SSL. Once installed BISCUIT will attempt to beacon to its command/control servers approximately every 10 or 30 minutes. It will beacon its primary server first, followed by a secondary server. All communication is encrypted with SSL (OpenSSL 0.9.8i).

Internal MISP references

UUID f1e05a12-ca50-41ab-a963-d7df5bcb141d which can be used as unique global reference for BISCUIT in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BOUNCER

BOUNCER will load an extracted DLL into memory, and then will call the DLL's dump export. The dump export is called with the parameters passed via the command line to the BOUNCER executable. It requires at least two arguments, the IP and port to send the password dump information. It can accept at most five arguments, including a proxy IP, port and an x.509 key for SSL authentication. The DLL backdoor has the capability to execute arbitrary commands, collect database and server information, brute force SQL login credentials, launch arbitrary programs, create processes and threads, delete files, and redirect network traffic.

Internal MISP references

UUID 52d9a474-fc37-48b5-8e39-4394194b9573 which can be used as unique global reference for BOUNCER in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CALENDAR

This family of malware uses Google Calendar to retrieve commands and send results. It retrieves event feeds associated with Google Calendar, where each event contains commands from the attacker for the malware to perform. Results are posted back to the event feed. The malware authenticates with Google using the hard coded email address and passwords. The malware uses the deprecated ClientLogin authentication API from Google. The malware is registered as a service dll as a persistence mechanism. Artifacts of this may be found in the registry.

Internal MISP references

UUID e2c18713-0a95-4092-a0e9-76358512daad which can be used as unique global reference for CALENDAR in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

COMBOS

The COMBOS malware family is an HTTP based backdoor. The backdoor is capable of file upload, file download, spawning a interactive reverse shell, and terminating its own process. The backdoor may decrypt stored Internet Explorer credentials from the local system and transmit the credentials to the C2 server. The COMBOS malware family does not have any persistence mechanisms built into itself.

Internal MISP references

UUID fa38b79c-9774-45a0-831c-24c6c8d39a22 which can be used as unique global reference for COMBOS in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

COOKIEBAG

his family of malware is a backdoor capable of file upload and download as well as providing remote interactive shell access to the compromised machine. Communication with the Command & Control (C2) servers uses a combination of single-byte XOR and Base64 encoded data in the Cookie and Set-Cookie HTTP header fields. Communication with the C2 servers is over port 80. Some variants install a registry key as means of a persistence mechanism. The hardcoded strings cited include a string of a command in common with several other APT1 families.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular COOKIEBAG.

Known Synonyms
TROJAN.COOKIES

Internal MISP references

UUID 63be3d30-0c8d-4c0a-8eee-6c96880734cb which can be used as unique global reference for COOKIEBAG in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DAIRY

Members of this malware family are backdoors that provide file downloading, process listing, process killing, and reverse shell capabilities. This malware may also add itself to the Authorized Applications list for the Windows Firewall.

Internal MISP references

UUID 2a56538f-7c21-44b3-b438-5baa025ed005 which can be used as unique global reference for DAIRY in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GETMAIL

Members of this family of malware are utilities designed to extract email messages and attachments from Outlook PST files. One part of this utility set is an executable, one is a dll. The malware may create a registry artifact related to the executable.

Internal MISP references

UUID 5abd7dee-cca1-4bee-9b82-da3f9be2970b which can be used as unique global reference for GETMAIL in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GDOCUPLOAD

This family of malware is a utility designed to upload files to Google Docs. Nearly all communications are with docs.google.com are SSL encrypted. The malware does not use Google's published API to interact with their services. The malware does not currently work with Google Docs. It does not detect HTTP 302 redirections and will get caught in an infinite loop attempting to parse results from Google that are not present.

Internal MISP references

UUID 4bb4320f-9379-43ba-ba8c-09dfece39000 which can be used as unique global reference for GDOCUPLOAD in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

GLOOXMAIL

GLOOXMAIL communicates with Google's Jabber/XMPP servers and authenticates with a hard-coded username and password. The malware can accept commands over XMPP that includes file upload and download, provide a remote shell, sending process listings, and terminating specified processes. The malware makes extensive use of the open source gloox library (http://camaya.net/gloox/, version 0.9.9.12) to communicate using the Jabber/XMPP protocol. All communications with the Google XMPP server are encrypted.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GLOOXMAIL.

Known Synonyms
TROJAN.GTALK

Internal MISP references

UUID a379f09b-5cec-4bdb-9735-125cef2de073 which can be used as unique global reference for GLOOXMAIL in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GOGGLES

A family of downloader malware, that retrieves an encoded payload from a fixed location, usually in the form of a file with the .jpg extension. Some variants have just an .exe that acts as a downloader, others have an .exe launcher that runs as a service and then loads an associated .dll of the same name that acts as the downloader. This IOC is targeted at the downloaders only. After downloading the file, the malware decodes the downloaded payload into an .exe file and launches it. The malware usually stages the files it uses in the %TEMP% directory or the %WINDIR%\Temp directory.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GOGGLES.

Known Synonyms
TROJAN.FOXY

Internal MISP references

UUID 4bc55eb3-7c92-4668-a75a-d5e291387613 which can be used as unique global reference for GOGGLES in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GREENCAT

Members of this family are full featured backdoors that communicates with a Web-based Command & Control (C2) server over SSL. Features include interactive shell, gathering system info, uploading and downloading files, and creating and killing processes, Malware in this family usually communicates with a hard-coded domain using SSL on port 443. Some members of this family rely on launchers to establish persistence mechanism for them. Others contains functionality that allows it to install itself, replacing an existing Windows service, and uninstall itself. Several variants use %SystemRoot%\Tasks or %WinDir%\Tasks as working directories, additional malware artifacts may be found there.

Internal MISP references

UUID 21a1d15c-acdd-49d1-aa8e-8d5b311024f0 which can be used as unique global reference for GREENCAT in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

HACKFASE

This family of malware is a backdoor that provides reverse shell, process creation, system statistics collection, process enumeration, and process termination capabilities. This family is designed to be a service DLL and does not contain an installation mechanism. It usually communicates over port 443. Some variants use their own encryption, others use SSL.

Internal MISP references

UUID aef3e40b-d295-4663-a2d0-585512b3ae44 which can be used as unique global reference for HACKFASE in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

HELAUTO

This family of malware is designed to operate as a service and provides remote command execution and file transfer capabilities to a fixed IP address or domain name. All communication with the C2 server happens over port 443 using SSL. This family can be installed as a service DLL. Some variants allow for uninstallation.

Internal MISP references

UUID 7c05c816-481f-499e-9545-d48b635dc2eb which can be used as unique global reference for HELAUTO in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

KURTON

This family of malware is a backdoor that tunnels its connection through a preconfigured proxy. The malware communicates with a remote command and control server over HTTPS via the proxy. The malware installs itself as a Windows service with a service name supplied by the attacker but defaults to IPRIP if no service name is provided during install.

Internal MISP references

UUID 616c7c32-110e-4bb3-8e99-4c2aeb8f8272 which can be used as unique global reference for KURTON in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

LIGHTBOLT

LIGHTBOLT is a utility with the ability to perform HTTP GET requests for a list of user-specified URLs. The responses of the HTTP requests are then saved as MHTML files, which are added to encrypted RAR files. LIGHTBOLT has the ability to use software certificates for authentication.

Internal MISP references

UUID 57e43779-0665-427c-abcb-997c1c0ced8d which can be used as unique global reference for LIGHTBOLT in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

LIGHTDART

LIGHTDART is a tool used to access a pre-configured web page that hosts an interface to query a database or data set. The tool then downloads the results of a query against that web page to an encrypted RAR file. This RAR file (1.rar) is renamed and uploaded to an attacker controlled FTP server, or uploaded via an HTTP POST with a .jpg extension. The malware will execute this search once a day. The target webpage usually contains information useful to the attacker, which is updated on a regular basis. Examples of targeted information include weather information or ship coordinates.

Internal MISP references

UUID 986f6b0f-51f8-4f83-bb38-8354a83a7f32 which can be used as unique global reference for LIGHTDART in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

LONGRUN

LONGRUN is a backdoor designed to communicate with a hard-coded IP address and provide the attackers with a custom interactive shell. It supports file uploads and downloads, and executing arbitrary commands on the compromised machine. When LONGRUN executes, it first loads configuration data stored as an obfuscated string inside the PE resource section. The distinctive string thequickbrownfxjmpsvalzydg is used as part of the input to the decoding algorithm. When the configuration data string is decoded it is parsed and treated as an IP and port number. The malware then connects to the host and begins interacting with it over a custom protocol.

Internal MISP references

UUID 5a2fc164-f6cf-4528-b85f-f2319545c8ad which can be used as unique global reference for LONGRUN in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

MANITSME

This family of malware will beacon out at random intervals to the remote attacker. The attacker can run programs, execute arbitrary commands, and easily upload and download files. This IOC looks for both the dropper file and the backdoor.

Internal MISP references

UUID 25db921d-d753-4fb1-b51b-961d7fdae6f4 which can be used as unique global reference for MANITSME in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MAPIGET

This malware utility is a set of two files that operate in conjunction to extract email messages and attachments from an Exchange server. In order to operate successfully, these programs require authentication credentials for a user on the Exchange server, and must be run from a machine joined to the domain that has Microsoft Outlook installed (or equivalent software that provides the Microsoft 'Messaging API' (MAPI) service).

Internal MISP references

UUID bf08965f-03a5-4cf6-83fb-8d3c9e9398ee which can be used as unique global reference for MAPIGET in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive
• http://contagiodump.blogspot.com/2010/06/these-days-i-see-spike-in-number-of.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MINIASP

This family of malware consists of backdoors that attempt to fetch encoded commands over HTTP. The malware is capable of downloading a file, downloading and executing a file, executing arbitrary shell commands, or sleeping a specified interval.

Internal MISP references

UUID ea9c7068-1c28-4826-a7d1-7ac04760e5c9 which can be used as unique global reference for MINIASP in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

NEWSREELS

The NEWSREELS malware family is an HTTP based backdoor. When first started, NEWSREELS decodes two strings from its resources section. These strings are both used as C2 channels, one URL is used as a beacon URL (transmitting) and the second URL is used to get commands (receiving). The NEWSREELS malware family is capable of performing file uploads, downloads, creating processes or creating an interactive reverse shell.

Internal MISP references

UUID 5abc6792-be17-48ee-a765-29cffa4242ee which can be used as unique global reference for NEWSREELS in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SEASALT

The SEASALT malware family communicates via a custom binary protocol. It is capable of gathering some basic system information, file system manipulation, file upload and download, process creation and termination, and spawning an interactive reverse shell. The malware maintains persistence by installing itself as a service.

Internal MISP references

UUID 7429aaf8-85a8-4ae9-b583-c7eec0f5b0cb which can be used as unique global reference for SEASALT in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

STARSYPOUND

STARSYPOUND provides an interactive remote shell over an obfuscated communications channel. When it is first run, it loads a string (from the executable PE resource section) containing the beacon IP address and port. The malware sends the beacon string "(SY)# " to the remote system, where is the hostname of the victim system. The remote host responds with a packet that also begins with the string "(SY)# cmd". This causes the malware to launch a new cmd.exe child process. Further communications are forwarded to the cmd.exe child process to execute. The commands sent to the shell and their responses are obfuscated when sent over the network.

Internal MISP references

UUID d0220108-48d7-4056-babc-189048f37a59 which can be used as unique global reference for STARSYPOUND in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SWORD

This family of malware provides a backdoor over the network to the attackers. It is configured to connect to a single host and offers file download over HTTP, program execution, and arbitrary execution of commands through a cmd.exe instance.

Internal MISP references

UUID 96fb29fa-7c3a-4124-baf5-cc5f99b2a05f which can be used as unique global reference for SWORD in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TABMSGSQL

This malware family is a full-featured backdoor capable of file uploading and downloading, arbitrary execution of programs, and providing a remote interactive command shell. All communications with the C2 server are sent over HTTP to a static URL, appending various URL parameters to the request. Some variants use a slightly different URL.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TABMSGSQL.

Known Synonyms
TROJAN LETSGO

Internal MISP references

UUID d5a4cbe7-81c9-4a52-80ee-07ca3f625844 which can be used as unique global reference for TABMSGSQL in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TARSIP-ECLIPSE

The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-ECLIPSE family is distinguished by the presence of 'eclipse' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.

Internal MISP references

UUID 049590f1-3f3a-4670-a341-d6d29fbb123f which can be used as unique global reference for TARSIP-ECLIPSE in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

TARSIP-MOON

The TARSIP malware family is a backdoor which communicates over encoded information in HTTPS headers. Typical TARSIP malware samples will only beacon out to their C2 servers if the C2 DNS address resolves to a specific address. The capability of TARSIP backdoors includes file uploading, file downloading, interactive command shells, process enumeration, process creation, process termination. The TARSIP-MOON family is distinguished by the presence of 'moon' in .pdb debug strings present in the malware samples. It does not provide a built in mechanism to maintain persistence.

Internal MISP references

UUID dbce78ac-5729-4bd1-b7c0-6bc0344564bc which can be used as unique global reference for TARSIP-MOON in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

WARP

The WARP malware family is an HTTP based backdoor written in C++, and the majority of its code base is borrowed from source code available in the public domain. Network communications are implemented using the same WWW client library (w3c.cpp) available from www.dankrusi.com/file_69653F3336383837.html. The malware has system survey functionality (collects hostname, current user, system uptime, CPU speed, etc.) taken directly from the BO2K backdoor available from www.bo2k.com. It also contains the hard disk identification code found at www.winsim.com/diskid32/diskid32.cpp. When the WARP executing remote commands, the malware creates a copy of the ?%SYSTEMROOT%\system32\cmd.exe? file as '%USERPROFILE%\Temp\~ISUN32.EXE'. The version signature information of the duplicate executable is zeroed out. Some WARP variants maintain persistence through the use of DLL search order hijacking.

Internal MISP references

UUID 29917fb3-6c56-4659-a203-5885c4a8e70f which can be used as unique global reference for WARP in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

WEBC2-ADSPACE

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is capable of downloading and executing a file. All variants represented here are the same file with different MD5 signatures. This malware attempts to contact its C2 once a week (Thursday at 10:00 AM). It looks for commands inside a set of HTML tags, part of which are in the File Strings indicator term below.

Internal MISP references

UUID 2d8043b4-48ef-4992-a04a-c342cbbb4f87 which can be used as unique global reference for WEBC2-ADSPACE in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-AUSOV

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware family is a only a downloader which operates over the HTTP protocol with a hard-coded URL. If directed, it has the capability to download, decompress, and execute compressed binaries.

Internal MISP references

UUID e2a27431-28ea-42e3-a0cc-72f29828c292 which can be used as unique global reference for WEBC2-AUSOV in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-BOLID

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware is a backdoor capable of downloading files and updating its configuration. Communication with the command and control (C2) server uses a combination of single-byte XOR and Base64 encoded data wrapped in standard HTML tags. The malware family installs a registry key as a persistence mechanism.

Internal MISP references

UUID a601e1b0-c0bc-4665-9639-4dc5e588520c which can be used as unique global reference for WEBC2-BOLID in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-CLOVER

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The family of malware provides the attacker with an interactive command shell, the ability to upload and download files, execute commands on the system, list processes and DLLs, kill processes, and ping hosts on the local network. Responses to these commands are encrypted and compressed before being POSTed to the server. Some variants copy cmd.exe to Updatasched.exe in a temporary directory, and then may launch that in a process if an interactive shell is called. On initial invocation, the malware also attempts to delete previous copies of the Updatasched.exe file.

Internal MISP references

UUID d7fa0245-2cff-475f-9d8c-3728c83ac194 which can be used as unique global reference for WEBC2-CLOVER in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

WEBC2-CSON

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware act only as downloaders and droppers for other malware. They communicate with a hard-coded C2 server, reading commands embedded in HTML comment fields. Some variants are executables which act upon execution, others are DLLs which can be attached to services or loaded through search order hijacking.

Internal MISP references

UUID 950a8038-eeec-44a0-b3db-a557e5796416 which can be used as unique global reference for WEBC2-CSON in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-DIV

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-DIV variant searches for the strings "div safe:" and " balance" to delimit encoded C2 information. If the decoded string begins with the letter "J" the malware will parse additional arguments in the decoded string to specify the sleep interval to use. WEBC2-DIV is capable of downloading a file, downloading and executing a file, or sleeping a specified interval.

Internal MISP references

UUID 54be66ea-fd26-4f25-b4af-d10d16fa919f which can be used as unique global reference for WEBC2-DIV in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-GREENCAT

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This malware is a variant on the GREENCAT family, using a fixed web C2. This family is a full featured backdoor which provides remote command execution, file transfer, process and service enumeration and manipulation. It installs itself persistently through the current user's registry Run key.

Internal MISP references

UUID bfe69071-17bf-466f-97fd-669b72053137 which can be used as unique global reference for WEBC2-GREENCAT in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-HEAD

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-HEAD variant communicates over HTTPS, using the system's SSL implementation to encrypt all communications with the C2 server. WEBC2-HEAD first issues an HTTP GET to the host, sending the Base64-encoded string containing the name of the compromised machine running the malware.

Internal MISP references

UUID 4ef97a7e-5686-44cb-ad91-7a393f32f39b which can be used as unique global reference for WEBC2-HEAD in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-KT3

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-KT3 variant searches for commands in a specific comment tag. Network traffic starting with *!Kt3+v| may indicate WEBC2-KT3 activity.

Internal MISP references

UUID e2afc267-9674-4ca3-807f-47678fb40da4 which can be used as unique global reference for WEBC2-KT3 in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-QBP

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-QBP variant will search for two strings in a HTML comment. The first will be "2010QBP " followed by " 2010QBP//--". Inside these tags will be a DES-encrypted string.

Internal MISP references

UUID 84f3bacf-abd5-445e-a98a-5b02f1eaac92 which can be used as unique global reference for WEBC2-QBP in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-RAVE

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. This family of malware will set itself up as a service and connect out to a hardcoded web page and read a modified base64 string from this webpage. The later versions of this malware supports three commands (earlier ones are just downloaders or reverse shells). The first commands will sleep the malware for N number of hours. The second command will download a binary from the encoded HTML comment and execute it on the infected host. The third will spawn an encoded reverse shell to an attacker specified location and port.

Internal MISP references

UUID 9e36feee-e7d2-400a-960e-5f2bd6ac0c15 which can be used as unique global reference for WEBC2-RAVE in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-TABLE

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.

Internal MISP references

UUID 269fee27-f275-44e9-a0db-bebf14d2f83c which can be used as unique global reference for WEBC2-TABLE in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-TOCK

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-TABLE variant looks for web pages containing 'background', 'align', and 'bgcolor' tags to be present in the requested Web page. If the data in these tags are formatted correctly, the malware will decode a second URL and a filename. This URL is then retrieved, written to the decoded filename and executed.

Internal MISP references

UUID 3213c61f-100c-4174-b50b-c7e256ae5474 which can be used as unique global reference for WEBC2-TOCK in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

WEBC2-UGX

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of malware provide remote command shell and remote file download and execution capabilities. The malware downloads a web page containing a crafted HTML comment that subsequently contains an encoded command. The contents of this command tell the malware whether to download and execute a program, launch a reverse shell to a specific host and port number, or to sleep for a period of time.

Internal MISP references

UUID d155c213-02bd-4992-a410-a541a1c1eb40 which can be used as unique global reference for WEBC2-UGX in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

WEBC2-Y21K

A WEBC2 backdoor is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. Members of this family of backdoor malware talk to specific Web-based Command & Control (C2) servers. The backdoor has a limited command set, depending on version. It is primarily a downloader, but it classified as a backdoor because it can accept a limited command set, including changing local directories, downloading and executing additional files, sleeping, and connecting to a specific IP & port not initially included in the instruction set for the malware. Each version of the malware has at least one hardcoded URL to which it connects to receive its initial commands. This family of malware installs itself as a service, with the malware either being the executable run by the service, or the service DLL loaded by a legitimate service. The same core code is seen recompiled on different dates or with different names, but the same functionality. Key signatures include a specific set of functions (some of which can be used with the OS-provided rundll32.exe tool to install the malware as a service), and hardcoded strings used in communication with C2 servers to issue commands to the implant.

Internal MISP references

UUID 215f6352-324f-4735-9fda-ffec0daaa2d2 which can be used as unique global reference for WEBC2-Y21K in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

WEBC2-YAHOO

The WEBC2 malware family is designed to retrieve a Web page from a pre-determined C2 server. It expects the Web page to contain special HTML tags; the backdoor will attempt to interpret the data between the tags as commands. The WEBC2-YAHOO variant enters a loop where every ten minutes it attempts to download a web page that may contain an encoded URL. The encoded URL will be found in the pages returned inside an attribute named 'sb' or 'ex' within a tag named 'yahoo'. The embedded link can direct the malware to download and execute files.

Internal MISP references

UUID d49f372e-c4ee-47bd-bc98-e3877fabaf9e which can be used as unique global reference for WEBC2-YAHOO in MISP communities and other software using the MISP galaxy

External references

• http://contagiodump.blogspot.lu/2013/03/mandiant-apt1-samples-categorized-by.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

HAYMAKER

HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string.

Internal MISP references

UUID d71604d2-a17e-4b4e-82be-19cb54f93161 which can be used as unique global reference for HAYMAKER in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BUGJUICE

BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell.

Internal MISP references

UUID 90124cc8-1205-4e63-83ad-5c45a110b1e6 which can be used as unique global reference for BUGJUICE in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SNUGRIDE

SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell. Persistence is maintained through a Run registry key.

Internal MISP references

UUID 6a42aa10-5b7e-43b0-8c58-414cdaeda453 which can be used as unique global reference for SNUGRIDE in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

QUASARRAT

QUASARRAT is an open-source RAT available at https://github.com/quasar/QuasarRat . The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past. QUASARRAT is a publicly available Windows backdoor. It may visit a website, download, upload, and execute files. QUASARRAT may acquire system information, act as a remote desktop or shell, or remotely activate the webcam. The backdoor may also log keystrokes and steal passwords from commonly used browsers and FTP clients. QUASARRAT was originally named xRAT before it was renamed by the developers in August 2015. Availability: Public

Internal MISP references

UUID 4d58ad7d-b5ee-4efb-b6af-6c70aadb326a which can be used as unique global reference for QUASARRAT in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html - webarchive
• https://researchcenter.paloaltonetworks.com/2017/10/unit42-tracking-subaat-targeted-phishing-attacks-point-leader-threat-actors-repository/ - webarchive
• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

da Vinci RCS

Hacking Team’s "DaVinci" Remote Control System is able, the company says, to break encryption and allow law enforcement agencies to monitor encrypted files and emails (even ones encrypted with PGP), Skype and other Voice over IP or chat communication. It allows identification of the target’s location and relationships. It can also remotely activate microphones and cameras on a computer and works worldwide. Hacking Team claims that its software is able to monitor hundreds of thousands of computers at once, all over the country. Trojans are available for Windows, Mac, Linux, iOS, Android, Symbian and Blackberry.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular da Vinci RCS.

Known Synonyms
DaVinci
Morcut

Internal MISP references

UUID 37709067-e55e-473b-bb1c-312a27714d0c which can be used as unique global reference for da Vinci RCS in MISP communities and other software using the MISP galaxy

External references

• http://surveillance.rsf.org/en/hacking-team/ - webarchive
• https://wikileaks.org/hackingteam/emails/fileid/581640/267803 - webarchive
• https://wikileaks.org/hackingteam/emails/emailid/31436 - webarchive

Associated metadata

Metadata key	Value

LATENTBOT

LATENTBOT, a new, highly obfuscated BOT that has been in the wild since mid-2013. It has managed to leave hardly any traces on the Internet, is capable of watching its victims without ever being noticed, and can even corrupt a hard disk, thus making a PC useless.

Internal MISP references

UUID 635d260f-39d9-4d3f-99ec-d2560cb5d694 which can be used as unique global reference for LATENTBOT in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2015/12/latentbot_trace_me.html - webarchive
• https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

FINSPY

Though we have not identified the targets, FINSPY is sold by Gamma Group to multiple nation-state clients, and we assess with moderate confidence that it was being used along with the zero-day to carry out cyber espionage.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FINSPY.

Known Synonyms
BlackOasis

Internal MISP references

UUID dd4358a4-7a43-42f7-8322-0f941ee61e57 which can be used as unique global reference for FINSPY in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199_useda.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

RCS Galileo

HackingTeam Remote Control System (RCS) Galileo hacking platform

Internal MISP references

UUID 8a15832a-2cb1-47cc-8916-c16a507f7154 which can be used as unique global reference for RCS Galileo in MISP communities and other software using the MISP galaxy

External references

• https://www.f-secure.com/documents/996508/1030745/callisto-group - webarchive

Associated metadata

Metadata key	Value

EARLYSHOVEL

RedHat 7.0 - 7.1 Sendmail 8.11.x exploit

Internal MISP references

UUID 80c7b1bf-c35f-4831-90ce-0699f6173f1b which can be used as unique global reference for EARLYSHOVEL in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EBBISLAND (EBBSHAVE)

root RCE via RPC XDR overflow in Solaris 6, 7, 8, 9 & 10 (possibly newer) both SPARC and x86

Internal MISP references

UUID 370331a1-2178-4369-afb7-ce2da134a2ba which can be used as unique global reference for EBBISLAND (EBBSHAVE) in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ECHOWRECKER

remote Samba 3.0.x Linux exploit

Internal MISP references

UUID 0381c40e-81c6-4a18-b5b6-48b7eef211c7 which can be used as unique global reference for ECHOWRECKER in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EASYBEE

appears to be an MDaemon email server vulnerability

Internal MISP references

UUID 7f96b58d-0f41-46cd-8141-c53d2a03fb81 which can be used as unique global reference for EASYBEE in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EASYPI

an IBM Lotus Notes exploit that gets detected as Stuxnet

Internal MISP references

UUID 4f3df03f-336d-4a2b-a500-47e93a4259e6 which can be used as unique global reference for EASYPI in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EWOKFRENZY

an exploit for IBM Lotus Domino 6.5.4 & 7.0.2

Internal MISP references

UUID c8fedb97-4f7e-48d1-8f2a-5e0562c1fba0 which can be used as unique global reference for EWOKFRENZY in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EXPLODINGCAN

an IIS 6.0 exploit that creates a remote backdoor

Internal MISP references

UUID f843ef63-9e42-42d0-84a0-40d863985088 which can be used as unique global reference for EXPLODINGCAN in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ETERNALROMANCE

a SMB1 exploit over TCP port 445 which targets XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2, and gives SYSTEM privileges (MS17-010)

Internal MISP references

UUID b5c5174e-36a2-4b53-aed7-91b006514c8b which can be used as unique global reference for ETERNALROMANCE in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EDUCATEDSCHOLAR

a SMB exploit (MS09-050)

Internal MISP references

UUID 342a64db-f130-4ac2-96d2-a773fb2bf86d which can be used as unique global reference for EDUCATEDSCHOLAR in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EMERALDTHREAD

a SMB exploit for Windows XP and Server 2003 (MS10-061)

Internal MISP references

UUID 32cd0bfb-9269-43ba-9c43-9fc484a30ad0 which can be used as unique global reference for EMERALDTHREAD in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EMPHASISMINE

a remote IMAP exploit for IBM Lotus Domino 6.6.4 to 8.5.2

Internal MISP references

UUID 48393a71-3814-48ab-805b-a7914e006814 which can be used as unique global reference for EMPHASISMINE in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ENGLISHMANSDENTIST

Outlook Exchange WebAccess rules to trigger executable code on the client's side to send an email to other users

Internal MISP references

UUID ce484c02-b538-4351-ba7e-48c7d05c013f which can be used as unique global reference for ENGLISHMANSDENTIST in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EPICHERO

0-day exploit (RCE) for Avaya Call Server

Internal MISP references

UUID 7120af74-6589-44a4-aee6-0f8fd3808d54 which can be used as unique global reference for EPICHERO in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ERRATICGOPHER

SMBv1 exploit targeting Windows XP and Server 2003

Internal MISP references

UUID a82fa4a0-1904-4c03-9fc4-7cbcd255ce58 which can be used as unique global reference for ERRATICGOPHER in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ETERNALSYNERGY

a SMBv3 remote code execution flaw for Windows 8 and Server 2012 SP0 (MS17-010)

Internal MISP references

UUID b4547fe9-25c9-40b6-9256-07f1ed7548c4 which can be used as unique global reference for ETERNALSYNERGY in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ETERNALBLUE

SMBv2 exploit for Windows 7 SP1 (MS17-010)

Internal MISP references

UUID e5b14d3e-ae59-495e-bdcb-f9d876db3f87 which can be used as unique global reference for ETERNALBLUE in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ETERNALCHAMPION

a SMBv1 exploit

Internal MISP references

UUID 4aee9bfe-f01d-44ea-9edd-91ecad88413a which can be used as unique global reference for ETERNALCHAMPION in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ESKIMOROLL

Kerberos exploit targeting 2000, 2003, 2008 and 2008 R2 domain controllers

Internal MISP references

UUID 4a8db2c4-04fb-49e0-b688-1bc5d8354072 which can be used as unique global reference for ESKIMOROLL in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ESTEEMAUDIT

RDP exploit and backdoor for Windows Server 2003

Internal MISP references

UUID 5d9131be-c3bb-44ac-9c4d-19fcc97d2efd which can be used as unique global reference for ESTEEMAUDIT in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ECLIPSEDWING

RCE exploit for the Server service in Windows Server 2008 and later (MS08-067)

Internal MISP references

UUID 406ad0a9-b1fc-4edc-aa20-692a69f349a6 which can be used as unique global reference for ECLIPSEDWING in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ETRE

exploit for IMail 8.10 to 8.22

Internal MISP references

UUID 3aaef939-132c-4cfb-9243-20918373ccfe which can be used as unique global reference for ETRE in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

FUZZBUNCH

an exploit framework, similar to MetaSploit

Internal MISP references

UUID 3de1aa96-24cd-4790-babc-df0b2d657bdb which can be used as unique global reference for FUZZBUNCH in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/darkpulsar/88199/ - webarchive
• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ODDJOB

implant builder and C&C server that can deliver exploits for Windows 2000 and later, also not detected by any AV vendors

Internal MISP references

UUID d20f9a41-db27-4d53-995e-547f86ff3d1e which can be used as unique global reference for ODDJOB in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PASSFREELY

utility which Bypasses authentication for Oracle servers

Internal MISP references

UUID b68ac0c5-124a-4f22-9c99-0c1cd42bdee3 which can be used as unique global reference for PASSFREELY in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

SMBTOUCH

check if the target is vulnerable to samba exploits like ETERNALSYNERGY, ETERNALBLUE, ETERNALROMANCE

Internal MISP references

UUID 48cf4f29-41a2-4244-bb25-377362eaa3ae which can be used as unique global reference for SMBTOUCH in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ERRATICGOPHERTOUCH

Check if the target is running some RPC

Internal MISP references

UUID a122b8e0-1249-4c77-8ef7-6b9caf48ab4f which can be used as unique global reference for ERRATICGOPHERTOUCH in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

IISTOUCH

check if the running IIS version is vulnerable

Internal MISP references

UUID 7b4bf6dd-d191-429b-a5ee-9305093aa1ec which can be used as unique global reference for IISTOUCH in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

RPCOUTCH

get info about windows via RPC

Internal MISP references

UUID 2c9e90ea-7421-4101-97a6-ebe095bd29ad which can be used as unique global reference for RPCOUTCH in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

DOPU

used to connect to machines exploited by ETERNALCHAMPIONS

Internal MISP references

UUID f1657aac-a6be-4383-8cd6-06b833acf07c which can be used as unique global reference for DOPU in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

FlexSpy

covert surveillance tools

Internal MISP references

UUID 71d6e949-69df-4d64-9637-136780226f49 which can be used as unique global reference for FlexSpy in MISP communities and other software using the MISP galaxy

feodo

Unfortunately, it is time to meet 'Feodo'. Since august of this year when FireEye's MPS devices detected this malware in the field, we have been monitoring this banking trojan very closely. In many ways, this malware looks similar to other famous banking trojans like Zbot and SpyEye. Although my analysis says that this malware is not a toolkit and is in the hands of a single criminal group.

Internal MISP references

UUID 372cdc12-d909-463c-877a-175f97f7abb5 which can be used as unique global reference for feodo in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2010/10/feodosoff-a-new-botnet-on-the-rise.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Cardinal RAT

Palo Alto Networks has discovered a previously unknown remote access Trojan (RAT) that has been active for over two years. It has a very low volume in this two-year period, totaling roughly 27 total samples. The malware is delivered via an innovative and unique technique: a downloader we are calling Carp uses malicious macros in Microsoft Excel documents to compile embedded C# (C Sharp) Programming Language source code into an executable that in turn is run to deploy the Cardinal RAT malware family. These malicious Excel files use a number of different lures, providing evidence of what attackers are using to entice victims into executing them.

Internal MISP references

UUID 1d9fbf33-faea-40c1-b543-c7b39561f0ff which can be used as unique global reference for Cardinal RAT in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

REDLEAVES

The REDLEAVES implant consists of three parts: an executable, a loader, and the implant shellcode. The REDLEAVES implant is a remote administration Trojan (RAT) that is built in Visual C++ and makes heavy use of thread generation during its execution. The implant contains a number of functions typical of RATs, including system enumeration and creating a remote shell back to the C2.

Internal MISP references

UUID 179f7228-6fcf-4664-a084-57bd296d0cde which can be used as unique global reference for REDLEAVES in MISP communities and other software using the MISP galaxy

External references

• https://www.us-cert.gov/ncas/alerts/TA17-117A - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Kazuar

Kazuar is a fully featured backdoor written using the .NET Framework and obfuscated using the open source packer called ConfuserEx. Unit 42 researchers have uncovered a backdoor Trojan used in an espionage campaign. The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator. Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan’s capabilities. During our analysis of this malware we uncovered interesting code paths and other artifacts that may indicate a Mac or Unix variant of this same tool also exists. Also, we discovered a unique feature within Kazuar: it exposes its capabilities through an Application Programming Interface (API) to a built-in webserver. We suspect the Kazuar tool may be linked to the Turla threat actor group (also known as Uroburos and Snake), who have been reported to have compromised embassies, defense contractors, educational institutions, and research organizations across the globe. A hallmark of Turla operations is iterations of their tools and code lineage in Kazuar can be traced back to at least 2005. If the hypothesis is correct and the Turla threat group is using Kazuar, we believe they may be using it as a replacement for Carbon and its derivatives. Of the myriad of tools observed in use by Turla Carbon and its variants were typically deployed as a second stage backdoor within targeted environments and we believe Kazuar may now hold a similar role for Turla operations.

Internal MISP references

UUID a5399473-859b-4c64-999b-a3b4070cd513 which can be used as unique global reference for Kazuar in MISP communities and other software using the MISP galaxy

External references

• http://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Trick Bot

Many links indicate, that this bot is another product of the people previously involved in Dyreza. It seems to be rewritten from scratch – however, it contains many similar features and solutions to those we encountered analyzing Dyreza (read more).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Trick Bot.

Known Synonyms
TrickBot
TrickLoader

Internal MISP references

UUID a7dbd72f-8d53-48c6-a9db-d16e7648b2d4 which can be used as unique global reference for Trick Bot in MISP communities and other software using the MISP galaxy

External references

• https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/ - webarchive
• https://blog.fraudwatchinternational.com/malware/trickbot-malware-works - webarchive
• https://securityintelligence.com/trickbot-is-hand-picking-private-banks-for-targets-with-redirection-attacks-in-tow/ - webarchive
• https://www.bleepingcomputer.com/news/security/trickbot-banking-trojan-gets-screenlocker-component/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Hackshit

Netskope Threat Research Labs recently discovered a Phishing-as-a-Service (PhaaS) platform named Hackshit, that records the credentials of the phished bait victims. The phished bait pages are packaged with base64 encoding and served from secure (HTTPS) websites with “.moe” top level domain (TLD) to evade traditional scanners. “.moe” TLD is intended for the purpose of ‘The marketing of products or services deemed’. The victim’s credentials are sent to the Hackshit PhaaS platform via websockets. The Netskope Active Platform can proactively protect customers by creating custom applications and a policy to block all the activities related to Hackshit PhaaS.

Internal MISP references

UUID 02d2ed4a-ce3f-430b-a8da-5b9750c148ca which can be used as unique global reference for Hackshit in MISP communities and other software using the MISP galaxy

External references

• https://resources.netskope.com/h/i/352356475-phishing-as-a-service-phishing-revamped - webarchive

Associated metadata

Metadata key	Value

Moneygram Adwind

Internal MISP references

UUID 6c6e717d-03c5-496d-83e9-13bdaa408348 which can be used as unique global reference for Moneygram Adwind in MISP communities and other software using the MISP galaxy

External references

• https://myonlinesecurity.co.uk/new-guidelines-from-moneygram-malspam-delivers-a-brand-new-java-adwind-version/ - webarchive

Associated metadata

Metadata key	Value

Banload

Banload has been around since the last decade. This malware generally arrives on a victim’s system through a spam email containing an archived file or bundled software as an attachment. In a few cases, this malware may also be dropped by other malware or a drive-by download. When executed, Banload downloads other malware, often banking Trojans, on the victim’s system to carry out further infections.

Internal MISP references

UUID d279bc1c-baa6-49aa-ab1b-7d012ae8db4e which can be used as unique global reference for Banload in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2016/03/banload-malware-affecting-brazil-exhibits-unusually-complex-infection-process/ - webarchive
• https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/banload - webarchive
• http://blog.trendmicro.com/trendlabs-security-intelligence/banload-limits-targets-via-security-plugin/ - webarchive
• https://securingtomorrow.mcafee.com/mcafee-labs/banload-trojan-targets-brazilians-with-malware-downloads/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Smoke Loader

This small application is used to download other malware. What makes the bot interesting are various tricks that it uses for deception and self protection.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Smoke Loader.

Known Synonyms
SmokeLoader

Internal MISP references

UUID 81f41bae-2ba9-4cec-9613-776be71645ca which can be used as unique global reference for Smoke Loader in MISP communities and other software using the MISP galaxy

External references

• https://blog.malwarebytes.com/threat-analysis/2016/08/smoke-loader-downloader-with-a-smokescreen-still-alive/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

LockPoS

The analyzed sample has a recent compilation date (2017-06-24) and is available on VirusTotal. It starts out by resolving several Windows functions using API hashing (CRC32 is used as the hashing function).

Internal MISP references

UUID c740c46b-1d95-42b5-ac3d-2bbab071b859 which can be used as unique global reference for LockPoS in MISP communities and other software using the MISP galaxy

External references

• https://www.arbornetworks.com/blog/asert/lockpos-joins-flock/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Fadok

Win.Worm.Fadok drops several files. %AppData%\RAC\mls.exe or %AppData%\RAC\svcsc.exe are instances of the malware which are auto-started when Windows starts. Further, the worm drops and opens a Word document. It connects to the domain wxanalytics[.]ru.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Fadok.

Known Synonyms
Win32/Fadok

Internal MISP references

UUID 6243b2d1-381b-4aa4-a59f-839afcdf03f2 which can be used as unique global reference for Fadok in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm%3AWin32%2FFadok.A - webarchive
• http://blog.talosintelligence.com/2017/06/threat-roundup-0602-0609.html - webarchive

Associated metadata

Metadata key	Value

Loki Bot

Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets.

Internal MISP references

UUID 9085faf1-e5ec-4e51-83eb-92620afda7be which can be used as unique global reference for Loki Bot in MISP communities and other software using the MISP galaxy

External references

• https://phishme.com/loki-bot-malware/ - webarchive

Associated metadata

Metadata key	Value

KONNI

Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time. In this article, we will analyse this evolution:

Internal MISP references

UUID 24ee55e3-697f-482f-8fa8-d05999df40cd which can be used as unique global reference for KONNI in MISP communities and other software using the MISP galaxy

External references

• http://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html - webarchive
• https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

NOKKI

Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks. Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.

Internal MISP references

UUID 9e4fd0d3-9736-421c-b1e1-96c1d3665c80 which can be used as unique global reference for NOKKI in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2018/09/unit42-new-konni-malware-attacking-eurasia-southeast-asia/ - webarchive
• https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SpyDealer

Recently, Palo Alto Networks researchers discovered an advanced Android malware we’ve named “SpyDealer” which exfiltrates private data from more than 40 apps and steals sensitive messages from communication apps by abusing the Android accessibility service feature. SpyDealer uses exploits from a commercial rooting app to gain root privilege, which enables the subsequent data theft.

Internal MISP references

UUID f86b4977-228d-4b31-854d-8bdc92db4653 which can be used as unique global reference for SpyDealer in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2017/07/unit42-spydealer-android-trojan-spying-40-apps/ - webarchive

Associated metadata

Metadata key	Value

CowerSnail

CowerSnail was compiled using Qt and linked with various libraries. This framework provides benefits such as cross-platform capability and transferability of the source code between different operating systems.

Internal MISP references

UUID 6da16d56-eaf9-475d-a7e0-4a11e0200c14 which can be used as unique global reference for CowerSnail in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/cowersnail-from-the-creators-of-sambacry/79087/ - webarchive

Associated metadata

Metadata key	Value

Svpeng

In mid-July 2017, we found a new modification of the well-known mobile banking malware family Svpeng – Trojan-Banker.AndroidOS.Svpeng.ae. In this modification, the cybercriminals have added new functionality: it now also works as a keylogger, stealing entered text through the use of accessibility services.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Svpeng.

Known Synonyms
trojan-banker.androidos.svpeng.ae

Internal MISP references

UUID a33df440-f112-4a5e-a290-3c65dae6091d which can be used as unique global reference for Svpeng in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/a-new-era-in-mobile-banking-trojans/79198/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TwoFace

While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization. The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell. It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server. Due to these two layers, we use the name TwoFace to track this webshell. During our analysis, we extracted the commands executed by the TwoFace webshell from the server logs on the compromised server. Our analysis shows that the commands issued by the threat actor date back to June 2016; this suggests that the actor had access to this shell for almost an entire year. The commands issued show the actor was interested in gathering credentials from the compromised server using the Mimikatz tool. We also saw the attacker using the TwoFace webshell to move laterally through the network by copying itself and other webshells to other servers.

Internal MISP references

UUID 9334c430-0d83-4893-8982-66a1dc1a2b11 which can be used as unique global reference for TwoFace in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/ - webarchive

Associated metadata

Metadata key	Value
type	['webshell']

Related clusters

To see the related clusters, click here.

IntrudingDivisor

Like TwoFace, the IntrudingDivisor webshell requires the threat actor to authenticate before issuing commands. To authenticate, the actor must provide two pieces of information, first an integer that is divisible by 5473 and a string whose MD5 hash is “9A26A0E7B88940DAA84FC4D5E6C61AD0”. Upon successful authentication, the webshell has a command handler that uses integers within the request to determine the command to execute - To complete

Internal MISP references

UUID bb2bd10b-b36d-4390-bf60-bd8d2d7cedec which can be used as unique global reference for IntrudingDivisor in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/ - webarchive

Associated metadata

Metadata key	Value
type	['webshell']

JS_POWMET

Attacks that use completely fileless malware are a rare occurrence, so we thought it important to discuss a new trojan known as JS_POWMET (Detected by Trend Micro as JS_POWMET.DE), which arrives via an autostart registry procedure. By utilizing a completely fileless infection chain, the malware will be more difficult to analyze using a sandbox, making it more difficult for anti-malware engineers to examine.

Internal MISP references

UUID c602edae-b186-4c60-a4f6-8785d6aa0eb0 which can be used as unique global reference for JS_POWMET in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/look-js_powmet-completely-fileless-malware/ - webarchive

Associated metadata

Metadata key	Value

EngineBox Malware

The main malware capabilities include a privilege escalation attempt using MS16–032 exploitation; a HTTP Proxy to intercept banking transactions; a backdoor to make it possible for the attacker to issue arbitrary remote commands and a C&C through a IRC channel. As it's being identified as a Generic Trojan by most of VirusTotal (VT) engines, let s name it EngineBox— the core malware class I saw after reverse engineering it.

Internal MISP references

UUID 17839df6-aa15-4269-b4b1-9e7ae8cfec1e which can be used as unique global reference for EngineBox Malware in MISP communities and other software using the MISP galaxy

External references

• https://isc.sans.edu/diary/22736 - webarchive

Associated metadata

Metadata key	Value

Joao

Spread via hacked Aeria games offered on unofficial websites, the modular malware can download and install virtually any other malicious code on the victim’s computer. To spread their malware, the attackers behind Joao have misused massively-multiplayer online role-playing games (MMORPGs) originally published by Aeria Games. At the time of writing this article, the Joao downloader was being distributed via the anime-themed MMORPG Grand Fantasia offered on gf.ignitgames[.]to.

Internal MISP references

UUID 673d05fa-4066-442c-bdb6-0c0a2da5ae62 which can be used as unique global reference for Joao in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2017/08/22/gamescom-2017-fun-blackhats/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Fireball

Upon execution, Fireball installs a browser hijacker as well as any number of adware programs. Several different sources have linked different indicators of compromise (IOCs) and varied payloads, but a few details remain the same.

Internal MISP references

UUID 968df869-7f60-4420-989f-23dfdbd58668 which can be used as unique global reference for Fireball in MISP communities and other software using the MISP galaxy

External references

• https://www.cylance.com/en_us/blog/threat-spotlight-is-fireball-adware-or-malware.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

ShadowPad

ShadowPad is a modular cyber-attack platform that attackers deploy in victim networks to gain flexible remote control capabilities. The platform is designed to run in two stages. The first stage is a shellcode that was embedded in a legitimate nssock2.dll used by Xshell, Xmanager and other software packages produced by NetSarang. This stage is responsible for connecting to “validation” command and control (C&C) servers and getting configuration information including the location of the real C&C server, which may be unique per victim. The second stage acts as an orchestrator for five main modules responsible for C&C communication, working with the DNS protocol, loading and injecting additional plugins into the memory of other processes.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ShadowPad.

Known Synonyms
Barlaiy
POISONPLUG

Internal MISP references

UUID 2448a4e1-46e3-4c42-9fd1-f51f8ede58c1 which can be used as unique global reference for ShadowPad in MISP communities and other software using the MISP galaxy

External references

• https://cdn.securelist.com/files/2017/08/ShadowPad_technical_description_PDF.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

IoT_reaper

IoT_reaper is fairly large now and is actively expanding. For example, there are multiple C2s we are tracking, the most recently data (October 19) from just one C2 shows the number of unique active bot IP address is more than 10k per day. While at the same time, there are millions of potential vulnerable device IPs being queued into the c2 system waiting to be processed by an automatic loader that injects malicious code to the devices to expand the size of the botnet.

Internal MISP references

UUID 6052becf-3060-444c-8ed7-d4a3901ae7dd which can be used as unique global reference for IoT_reaper in MISP communities and other software using the MISP galaxy

External references

• http://blog.netlab.360.com/iot_reaper-a-rappid-spreading-new-iot-botnet-en/ - webarchive

Associated metadata

Metadata key	Value

FormBook

FormBook is a data stealer and form grabber that has been advertised in various hacking forums since early 2016.

Internal MISP references

UUID c7e7063b-b2a2-4046-8a19-94dea018eaa0 which can be used as unique global reference for FormBook in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2017/10/formbook-malware-distribution-campaigns.html - webarchive
• https://www.arbornetworks.com/blog/asert/formidable-formbook-form-grabber/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Dimnie

Dimnie, the commonly agreed upon name for the binary dropped by the PowerShell script above, has been around for several years. Palo Alto Networks has observed samples dating back to early 2014 with identical command and control mechanisms. The malware family serves as a downloader and has a modular design encompassing various information stealing functionalities. Each module is injected into the memory of core Windows processes, further complicating analysis. During its lifespan, it appears to have undergone few changes and its stealthy command and control methods combined with a previously Russian focused target base has allowed it to fly under the radar up until this most recent campaign.

Internal MISP references

UUID 9fed4326-a7ad-4c58-ab87-90ac3957d82f which can be used as unique global reference for Dimnie in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2017/03/unit42-dimnie-hiding-plain-sight/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

ALMA Communicator

The ALMA Communicator Trojan is a backdoor Trojan that uses DNS tunneling exclusively to receive commands from the adversary and to exfiltrate data. This Trojan specifically reads in a configuration from the cfg file that was initially created by the Clayslide delivery document. ALMA does not have an internal configuration, so the Trojan does not function without the cfg file created by the delivery document.

Internal MISP references

UUID 45de0d28-5a20-4190-ae21-68067e36e316 which can be used as unique global reference for ALMA Communicator in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2017/11/unit42-oilrig-deploys-alma-communicator-dns-tunneling-trojan/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Silence

In September 2017, we discovered a new targeted attack on financial institutions. Victims are mostly Russian banks but we also found infected organizations in Malaysia and Armenia. The attackers were using a known but still very effective technique for cybercriminals looking to make money: gaining persistent access to an internal banking network for a long period of time, making video recordings of the day to day activity on bank employees’ PCs, learning how things works in their target banks, what software is being used, and then using that knowledge to steal as much money as possible when ready. We saw that technique before in Carbanak, and other similar cases worldwide. The infection vector is a spear-phishing email with a malicious attachment. An interesting point in the Silence attack is that the cybercriminals had already compromised banking infrastructure in order to send their spear-phishing emails from the addresses of real bank employees and look as unsuspicious as possible to future victims.

Internal MISP references

UUID 304fd753-c917-4008-8f85-81390c37a070 which can be used as unique global reference for Silence in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/the-silence/83009/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Volgmer

Volgmer is a backdoor Trojan designed to provide covert access to a compromised system. Since at least 2013, HIDDEN COBRA actors have been observed using Volgmer malware in the wild to target the government, financial, automotive, and media industries. It is suspected that spear phishing is the primary delivery mechanism for Volgmer infections; however, HIDDEN COBRA actors use a suite of custom tools, some of which could also be used to initially compromise a system. Therefore, it is possible that additional HIDDEN COBRA malware may be present on network infrastructure compromised with Volgmer

Internal MISP references

UUID 0a52e73b-d7e9-45ae-9bda-46568f753931 which can be used as unique global reference for Volgmer in MISP communities and other software using the MISP galaxy

External references

• https://www.us-cert.gov/ncas/alerts/TA17-318B - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Nymaim

Nymaim is a 2-year-old strain of malware most closely associated with ransomware. We have seen recent attacks spreading it using an established email marketing service provider to avoid blacklists and detection tools. But instead of ransomware, the malware is now being used to distribute banking Trojans

Internal MISP references

UUID d36f4834-b958-4f32-aff0-5263e0034408 which can be used as unique global reference for Nymaim in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/what-old-new-again-nymaim-moves-past-its-ransomware-roots-0 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GootKit

As was the case earlier, the bot Gootkit is written in NodeJS, and is downloaded to a victim computer via a chain of downloaders. The main purpose of the bot also remained the same – to steal banking data. The new Gootkit version, detected in September, primarily targets clients of European banks, including those in Germany, France, Italy, the Netherlands, Poland, etc.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GootKit.

Known Synonyms
Gootkit

Internal MISP references

UUID 07ffcf9f-b9c0-4b22-af4b-78527427e6f5 which can be used as unique global reference for GootKit in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/inside-the-gootkit-cc-server/76433/ - webarchive
• https://securityintelligence.com/gootkit-bobbing-and-weaving-to-avoid-prying-eyes/ - webarchive
• https://securityintelligence.com/gootkit-launches-redirection-attacks-in-the-uk/ - webarchive
• https://www.symantec.com/security_response/writeup.jsp?docid=2010-051118-0604-99 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Agent Tesla

Agent Tesla is modern powerful keystroke logger. It provides monitoring your personel computer via keyboard and screenshot. Keyboard, screenshot and registered passwords are sent in log. You can receive your logs via e-mail, ftp or php(web panel).

Internal MISP references

UUID f8cd62cb-b9d3-4352-8f46-0961cfde104c which can be used as unique global reference for Agent Tesla in MISP communities and other software using the MISP galaxy

External references

• https://www.agenttesla.com/ - webarchive
• https://www.bleepingcomputer.com/news/security/zoho-heavily-used-by-keyloggers-to-transmit-stolen-data/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Ordinypt

A new ransomware strain called Ordinypt is currently targeting victims in Germany, but instead of encrypting users' documents, the ransomware rewrites files with random data. Ordinypt is actually a wiper and not ransomware because it does not bother encrypting anything, but just replaces files with random data.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Ordinypt.

Known Synonyms
HSDFSDCrypt

Internal MISP references

UUID 1d46f816-d159-4457-b98e-c34307d90655 which can be used as unique global reference for Ordinypt in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/ordinypt-ransomware-intentionally-destroys-files-currently-targeting-germany/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

StrongPity2

Detected by ESET as Win32/StrongPity2, this spyware notably resembles one that was attributed to the group called StrongPity.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StrongPity2.

Known Synonyms
Win32/StrongPity2

Internal MISP references

UUID d422e7c9-a2ac-45b2-9804-61d16a6e30e7 which can be used as unique global reference for StrongPity2 in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2017/12/08/strongpity-like-spyware-replaces-finfisher/ - webarchive

Associated metadata

Metadata key	Value

wp-vcd

WordPress site owners should be on the lookout for a malware strain tracked as wp-vcd that hides in legitimate WordPress files and that is used to add a secret admin user and grant attackers control over infected sites. The malware was first spotted online over the summer by Italian security researcher Manuel D'Orso. The initial version of this threat was loaded via an include call for the wp-vcd.php file —hence the malware's name— and injected malicious code into WordPress core files such as functions.php and class.wp.php. This was not a massive campaign, but attacks continued throughout the recent months.

Internal MISP references

UUID 99de56dc-92c5-4540-91bc-a6cd1e3a3c7f which can be used as unique global reference for wp-vcd in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/wp-vcd-wordpress-malware-campaign-is-back/ - webarchive
• https://www.bleepingcomputer.com/news/security/wp-vcd-wordpress-malware-spreads-via-nulled-wordpress-themes/ - webarchive

Associated metadata

Metadata key	Value

MoneyTaker 5.0

malicious program for auto replacement of payment data in AWS CBR

Internal MISP references

UUID 0acb6f04-7e51-44bb-843c-4bb55a3647d5 which can be used as unique global reference for MoneyTaker 5.0 in MISP communities and other software using the MISP galaxy

External references

• https://www.group-ib.com/blog/moneytaker - webarchive

Associated metadata

Metadata key	Value

Quant Loader

Described as a "professional exe loader / dll dropper" Quant Loader is in fact a very basic trojan downloader. It began being advertised on September 1, 2016 on various Russian underground forums.

Internal MISP references

UUID 2d1aadfb-03c1-4580-b6ac-f12c6941067d which can be used as unique global reference for Quant Loader in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/quant-loader-is-now-bundled-with-other-crappy-malware/ - webarchive
• https://blogs.forcepoint.com/security-labs/locky-distributor-uses-newly-released-quant-loader-sold-russian-underground - webarchive
• https://www.bleepingcomputer.com/news/security/worlds-largest-spam-botnet-finds-a-new-way-to-avoid-detection-for-now/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SSHDoor

The Secure Shell Protocol (SSH) is a very popular protocol used for secure data communication. It is widely used in the Unix world to manage remote servers, transfer files, etc. The modified SSH daemon described here, Linux/SSHDoor.A, is designed to steal usernames and passwords and allows remote access to the server via either an hardcoded password or SSH key.

Internal MISP references

UUID f258f96c-8281-4b24-8aa7-4e23d1a5540e which can be used as unique global reference for SSHDoor in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2013/01/24/linux-sshdoor-a-backdoored-ssh-daemon-that-steals-passwords/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TRISIS

(Dragos Inc.) The team identifies this malware as TRISIS because it targets Schneider Electric’s Triconex safety instrumented system (SIS) enabling the replacement of logic in final control elements. TRISIS is highly targeted and likely does not pose an immediate threat to other Schneider Electric customers, let alone other SIS products. (FireEye Inc.) This malware, which we call TRITON, is an attack framework built to interact with Triconex Safety Instrumented System (SIS) controllers. We have not attributed the incident to a threat actor, though we believe the activity is consistent with a nation state preparing for an attack. TRITON is one of a limited number of publicly identified malicious software families targeted at industrial control systems (ICS). It follows Stuxnet which was used against Iran in 2010 and Industroyer which we believe was deployed by Sandworm Team against Ukraine in 2016.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TRISIS.

Known Synonyms
TRITON

Internal MISP references

UUID 8a45d1a5-8157-4303-a47a-352282065059 which can be used as unique global reference for TRISIS in MISP communities and other software using the MISP galaxy

External references

• https://www.fireeye.com/blog/threat-research/2017/12/attackers-deploy-new-ics-attack-framework-triton.html - webarchive
• https://dragos.com/blog/trisis/TRISIS-01.pdf - webarchive

Associated metadata

Metadata key	Value

OSX.Pirrit

macOS adware strain

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular OSX.Pirrit.

Known Synonyms
OSX/Pirrit

Internal MISP references

UUID e2b7ddc2-2fce-4ef9-9054-609e74a8775e which can be used as unique global reference for OSX.Pirrit in MISP communities and other software using the MISP galaxy

External references

• http://go.cybereason.com/rs/996-YZT-709/images/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf - webarchive
• https://www2.cybereason.com/research-osx-pirrit-mac-adware - webarchive
• https://www.cybereason.com/hubfs/Content%20PDFs/OSX.Pirrit%20Part%20III%20The%20DaVinci%20Code.pdf - webarchive

Associated metadata

Metadata key	Value

GratefulPOS

GratefulPOS has the following functions 1. Access arbitrary processes on the target POS system 2. Scrape track 1 and 2 payment card data from the process(es) 3. Exfiltrate the payment card data via lengthy encoded and obfuscated DNS queries to a hardcoded domain registered and controlled by the perpetrators, similar to that described by Paul Rascagneres in his analysis of FrameworkPOS in 2014[iii], and more recently by Luis Mendieta of Anomoli in analysis of a precursor to this sample.

Internal MISP references

UUID 4cfe3f22-96b8-4d3d-a6cc-85835d9471e2 which can be used as unique global reference for GratefulPOS in MISP communities and other software using the MISP galaxy

External references

• https://community.rsa.com/community/products/netwitness/blog/2017/12/08/gratefulpos-credit-card-stealing-malware-just-in-time-for-the-shopping-season - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PRILEX

Prilex malware steals the information of the infected ATM’s users. In this case, it was a Brazilian bank, but consider the implications of such an attack in your region, whether you’re a customer or the bank.

Internal MISP references

UUID 523e8772-0610-424c-bcfb-9123bcb8328f which can be used as unique global reference for PRILEX in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/dissecting-prilex-cutlet-maker-atm-malware-families/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CUTLET MAKER

Cutlet Maker is an ATM malware designed to empty the machine of all its banknotes. Interestingly, while its authors have been advertising its sale, their competitors have already cracked the program, allowing anybody to use it for free.

Internal MISP references

UUID c03e7054-6013-4f69-994d-7cdaa41588ed which can be used as unique global reference for CUTLET MAKER in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/dissecting-prilex-cutlet-maker-atm-malware-families/ - webarchive

Associated metadata

Metadata key	Value

Satori

According to a report Li shared with Bleeping Computer today, the Mirai Satori variant is quite different from all previous pure Mirai variants.Previous Mirai versions infected IoT devices and then downloaded a Telnet scanner component that attempted to find other victims and infect them with the Mirai bot.The Satori variant does not use a scanner but uses two embedded exploits that will try to connect to remote devices on ports 37215 and 52869.Effectively, this makes Satori an IoT worm, being able to spread by itself without the need for separate components.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Satori.

Known Synonyms
Okiru

Internal MISP references

UUID 1ad4697b-3388-48ed-8621-85abebf5dbbf which can be used as unique global reference for Satori in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/satori-botnet-has-sudden-awakening-with-over-280-000-active-bots/ - webarchive
• https://blog.fortinet.com/2017/12/12/rise-of-one-more-mirai-worm-variant - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PowerSpritz

PowerSpritz is a Windows executable that hides both its legitimate payload and malicious PowerShell command using a non-standard implementation of the already rarely used Spritz encryption algorithm (see the Attribution section for additional analysis of the Spritz implementation). This malicious downloader has been observed being delivered via spearphishing attacks using the TinyCC link shortener service to redirect to likely attacker-controlled servers hosting the malicious PowerSpritz payload.

Internal MISP references

UUID 5629bc84-58eb-42d9-adc6-cd0eeb08ccaf which can be used as unique global reference for PowerSpritz in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PowerRatankba

PowerRatankba is used for the same purpose as Ratankba: as a first stage reconnaissance tool and for the deployment of further stage implants on targets that are deemed interesting by the actor. Similar to its predecessor, PowerRatankba utilizes HTTP for its C&C communication.

Internal MISP references

UUID 1f1be19e-d1b5-408b-90a0-03ad27cc8924 which can be used as unique global reference for PowerRatankba in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/sites/default/files/pfpt-us-wp-north-korea-bitten-by-bitcoin-bug.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Ratankba

In one instance we observed, one of the initial malware delivered to the victim, RATANKBA, connects to a legitimate but compromised website from which a hack tool (nbt_scan.exe) is also downloaded. The domain also serves as one of the campaign’s platform for C&C communication. The threat actor uses RATANKBA to survey the lay of the land as it looks into various aspects of the host machine where it has been initially downloaded—the machine that has been victim of the watering hole attack. Information such as the running tasks, domain, shares, user information, if the host has default internet connectivity, and so forth.

Internal MISP references

UUID 64b3c66b-fc70-4b5a-83a9-866cde2ccb0b which can be used as unique global reference for Ratankba in MISP communities and other software using the MISP galaxy

External references

• http://blog.trendmicro.com/trendlabs-security-intelligence/ratankba-watering-holes-against-enterprises/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

USBStealer

USBStealer serves as a network tool that extracts sensitive information from air-gapped networks. We have not seen this component since mid 2015.

Internal MISP references

UUID 44909efb-7cd3-42e3-b225-9f3e96b5f362 which can be used as unique global reference for USBStealer in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Downdelph

Downdelph is a lightweight downloader developed in the Delphi programming language. As we already mentioned in our white paper, its period of activity was from November 2013 to September 2015 and there have been no new variants seen since.

Internal MISP references

UUID 837a295c-15ff-41c0-9b7e-5f2fb502b00a which can be used as unique global reference for Downdelph in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CoinMiner

Monero-mining malware

Internal MISP references

UUID 89bd2020-2594-45c4-8957-522c0ac41370 which can be used as unique global reference for CoinMiner in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2017/09/28/monero-money-mining-malware/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

FruitFly

A fully-featured backdoor, designed to perversely spy on Mac users

Internal MISP references

UUID 6a6525b9-4656-4973-ab45-588592395d0c which can be used as unique global reference for FruitFly in MISP communities and other software using the MISP galaxy

External references

• https://objective-see.com/blog/blog_0x25.html#FruitFly - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MacDownloader

Iranian macOS exfiltration agent, targeting the 'defense industrial base' and human rights advocates.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MacDownloader.

Known Synonyms
iKitten

Internal MISP references

UUID 14f08f6f-7f58-48a8-8469-472244ffb571 which can be used as unique global reference for MacDownloader in MISP communities and other software using the MISP galaxy

External references

• https://objective-see.com/blog/blog_0x25.html#MacDownloader - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Empyre

The open-source macOS backdoor, 'Empye', maliciously packaged into a macro'd Word document

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Empyre.

Known Synonyms
Empye

Internal MISP references

UUID cf55bbb8-37eb-4cc6-ac14-7b42b950c687 which can be used as unique global reference for Empyre in MISP communities and other software using the MISP galaxy

External references

• https://objective-see.com/blog/blog_0x25.html#Empyre - webarchive

Associated metadata

Metadata key	Value

Proton

A fully-featured macOS backdoor, designed to collect and exfiltrate sensitive user data such as 1Password files, browser login data, and keychains.

Internal MISP references

UUID a495d254-7092-4a63-9872-3a82c13fe2dd which can be used as unique global reference for Proton in MISP communities and other software using the MISP galaxy

External references

• https://objective-see.com/blog/blog_0x25.html#Proton - webarchive

Associated metadata

Metadata key	Value

Mughthesec

Adware which hijacks a macOS user's homepage to redirect search queries.

Internal MISP references

UUID 4e2f0af2-6d2d-4a49-adc9-fae3745fcb72 which can be used as unique global reference for Mughthesec in MISP communities and other software using the MISP galaxy

External references

• https://objective-see.com/blog/blog_0x25.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Pwnet

A macOS crypto-currency miner, distributed via a trojaned 'CS-GO' hack.

Internal MISP references

UUID 29e52693-b325-4c14-93de-8f2ff9dca8bf which can be used as unique global reference for Pwnet in MISP communities and other software using the MISP galaxy

External references

• https://objective-see.com/blog/blog_0x25.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CpuMeaner

A macOS crypto-currency mining trojan.

Internal MISP references

UUID 5bc62523-dc80-46b4-b5cb-9caf44c11552 which can be used as unique global reference for CpuMeaner in MISP communities and other software using the MISP galaxy

External references

• https://objective-see.com/blog/blog_0x25.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Travle

The Travle sample found during our investigation was a DLL with a single exported function (MSOProtect). The malware name Travle was chosen given a string found in early samples of this family: “Travle Path Failed!”. This typo was replaced with correct word “Travel” in newer releases. We believe that Travle could be a successor to the NetTraveler family.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Travle.

Known Synonyms
PYLOT

Internal MISP references

UUID 9d689318-2bc1-4bfb-92ee-a81fea35434f which can be used as unique global reference for Travle in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/travle-aka-pylot-backdoor-hits-russian-speaking-targets/83455/ - webarchive

Associated metadata

Metadata key	Value

Digmine

Digmine is coded in AutoIt, and sent to would-be victims posing as a video file but is actually an AutoIt executable script. If the user’s Facebook account is set to log in automatically, Digmine will manipulate Facebook Messenger in order to send a link to the file to the account’s friends. The abuse of Facebook is limited to propagation for now, but it wouldn’t be implausible for attackers to hijack the Facebook account itself down the line. This functionality’s code is pushed from the command-and-control (C&C) server, which means it can be updated.

Internal MISP references

UUID d248a27c-d036-4032-bc70-803a1b0c8148 which can be used as unique global reference for Digmine in MISP communities and other software using the MISP galaxy

External references

• https://blog.trendmicro.com/trendlabs-security-intelligence/digmine-cryptocurrency-miner-spreading-via-facebook-messenger/ - webarchive

Associated metadata

Metadata key	Value

TSCookie

TSCookie itself only serves as a downloader. It expands functionality by downloading modules from C&C servers. The sample that was examined downloaded a DLL file which has exfiltrating function among many others (hereafter “TSCookieRAT”). Downloaded modules only runs on memory.

Internal MISP references

UUID a71ed71f-b8f4-416d-9c57-910a42e59430 which can be used as unique global reference for TSCookie in MISP communities and other software using the MISP galaxy

External references

• http://blog.jpcert.or.jp/.s/2018/03/malware-tscooki-7aa0.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Exforel

Exforel backdoor malware, VirTool:WinNT/Exforel.A, backdoor implemented at the Network Driver Interface Specification (NDIS) level.

Internal MISP references

UUID 3119554e-236e-11e8-ae2e-b7063732fd07 which can be used as unique global reference for Exforel in MISP communities and other software using the MISP galaxy

External references

• http://news.softpedia.com/news/Exforel-Backdoor-Implemented-at-NDIS-Level-to-Be-More-Stealthy-Experts-Say-313567.shtml - webarchive

Associated metadata

Metadata key	Value

Rotinom

W32.Rotinom is a worm that spreads by copying itself to removable drives.

Internal MISP references

UUID 5f4be30a-2373-11e8-bbab-774ff49fd040 which can be used as unique global reference for Rotinom in MISP communities and other software using the MISP galaxy

External references

• https://www.symantec.com/security_response/writeup.jsp?docid=2011-011117-0057-99 - webarchive

Associated metadata

Metadata key	Value

Aurora

You probably have heard the recent news about a widespread attack that was carried out using a 0-Day exploit for Internet Explorer as one of the vectors. This exploit is also known as the "Aurora Exploit". The code has recently gone public and it was also added to the Metasploit framework. This exploit was used to deliver a malicious payload, known by the name of Trojan.Hydraq, the main purpose of which was to steal information from the compromised computer and report it back to the attackers. The exploit code makes use of known techniques to exploit a vulnerability that exists in the way Internet Explorer handles a deleted object. The final purpose of the exploit itself is to access an object that was previously deleted, causing the code to reference a memory location over which the attacker has control and in which the attacker dropped his malicious code.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Aurora.

Known Synonyms
Hydraq

Internal MISP references

UUID 70c31066-237a-11e8-8eff-37ef1ad0c703 which can be used as unique global reference for Aurora in MISP communities and other software using the MISP galaxy

External references

• https://www.symantec.com/connect/blogs/trojanhydraq-incident-analysis-aurora-0-day-exploit - webarchive
• https://www.symantec.com/connect/blogs/hydraq-aurora-attackers-back - webarchive
• https://www.symantec.com/connect/blogs/hydraq-attack-mythical-proportions - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Cheshire Cat

Oldest Cheshire Cat malware compiled in 2002. It's a very old family of malware. The time stamps may be forged but the malware does have support for very old operating systems. The 2002 implant retrieves a handle for an asr2892 drives that they never got their hands on. It checks for a NE header which is a header type used before PE headers even existed. References to 16bit or DOS on a non 9x platform. This malware implant IS REALLY for old systems. The malware is for espionage - it's very carefully made to stay hidden. Newer versions install as icon handler shell extension for .lnk files. Shell in this case means the program manager because windows explorer was not yet a thing. It sets up COM server objects. It looks like it was written in pure C, but made to look like C++. A sensitive implant as well: it checks for all kinds of old MS platforms including Windows NT, win95, win98, winME and more. It checks the patch level as well. A lot of effort was put into adapting this malware to a lot of different operating systems with very granular decision chains.

Internal MISP references

UUID 7af226a0-237d-11e8-b438-075460988010 which can be used as unique global reference for Cheshire Cat in MISP communities and other software using the MISP galaxy

External references

• https://www.youtube.com/watch?v=u2Ry9HTBbZI - webarchive
• https://malware-research.org/prepare-father-of-stuxnet-news-are-coming/ - webarchive
• https://www.peerlyst.com/posts/hack-lu-2016-recap-interesting-malware-no-i-m-not-kidding-by-marion-marschalek-claus-cramon - webarchive

Associated metadata

Metadata key	Value

Downloader-FGO

Downloader-FGO is a trojan that comes hidden in malicious programs. Once you install the source (carrier) program, this trojan attempts to gain "root" access (administrator level access) to your computer without your knowledge

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Downloader-FGO.

Known Synonyms
Generic30.ASYL (Trojan horse)
Mal/Behav-112
SB/Malware
TR/Agent.84480.85
TROJ_KAZY.SM1
Trj/CI.A
Trojan.Generic.8627031
Trojan.Spuler
Trojan:Win32/Sisproc
Win32/FakePPT_i
Win32:Malware-gen

Internal MISP references

UUID 1a3f876f-0f52-497f-b3ff-b995e2d42c15 which can be used as unique global reference for Downloader-FGO in MISP communities and other software using the MISP galaxy

External references

• https://www.solvusoft.com/en/malware/trojans/downloader-fgo/ - webarchive

Associated metadata

Metadata key	Value
uuid	c565a3a4-2384-11e8-99e9-ebd8ea5c3c3e

miniFlame

Newly discovered spying malware designed to steal data from infected systems was likely built from the same cyber-weaponry factory that produced two other notorious cyberespionage software Flame and Gauss, a security vendor says. Kaspersky Lab released a technical paper Monday outlining the discovery of the malware the vendor has dubbed "miniFlame." While capable of working with Flame and Gauss, miniFlame is a "small, fully functional espionage module designed for data theft and direct access to infected systems," Kaspersky said.

Internal MISP references

UUID 16c57264-239f-11e8-9469-0738871e7aa4 which can be used as unique global reference for miniFlame in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/miniflame-aka-spe-elvis-and-his-friends-5/31730/ - webarchive
• https://www.csoonline.com/article/2132422/malware-cybercrime/cyberespionage-malware--miniflame--discovered.html - webarchive

Associated metadata

Metadata key	Value

GHOTEX

PE_GHOTEX.A-O is a portable executable (PE is the standard executable format for 32-bit Windows files) virus. PE viruses infect executable Windows files by incorporating their code into these files such that they are executed when the infected files are opened.

Internal MISP references

UUID 231b7572-239f-11e8-8404-df420a5d403b which can be used as unique global reference for GHOTEX in MISP communities and other software using the MISP galaxy

External references

• https://www.trendmicro.com/vinfo/dk/threat-encyclopedia/archive/malware/pe_ghotex.a-o - webarchive

Associated metadata

Metadata key	Value

Shipup

Trojan:Win32/Shipup.G is a trojan that modifies the Autorun feature for certain devices.

Internal MISP references

UUID 4613b76c-4966-44b6-bcd5-f74fa64deb18 which can be used as unique global reference for Shipup in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shipup.G - webarchive
• https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan%3AWin32%2FShipup.K - webarchive
• https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Worm:Win32/Shipup.A - webarchive
• https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~ShipUp-F/detailed-analysis.aspx - webarchive
• https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Troj~ShipUp-A/detailed-analysis.aspx - webarchive

Associated metadata

Metadata key	Value

Neuron

Neuron consists of both client and server components. The Neuron client and Neuron service are written using the .NET framework with some codebase overlaps. The Neuron client is used to infect victim endpoints and extract sensitive information from local client machines. The Neuron server is used to infect network infrastructure such as mail and web servers, and acts as local Command & Control (C2) for the client component. Establishing a local C2 limits interaction with the target network and remote hosts. It also reduces the log footprint of actor infrastructure and enables client interaction to appear more convincing as the traffic is contained within the target network.

Internal MISP references

UUID 5c2eeaec-25e3-11e8-9d28-7f64aba5b173 which can be used as unique global reference for Neuron in MISP communities and other software using the MISP galaxy

External references

• https://www.ncsc.gov.uk/content/files/protected_files/article_files/Turla%20group%20using%20Neuron%20and%20Nautilus%20tools%20alongside%20Snake%20malware_0.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Nautilus

Nautilus is very similar to Neuron both in the targeting of mail servers and how client communications are performed. This malware is referred to as Nautilus due to its embedded internal DLL name “nautilus-service.dll”, again sharing some resemblance to Neuron. The Nautilus service listens for HTTP requests from clients to process tasking requests such as executing commands, deleting files and writing files to disk

Internal MISP references

UUID 73cb7ecc-25e3-11e8-a97b-c35ec4e7dcf8 which can be used as unique global reference for Nautilus in MISP communities and other software using the MISP galaxy

External references

• https://www.ncsc.gov.uk/content/files/protected_files/article_files/Turla%20group%20using%20Neuron%20and%20Nautilus%20tools%20alongside%20Snake%20malware_0.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Gamut Botnet

Gamut was found to be downloaded by a Trojan Downloader that arrives as an attachment from a spam email message. The bot installation is quite simple. After the malware binary has been downloaded, it launches itself from its current directory, usually the Windows %Temp% folder and installs itself as a Windows service. The malware utilizes an anti-VM (virtual machine) trick and terminates itself if it detects that it is running in a virtual machine environment. The bot uses INT 03h trap sporadically in its code, an anti-debugging technique which prevents its code from running within a debugger environment. It can also determine if it is being debugged by using the Kernel32 API - IsDebuggerPresent function.

Internal MISP references

UUID 492879ac-285b-11e8-a06e-33f548e66e42 which can be used as unique global reference for Gamut Botnet in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/necurs-and-gamut-botnets-account-for-97-percent-of-the-internets-spam-emails/ - webarchive
• https://www.trustwave.com/Resources/SpiderLabs-Blog/Gamut-Spambot-Analysis/ - webarchive

Associated metadata

Metadata key	Value

CORALDECK

CORALDECK is an exfiltration tool that searches for specified files and exfiltrates them in password protected archives using hardcoded HTTP POST headers. CORALDECK has been observed dropping and using Winrar to exfiltrate data in password protected RAR files as well as WinImage and zip archives

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular CORALDECK.

Known Synonyms
APT.InfoStealer.Win.CORALDECK
FE_APT_InfoStealer_Win_CORALDECK_1

Internal MISP references

UUID becf81e5-f989-4093-a67d-d55a0483885f which can be used as unique global reference for CORALDECK in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DOGCALL

DOGCALL is a backdoor commonly distributed as an encoded binary file downloaded and decrypted by shellcode following the exploitation of weaponized documents. DOGCALL is capable of capturing screenshots, logging keystrokes, evading analysis with anti-virtual machine detections, and leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex. DOGCALL was used to target South Korean Government and military organizations in March and April 2017. The malware is typically dropped using an HWP exploit in a lure document. The wiper tool, RUHAPPY, was found on some of the systems targeted by DOGCALL. While DOGCALL is primarily an espionage tool, RUHAPPY is a destructive wiper tool meant to render systems inoperable.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DOGCALL.

Known Synonyms
APT.Backdoor.Win.DOGCALL
FE_APT_Backdoor_Win32_DOGCALL_1
FE_APT_RAT_DOGCALL

Internal MISP references

UUID a5e851b4-e046-43b6-bc6e-c6c008e3c5aa which can be used as unique global reference for DOGCALL in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive
• https://www.bleepingcomputer.com/news/security/report-ties-north-korean-attacks-to-new-malware-linked-by-word-macros/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GELCAPSULE

GELCAPSULE is a downloader traditionally dropped or downloaded by an exploit document. GELCAPSULE has been observed downloading SLOWDRIFT to victim systems.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GELCAPSULE.

Known Synonyms
FE_APT_Downloader_Win32_GELCAPSULE_1

Internal MISP references

UUID ac008bbd-f415-458e-96bf-be7d158df2d8 which can be used as unique global reference for GELCAPSULE in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

HAPPYWORK

HAPPYWORK is a malicious downloader that can download and execute a second-stage payload, collect system information, and beacon it to the command and control domains. The collected system information includes: computer name, user name, system manufacturer via registry, IsDebuggerPresent state, and execution path. In November 2016, HAPPYWORK targeted government and financial targets in South Korea.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular HAPPYWORK.

Known Synonyms
Downloader.APT.HAPPYWORK
FE_APT_Downloader_HAPPYWORK
FE_APT_Exploit_HWP_Happy

Internal MISP references

UUID 656cd201-d57a-4a2f-a201-531eb4922a72 which can be used as unique global reference for HAPPYWORK in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

KARAE

Karae backdoors are typically used as first-stage malware after an initial compromise. The backdoors can collect system information, upload and download files, and may be used to retrieve a second-stage payload. The malware uses public cloud-based storage providers for command and control. In March 2016, KARAE malware was distributed through torrent file-sharing websites for South Korean users. During this campaign, the malware used a YouTube video downloader application as a lure.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KARAE.

Known Synonyms
Backdoor.APT.Karae
FE_APT_Backdoor_Karae
FE_APT_Backdoor_Karae_enc

Internal MISP references

UUID 70ca8408-bc45-4d39-acd2-9190ba15ea97 which can be used as unique global reference for KARAE in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MILKDROP

MILKDROP is a launcher that sets a persistence registry key and launches a backdoor.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular MILKDROP.

Known Synonyms
FE_Trojan_Win32_MILKDROP_1

Internal MISP references

UUID 1064c911-44e6-4c84-8e11-f476a8b06ce8 which can be used as unique global reference for MILKDROP in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

POORAIM

POORAIM malware is designed with basic backdoor functionality and leverages AOL Instant Messenger for command and control communications. POORAIM includes the following capabilities: System information enumeration, File browsing, manipulation and exfiltration, Process enumeration, Screen capture, File execution, Exfiltration of browser favorites, and battery status. Exfiltrated data is sent via files over AIM. POORAIM has been involved in campaigns against South Korean media organizations and sites relating to North Korean refugees and defectors since early 2014. Compromised sites have acted as watering holes to deliver newer variants of POORAIM.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular POORAIM.

Known Synonyms
Backdoor.APT.POORAIM

Internal MISP references

UUID fe97ace3-9a80-42af-9eae-1f9245927e5d which can be used as unique global reference for POORAIM in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

RICECURRY

RICECURRY is a Javascript based profiler used to fingerprint a victim's web browser and deliver malicious code in return. Browser, operating system, and Adobe Flash version are detected by RICECURRY, which may be a modified version of PluginDetect.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RICECURRY.

Known Synonyms
Exploit.APT.RICECURRY

Internal MISP references

UUID 6f37edf6-f5e6-4749-82f9-2aa7c30582c4 which can be used as unique global reference for RICECURRY in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

RUHAPPY

RUHAPPY is a destructive wiper tool seen on systems targeted by DOGCALL. It attempts to overwrite the MBR, causing the system not to boot. When victims' systems attempt to boot, the string 'Are you Happy?' is displayed. The malware is believed to be tied to the developers of DOGCALL and HAPPYWORK based on similar PDB paths in all three.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular RUHAPPY.

Known Synonyms
FE_APT_Trojan_Win32_RUHAPPY_1

Internal MISP references

UUID 96296d57-e9d9-42f1-b08c-c8636369b9aa which can be used as unique global reference for RUHAPPY in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

SHUTTERSPEED

SHUTTERSPEED is a backdoor that can collect system information, acquire screenshots, and download/execute an arbitrary executable. SHUTTERSPEED typically requires an argument at runtime in order to execute fully. Observed arguments used by SHUTTERSPEED include: 'help', 'console', and 'sample'. The spear phishing email messages contained documents exploiting RTF vulnerability CVE-2017-0199. Many of the compromised domains in the command and control infrastructure are linked to South Korean companies. Most of these domains host a fake webpage pertinent to targets.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SHUTTERSPEED.

Known Synonyms
APT.Backdoor.SHUTTERSPEED
FE_APT_Backdoor_SHUTTERSPEED

Internal MISP references

UUID d909efe3-abc3-4be0-9640-e4727542fa2b which can be used as unique global reference for SHUTTERSPEED in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SLOWDRIFT

SLOWDRIFT is a launcher that communicates via cloud based infrastructure. It sends system information to the attacker command and control and then downloads and executes additional payloads.Lure documents distributing SLOWDRIFT were not tailored for specific victims, suggesting that TEMP.Reaper is attempting to widen its target base across multiple industries and in the private sector. SLOWDRIFT was seen being deployed against academic and strategic targets in South Korea using lure emails with documents leveraging the HWP exploit. Recent SLOWDRIFT samples were uncovered in June 2017 with lure documents pertaining to cyber crime prevention and news stories. These documents were last updated by the same actor who developed KARAE, POORAIM and ZUMKONG.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SLOWDRIFT.

Known Synonyms
APT.Downloader.SLOWDRIFT
FE_APT_Downloader_Win_SLOWDRIFT_1
FE_APT_Downloader_Win_SLOWDRIFT_2

Internal MISP references

UUID e5a9a2ec-348e-4a2f-98dd-16c3e8845576 which can be used as unique global reference for SLOWDRIFT in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SOUNDWAVE

SOUNDWAVE is a windows based audio capturing utility. Via command line it accepts the -l switch (for listen probably), captures microphone input for 100 minutes, writing the data out to a log file in this format: C:\Temp\HncDownload\YYYYMMDDHHMMSS.log.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular SOUNDWAVE.

Known Synonyms
FE_APT_HackTool_Win32_SOUNDWAVE_1

Internal MISP references

UUID 6a0e3c75-5a59-4747-8fec-2e344a328575 which can be used as unique global reference for SOUNDWAVE in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

ZUMKONG

ZUMKONG is a credential stealer capable of harvesting usernames and passwords stored by Internet Explorer and Chrome browsers. Stolen credentials are emailed to the attacker via HTTP POST requests to mail[.]zmail[.]ru.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ZUMKONG.

Known Synonyms
FE_APT_Trojan_Zumkong
Trojan.APT.Zumkong

Internal MISP references

UUID 6f1b9155-5de4-4ef7-9f42-60007599c477 which can be used as unique global reference for ZUMKONG in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

WINERACK

WINERACK is backdoor whose primary features include user and host information gathering, process creation and termination, filesystem and registry manipulation, as well as the creation of a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands. Other capabilities include the enumeration of files, directories, services, active windows and processes.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular WINERACK.

Known Synonyms
Backdoor.APT.WINERACK
FE_APT_Backdoor_WINERACK

Internal MISP references

UUID 49025073-4cd3-43b8-b893-e80a1d3adc04 which can be used as unique global reference for WINERACK in MISP communities and other software using the MISP galaxy

External references

• https://www2.fireeye.com/rs/848-DID-242/images/rpt_APT37.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

RoyalCli

The RoyalCli backdoor appears to be an evolution of BS2005 and uses familiar encryption and encoding routines. The name RoyalCli was chosen by us due to a debugging path left in the binary: 'c:\users\wizard\documents\visual studio 2010\Projects\RoyalCli\Release\RoyalCli.pdb' RoyalCli and BS2005 both communicate with the attacker's command and control (C2) through Internet Explorer (IE) by using the COM interface IWebBrowser2. Due to the nature of the technique, this results in C2 data being cached to disk by the IE process; we'll get to this later.

Internal MISP references

UUID ac04d0b0-c6b5-4125-acd7-c58dfe7ad4cf which can be used as unique global reference for RoyalCli in MISP communities and other software using the MISP galaxy

External references

• https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

RoyalDNS

Internal MISP references

UUID 7b20b78a-df6e-40c7-9a3a-363f040cfad7 which can be used as unique global reference for RoyalDNS in MISP communities and other software using the MISP galaxy

External references

• https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/march/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ - webarchive

Associated metadata

Metadata key	Value

SHARPKNOT

Internal MISP references

UUID 203fd529-6382-417e-a68f-7565fbf89ece which can be used as unique global reference for SHARPKNOT in MISP communities and other software using the MISP galaxy

External references

• https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

KillDisk Wiper

KillDisk, along with the multipurpose, cyberespionage-related BlackEnergy, was used in cyberattacks in late December 2015 against Ukraine’s energy sector as well as its banking, rail, and mining industries. The malware has since metamorphosed into a threat used for digital extortion, affecting Windows and Linux platforms. The note accompanying the ransomware versions, like in the case of Petya, was a ruse: Because KillDisk also overwrites and deletes files (and don’t store the encryption keys on disk or online), recovering the scrambled files was out of the question. The new variant we found, however, does not include a ransom note.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular KillDisk Wiper.

Known Synonyms
KillDisk

Internal MISP references

UUID aef0fdd4-38b6-11e8-afdd-3b6145112467 which can be used as unique global reference for KillDisk Wiper in MISP communities and other software using the MISP galaxy

External references

• https://blog.trendmicro.com/trendlabs-security-intelligence/new-killdisk-variant-hits-financial-organizations-in-latin-america/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

UselessDisk

A new MBR bootlocker called DiskWriter, or UselessDisk, has been discovered that overwrites the MBR of a victim's computer and then displays a ransom screen on reboot instead of booting into Windows. This ransom note asks for $300 in bitcoins in order to gain access to Windows again. Might be a wiper.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular UselessDisk.

Known Synonyms
DiskWriter

Internal MISP references

UUID b5112fe0-38b6-11e8-af9f-6381b5e5403f which can be used as unique global reference for UselessDisk in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/the-diskwriter-or-uselessdisk-bootlocker-may-be-a-wiper/ - webarchive

Associated metadata

Metadata key	Value

GoScanSSH

During a recent Incident Response (IR) engagement, Talos identified a new malware family that was being used to compromise SSH servers exposed to the internet. This malware, which we have named GoScanSSH, was written using the Go programming language, and exhibited several interesting characteristics. This is not the first malware family that Talos has observed that was written using Go. However, it is relatively uncommon to see malware written in this programming language. In this particular case, we also observed that the attacker created unique malware binaries for each host that was infected with the GoScanSSH malware. Additionally, the GoScanSSH command and control (C2) infrastructure was observed leveraging the Tor2Web proxy service in an attempt to make tracking the attacker-controlled infrastructure more difficult and resilient to takedowns.

Internal MISP references

UUID 8c0a7e1e-3cc4-11e8-8f03-2f71e72f737b which can be used as unique global reference for GoScanSSH in MISP communities and other software using the MISP galaxy

External references

• http://blog.talosintelligence.com/2018/03/goscanssh-analysis.html - webarchive
• https://www.bleepingcomputer.com/news/security/goscanssh-malware-avoids-government-and-military-servers/ - webarchive

Associated metadata

Metadata key	Value

Rovnix

We recently found that the malware family ROVNIX is capable of being distributed via macro downloader. This malware technique was previously seen in the DRIDEX malware, which was notable for using the same routines. DRIDEX is also known as the successor of the banking malware CRIDEX.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rovnix.

Known Synonyms
ROVNIX

Internal MISP references

UUID a4036a28-3d94-11e8-ad9f-97ada3c6d5fb which can be used as unique global reference for Rovnix in MISP communities and other software using the MISP galaxy

External references

• https://blog.trendmicro.com/trendlabs-security-intelligence/rovnix-infects-systems-with-password-protected-macros/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Kwampirs

Once Orangeworm has infiltrated a victim’s network, they deploy Trojan.Kwampirs, a backdoor Trojan that provides the attackers with remote access to the compromised computer. When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.

Internal MISP references

UUID d1e548b8-4793-11e8-8dea-6beff82cac0a which can be used as unique global reference for Kwampirs in MISP communities and other software using the MISP galaxy

External references

• https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Rubella Macro Builder

A crimeware kit dubbed the Rubella Macro Builder has recently been gaining popularity among members of a top-tier Russian hacking forum. Despite being relatively new and unsophisticated, the kit has a clear appeal for cybercriminals: it’s cheap, fast, and can defeat basic static antivirus detection.

Internal MISP references

UUID b7be6732-4ed5-11e8-8b82-dff39eb7a396 which can be used as unique global reference for Rubella Macro Builder in MISP communities and other software using the MISP galaxy

External references

• https://www.flashpoint-intel.com/blog/rubella-macro-builder/ - webarchive

Associated metadata

Metadata key	Value

kitty Malware

Researchers at Imperva's Incapsula said a new piece malware called Kitty leaves a note for cat lovers. It attacks the Drupal content management system (CMS) to illegally mine cryptocurrency Monero.

Internal MISP references

UUID 85d5da28-51f7-11e8-bbeb-af367d720136 which can be used as unique global reference for kitty Malware in MISP communities and other software using the MISP galaxy

External references

• https://www.zdnet.com/article/hello-kitty-malware-targets-drupal-to-mine-for-cryptocurrency/ - webarchive
• https://threatpost.com/kitty-cryptomining-malware-cashes-in-on-drupalgeddon-2-0/131668/ - webarchive
• https://cryptovest.com/news/hello-kitty-new-malware-me0ws-its-way-into-mining-monero/ - webarchive

Associated metadata

Metadata key	Value

Maikspy

We discovered a malware family called Maikspy — a multi-platform spyware that can steal users’ private data. The spyware targets Windows and Android users, and first posed as an adult game named after a popular U.S.-based adult film actress. Maikspy, which is an alias that combines the name of the adult film actress and spyware, has been around since 2016.

Internal MISP references

UUID d83ec444-535c-11e8-ae83-831d0a85d77a which can be used as unique global reference for Maikspy in MISP communities and other software using the MISP galaxy

External references

• https://blog.trendmicro.com/trendlabs-security-intelligence/maikspy-spyware-poses-as-adult-game-targets-windows-and-android-users/ - webarchive

Associated metadata

Metadata key	Value

Huigezi malware

backdoor trojan popular found prevalently in China

Internal MISP references

UUID 6aef5a32-5381-11e8-ac5a-bb46d8986552 which can be used as unique global reference for Huigezi malware in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/gaming/chinese-police-arrest-15-people-who-hid-malware-inside-pubg-cheat-apps/ - webarchive

Associated metadata

Metadata key	Value

FacexWorm

Facebook, Chrome, and cryptocurrency users should be on the lookout for a new malware strain named FacexWorm that infects victims for the purpose of stealing passwords, stealing cryptocurrency funds, running cryptojacking scripts, and spamming Facebook users. This new strain was spotted in late April by Trend Micro researchers and appears to be related to two other Facebook Messenger spam campaigns, one that took place last August, and another one from December 2017, the latter spreading the Digmine malware. Researchers say FacexWorm's modus operandi is similar to the previous two campaigns, but with the addition of new techniques aimed at cryptocurrency users.

Internal MISP references

UUID 86ac8c80-5382-11e8-b893-4f1651951472 which can be used as unique global reference for FacexWorm in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/facexworm-spreads-via-facebook-messenger-malicious-chrome-extension/ - webarchive

Associated metadata

Metadata key	Value

Bankshot

implant used in Operation GhostSecret

Internal MISP references

UUID d9431c02-5391-11e8-931f-4beceb8bd697 which can be used as unique global reference for Bankshot in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Proxysvc

downloader used in Operation GhostSecret

Internal MISP references

UUID dafba168-5391-11e8-87e4-0f93b75d6ac0 which can be used as unique global reference for Proxysvc in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/ - webarchive

Associated metadata

Metadata key	Value

Escad

backdoor used in Operation GhostSecret

Internal MISP references

UUID db36cf9a-5391-11e8-b53a-97adedf48055 which can be used as unique global reference for Escad in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/north-korean-hackers-are-up-to-no-good-again/ - webarchive

Associated metadata

Metadata key	Value

StalinLocker

A new in-development screenlocker/wiper called StalinLocker, or StalinScreamer, was discovered by MalwareHunterTeam that gives you 10 minutes to enter a code or it will try to delete the contents of the drives on the computer. While running, it will display screen that shows Stalin while playing the USSR anthem and displaying a countdown until files are deleted.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular StalinLocker.

Known Synonyms
StalinScreamer

Internal MISP references

UUID 50eb8c54-5828-11e8-8d6b-232bb9329fc0 which can be used as unique global reference for StalinLocker in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/stalinlocker-deletes-your-files-unless-you-enter-the-right-code/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

VPNFilter

Advanced, likely state-sponsored or state-affiliated modular malware. The code of this malware overlaps with versions of the BlackEnergy malware. Targeted devices are Linksys, MikroTik, NETGEAR and TP-Link networking equipment in the small and home office (SOHO) space, as well as QNAP network-attached storage (NAS) systems.

Internal MISP references

UUID 895d769e-b288-4977-a4e1-7d64eb134bf9 which can be used as unique global reference for VPNFilter in MISP communities and other software using the MISP galaxy

External references

• https://blog.talosintelligence.com/2018/05/VPNFilter.html - webarchive
• https://securingtomorrow.mcafee.com/consumer/consumer-threat-notices/new-vpnfilter-malware-infects-routers/ - webarchive
• https://www.fortinet.com/blog/threat-research/defending-against-the-new-vpnfilter-botnet.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Iron Backdoor

Iron Backdoor uses a virtual machine detection code taken directly from HackingTeam’s Soldier implant leaked source code. Iron Backdoor is also using the DynamicCall module from HackingTeam core library. Backdoor was used to drop cryptocurrency miners.

Internal MISP references

UUID 5433edec-f1c3-4051-a3cc-c7f9fc8972ee which can be used as unique global reference for Iron Backdoor in MISP communities and other software using the MISP galaxy

External references

• https://www.intezer.com/iron-cybercrime-group-under-the-scope-2/ - webarchive

Associated metadata

Metadata key	Value

Brambul

Brambul malware is a malicious Windows 32-bit SMB worm that functions as a service dynamic link library file or a portable executable file often dropped and installed onto victims’ networks by dropper malware. When executed, the malware attempts to establish contact with victim systems and IP addresses on victims’ local subnets. If successful, the application attempts to gain unauthorized access via the SMB protocol (ports 139 and 445) by launching brute-force password attacks using a list of embedded passwords. Additionally, the malware generates random IP addresses for further attacks.

Internal MISP references

UUID 4c057ade-6989-11e8-9efd-ab33ed427468 which can be used as unique global reference for Brambul in MISP communities and other software using the MISP galaxy

External references

• https://www.us-cert.gov/ncas/alerts/TA18-149A - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PLEAD

PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers. On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.

Internal MISP references

UUID d1482c9e-6af3-11e8-aa8e-279274bd10c7 which can be used as unique global reference for PLEAD in MISP communities and other software using the MISP galaxy

External references

• https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BabaYaga

The group behind BabaYaga —believed to be Russian-speaking hackers— uses this malware to inject sites with special keyboards to drive SEO traffic to hidden pages on compromised sites. These pages are then used to redirect users to affiliate marketing links, where if the user purchases advertised goods, the hackers also make a profit. The malware per-se is comprised of two modules —one that injects the spam content inside the compromised sites, and a backdoor module that gives attackers control over an infected site at any time. The intricacies of both modules are detailed in much more depth in this 26-page report authored by Defiant (formerly known as WordFence), the security firm which dissected the malware's more recent versions. "[BabaYaga] is relatively well-written, and it demonstrates that the author has some understanding of software development challenges, like code deployment, performance and management," Defiant researchers say. "It can also infect Joomla and Drupal sites, or even generic PHP sites, but it is most fully developed around Wordpress."

Internal MISP references

UUID 65c0dff4-6b23-11e8-899f-8fcb21ad9649 which can be used as unique global reference for BabaYaga in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/lol-babayaga-wordpress-malware-updates-your-site/ - webarchive

Associated metadata

Metadata key	Value

InvisiMole

Except for the malware's binary file, very little is known of who's behind it, how it spreads, or in what types of campaigns has this been used.

"Our telemetry indicates that the malicious actors behind this malware have been active at least since 2013, yet the cyber-espionage tool was never analyzed nor detected until discovered by ESET products on compromised computers in Ukraine and Russia," said ESET researcher Zuzana Hromcová, who recently penned an in-depth report about this new threat.

"All infection vectors are possible, including installation facilitated by physical access to the machine," Hromcová added.

Typical to malware used in highly-targeted attacks, the malware has been stripped of most clues that could lead researchers back to its author. With the exception of one file (dating to October 13, 2013), all compilation dates have been stripped and replaced with zeros, giving little clues regarding its timeline and lifespan.

Furthermore, the malware is some clever piece of coding in itself, as it's comprised of two modules, both with their own set of spying features, but which can also help each other in exfiltrating data.

Internal MISP references

UUID 10f50ef8-6e3b-11e8-a648-d73fb4d2f48e which can be used as unique global reference for InvisiMole in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/invisimole-is-a-complex-spyware-that-can-take-pictures-and-record-audio/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Roaming Mantis

Roaming Mantis malware is designed for distribution through a simple, but very efficient trick based on a technique known as DNS hijacking. When a user attempts to access any website via a compromised router, they will be redirected to a malicious website. For example, if a user were to navigate to www.securelist.com using a web browser, the browser would be redirected to a rogue server which has nothing to do with the security research blog. As long as the browser displays the original URL, users are likely to believe the website is genuine. The web page from the rogue server displays the popup message: To better experience the browsing, update to the latest chrome version.

Internal MISP references

UUID f35f219a-6eed-11e8-980a-93bb96299951 which can be used as unique global reference for Roaming Mantis in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/roaming-mantis-uses-dns-hijacking-to-infect-android-smartphones/85178/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PLEAD Downloader

PLEAD is referred to both as a name of malware including TSCookie and its attack campaign. PLEAD has two kinds – RAT (Remote Access Tool) and downloader. The RAT operates based on commands that are provided from C&C servers.　On the other hand, PLEAD downloader downloads modules and runs it on memory in the same way as TSCookie does.

Internal MISP references

UUID 7cda6406-6eef-11e8-a2ad-9340096d5711 which can be used as unique global reference for PLEAD Downloader in MISP communities and other software using the MISP galaxy

External references

• https://blog.jpcert.or.jp/2018/06/plead-downloader-used-by-blacktech.html - webarchive

Associated metadata

Metadata key	Value

ClipboardWalletHijacker

The malware's purpose is to intercept content recorded in the Windows clipboard, look for strings resembling Bitcoin and Ethereum addresses, and replace them with ones owned by the malware's authors. ClipboardWalletHijacker's end-plan is to hijack BTC and ETH transactions, so victims unwittingly send funds to the malware's authors.

Internal MISP references

UUID 9f926c84-72cb-11e8-a1f2-676d779700ba which can be used as unique global reference for ClipboardWalletHijacker in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/clipboard-hijacker-targeting-bitcoin-and-ethereum-users-infects-over-300-0000-pcs/ - webarchive
• https://blog.360totalsecurity.com/en/new-cryptominer-hijacks-your-bitcoin-transaction-over-300000-computers-have-been-attacked/ - webarchive

Associated metadata

Metadata key	Value

TYPEFRAME

Trojan malware

Internal MISP references

UUID 8981aaca-72dc-11e8-8649-838c1b2613c5 which can be used as unique global reference for TYPEFRAME in MISP communities and other software using the MISP galaxy

External references

• https://www.us-cert.gov/ncas/analysis-reports/AR18-165A - webarchive

Associated metadata

Metadata key	Value

Olympic Destroyer

The Winter Olympics this year is being held in Pyeongchang, South Korea. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. Officials at the games confirmed some technical issues to non-critical systems and they completed recovery within around 12 hours. Sunday 11th February the Olympic games officials confirmed a cyber attack occurred but did not comment or speculate further. Talos have identified the samples, with moderate confidence, used in this attack. The infection vector is currently unknown as we continue to investigate. The samples identified, however, are not from adversaries looking for information from the games but instead they are aimed to disrupt the games. The samples analysed appear to perform only destructive functionality. There does not appear to be any exfiltration of data. Analysis shows that actors are again favouring legitimate pieces of software as PsExec functionality is identified within the sample. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec & WMI to further move through the environment. This is something we have witnessed previously with BadRabbit and Nyetya.

Internal MISP references

UUID 76d5c7a2-73c3-11e8-bd92-db4d715af093 which can be used as unique global reference for Olympic Destroyer in MISP communities and other software using the MISP galaxy

External references

• https://blog.talosintelligence.com/2018/02/olympic-destroyer.html - webarchive
• https://www.bleepingcomputer.com/news/security/malware-that-hit-pyeongchang-olympics-deployed-in-new-attacks/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DDKONG

The malware in question is configured with the following three exported functions: ServiceMain,Rundll32Call, DllEntryPoint. The ServiceMain exported function indicates that this DLL is expected to be loaded as a service. If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. If it’s not, it dies. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3. After this configuration is decoded and parsed, DDKONG proceeds to send a beacon to the configured remote server via a raw TCP connection. The packet has a header of length 32 and an optional payload. In the beacon, no payload is provided, and as such, the length of this packet is set to zero. After it sends the beacon, the malware expects a response command of either 0x4 or 0x6. Both responses instruct the malware to download and load a remote plugin. In the event 0x4 is specified, the malware is instructed to load the exported ‘InitAction’ function. If 0x6 is specified, the malware is instructed to load the exported ‘KernelDllCmdAction’ function. Prior to downloading the plugin, the malware downloads a buffer that is concatenated with the embedded configuration and ultimately provided to the plugin at runtime. As we can see in the above text, two full file paths are included in this buffer, providing us with insight into the original malware family’s name, as well as the author. After this buffer is collected, the malware downloads the plugin and loads the appropriate function. This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine.

Internal MISP references

UUID 57dd0828-79d7-11e8-a7d8-57db14e1ef24 which can be used as unique global reference for DDKONG in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PLAINTEE

This sample is configured with three exported functions: Add, Sub, DllEntryPoint. The DLL expects the export named ‘Add’ to be used when initially loaded. When this function is executed PLAINTEE executes a command in a new process to add persistence. Next, the malware calls the ‘Sub’ function which begins by spawning a mutex named ‘microsoftfuckedupb’ to ensure only a single instance is running at a given time. In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The configuration blob is encoded using a simple single-byte XOR scheme. The first byte of the string is used as the XOR key to in turn decode the remainder of the data. The malware then proceeds to beacon to the configured port via a custom UDP protocol. The network traffic is encoded in a similar fashion, with a random byte being selected as the first byte, which is then used to decode the remainder of the packet via XOR. This beacon is continuously sent out until a valid response is obtained from the C2 server (there is no sleep timer set). After the initial beacon, there is a two second delay in between all other requests made. This response is expected to have a return command of 0x66660002 and to contain the same GUID that was sent to the C2 server. Once this response is received, the malware spawns several new threads, with different Command parameters, with the overall objective of loading and executing a new plugin that is to be received from the C2 server. During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample. PLAINTEE expects the downloaded plugin to be a DLL with an export function of either ‘shell’ or ‘file’. The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent. The following commands were observed: tasklist, ipconfig /all. The attacker performed these two commands 33 seconds apart. As automated commands are typically performed more quickly this indicates that they may have been sent manually by the attacker.

Internal MISP references

UUID 58b24db2-79d7-11e8-9b1b-bbdbc798af4f which can be used as unique global reference for PLAINTEE in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Koadic

Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host

Internal MISP references

UUID f9e0b922-253c-40fa-a6d2-e60ec9c6980b which can be used as unique global reference for Koadic in MISP communities and other software using the MISP galaxy

External references

• https://github.com/zerosum0x0/koadic - webarchive
• https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Bisonal

In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. To date, we have only collected 14 samples of this variant, indicating it may be sparingly used. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. In 2013, both COSEINC and FireEye revealed attacks using Bisonal against Japanese organizations . In October 2017, AhnLab published a report called “Operation Bitter Biscuit,” an attack campaign against South Korea, Japan, India and Russia using Bisonal and its successors, Bioazih and Dexbia.

Internal MISP references

UUID 23f6da78-873a-4ab0-9167-c8b0563627a5 which can be used as unique global reference for Bisonal in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2018/07/unit42-bisonal-malware-used-attacks-russia-south-korea/ - webarchive
• https://camal.coseinc.com/publish/2013Bisonal.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Sekur

Sekur has been CARBON SPIDER’s primary tool for several years, although usage over the last year appears to have declined. It contains all the functionality you would expect from a RAT, allowing the adversary to execute commands, manage the file system, manage processes, and collect data. In addition, it can record videos of victim sessions, log keystrokes, enable remote desktop, or install Ammyy Admin or VNC modules. From July 2014 on, samples were compiled with the capability to target Epicor POS systems and to collect credit card data.

Internal MISP references

UUID ddbd9db5-7875-437b-b7c5-a17d2892d218 which can be used as unique global reference for Sekur in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ - webarchive

Associated metadata

Metadata key	Value

Agent ORM

Agent ORM began circulating alongside Skeur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Agent ORM.

Known Synonyms
DRIFTPIN
Tosliph

Internal MISP references

UUID c1159097-3dad-48ab-91cf-c055182f5785 which can be used as unique global reference for Agent ORM in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ - webarchive

Associated metadata

Metadata key	Value

VB Flash

VB Flash was first observed being deployed alongside Agent ORM in September 2015. It is likely that this was developed as a replacement to Agent ORM and contained similar capabilities. The first observed instance of VB Flash included comments and was easy to analyze—later versions soon began to integrate multiple layers of obfuscation. Several versions of VB Flash were developed including ones that utilized Google Forms, Google Macros, and Google Spreadsheets together to make a command-and-control (C2) channel. This variant would POST victim data to a specified Google form, then make a request to a Google macro script, receiving an address for a Google Spreadsheet from which to request commands.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular VB Flash.

Known Synonyms
HALFBAKED

Internal MISP references

UUID 2815a353-cd56-4ed0-8581-812b94f7a326 which can be used as unique global reference for VB Flash in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

JS Flash

JS Flash capabilities closely resemble those of VB Flash and leverage interesting techniques in deployment via batch scripts embedded as OLE objects in malicious documents. Many iterations of JS Flash were observed being tested before deployment, containing minor changes to obfuscation and more complex additions, such as the ability to download TinyMet (a cutdown of the Metasploit Meterpreter payload). PowerShell was also used heavily for the execution of commands and arbitrary script execution. No JS Flash samples were observed being deployed after November 2017.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular JS Flash.

Known Synonyms
JavaScript variant of HALFBAKED

Internal MISP references

UUID bf03a7ae-3c5e-47b9-84c6-27756297f1b5 which can be used as unique global reference for JS Flash in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ - webarchive

Associated metadata

Metadata key	Value

Bateleur

Bateleur deployments began not long after JS Flash and were also written in JavaScript. Deployments were more infrequent and testing was not observed. It is likely that Bateleur was run in parallel as an alternative tool and eventually replaced JS Flash as CARBON SPIDER’s first stage tool of choice. Although much simpler in design than JS Flash, all executing out of a single script with more basic obfuscation, Bateleur has a wealth of capabilities—including the ability to download arbitrary scripts and executables, deploy TinyMet, execute commands via PowerShell, deploy a credential stealer, and collect victim system information such as screenshots.

Internal MISP references

UUID 81faf0c1-0595-436b-a66a-05d8b435bccd which can be used as unique global reference for Bateleur in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

JexBoss

A tool for testing and exploiting vulnerabilities in JBoss Application Servers.

Internal MISP references

UUID 509fc49c-9bd8-11e8-ade9-af561325f046 which can be used as unique global reference for JexBoss in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

reGeorg

“Provides TCP tunneling over HTTP and bolts a SOCKS4/5 proxy on top of it, so, reGeorg is a fully-functional SOCKS proxy and gives ability to analyze target internal network.”

Internal MISP references

UUID 2c62f08a-9bd9-11e8-9e20-db9ec0d2b277 which can be used as unique global reference for reGeorg in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Hyena

An Active Directory and Windows system management software, which can be used for remote administration of servers and workstations.

Internal MISP references

UUID 511d1000-9bd8-11e8-8477-8f5bcff04fb0 which can be used as unique global reference for Hyena in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

csvde.exe

Imports and exports data from Active Directory Lightweight Directory Services (AD LDS) using files that store data in the comma-separated value (CSV) format.

Internal MISP references

UUID 521721a8-9bd8-11e8-b26e-efd4142476e4 which can be used as unique global reference for csvde.exe in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

NLBrute

A tool to brute-force Remote Desktop Protocol (RDP) passwords.

Internal MISP references

UUID 49ebf3e4-9bda-11e8-b1c1-8bdbfc744293 which can be used as unique global reference for NLBrute in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

xDedic RDP Patch

Used to create new RDP user accounts.

Internal MISP references

UUID 52be6512-9bd8-11e8-8bab-f7d8a88482ed which can be used as unique global reference for xDedic RDP Patch in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

xDedic SysScan

Used to profile servers for potential sale on the dark net

Internal MISP references

UUID 52dae6ce-9bd8-11e8-a230-7bca2e015ba5 which can be used as unique global reference for xDedic SysScan in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

Wmiexec

A PsExec-like tool, which executes commands through Windows Management Instrumentation (WMI).

Internal MISP references

UUID 52f7f890-9bd8-11e8-a731-ab637e0833b4 which can be used as unique global reference for Wmiexec in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

RDPWrap

Allows a user to be logged in both locally and remotely at the same time.

Internal MISP references

UUID 5316eb7e-9bd8-11e8-8587-eb328b3dd314 which can be used as unique global reference for RDPWrap in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

PsExec

A light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. When a command is executed on a remote computer using PsExec, then the service PSEXESVC will be installed on that system, which means that an executable called psexesvc.exe will execute the commands.

Internal MISP references

UUID 6dd05630-9bd8-11e8-a8b9-47ce338a4367 which can be used as unique global reference for PsExec in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PAExec

A PsExec-like tool, which lets you launch Windows programs on remote Windows computers without needing to install software on the remote computer first. When the PAExec service is running on the remote computer, the name of the source system is added to service’s name, e.g., paexec--.exe, which can help to identify the entry point of the attack.

Internal MISP references

UUID 6e76f29c-9bd8-11e8-97ae-8f7b8be65f0c which can be used as unique global reference for PAExec in MISP communities and other software using the MISP galaxy

External references

• https://www.sophos.com/en-us/medialibrary/PDFs/technical-papers/SamSam-The-Almost-Six-Million-Dollar-Ransomware.pdf - webarchive

Associated metadata

Metadata key	Value

KEYMARBLE

This Malware Analysis Report (MAR) is the result of analytic efforts between Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. Government partners, DHS and FBI identified Trojan malware variants used by the North Korean government. This malware variant has been identified as KEYMARBLE. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity.

Internal MISP references

UUID f7f53bb8-37ed-4bbe-9809-ca1594431536 which can be used as unique global reference for KEYMARBLE in MISP communities and other software using the MISP galaxy

External references

• https://www.us-cert.gov/ncas/analysis-reports/AR18-221A - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BISKVIT

The BISKVIT Trojan is a multi-component malware written in C#. We dubbed this malware BISKVIT based on the namespaces used in the code, which contain the word “biscuit”. Unfortunately, there is already an existing unrelated malware called BISCUIT, so BISKVIT is used instead, which is the Russian translation of biscuit.

Internal MISP references

UUID 69ed8a69-8b33-4195-9b21-a1f4cd76acde which can be used as unique global reference for BISKVIT in MISP communities and other software using the MISP galaxy

External references

• https://www.fortinet.com/blog/threat-research/russian-army-exhibition-decoy-leads-to-new-biskvit-malware.html - webarchive

Associated metadata

Metadata key	Value

Sirefef

This family of malware uses stealth to hide its presence on your PC. Trojans in this family can do different things, including: -Downloading and running other files -Contacting remote hosts -Disabling security features Members of the family can also change search results, which can generate money for the hackers who use Sirefef.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Sirefef.

Known Synonyms
Win32/Sirefef

Internal MISP references

UUID 641464a6-b690-11e8-976e-bffc9a17c6a4 which can be used as unique global reference for Sirefef in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Win32%2Fsirefef - webarchive

Associated metadata

Metadata key	Value

MagentoCore Malware

A Dutch security researcher has lifted the veil on a massive website hacking campaign that has infected 7,339 Magento stores with a script that collects payment card data from people shopping on the sites. The script is what industry experts call a "payment card scraper" or "skimmer." Hackers breach sites and modify their source code to load the script along with its legitimate files. The script usually loads on store checkout pages and secretly records payment card details entered in payment forms, data that it later sends to a server under the hacker's control.

Internal MISP references

UUID df05f528-bb57-11e8-9fd4-8320e14151f2 which can be used as unique global reference for MagentoCore Malware in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/magentocore-malware-found-on-7-339-magento-stores/ - webarchive

Associated metadata

Metadata key	Value

NotPetya

Threat actors deploy a tool, called NotPetya, with the purpose of encrypting data on victims' machines and rendering it unusable. The malware was spread through tax software that companies and individuals require for filing taxes in Ukraine. Australia, Estonia, Denmark, Lithuania, Ukraine, the United Kingdom, and the United States issued statements attributing NotPetya to Russian state-sponsored actors. In June 2018, the United States sanctioned Russian organizations believed to have assisted the Russian state-sponsored actors with the operation.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular NotPetya.

Known Synonyms
Not Petya

Internal MISP references

UUID 00c31914-bc0e-11e8-8241-3ff3b5e4671d which can be used as unique global reference for NotPetya in MISP communities and other software using the MISP galaxy

External references

• https://www.cfr.org/interactive/cyber-operations/notpetya - webarchive

Associated metadata

Metadata key	Value
cfr-suspected-state-sponsor	Russian Federation
cfr-suspected-victims	['Rosneft', 'Cie de Saint-Gobain', 'Mondelez', 'The government of Ukraine', 'WPP Plc.', 'SNCF', 'Port of Rosario', 'Maersk', 'Merck', 'Kyivenergo']
cfr-target-category	['Government', 'Private sector']
cfr-type-of-incident	Data destruction

Related clusters

To see the related clusters, click here.

Xbash

Xbash is a malware family that is targeting Linux and Microsoft Windows servers. We can tie this malware, which we have named Xbash, to the Iron Group, a threat actor group known for previous ransomware attacks. Xbash was developed using Python and converted into self-contained Linux ELF executables by abusing the legitimate tool PyInstaller for distribution. Xbash aimed on discovering unprotected services, deleting victim’s MySQL, PostgreSQL and MongoDB databases, and ransom for Bitcoins. Linux based systems are targeted for ransomware and botnet capabilities. The ransomware targets and deletes linux databases and there is no evidence of any functionality that makes recovery even possible by payment the ransom. Where as, windows based systems are targeted for coinmining & self-propagating capabilities. Xbash spreads by attacking weak passwords and unpatched vulnerabilities.

Internal MISP references

UUID 10c981cc-4ef1-4719-8ed7-c5e4c2f6c7a3 which can be used as unique global reference for Xbash in MISP communities and other software using the MISP galaxy

External references

• https://researchcenter.paloaltonetworks.com/2018/09/unit42-xbash-combines-botnet-ransomware-coinmining-worm-targets-linux-windows/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

LoJax

rootkit for the Unified Extensible Firmware Interface (UEFI). Used by APT28. The researchers named the rootkit LoJax, after the malicious samples of the LoJack anti-theft software that were discovered earlier this year.

Internal MISP references

UUID 6d53a74e-c8a5-11e8-a123-332e4eaac9bb which can be used as unique global reference for LoJax in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/apt28-uses-lojax-first-uefi-rootkit-seen-in-the-wild/ - webarchive
• https://www.bleepingcomputer.com/news/security/lojax-command-and-control-domains-still-active/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Chainshot

The new piece of malware, which received the name Chainshot, is used in the early stages of an attack to activate a downloader for the final payload in a malicious chain reaction.

Internal MISP references

UUID a032460e-c54c-11e8-9965-43b7b6469a65 which can be used as unique global reference for Chainshot in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/new-chainshot-malware-found-by-cracking-512-bit-rsa-key/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CroniX

The researchers named this campaign CroniX, a moniker that derives from the malware's use of Cron to achieve persistence and Xhide to launch executables with fake process names. The cryptocurrency minted on victim's computers is Monero (XMR), the coin of choice in cryptojacking activities. To make sure that rival activity does not revive, CroniX deletes the binaries of other cryptominers present on the system. Another action CroniX takes to establish supremacy on the machine is to check the names of the processes and kill those that swallow 60% of the CPU or more.

Internal MISP references

UUID 55d29d1c-c550-11e8-9904-47c1d86af7c5 which can be used as unique global reference for CroniX in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/cronix-cryptominer-kills-rivals-to-reign-supreme/ - webarchive

Associated metadata

Metadata key	Value

FASTCash

Treasury has identified a sophisticated cyber-enabled ATM cash out campaign we are calling FASTCash. FASTCash has been active since late 2016 targeting banks in Africa and Asia to remotely compromise payment switch application servers within banks to facilitate fraudulent transactions, primarily involving ATMs, to steal cash equivalent to tens of millions of dollars. FBI has attributed malware used in this campaign to the North Korean government. We expect FASTCash to continue targeting retail payment systems vulnerable to remote exploitation.

Internal MISP references

UUID e306fe62-c708-11e8-89f2-073e396e5403 which can be used as unique global reference for FASTCash in MISP communities and other software using the MISP galaxy

Related clusters

To see the related clusters, click here.

Zebrocy

Zebrocy is a tool used by APT28, which has been observed since late 2015. The communications module used by Zebrocy transmits using HTTP. The implant has key logging and file exfiltration functionality and utilises a file collection capability that identifies files with particular extensions.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Zebrocy.

Known Synonyms
Zekapab

Internal MISP references

UUID 8a2ae47a-c7b2-11e8-b223-ab4d8f78f3ef which can be used as unique global reference for Zebrocy in MISP communities and other software using the MISP galaxy

External references

• https://www.ncsc.gov.uk/alerts/indicators-compromise-malware-used-apt28 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

CoalaBot

Internal MISP references

UUID 92628a72-c874-11e8-a094-ebbb3bd1f412 which can be used as unique global reference for CoalaBot in MISP communities and other software using the MISP galaxy

External references

• https://malware.dontneedcoffee.com/2017/10/coalabot-http-ddos-bot.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DanderSpritz

DanderSpritz consists entirely of plugins to gather intelligence, use exploits and examine already controlled machines. It is written in Java and provides a graphical windows interface similar to botnets administrative panels as well as a Metasploit-like console interface. It also includes its own backdoors and plugins for not-FuzzBunch-controlled victims DanderSpritz is the framework for controlling infected machines, different from FuZZbuNch as the latter provides a limited toolkit for the post-exploitation stage with specific functions such as DisableSecurity and EnableSecurity for DarkPulsar. For DanderSpritz works for a larger range of backdoors, using PeedleCheap in the victim to enable operators launching plugins. PeddleCheap is a plugin of DanderSpritz which can be used to configure implants and connect to infected machines. Once a connection is established all DanderSpritz post-exploitation features become available.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DanderSpritz.

Known Synonyms
Dander Spritz

Internal MISP references

UUID 7e4898fa-d5d1-11e8-89bc-a36f56275b1e which can be used as unique global reference for DanderSpritz in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/darkpulsar/88199/ - webarchive

Associated metadata

Metadata key	Value

DarkPulsar

DarkPulsar is a very interesting administrative module for controlling a passive backdoor named ‘sipauth32.tsp’ that provides remote control.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DarkPulsar.

Known Synonyms
Dark Pulsar

Internal MISP references

UUID 7e9f46aa-d5d1-11e8-b782-e71d52d8ac7c which can be used as unique global reference for DarkPulsar in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/darkpulsar/88199/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

EASYFUN

EasyFun 2.2.0 Exploit for WDaemon / IIS MDaemon/WorldClient pre 9.5.6 WordClient / IIS6.0 exploit

Internal MISP references

UUID d6e1753a-d5d7-11e8-8006-07bea975cf2d which can be used as unique global reference for EASYFUN in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ETCETERABLUE

an exploit for IMail 7.04 to 8.05

Internal MISP references

UUID d74d5ee4-d5d7-11e8-9950-f7ab0161fc92 which can be used as unique global reference for ETCETERABLUE in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EXPIREDPAYCHECK

IIS6 exploit

Internal MISP references

UUID d7942766-d5d7-11e8-ba22-db5901eb11e7 which can be used as unique global reference for EXPIREDPAYCHECK in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EAGERLEVER

NBT/SMB exploit for Windows NT4.0, 2000, XP SP1 & SP2, 2003 SP1 & Base Release

Internal MISP references

UUID d7dcf838-d5d7-11e8-89da-ebbfd391066b which can be used as unique global reference for EAGERLEVER in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

ESSAYKEYNOTE

Internal MISP references

UUID d8744882-d5d7-11e8-810b-87f6397c9f5f which can be used as unique global reference for ESSAYKEYNOTE in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

EVADEFRED

Internal MISP references

UUID d8d06be4-d5d7-11e8-b34c-93aec8a36b50 which can be used as unique global reference for EVADEFRED in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

NAMEDPIPETOUCH

Utility to test for a predefined list of named pipes, mostly AV detection. User can add checks for custom named pipes.

Internal MISP references

UUID d93894ee-d5d7-11e8-b360-572c0c441c8f which can be used as unique global reference for NAMEDPIPETOUCH in MISP communities and other software using the MISP galaxy

External references

• https://github.com/misterch0c/shadowbroker - webarchive

Associated metadata

Metadata key	Value

GhostMiner

GhostMiner is a new cryptocurrency mining malware. By the end of March 2018, a new variant of mining malware was detected targeting MSSQL, phpMyAdmin, and Oracle WebLogic servers. The sample uses Powershell to execute code with volatile resources and scans the server's processes to detect and stop other miners that might have been running prior to execution. The fileless malware has become more popular in the last years. The malicious code runs directly in main memory without writing any file on disk, where an antivirus engine could detect it.

Internal MISP references

UUID 0a339826-d5f8-11e8-b520-5b93fe65a08e which can be used as unique global reference for GhostMiner in MISP communities and other software using the MISP galaxy

External references

• https://www.alienvault.com/forums/discussion/17301/alienvault-labs-threat-intelligence-update-for-usm-anywhere-march-25-march-31-2018 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

August

August contains stealing functionality targeting credentials and sensitive documents from the infected computer.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular August.

Known Synonyms
August Stealer

Internal MISP references

UUID 9972d4c4-d6c6-11e8-867e-87b4a45aa76d which can be used as unique global reference for August in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/uk/threat-insight/post/august-in-december-new-information-stealer-hits-the-scene - webarchive

Associated metadata

Metadata key	Value

China Chopper

China Chopper is a publicly available, well-documented web shell, in widespread use since 2012.

Internal MISP references

UUID 1ac4a966-0c74-46d5-b7e1-a40f4c681bc8 which can be used as unique global reference for China Chopper in MISP communities and other software using the MISP galaxy

External references

• https://www.ncsc.gov.uk/content/files/protected_files/article_files/Joint%20report%20on%20publicly%20available%20hacking%20tools%20%28NCSC%29.pdf - webarchive

Associated metadata

Metadata key	Value

PNG Dropper

The PNG_dropper family primarily uses a modified version of the publicly available tool JPEGView.exe (version 1.0.32.1 – both x86 and x64 bit versions). Carbon Black Threat Research also observed where PNG_dropper malware was seen compiled into a modified version of the 7-Zip File Manager Utility (version 9.36.0.0 – x64 bit).

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PNG Dropper.

Known Synonyms
PNGDropper
PNG_Dropper

Internal MISP references

UUID 6ab71ed6-e5c7-4545-a46e-6445e78758ed which can be used as unique global reference for PNG Dropper in MISP communities and other software using the MISP galaxy

External references

• https://www.carbonblack.com/2017/08/18/threat-analysis-carbon-black-threat-research-dissects-png-dropper/ - webarchive
• https://www.nccgroup.trust/uk/about-us/newsroom-and-events/blogs/2018/november/turla-png-dropper-is-back/ - webarchive

Associated metadata

Metadata key	Value

Rotexy

A mobile spyware that turned into a banking trojan with ransomware capabilities managed to launch over 70,000 attacks in the course of just three months.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Rotexy.

Known Synonyms
SMSThief

Internal MISP references

UUID 43dec915-2511-4275-8007-685402ffab08 which can be used as unique global reference for Rotexy in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/rotexy-mobile-trojan-launches-70k-attacks-in-three-months/ - webarchive

Associated metadata

Metadata key	Value

KingMiner

A recently discovered cryptomining operation forces access to Windows servers to use their CPU cycles for mining Monero coins. Detected six months ago, the activity went through multiple stages of evolution. Since it was spotted in mid-June, the malware received two updates and the number of attacks keeps increasing. The researchers at CheckPoint analyzed the new threat and gave it the name KingMiner. They found that it targets Microsoft IIS and SQL Servers in particular and runs a brute-force attack to gain access. Once in, the malware determines the CPU architecture and checks for older versions of itself to remove them.

Internal MISP references

UUID a9467439-48d8-4f68-9519-560bb6430f0c which can be used as unique global reference for KingMiner in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/new-kingminer-threat-shows-cryptominer-evolution/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Taurus

Toolkit - building kit for crafting documents used to deliver attacks

Internal MISP references

UUID a315f2be-0cd7-4a2b-876d-d6a772de9dca which can be used as unique global reference for Taurus in MISP communities and other software using the MISP galaxy

External references

• https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648 - webarchive

Associated metadata

Metadata key	Value

Terra Loader

Internal MISP references

UUID dbbc8e91-a6c4-441f-8424-6bc096edf944 which can be used as unique global reference for Terra Loader in MISP communities and other software using the MISP galaxy

External references

• https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648 - webarchive

Associated metadata

Metadata key	Value

SpicyOmelette

In 2018, CTU researchers observed several GOLD KINGSWOOD campaigns involving SpicyOmelette, a tool used by the group during initial exploitation of an organization. This sophisticated JavaScript remote access tool is generally delivered via phishing, and it uses multiple defense evasion techniques to hinder prevention and detection activities. GOLD KINGSWOOD delivered SpicyOmelette through a phishing email containing a shortened link that appeared to be a PDF document attachment. When clicked, the link used the Google AppEngine to redirect the system to a GOLD KINGSWOOD-controlled Amazon Web Services (AWS) URL that installed a signed JavaScript file, which was SpicyOmelette.

Internal MISP references

UUID 48753e22-6c22-409c-b274-68f822c7ef57 which can be used as unique global reference for SpicyOmelette in MISP communities and other software using the MISP galaxy

External references

• https://medium.com/@quoscient/golden-chickens-uncovering-a-malware-as-a-service-maas-provider-and-two-new-threat-actors-using-61cf0cb87648 - webarchive
• https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish - webarchive

Associated metadata

Metadata key	Value

LamePyre

When LamePyre runs on the system, users see the generic Automator icon in the menu bar, which is typical for any script of this sort. The script decodes a payload written in Python and runs it on the victim host. It then starts to take pictures and upload them to the attacker's command and control (C2) server.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LamePyre.

Known Synonyms
OSX.LamePyre

Internal MISP references

UUID ca044d42-000e-4366-ace9-e536f8c57440 which can be used as unique global reference for LamePyre in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/new-lamepyre-macos-malware-sends-screenshots-to-attacker/ - webarchive

Associated metadata

Metadata key	Value

DarthMiner

Internal MISP references

UUID 34688253-fea5-4770-bf96-55f45077c347 which can be used as unique global reference for DarthMiner in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/new-lamepyre-macos-malware-sends-screenshots-to-attacker/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

OSX.BadWord

Internal MISP references

UUID 0147c0fd-ed74-4d38-a823-130542d894a3 which can be used as unique global reference for OSX.BadWord in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/new-lamepyre-macos-malware-sends-screenshots-to-attacker/ - webarchive

Associated metadata

Metadata key	Value

OSX/Shlayer

The initial Trojan horse infection (the fake Flash Player installer) component of OSX/Shlayer leverages shell scripts to download additional malware or adware onto the infected system. The primary goal of OSX/Shlayer is to download and install adware onto an infected Mac. Although "adware" may not sound like a big deal, it can be a lot more harmful than the name implies; be sure to watch our aforementioned interview with Amit Serper to learn more about one particular example of malicious Mac adware. At least one variant of the malware also appears to exhibit an interesting behavior: It checks whether one of several Mac anti-virus products is installed.

Internal MISP references

UUID 6e60cb73-0bcc-45bf-b14f-633aa7ffc8b4 which can be used as unique global reference for OSX/Shlayer in MISP communities and other software using the MISP galaxy

External references

• https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/ - webarchive

Associated metadata

Metadata key	Value

Bushaloader

Internal MISP references

UUID 4473f19e-ad0f-4191-bb7f-a28ef7ae3be3 which can be used as unique global reference for Bushaloader in MISP communities and other software using the MISP galaxy

External references

• https://www.virusbulletin.com/blog/2019/02/malspam-security-products-miss-banking-and-email-phishing-emotet-and-bushaloader/ - webarchive

Associated metadata

Metadata key	Value

ANEL

Backdoor

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular ANEL.

Known Synonyms
UPPERCUT

Internal MISP references

UUID 588b97ff-3434-4aa1-a5fd-815e1bb0178b which can be used as unique global reference for ANEL in MISP communities and other software using the MISP galaxy

External references

• https://blog.trendmicro.com/trendlabs-security-intelligence/chessmaster-adds-updated-tools-to-its-arsenal/ - webarchive
• https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BabyShark

BabyShark is a relatively new malware. The earliest sample we found from open source repositories and our internal data sets was seen in November 2018. The malware is launched by executing the first stage HTA from a remote location, thus it can be delivered via different file types including PE files as well as malicious documents. It exfiltrates system information to C2 server, maintains persistence on the system, and waits for further instruction from the operator.

Internal MISP references

UUID 78ed653d-2d76-4a99-849e-1509e4573c32 which can be used as unique global reference for BabyShark in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

StealthWorker

Hackers are running a new campaign which drops the StealthWorker brute-force malware on Windows and Linux machines that end up being used to brute force other computers in a series of distributed brute force attacks. As unearthed by FortiGuard Labs' Rommel Joven, the StealthWorker Golang-based brute forcer (also known as GoBrut) discovered by Malwarebytes at the end of February is actively being used to target and compromise multiple platforms. StealthWorker was previously connected to a number of compromised Magento-powered e-commerce websites on which attackers infiltrated skimmers designed to exfiltrate both payment and personal information. As later discovered, the malware is capable of exploiting a number of vulnerabilities in to infiltrate Magento, phpMyAdmin, and cPanel Content Management Systems (CMSs), as well as brute force its way in if everything else fails.

Internal MISP references

UUID f0fc5ab9-4973-42b3-a2f6-25ff551b5566 which can be used as unique global reference for StealthWorker in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/stealthworker-malware-uses-windows-linux-bots-to-hack-websites/ - webarchive

Associated metadata

Metadata key	Value

SLUB Backdoor

The SLUB backdoor is a custom one written in the C++ programming language, statically linking curl library to perform multiple HTTP requests. Other statically-linked libraries are boost (for extracting commands from gist snippets) and JsonCpp (for parsing slack channel communication).

Internal MISP references

UUID bb6492fa-36b5-4f4a-a787-e718e7f9997f which can be used as unique global reference for SLUB Backdoor in MISP communities and other software using the MISP galaxy

External references

• https://blog.trendmicro.com/trendlabs-security-intelligence/new-slub-backdoor-uses-github-communicates-via-slack/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Carp Downloader

In 2017, Unit 42 reported on and analyzed a low-volume malware family called Cardinal RAT. This malware family had remained undetected for over two years and was delivered via a unique downloader named Carp Downloader.

Internal MISP references

UUID 8fb35101-dad6-4628-84ab-905afacb986b which can be used as unique global reference for Carp Downloader in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ - webarchive

Associated metadata

Metadata key	Value

EVILNUM

EVILNUM is a JavaScript-based malware family that is used in attacks against similar organizations.

Internal MISP references

UUID e1ca79eb-5629-4267-bb37-3992c7126ef4 which can be used as unique global reference for EVILNUM in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/cardinal-rat-sins-again-targets-israeli-fin-tech-firms/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Brushaloader

Brushaloader also leverages a combination of VBScript and PowerShell to create a Remote Access Trojan (RAT) that allows persistent command execution on infected systems.

Internal MISP references

UUID e1ca79ea-5628-4266-bb36-3892c7126ef4 which can be used as unique global reference for Brushaloader in MISP communities and other software using the MISP galaxy

External references

• https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Karkoff

In addition to increased reports of threat activity, we have also discovered new evidence that the threat actors behind the DNSpionage campaign continue to change their tactics, likely in an attempt to improve the efficacy of their operations. In February, we discovered some changes to the actors' tactics, techniques and procedures (TTPs), including the use of a new reconnaissance phase that selectively chooses which targets to infect with malware. In April 2019, we also discovered the actors using a new malware, which we are calling Karkoff.

Internal MISP references

UUID a9fc6d3d-09d5-45c3-a91e-e8c61ef37908 which can be used as unique global reference for Karkoff in MISP communities and other software using the MISP galaxy

External references

• https://blog.talosintelligence.com/2019/04/dnspionage-brings-out-karkoff.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

KimJongRAT

We conclude that this RAT/stealeris efficient and was also really interesting to analyse.Furthermore, the creator made effortsto look Korean, for example the author of the .pdf file is Kim Song Chol. He is the brother of Kim Jong-un, the leader of North Korea. We identified that the author of a variant of this stealer is another brother of Kim Jong-un. Maybe the author named every variant withthe name of each brother. After some searches using Google, we identified anold variant of this malware here: http://contagiodump.blogspot.ca/2010/10/oct-08-cve-2010-2883-pdf-nuclear.html. The code of the malware available on the blog is closeto our case but with fewer features. In 2010, the password of the Gmail account was futurekimkim. Three years ago, the author was already fixatedon the Kim family...The language of the resource stored in the .dll file is Korean (LANG_KOREAN). The owner of the gmail mailbox is laoshi135.zhangand the secret question of this account is in Korean too.We don’t know if the malware truly comesfrom Korea.However, thanks to these factors, we decided to name this sample KimJongRAT/Stealer.

Internal MISP references

UUID 3160f772-d458-4bff-970c-1c0431238803 which can be used as unique global reference for KimJongRAT in MISP communities and other software using the MISP galaxy

External references

• https://malware.lu/assets/files/articles/RAP003_KimJongRAT-Stealer_Analysis.1.0.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Cowboy

Based on our research, it appears the malware author calls the encoded secondary payload “Cowboy” regardless of what malware family is delivered.

Internal MISP references

UUID 50baa4dc-0667-4b47-b4aa-374a2743f409 which can be used as unique global reference for Cowboy in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/ - webarchive

Associated metadata

Metadata key	Value

JasperLoader

JasperLoader employs a multi-stage infection process that features several obfuscation techniques that make analysis more difficult. It appears that this loader was designed with resiliency and flexibility in mind, as evidenced in later stages of the infection process.

Internal MISP references

UUID d8de6b56-9950-4389-83b8-4fc3262dc4c9 which can be used as unique global reference for JasperLoader in MISP communities and other software using the MISP galaxy

External references

• https://blog.talosintelligence.com/2019/04/jasperloader-targets-italy.html?m=1 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Scranos

The malware Scranos infects with rootkit capabilities, burying deep into vulnerable Windows computers to gain persistent access — even after the computer restarts. Scranos only emerged in recent months, according to Bitdefender with new research out Tuesday, but the number of its infections has rocketed in the months since it was first identified in November.

Internal MISP references

UUID 5f0f6af2-b644-49a6-8f68-5d4ca58c989e which can be used as unique global reference for Scranos in MISP communities and other software using the MISP galaxy

External references

• https://labs.bitdefender.com/2019/04/inside-scranos-a-cross-platform-rootkit-enabled-spyware-operation/ - webarchive
• https://techcrunch.com/2019/04/16/scranos-rootkit-passwords-payments/?guccounter=1&guce_referrer_us=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&guce_referrer_cs=MrGSn18TmNoWovpLbekFYA - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Reaver

Unit 42 has discovered a new malware family we’ve named “Reaver” with ties to attackers who use SunOrcal malware. SunOrcal activity has been documented to at least 2013, and based on metadata surrounding some of the C2s, may have been active as early as 2010. The new family appears to have been in the wild since late 2016 and to date we have only identified 10 unique samples, indicating it may be sparingly used. Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file. To date, only 0.006% of all malware seen by Palo Alto Networks employs this technique, indicating that it is in fact fairly rare.

Internal MISP references

UUID 22b75148-9d58-4fa7-8459-6ef25bbaf759 which can be used as unique global reference for Reaver in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/unit42-new-malware-with-ties-to-sunorcal-discovered/ - webarchive
• https://threatvector.cylance.com/en_us/home/reaver-mapping-connections-between-disparate-chinese-apt-groups.html - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SURTR

The Citizen Lab analyzed a malicious email sent to Tibetan organizations in June 2013. The email in question purported to be from a prominent member of the Tibetan community and repurposed content from a community mailing list. Attached to the email were what appeared to be three Microsoft Word documents (.doc), but which were trojaned with a malware family we call “Surtr”.1 All three attachments drop the exact same malware. We have seen the Surtr malware family used in attacks on Tibetan groups dating back to November 2012.

Internal MISP references

UUID dd919e75-57e8-4e5c-9451-8be6e734f1f3 which can be used as unique global reference for SURTR in MISP communities and other software using the MISP galaxy

External references

• https://citizenlab.ca/2013/08/surtr-malware-family-targeting-the-tibetan-community/ - webarchive
• https://otx.alienvault.com/pulse/588a7c8fe4166d1d84244b9a - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SunOrcal

SunOrcal is a trojan malware family whose activity dates back to at least 2013. A version discovered in November 2017 incorporates steganography techniques and can collect C2 information via GitHub, obscuring its C2 infrastructure and evading detection using the legitimate site for its first beacon. The threat actors have targeted users in the Vietnam area, spreading phishing emails containing malicious documents purportedly regarding South China Sea disputes. The new SunOrcal version has also been used with the recently discovered Reaver trojan and the original SunOrcal version. Some of the recent activity also incorporates the use of the Surtr malware.

Internal MISP references

UUID 80365d3a-6d46-4195-a772-364749a6dc06 which can be used as unique global reference for SunOrcal in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/unit42-sunorcal-adds-github-steganography-repertoire-expands-vietnam-myanmar/ - webarchive
• https://www.cyber.nj.gov/threat-profiles/trojan-variants/sunorcal - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Bookworm

Threat actors have delivered Bookworm as a payload in attacks on targets in Thailand. Readers who are interested in this campaign should start with our first blog that lays out the overall functionality of the malware and introduces its many components. Unit 42 does not have detailed targeting information for all known Bookworm samples, but we are aware of attempted attacks on at least two branches of government in Thailand. We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents, as well as several of the dynamic DNS domain names used to host C2 servers that contain the words “Thai” or “Thailand”. Analysis of compromised systems seen communicating with Bookworm C2 servers also confirms our speculation on targeting with a majority of systems existing within Thailand.

Internal MISP references

UUID 9ff6e087-6755-447a-b537-8f06c7aa4a85 which can be used as unique global reference for Bookworm in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/attack-campaign-on-the-government-of-thailand-delivers-bookworm-trojan/ - webarchive
• https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Amavaldo

We named the malware family described in the rest of this blog post Amavaldo. This family is still in active development – the latest version we have observed (10.7) has a compilation timestamp of June 10th, 2019.

Internal MISP references

UUID c72f8f57-fc2f-4ca2-afbe-ca5bfa5a1747 which can be used as unique global reference for Amavaldo in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2019/08/01/banking-trojans-amavaldo/ - webarchive

Associated metadata

Metadata key	Value

TVSPY

hacker going by the handle Mr. Burns. He also created something similar called RMS, which behaves very much like the TVSPY builder. “RMS/TVSPY continues to be developed, with a new version being posted by the developer/reseller on a regular basis,” Damballa researchers noted. “In fact, the legitimate RMS version developed by TektonIT and the version posted in criminal forums appear to be identical. TVSPY seems to be merely a modification of RMS to utilize TeamViewer infrastructure and a command-and-control interface manageable through the Web.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular TVSPY.

Known Synonyms
SpY-Agent
TVRAT
teamspy

Internal MISP references

UUID ae82a19e-2334-4e72-b55c-79b4ba4f137f which can be used as unique global reference for TVSPY in MISP communities and other software using the MISP galaxy

External references

• https://mobile.twitter.com/SaudiDFIR/status/1177740045186457600 - webarchive

Associated metadata

Metadata key	Value

COMpfun

The COMpfun malware was initially documented by G-DATA in 2014. Although G-DATA didn’t identify which actor was using this malware, Kaspersky tentatively linked it to the Turla APT, based on the victimology. Our telemetry indicates that the current campaign using Reductor started at the end of April 2019 and remained active at the time of writing (August 2019). We identified targets in Russia and Belarus.

Internal MISP references

UUID b2c2d42b-a6a3-4ab0-a013-eb1c7461aca9 which can be used as unique global reference for COMpfun in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/compfun-successor-reductor/93633/ - webarchive
• https://www.gdatasoftware.com/blog/2014/10/23941-com-object-hijacking-the-discreet-way-of-persistence - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Reductor

We called these new modules ‘Reductor’ after a .pdb path left in some samples. Besides typical RAT functions such as uploading, downloading and executing files, Reductor’s authors put a lot of effort into manipulating digital certificates and marking outbound TLS traffic with unique host-related identifiers. The Kaspersky Attribution Engine shows strong code similarities between this family and the COMPfun Trojan. Moreover, further research showed that the original COMpfun Trojan most probably is used as a downloader in one of the distribution schemes. Based on these similarities, we’re quite sure the new malware was developed by the COMPfun authors.

Internal MISP references

UUID a577bb0d-9732-449a-80f7-5e6c93e6046c which can be used as unique global reference for Reductor in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/compfun-successor-reductor/93633/ - webarchive

Associated metadata

Metadata key	Value

ProcDump

Legitimate tool - command-line tool used to monitor a running process and dump memory depending on customcriteria. The attackers use this tool to dump the LSASS process to gatherWINDOWScredentials hashes

Internal MISP references

UUID 1ae22855-c343-4ae9-8cab-522c9da938aa which can be used as unique global reference for ProcDump in MISP communities and other software using the MISP galaxy

CertMig

Legitimate tool - command-line tool used to import and export certificates on a machine. The attackers use this toolto gather credentials used for VPN authentication to the clients’ networks

Internal MISP references

UUID fadd0d1f-b098-43ea-b7a6-50fb58aef9f6 which can be used as unique global reference for CertMig in MISP communities and other software using the MISP galaxy

Netscan

Legitimate tool - tool used to scan IPv4/IPv6 networks and remotely execute PowerShell commands.

Internal MISP references

UUID bbba3a35-5064-4e60-ad4b-0ba16cc81a23 which can be used as unique global reference for Netscan in MISP communities and other software using the MISP galaxy

ShadowHammer

Malware embedded in Asus Live Update in 2018. ShadowHammer triggers its malicious behavior only if the computer it is running on has a network adapter with the MAC address whitelisted by the attacker.

Internal MISP references

UUID c1815516-aa2a-43d2-9136-78a8feb054b6 which can be used as unique global reference for ShadowHammer in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Winnti.pdf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DePriMon

DePriMon is a malicious downloader, with several stages and using many non-traditional techniques. To achieve persistence, the malware registers a new local port monitor – a trick falling under the “Port Monitors” technique in the MITRE ATT&CK knowledgebase. For that, the malware uses the “Windows Default Print Monitor” name; that’s why we have named it DePriMon. Due to its complexity and modular architecture, we consider it to be a framework.

Internal MISP references

UUID c76874cd-0d73-4cbf-8d39-a066900dd4ce which can be used as unique global reference for DePriMon in MISP communities and other software using the MISP galaxy

External references

• https://www.bleepingcomputer.com/news/security/deprimon-malware-registers-itself-as-a-windows-print-monitor/ - webarchive
• https://www.welivesecurity.com/2019/11/21/deprimon-default-print-monitor-malicious-downloader/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Private Internet Access

Private Internet Access provides state of the art, multi-layered security with advanced privacy protection using VPN tunneling.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Private Internet Access.

Known Synonyms
PIA

Internal MISP references

UUID 68cd6cbf-6629-4e02-98b6-128978f44546 which can be used as unique global reference for Private Internet Access in MISP communities and other software using the MISP galaxy

External references

• https://www.privateinternetaccess.com/ - webarchive

Associated metadata

Metadata key	Value

Netcat

Reads from and writes to network connections using TCP or UDP protocols.

Internal MISP references

UUID cb45bb39-745b-4cde-9a42-2e67334e5071 which can be used as unique global reference for Netcat in MISP communities and other software using the MISP galaxy

NBTScan

NBTScan is a program for scanning IP networks for NetBIOS name information (similar to what the Windows nbtstat tool provides against single hosts). It sends a NetBIOS status query to each address in a supplied range and lists received information in human readable form. For each responded host it lists IP address, NetBIOS computer name, logged-in user name and MAC address.

Internal MISP references

UUID a0736351-1721-42ed-a057-19b4b93b585e which can be used as unique global reference for NBTScan in MISP communities and other software using the MISP galaxy

External references

• https://sectools.org/tool/nbtscan/ - webarchive

Associated metadata

Metadata key	Value

PowerGhost

PowerGhost is capable of stealthily establishing itself in a system and spreading across large corporate networks infecting both workstations and servers. This type of hidden consolidation is typical of miners: the more machines that get infected and the longer they remain that way, the greater the attacker’s profits. Therefore, it’s not uncommon to see clean software being infected with a miner; the popularity of the legitimate software serves to promote the malware’s proliferation. The creators of PowerGhost, however, went further and started using fileless techniques to establish the illegal miner within the victim system.

Internal MISP references

UUID 92480988-82ad-4e1c-af5f-71c85f9ab809 which can be used as unique global reference for PowerGhost in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/a-mining-multitool/86950/ - webarchive

Associated metadata

Metadata key	Value

VBEtaly

Check Point researchers have found another wave of the Ursnif malspam campaign targeting Italy. Only a few details are known so far but what we have found is that the file delivered is a VBE file (encoded VBS) named “SCANSIONE.vbe” and is delivered via ZIP attachments in emails with the subject suggesting different documents in Italian.

Internal MISP references

UUID 10c0d60b-c9c1-474c-8594-11b5d82c6498 which can be used as unique global reference for VBEtaly in MISP communities and other software using the MISP galaxy

External references

• https://research.checkpoint.com/vbetaly/ - webarchive

Associated metadata

Metadata key	Value

ZeroCleare

ZeroCleare was used to execute a destructive attack that affected organizations in the energy and industrial sectorsin the Middle East. Based on the analysis of the malware and the attackers’ behavior, we suspect Iran-based nation state adversaries were involved to develop and deploy this new wiper.

Internal MISP references

UUID 40fdcaac-a733-4088-9058-7b15a415b943 which can be used as unique global reference for ZeroCleare in MISP communities and other software using the MISP galaxy

External references

• https://www.ibm.com/downloads/cas/OAJ4VZNJ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Dustman

At the heart of the recent Bapco attack is a new strain of malware named Dustman. According to an analysis by Saudi Arabia's cyber-security agency, Dustman is a so-called data wiper -- malware designed to delete data on infected computers, once launched into execution. Dustman represents the third different data-wiping malware linked to the Tehran regime. Iranian state-backed hackers have a long history of developing data-wiping malware.

Internal MISP references

UUID ff692a4c-23ff-4e86-a03b-2de8d36bc98f which can be used as unique global reference for Dustman in MISP communities and other software using the MISP galaxy

External references

• https://mobile.twitter.com/IntezerLabs/status/1215252764080644098 - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Autochk Rootkit

This rootkit is a very simple. The name of the driver is “autochk.sys” - that’s why we’ll call it the autochk rootkit. The rootkit implements 2 functionalities: File Redirection and Network Connection Hiding.

Internal MISP references

UUID 4a60dc72-1ca0-4503-a635-96e119c5278d which can be used as unique global reference for Autochk Rootkit in MISP communities and other software using the MISP galaxy

External references

• https://repnz.github.io/posts/autochk-rootkit-analysis/ - webarchive

Associated metadata

Metadata key	Value

Lampion

New trojan called Lampion has spread using template emails from the Portuguese Government Finance & Tax during the last days of 2019.

Internal MISP references

UUID dd299e22-bf82-4317-8c81-c6b1f7514571 which can be used as unique global reference for Lampion in MISP communities and other software using the MISP galaxy

External references

• https://seguranca-informatica.pt/targeting-portugal-a-new-trojan-lampion-has-spread-using-template-emails-from-the-portuguese-government-finance-tax/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

LiquorBot

Bitdefender researchers tracked the development of a Mirai-inspired botnet, dubbed LiquorBot, which seems to be actively in development and has recently incorporated Monero cryptocurrency mining features.

Internal MISP references

UUID e537e165-ea8b-4e75-8813-6519632d3f6a which can be used as unique global reference for LiquorBot in MISP communities and other software using the MISP galaxy

External references

• https://labs.bitdefender.com/2020/01/hold-my-beer-mirai-spinoff-named-liquorbot-incorporates-cryptomining/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Gelup malware tool

Written in C++ and designed to function as a downloader of other malware, Gelup stood out for its obfuscation techniques. Gelup can also bypass User Account Control (UAC) by mocking trusted directories, abusing auto-elevated executables and using the Dynamic Link Library (DLL) side-loading technique.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Gelup malware tool.

Known Synonyms
AndroMut

Internal MISP references

UUID 32a6065c-4f4e-4a60-8717-5872b5f21ac4 which can be used as unique global reference for Gelup malware tool in MISP communities and other software using the MISP galaxy

External references

• https://securityintelligence.com/news/ta505-delivers-new-gelup-malware-tool-flowerpippi-backdoor-via-spam-campaign/ - webarchive

Associated metadata

Metadata key	Value

DenesRAT

DenesRAT is a private Trojan horse of the "Sea Lotus" organization, which can perform corresponding functions according to the instructions issued by the C2 server. The main functions are file operations, such as creating files or directories, deleting files or directories, finding files; registry reading and writing; remote code execution, such as creating processes, executing DLLs, etc....

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DenesRAT.

Known Synonyms
METALJACK

Internal MISP references

UUID edd9e14c-80f7-4a50-ab85-fa1120c54003 which can be used as unique global reference for DenesRAT in MISP communities and other software using the MISP galaxy

External references

• http://baijiahao.baidu.com/s?id=1661498030941117519 - webarchive
• https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html - webarchive

Associated metadata

Metadata key	Value
type	['Loader', 'Backdoor']

Sedkit

Sednit's Exploit-Kit

Internal MISP references

UUID a2d1cdd6-1c3d-47b3-803b-9a3fffe2f051 which can be used as unique global reference for Sedkit in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2014/10/08/sednit-espionage-group-now-using-custom-exploit-kit/ - webarchive
• https://www.welivesecurity.com/2016/10/20/new-eset-research-paper-puts-sednit-under-the-microscope/ - webarchive

Associated metadata

Metadata key	Value
type	['Exploit-Kit']

Covenant

Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers.

Internal MISP references

UUID 01a4f3c4-a578-49bd-b6ab-eb3b7d27d8c1 which can be used as unique global reference for Covenant in MISP communities and other software using the MISP galaxy

External references

• https://github.com/cobbr/Covenant/ - webarchive

Associated metadata

Metadata key	Value
type	['post-exploitation framework']

Cobalt Strike

Cobalt Strike is a post-exploitation framework.

Internal MISP references

UUID 97f26fab-af0e-4da9-b4c1-aec70cace22d which can be used as unique global reference for Cobalt Strike in MISP communities and other software using the MISP galaxy

External references

• https://www.cobaltstrike.com - webarchive

Associated metadata

Metadata key	Value
type	['post-exploitation framework']

Related clusters

To see the related clusters, click here.

metasploit

METASPLOIT is a penetration testing framework whose features include vulnerability testing, network enumeration, payload generation and execution, and defense evasion. Availability: Public

Internal MISP references

UUID be419332-61ab-45f0-979e-56f78a223c8e which can be used as unique global reference for metasploit in MISP communities and other software using the MISP galaxy

External references

• https://www.metasploit.com - webarchive
• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value
type	['exploitation framework']

CrackMapExec

A swiss army knife for pentesting networks. CRACKMAPEXEC is a post-exploitation tool against Microsoft Windows environments. It is recognized for its lateral movement capabilities.

Internal MISP references

UUID e83d1296-027a-4f30-98e0-19622967d5c4 which can be used as unique global reference for CrackMapExec in MISP communities and other software using the MISP galaxy

External references

• https://github.com/byt3bl33d3r/CrackMapExec - webarchive
• https://bitdefender.com/files/News/CaseStudies/study/332/Bitdefender-Whitepaper-Chafer-creat4491-en-EN-interactive.pdf - webarchive
• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value
type	['exploitation framework']

WellMess

Wellmess is a Remote Access Trojan written in Golang and also have a .NET version

Internal MISP references

UUID 4fe80228-1142-4e70-9df8-c8f1f3356cfb which can be used as unique global reference for WellMess in MISP communities and other software using the MISP galaxy

External references

• https://www.lac.co.jp/lacwatch/pdf/20180614_cecreport_vol3.pdf - webarchive
• https://blogs.jpcert.or.jp/en/2018/07/malware-wellmes-9b78.html - webarchive
• https://www.botconf.eu/wp-content/uploads/2018/12/2018-Y-Ishikawa-S-Nagano-Lets-go-with-a-Go-RAT-_final.pdf - webarchive
• https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf - webarchive

Associated metadata

Metadata key	Value
type	['RAT']

Related clusters

To see the related clusters, click here.

WellMail

WellMail is a lightweight tool designed to run commands or scripts with the results being sent to a hardcoded Command and Control (C2) server.

Internal MISP references

UUID 59266c02-e3c8-47a6-b00c-bbb50c8975e9 which can be used as unique global reference for WellMail in MISP communities and other software using the MISP galaxy

External references

• https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development.pdf - webarchive

Associated metadata

Metadata key	Value
type	['RAT']

Related clusters

To see the related clusters, click here.

Drovorub

Drovorub is a Linux malware toolset consisting of an implant coupled with a kernel module rootkit, a file transfer and port forwarding tool, and a Command and Control (C2) server.

Internal MISP references

UUID a0a46c1b-e774-410e-a84b-020b2558d851 which can be used as unique global reference for Drovorub in MISP communities and other software using the MISP galaxy

External references

• https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF - webarchive

Associated metadata

Metadata key	Value
type	['Backdoor', 'Rootkit']

IsErIk

The adware DealPly (sometimes also referred to as IsErIk) and malicious Chrome extension ManageX, for instance, can come bundled under the guise of a legitimate installer and other potentially unwanted applications (PUAs). Because various write-ups cover Dealply or IsErik separately, the technical discussion and representation of both are discussed separately.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular IsErIk.

Known Synonyms
DealPly
ManageX

Internal MISP references

UUID 9f9daf7b-3530-4e2d-9d2c-d1036bafc825 which can be used as unique global reference for IsErIk in MISP communities and other software using the MISP galaxy

External references

• https://blog.trendmicro.com/trendlabs-security-intelligence/exposing-modular-adware-how-dealply-iserik-and-managex-persist-in-systems/ - webarchive

Associated metadata

Metadata key	Value
type	['PUA']

Vatet

Attackers often shift infrastructure, techniques, and tools to avoid notoriety that might attract law enforcement or security researchers. They often retain them while waiting for security organizations to start considering associated artifacts inactive, so they face less scrutiny. Vatet, a custom loader for the Cobalt Strike framework that has been seen in ransomware campaigns as early as November 2018, is one of the tools that has resurfaced in the recent campaigns.

Internal MISP references

UUID 2a838144-b42d-4c12-bf41-4e99de1935e9 which can be used as unique global reference for Vatet in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2020/04/28/ransomware-groups-continue-to-target-healthcare-critical-services-heres-how-to-reduce-risk/ - webarchive
• https://www.tripwire.com/state-of-security/featured/ransomware-characteristics-attack-chains-recent-campaigns/ - webarchive

Associated metadata

Metadata key	Value
type	['Loader']

ConfuserEx

ConfuserEx is a common .NET packer/protector used to obfuscate .NET assemblies and confuse the decompilation process. According to the official site: ConfuserEx is an free, open-source protector for .NET applications. It is the successor of Confuser project. ConfuserEx supports .NET Framework from 2.0 - 4.5 and Mono (and other .NET platforms if enough request!). It supports most of the protections you’ll find in commerical protectors, and some more!

Internal MISP references

UUID 1d734fcc-58a2-4176-bfa9-0d96f447799d which can be used as unique global reference for ConfuserEx in MISP communities and other software using the MISP galaxy

External references

• https://yck1509.github.io/ConfuserEx/ - webarchive
• https://blog.talosintelligence.com/2017/12/recam-redux-deconfusing-confuserex.html - webarchive

Associated metadata

Metadata key	Value
type	['Packer']

Beds Protector

Beds Protector is a common .NET packer/protector. It is a mod of ConfuserEx, which is another common .NET packer/protector. It is commonly used to obfuscate .NET assemblies and confuse the decompilation process. The latest available version is Beds Protector v1.4.1

Internal MISP references

UUID 5ce18513-bd12-4689-a705-634cf727162e which can be used as unique global reference for Beds Protector in MISP communities and other software using the MISP galaxy

External references

• https://github.com/BedTheGod/ConfuserEx-Mod-By-Bed - webarchive

Associated metadata

Metadata key	Value
type	['Packer']

HyperBro

HyperBro Trojan was used as last-stage in-memory remote administration tool (RAT).

Internal MISP references

UUID e1bfe1d9-190c-4cf4-aec8-a8f2c41c7d8b which can be used as unique global reference for HyperBro in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/luckymouse-hits-national-data-center/86083/ - webarchive

Associated metadata

Metadata key	Value
type	['RAT']

Related clusters

To see the related clusters, click here.

SUNSPOT

SUNSPOT is StellarParticle’s malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion IT management product.

Internal MISP references

UUID d9b2305e-9802-483c-a95d-2ae8525c7704 which can be used as unique global reference for SUNSPOT in MISP communities and other software using the MISP galaxy

External references

• https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Caterpillar WebShell

Internal MISP references

UUID 1974ea65-7312-4d91-a592-649983b46554 which can be used as unique global reference for Caterpillar WebShell in MISP communities and other software using the MISP galaxy

External references

• https://www.clearskysec.com/cedar/ - webarchive

Associated metadata

Metadata key	Value
type	['webshell']

P.A.S. webshell

The P.A.S. webshell was developed by an ukrainian student, Jaroslav Volodimirovich Panchenko, who used the nick-name Profexer. It was developed in PHP and features a characteristic password-based encryption. This tool was available through a form on his website, where a user had to provide a password to receive a custom webshell. The form suggested a donation to the developer. It was commonly used, including during a WORDPRESS website attack.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular P.A.S. webshell.

Known Synonyms
Fobushell

Internal MISP references

UUID 6baa1f46-daa9-4f40-952b-ec613c835abb which can be used as unique global reference for P.A.S. webshell in MISP communities and other software using the MISP galaxy

External references

• https://us-cert.cisa.gov/GRIZZLY-STEPPE-Russian-Malicious-Cyber-Activity - webarchive
• https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf - webarchive

Associated metadata

Metadata key	Value
type	['webshell']

Exaramel

Exaramel is a backdoor first publicly reported by ESET in 2018. Two samples were identified, one targeting the WINDOWS operating system and the other targeting LINUX operating systems.

Internal MISP references

UUID 95174297-6dff-47d9-bcb9-263f9b2efcfb which can be used as unique global reference for Exaramel in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2018/10/11/new-telebots-backdoor-linking-industroyer-notpetya/ - webarchive
• https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf - webarchive

Associated metadata

Metadata key	Value
type	['backdoor']

RDAT

RDAT is a backdoor used by the suspected Iranian threat group OilRig. RDAT was originally identified in 2017 and targeted companies in the telecommunications sector.

Internal MISP references

UUID d357a6ff-00e5-4fcc-8b9e-4a9d98a736e7 which can be used as unique global reference for RDAT in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/oilrig-novel-c2-channel-steganography/ - webarchive

Associated metadata

Metadata key	Value
type	['backdoor']

Related clusters

To see the related clusters, click here.

TEARDROP

Loader used in hands-on-keyboard techniques that attackers employed on compromised endpoints using a powerful second-stage payload, one of several custom Cobalt Strike loaders.

Internal MISP references

UUID aba3fd7d-87cc-4266-82a1-d458ae299266 which can be used as unique global reference for TEARDROP in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - webarchive
• https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GoldMax

Written in Go, GoldMax acts as command-and-control backdoor for the actor. It uses several different techniques to obfuscate its actions and evade detection. The malware writes an encrypted configuration file to disk, where the file name and AES-256 cipher keys are unique per implant and based on environmental variables and information about the network where it is running. GoldMax establishes a secure session key with its C2 and uses that key to securely communicate with the C2, preventing non-GoldMax-initiated connections from receiving and identifying malicious traffic. The C2 can send commands to be launched for various operations, including native OS commands, via psuedo-randomly generated cookies. The hardcoded cookies are unique to each implant, appearing to be random strings but mapping to victims and operations on the actor side.

Internal MISP references

UUID 1e912590-c879-4a9c-81b9-2d31e82ac718 which can be used as unique global reference for GoldMax in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/ - webarchive
• https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Raindrop

Loader used in hands-on-keyboard techniques that attackers employed on compromised endpoints using a powerful second-stage payload, one of several custom Cobalt Strike loaders.

Internal MISP references

UUID 6c562458-7970-4d61-aded-1fe4a9002404 which can be used as unique global reference for Raindrop in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GoldFinder

Tool written in Go, GoldFinder was most likely used as a custom HTTP tracer tool that logs the route or hops that a packet takes to reach a hardcoded C2 server. When launched, the malware issues an HTTP request for a hardcoded IP address (e.g., hxxps://185[.]225[.]69[.]69/) and logs the HTTP response to a plaintext log file (e.g., loglog.txt created in the present working directory). GoldFinder uses the following hardcoded labels to store the request and response information in the log file:

Internal MISP references

UUID 235832b0-ee82-4ed9-8cbd-99cd3cc3596c which can be used as unique global reference for GoldFinder in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Sibot

Sibot is a dual-purpose malware implemented in VBScript. It is designed to achieve persistence on the infected machine then download and execute a payload from a remote C2 server. The VBScript file is given a name that impersonates legitimate Windows tasks and is either stored in the registry of the compromised system or in an obfuscated format on disk. The VBScript is then run via a scheduled task.

Internal MISP references

UUID 1422b81c-a3c6-4229-8523-82d705400f46 which can be used as unique global reference for Sibot in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Matanbuchus

Matanbuchus is a loader promoted by BelialDemon. It can launch an EXE or DLL file in memory, leverage schtasks.exe to add or modify task schedules, and launch custom PowerShell commands, among other capabilities. Attackers use a Microsoft Excel document as the initial vector to drop the Matanbuchus Loader DLL.

Internal MISP references

UUID 2214b113-6942-494f-94b7-576e74fccdb5 which can be used as unique global reference for Matanbuchus in MISP communities and other software using the MISP galaxy

External references

• https://unit42.paloaltonetworks.com/matanbuchus-malware-as-a-service/ - webarchive

Associated metadata

Metadata key	Value
date	Feb 2021.
type	['Loader']

Related clusters

To see the related clusters, click here.

BLUELIGHT

It is likely that BLUELIGHT is used as a secondary payload following successful delivery of Cobalt Strike.

Internal MISP references

UUID b1c4f468-1c55-40aa-bce4-c3772ef83d0c which can be used as unique global reference for BLUELIGHT in MISP communities and other software using the MISP galaxy

External references

• https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/ - webarchive

Associated metadata

Metadata key	Value
type	['backdoor']

ESPecter bootkit

ESET researchers have analyzed a previously undocumented, real-world UEFI bootkit that persists on the EFI System Partition (ESP). The bootkit, which we’ve named ESPecter, can bypass Windows Driver Signature Enforcement to load its own unsigned driver, which facilitates its espionage activities. Alongside Kaspersky’s recent discovery of the unrelated FinSpy bootkit, it is now safe to say that real-world UEFI threats are no longer limited to SPI flash implants, as used by Lojax.

Internal MISP references

UUID d5b31712-a5b4-4b1c-9a74-4340abc61210 which can be used as unique global reference for ESPecter bootkit in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2021/10/05/uefi-threats-moving-esp-introducing-especter-bootkit/ - webarchive
• https://github.com/eset/malware-ioc/tree/master/especter - webarchive

Associated metadata

Metadata key	Value

Shark

Shark is a 32-bit executable written in C# and .NET. To run Shark, a parameter is passed on the command line that includes the executable’s filename. Shark generates a mutex that uses the executable’s filename as the mutex value. The mutex likely ensures Shark does not execute on a machine where it is already running and that the correct version of Shark is executed.

Internal MISP references

UUID 9ea6d29e-00a7-4042-9bc5-31b1adeee6ec which can be used as unique global reference for Shark in MISP communities and other software using the MISP galaxy

External references

• https://www.prevailion.com/latest-targets-of-cyber-group-lyceum/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Motnug

Motnug is a simple shellcode loader that is used to load and execute shellcode located either in its overlay or in a separate file stored on disk.

Internal MISP references

UUID f3bae23a-ec73-49cb-8149-f93578bb2bff which can be used as unique global reference for Motnug in MISP communities and other software using the MISP galaxy

External references

• https://www.welivesecurity.com/2021/08/24/sidewalk-may-be-as-dangerous-as-crosswalk/ - webarchive
• https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/ - webarchive

Associated metadata

Metadata key	Value

BadPotato

BadPotato leaks a system token handle through the MS RPN API, which can be used to get NT AUTHORITY\SYSTEM access.

Internal MISP references

UUID f43a3828-a3b6-11ec-80e1-55a8e5815c2c which can be used as unique global reference for BadPotato in MISP communities and other software using the MISP galaxy

External references

• https://github.com/BeichenDream/BadPotato - webarchive
• https://www.mandiant.com/resources/apt41-us-state-governments - webarchive
• https://thehackernews.com/2021/06/chinese-hackers-believed-to-be-behind.html - webarchive
• https://blog.group-ib.com/colunmtk_apt41 - webarchive

Associated metadata

Metadata key	Value

Microcin

A simple RAT used by Vicious Panda

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Microcin.

Known Synonyms
Mikroceen

Internal MISP references

UUID 7d17dabf-a68e-4eda-a18f-26868ced8e73 which can be used as unique global reference for Microcin in MISP communities and other software using the MISP galaxy

External references

• https://securelist.com/microcin-is-here/97353 - webarchive
• https://securelist.com/a-simple-example-of-a-complex-cyberattack/82636 - webarchive
• https://decoded.avast.io/luigicamastra/apt-group-planted-backdoors-targeting-high-profile-networks-in-central-asia - webarchive
• https://www.welivesecurity.com/2020/05/14/mikroceen-spying-backdoor-high-profile-networks-central-asia - webarchive
• https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign - webarchive

Associated metadata

Metadata key	Value
type	['RAT']

Related clusters

To see the related clusters, click here.

Esile

The Esile campaign was named after certain strings found in the unpacked malware file that it sends out. All of the malware related to this campaign are detected as BKDR_ESILE variants.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Esile.

Known Synonyms
BKDR_ESILE

Internal MISP references

UUID 7d34ca56-ce69-465f-b8c8-ffd02c4b619d which can be used as unique global reference for Esile in MISP communities and other software using the MISP galaxy

External references

• https://www.trendmicro.com/vinfo/de/security/news/cyber-attacks/esile-targeted-attack-campaign-hits-apac-governments - webarchive
• https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/esile - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

MOUSEISLAND

MOUSEISLAND is a Microsoft Word macro downloader used as the first infection stage and is delivered inside a password-protected zip attached to a phishing email (Figure 2). Based on our intrusion data from responding to ICEDID related incidents, the secondary payload delivered by MOUSEISLAND has been PHOTOLOADER, which acts as an intermediary downloader to install ICEDID. Mandiant attributes the MOUSEISLAND distribution of PHOTOLOADER and other payloads to UNC2420, a distribution threat cluster created by Mandiant’s Threat Pursuit team. UNC2420 activity shares overlaps with the publicly reported nomenclature of “Shathak” or “TA551”.

Internal MISP references

UUID 2bea2cc9-c1cc-453d-a483-541b895867d1 which can be used as unique global reference for MOUSEISLAND in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/melting-unc2198-icedid-to-ransomware-operations - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GootLoader

GootLoader is a malware loader historically associated with the GootKit malware. As its developers updated its capabilities, GootLoader has evolved from a loader downloading a malicious payload into a multi-payload malware platform. As a loader malware, GootLoader is usually the first-stage of a system compromise. By leveraging search engine poisoning, GootLoader’s developers may compromise or create websites that rank highly in search engine results, such as Google search results. How is it delivered? Via Malicious files available for download on compromised websites that rank high as search engine results

Internal MISP references

UUID 0bdb6f1c-1229-4556-a535-7444ddfbd7a9 which can be used as unique global reference for GootLoader in MISP communities and other software using the MISP galaxy

External references

• https://www.cyber.nj.gov/alerts-advisories/gootloader-malware-platform-uses-sophisticated-techniques-to-deliver-malware - webarchive
• https://blogs.blackberry.com/en/2022/07/gootloader-from-seo-poisoning-to-multi-stage-downloader - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BumbleBee

BumbleBee is a modular backdoor that comprises two applications, a server and a client application (a master and slaver application, respectively in the malware’s jargon). Once the client application is deployed on the target computer (these are commonly local government devices), threat actors can control the machine using the server module. Let us take a deeper look into this backdoor.

Internal MISP references

UUID 6fc4beee-b922-4d25-833d-8fb574a3c56e which can be used as unique global reference for BumbleBee in MISP communities and other software using the MISP galaxy

External references

• https://www.trendmicro.com/en_us/research/22/i/buzzing-in-the-background-bumblebee-a-new-modular-backdoor-evolv.html - webarchive
• https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive

Associated metadata

Metadata key	Value
type	['backdoor']

Related clusters

To see the related clusters, click here.

Chisel

Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go (golang). Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network. Benign in itself, but used by threat actors.

Internal MISP references

UUID f493dede-9134-44db-a00d-aa4866bfd555 which can be used as unique global reference for Chisel in MISP communities and other software using the MISP galaxy

External references

• https://github.com/jpillora/chisel - webarchive

Associated metadata

Metadata key	Value

SharPyShell

SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications

Internal MISP references

UUID e10ff67f-8b52-4648-9217-da53ff7d52f9 which can be used as unique global reference for SharPyShell in MISP communities and other software using the MISP galaxy

External references

• https://github.com/antonioCoco/SharPyShell - webarchive

Associated metadata

Metadata key	Value

Raspberry Robin

Raspberry Robin has evolved from being a widely distributed worm with no observed post-infection actions when Red Canary first reported it in May 2022, to one of the largest malware distribution platforms currently active.

Internal MISP references

UUID 70dc3e92-9b3b-4fc1-abd2-d98985d83225 which can be used as unique global reference for Raspberry Robin in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive

Associated metadata

Metadata key	Value
type	['Worm']

Related clusters

To see the related clusters, click here.

Fauppod

The Fauppod malware delivers a JavaScript backdoor to gain unauthorized access to the target system and deploy additional malware.

Internal MISP references

UUID 9f0224f6-dd46-4a23-a3fd-d295abae5f93 which can be used as unique global reference for Fauppod in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive

Associated metadata

Metadata key	Value

Truebot

This threat takes multiple screenshots of your desktop. It saves all screenshots in a .dat file that becomes a collection of bitmap images. According to Group-IB, FlawedAmmyy.downloader and Truebot would have been developed by the same individual

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular Truebot.

Known Synonyms
Silence

Internal MISP references

UUID ad6d0074-476e-4c05-b0d9-79404f71bbba which can be used as unique global reference for Truebot in MISP communities and other software using the MISP galaxy

External references

• https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive

Associated metadata

Metadata key	Value

FakeUpdates

FAKEUPDATES is a downloader written in JavaScript that communicates via HTTP. Supported payload types include executables and JavaScript. It writes the payloads to disk prior to launching them. FAKEUPDATES has led to further compromise via additional malware families that include CHTHONIC, DRIDEX, EMPIRE, KOADIC, DOPPELPAYMER, and AZORULT. FAKEUPDATES has been heavily used by UNC1543,a financially motivated group.

SocGholish, first appearing in late 2017 and rising to prominence in mid-2018, has been used to describe both the web drive-by download network used to infect victims and the JavaScript-based loader malware that targets Windows systems.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular FakeUpdates.

Known Synonyms
FakeUpdate
SocGholish

Internal MISP references

UUID cd32b19e-c365-4efc-9998-548e50e04a4c which can be used as unique global reference for FakeUpdates in MISP communities and other software using the MISP galaxy

External references

• https://www.malwarebytes.com/blog/news/2018/04/fakeupdates-campaign-leverages-multiple-website-platforms - webarchive
• https://www.microsoft.com/en-us/security/blog/2022/10/27/raspberry-robin-worm-part-of-larger-ecosystem-facilitating-pre-ransomware-activity/ - webarchive
• https://www.secureworks.com/research/threat-profiles/gold-prelude - webarchive
• https://redcanary.com/threat-detection-report/threats/socgholish/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TgToxic

Banking trojan named TgToxic (detected by Trend Micro as AndroidOS_TgToxic based on its special encrypted filename) embedded in multiple fake apps.

Internal MISP references

UUID 55d5853c-393e-449b-ab2b-871e3fe45288 which can be used as unique global reference for TgToxic in MISP communities and other software using the MISP galaxy

External references

• https://www.trendmicro.com/en_us/research/23/b/tgtoxic-malware-targets-southeast-asia-android-users.html - webarchive

Associated metadata

Metadata key	Value

WasabiSeed

According to Proofpoint, WasabiSeed is a simple VBS downloader which repeatedly uses Windows Installer to connect to the C2 server looking for MSI packages to download and run. Proofpoint showed that it downloads and executes first a second MSI file containing Screenshotter.

Internal MISP references

UUID f3b7e302-152b-4c4e-85c2-82733b78d13f which can be used as unique global reference for WasabiSeed in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Screenshotter

According to Proofpoint, this is a utility with a single function of taking a JPG screenshot of the user's desktop and submitting it to a remote C2 via a POST to a hardcoded IP address. This is helpful to the threat actor during the reconnaissance and victim profiling stage.

Internal MISP references

UUID 49ca568f-b6e4-49ff-963e-796f8207d185 which can be used as unique global reference for Screenshotter in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me - webarchive

Associated metadata

Metadata key	Value

SunSeed

According to Proofpoint, this is a Lua-based malware likely used by a nation-state sponsored attacker used to target European government personnel involved in managing the logistics of refugees fleeing Ukraine.

Internal MISP references

UUID 54c03b3c-6f97-46ea-a93f-f07bfd5cdd36 which can be used as unique global reference for SunSeed in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/blog/threat-insight/asylum-ambuscade-state-actor-uses-compromised-private-ukrainian-military-emails - webarchive
• https://blogs.blackberry.com/en/2022/03/threat-thursday-sunseed-malware - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

AHK Bot

According to Proofpoint, the A(uto)H(ot)K(key) Bot is a collection of separate AutoHotKey scripts. The bot's main component is an infinite loop that polls and downloads additional AHK scripts. The bot can load a stealer like Rhadamanthys and can check if the machine is part of an Active Directory domain.

Internal MISP references

UUID 5c7fa5e1-352a-41c3-8e55-744e5fa88793 which can be used as unique global reference for AHK Bot in MISP communities and other software using the MISP galaxy

External references

• https://www.proofpoint.com/us/blog/threat-insight/screentime-sometimes-it-feels-like-somebodys-watching-me - webarchive
• https://research.checkpoint.com/2019/finteam-trojanized-teamviewer-against-government-targets/ - webarchive
• https://www.trendmicro.com/en_us/research/19/d/potential-targeted-attack-uses-autohotkey-and-malicious-script-embedded-in-excel-file-to-avoid-detection.html - webarchive
• https://www.trendmicro.com/en_us/research/20/l/stealth-credential-stealer-targets-us-canadian-bank-customers.html - webarchive

Associated metadata

Metadata key	Value

SNOWYAMBER

A tool first used in October 2022, abusing the Notion service to communicate and download further malicious files. Two versions of this tool have been observed.

SNOWYAMBER is a dropper that was used in an espionage campaign significantly overlapping with publicly described activity linked to the APT29 and NOBELIUM activity sets. SNOWYAMBER abuses the NOTION collaboration service as a communication channel. It does not contain any other capabilities aside from downloading and executing 2nd stage. To bypass security products, SNOWYAMBER uses several antidetection and obfuscation techniques, including string encryption, dynamic API resolving, EDR/AV unhooking, and direct syscalls.

Internal MISP references

UUID 0125ef58-2675-426f-90eb-0b189961199a which can be used as unique global reference for SNOWYAMBER in MISP communities and other software using the MISP galaxy

External references

• https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services - webarchive
• https://www.gov.pl/attachment/6e085a2c-ac05-4b62-9423-5d6e9ef730bf - webarchive
• https://www.gov.pl/attachment/ee91f24d-3e67-436d-aa50-7fa56acf789d - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

HALFRIG

Used for the first time in February 2023. This tool is distinguished from the others by the embedded code that runs the COBALT STRIKE tool.

HALFRIG is a stager for CobaltStrike Beacon that was used in an espionage campaign significantly overlapping with publicly described activity linked to the APT29 and NOBELIUM activity sets. HALFRIG has significant code overlap with the QUARTERRIG and it is highly probable that it was developed by the same team.

Internal MISP references

UUID f169f0b3-fe4d-40e5-a443-2561c98eb67e which can be used as unique global reference for HALFRIG in MISP communities and other software using the MISP galaxy

External references

• https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services - webarchive
• https://www.gov.pl/attachment/64193e8d-05e2-4cbf-bb4c-5f58da21fefb - webarchive
• https://www.gov.pl/attachment/6e085a2c-ac05-4b62-9423-5d6e9ef730bf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

QUARTERRIG

A tool first used in March 2023, sharing part of the code with HALFRIG. Two versions of this tool were observed.

QUARTERRIG is a dropper that was used in an espionage campaign significantly overlapping with publicly described activity linked to the APT29 and NOBELIUM activity sets. QUARTERRIG does not contain any other capabilities aside from downloading and executing 2nd stage. To bypass security products, QUARTERRIG heavily relies on obfuscation based on opaque predicates and multi-stage execution, interweaving shellcode and PE files. HALFRIG and QUARTERRIG share some of the codebase, suggesting that QUARTERRIG authors have access to both HALFRIG source code and the same obfuscation libraries.

Internal MISP references

UUID 2d5072db-64e2-4d81-9b3a-3aa76cfa978b which can be used as unique global reference for QUARTERRIG in MISP communities and other software using the MISP galaxy

External references

• https://www.gov.pl/web/baza-wiedzy/espionage-campaign-linked-to-russian-intelligence-services - webarchive
• https://www.gov.pl/attachment/6f51bb1a-3ad2-461c-a16d-408915a56f77 - webarchive
• https://www.gov.pl/attachment/6e085a2c-ac05-4b62-9423-5d6e9ef730bf - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

ICONICSTEALER

ICONICSTEALER is a C/C++ data miner that collects application configuration data as well as browser history.

Internal MISP references

UUID 1dca0cec-920e-47d4-a848-ed417f4012e8 which can be used as unique global reference for ICONICSTEALER in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive

Associated metadata

Metadata key	Value

DAVESHELL

DAVESHELL is shellcode that functions as an in-memory dropper. Its embedded payload is mapped into memory and executed.

Internal MISP references

UUID 0ca56007-de60-41b6-99a6-3b7d9dd737d4 which can be used as unique global reference for DAVESHELL in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive

Associated metadata

Metadata key	Value

SIGFLIP

SigFlip is a tool for patching authenticode signed PE-COFF files to inject arbitrary code without affecting or breaking the file's signature.

Internal MISP references

UUID 832f7b8c-b733-48b5-a186-7482b09fe5be which can be used as unique global reference for SIGFLIP in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive

Associated metadata

Metadata key	Value

COLDCAT

COLDCAT is a complex downloader. COLDCAT generates unique host identifier information, and beacons it to a C2 that is specified in a separate file via POST request with the data in the cookie header. After a brief handshake, the malware expects base64 encoded shellcode to execute in response.

Internal MISP references

UUID 62530fb1-fbce-4b39-91d3-bedc0c37d0fe which can be used as unique global reference for COLDCAT in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive

Associated metadata

Metadata key	Value

TAXHAUL

TAXHAUL is a DLL that, when executed, decrypts a shellcode payload expected at C:\Windows\System32\config\TxR\.TXR.0.regtrans-ms. Mandiant has seen TAXHAUL persist via DLL side loading.

Internal MISP references

UUID 90ced040-3507-4b81-9e6d-131acde085ab which can be used as unique global reference for TAXHAUL in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive

Associated metadata

Metadata key	Value

SUDDENICON

downloader (?)

Internal MISP references

UUID 1e7167b1-b7cc-4808-9817-69d7cbcc82a2 which can be used as unique global reference for SUDDENICON in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise - webarchive

Associated metadata

Metadata key	Value

AMADEY

AMADEY is a downloader written in C that retrieves payloads via HTTP. Downloaded payloads are written to disk and executed. Availability: Public

Internal MISP references

UUID 996c0284-cd30-4ecc-9bde-29bbc4018118 which can be used as unique global reference for AMADEY in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BENCHMARK

BENCHMARK is a dropper written in C/C++ that reads a filename and extracts a Base64 encoded payload from a hard-coded path, decodes the payload and drops it to disk. Availability: Non-public

Internal MISP references

UUID b9c0633d-27a8-49ac-a2c0-376e266e1123 which can be used as unique global reference for BENCHMARK in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BITTERSWEET

BITTERSWEET is a C/C++ Windows downloader. It collects basic system information before downloading the next stage to disk and executing. Availability: Non-public

Internal MISP references

UUID 2cda0b1d-ac45-48a2-a582-a24d9d3c185d which can be used as unique global reference for BITTERSWEET in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BRAVEPRINCE

BRAVEPRINCE is a C/C++ downloader. It uses the Daum email service to upload collected system information and download files. Availability: Public

Internal MISP references

UUID d7596e75-34c6-46f0-badc-3cb26b41475d which can be used as unique global reference for BRAVEPRINCE in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

COINTOSS

COINTOSS is a C/C++ downloader. It uses the Windows Management Instrumentation command-line (WMIC) utility to download the payload over FTP. COINTOSS then creates and runs a batch script to uninstall itself. Availability: Non-public

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular COINTOSS.

Known Synonyms
COINTOSS.XLM

Internal MISP references

UUID 3006e4ea-a518-48df-a3f2-4ad9c17773d2 which can be used as unique global reference for COINTOSS in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DINOLAB

DINOLAB is a C/C++ builder. It is used to encrypt and decrypt files, obfuscate VBSscripts, and infect files. Availability: Non-public

Internal MISP references

UUID c95933da-0b83-4324-bd2d-b2cf891ea1b4 which can be used as unique global reference for DINOLAB in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DRIVEDOWN

DRIVEDOWN is a C/C++ Windows downloader capable of executing embedded scripts and downloading stages from OneDrive. Availability: Non-public

Internal MISP references

UUID 89ff8321-110f-44bb-b4d9-532b234bd06d which can be used as unique global reference for DRIVEDOWN in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GOLDDRAGON

GOLDDRAGON is a downloader written in C that retrieves a payload from a remote server via HTTP. The downloaded payload is written to disk and executed. GOLDDRAGON also extracts a payload from a Hangul Word Processor document and writes it to a startup directory. As a result, the new file is executed when the current user logs in. Availability: Non-public

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GOLDDRAGON.

Known Synonyms
GOLDDRAGON.POWERSHELL

Internal MISP references

UUID 170c57a6-326b-4d6a-9f3f-158a0e29abf2 which can be used as unique global reference for GOLDDRAGON in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

EGGHATCH

EGGHATCH is a C/C++ Windows downloader. It uses mshta.exe to download and execute a script. Availability: Non-public

Internal MISP references

UUID 97b32dd9-c39f-4043-ae6b-edde96584e20 which can be used as unique global reference for EGGHATCH in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GOLDDROP

GOLDDROP is a C/C++ Windows dropper. It decrypts a resource file, saves it to the file system, and injects it into another process. Availability: Non-public

Internal MISP references

UUID e8428747-7bb6-4f71-bfb1-2e90139ca5db which can be used as unique global reference for GOLDDROP in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GOLDSMELT

GOLDSMELT is a C/C++ utility used to close the rundll32.exe process and delete a file likely used for logs. Availability: Non-public

Internal MISP references

UUID 396525b4-3d78-4557-87dd-b86e7df0bdf9 which can be used as unique global reference for GOLDSMELT in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Invoke-Mimikatz

Invoke-Mimikatz is PowerShell script that reflectively loads a Mimikatz credential-stealing DLL into memory. Availability: Public

Internal MISP references

UUID 0562d52e-a971-4601-bee6-477707df4218 which can be used as unique global reference for Invoke-Mimikatz in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

JURASSICSHELL

JURASSICSHELL is a PHP file management web shell that allows the actor to download and upload files. Availability: Non-public

Internal MISP references

UUID 5142fb67-0f1f-4d56-9e18-c4525ee37916 which can be used as unique global reference for JURASSICSHELL in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

LANDMARK

LANDMARK is a C/C++ Windows launcher that loads and executes a file on disk stored as desktop.r5u. Availability: Non-public

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LANDMARK.

Known Synonyms
LANDMARK.NET

Internal MISP references

UUID 3ae8fbe4-6bcb-4a49-9931-c62532bf0499 which can be used as unique global reference for LANDMARK in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

LATEOP

LATEOP is a datamine VisualBasic script that can enumerate a variety of characteristics of a target system as well as execute additional arbitrary VisualBasic content. Some deployments of LATEOP have led to the download and execution of the PASSMARK credential theft payload. In contrast, somedeployments of LATEOP.v2 have originated from BENCHMARK sourced infections. Availability: Non-public

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular LATEOP.

Known Synonyms
LATEOP.V2

Internal MISP references

UUID f8ce3bfe-529b-4fcf-b854-16be80021024 which can be used as unique global reference for LATEOP in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

LONEJOGGER

LONEJOGGER is a downloader/dropper which has been observed targeting cryptocurrency services (including exchanges and investment companies), and uses a .lnk shortcut to download guardrailed HTML Application payloads. Availability: Non-public

Internal MISP references

UUID 5bdf163b-0a6e-40b1-a69c-1e306de93db6 which can be used as unique global reference for LONEJOGGER in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PASSMARK

PASSMARK is a credential harvester that steals usernames and passwords from web browsers and email applications. PASSMARK is likely derived from the tool PassView. Availability: Public

Internal MISP references

UUID e1b2425b-f80b-46e8-a788-db62ce592b6b which can be used as unique global reference for PASSMARK in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PENCILDOWN

PENCILDOWN is a C/C++ Windows based downloader. PENCILDOWN collects basic system information and sends it to the C2 server before receiving the next stage. The next stage is then loaded in memory or executed directly based off a flag in the response. Availability: Non-public

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular PENCILDOWN.

Known Synonyms
PENCILDOWN.ANDROID

Internal MISP references

UUID aa4ba5b8-1dbc-47ac-9645-653f6e421721 which can be used as unique global reference for PENCILDOWN in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PENDOWN

PENDOWN is a downloader written in C++ that retrieves a payload via HTTP. The downloaded file is saved to disk and executed. Availability: Non-public

Internal MISP references

UUID d8799cef-775c-4625-871d-8fb17dde8b62 which can be used as unique global reference for PENDOWN in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

PUMPKINBAR

PUMPKINBAR is a C/C++ dropper. PUMPKINBAR can contain multiple payloads encoded and embedded within itself. The key to decode each payload is appended at the end of the PUMPKINBAR executable. The payloads are dropped to disk and executed. Availability: Non-public

Internal MISP references

UUID 9df0243f-61f5-45da-b8d8-9f61e78242ec which can be used as unique global reference for PUMPKINBAR in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SLIMCURL

SLIMCURL is a C/C++ downloader. It contains the next stage as a Base64 encoded Google Drive link. The next stage is downloaded using cURL. Availability: Non-public

Internal MISP references

UUID b12eb4e9-1c73-4394-91cd-1b2ee59ca8f5 which can be used as unique global reference for SLIMCURL in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SPICYTUNA

SPICYTUNA is a VBA downloader. It collects basic system information and is capable of downloading and executing additional stages. Availability: Non-public

Internal MISP references

UUID d6a07a16-d986-4e26-9338-d6ce24732e07 which can be used as unique global reference for SPICYTUNA in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SWEETDROP

SWEETDROP is a C/C++ Windows dropper. It drops an embedded binary resource to the file system and executes it. Availability: Non-public

Internal MISP references

UUID 6fb05366-be31-4b43-a501-3cc5f7ffd234 which can be used as unique global reference for SWEETDROP in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

VENOMBITE

VENOMBITE is a C/C++ Windows downloader that has evolved from PENDOWN. It uses the same custom encoding routine, but the network functionality has been moved to an embedded executable. The downloaded file is loaded and executed in memory. Availability: Non-public

Internal MISP references

UUID 7b002b6e-442c-4c0a-b173-873820c7c731 which can be used as unique global reference for VENOMBITE in MISP communities and other software using the MISP galaxy

External references

• https://mandiant.widen.net/s/zvmfw5fnjs/apt43-report - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

DarkGate

First documented in 2018, DarkGate is a commodity loader with features that include the ability to download and execute files to memory, a Hidden Virtual Network Computing (HVNC) module, keylogging, information-stealing capabilities, and privilege escalation. DarkGate makes use of legitimate AutoIt files and typically runs multiple AutoIt scripts. New versions of DarkGate have been advertised on a Russian language eCrime forum since May 2023.

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular DarkGate.

Known Synonyms
Meh

Internal MISP references

UUID 978e5adc-e6e4-49a9-822f-0c130ac983a3 which can be used as unique global reference for DarkGate in MISP communities and other software using the MISP galaxy

External references

• https://0xtoxin.github.io/threat%20breakdown/DarkGate-Camapign-Analysis/ - webarchive
• https://www.aon.com/cyber-solutions/aon_cyber_labs/darkgate-keylogger-analysis-masterofnone/ - webarchive
• https://securelist.com/emotet-darkgate-lokibot-crimeware-report/110286/ - webarchive
• https://www.zerofox.com/blog/the-underground-economist-volume-3-issue-12/ - webarchive
• https://decoded.avast.io/janrubin/meh-2-2/ - webarchive
• https://decoded.avast.io/janrubin/complex-obfuscation-meh/ - webarchive
• https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign - webarchive

Associated metadata

Metadata key	Value
type	['Loader']

DangerAds

This is a loader Trojan used by AtlasCross in this activity. Its main function is to detect the host environment and execute a built-in shellcode in its own process, and then the shellcode loads and runs subsequent Trojan programs. DangerAds writes major malicious code to the .NET dll program’s HelpText method, so it starts when an external program invokes Help from that dll program. It should be noted that the user name and local domain name of the host will be collected before the main malicious functions of DangerAds are executed, and subsequent codes will be executed only when one of these two names contains the keyword “danger” or “ads-wcf”. Therefore, it can be judged that this attack is a targeted attack against the domain or user name containing “ads-wcf”. The main body of DangerAds malicious code will determine the number of program version bits and selectively decrypt and execute an x86 or x64 shellcode. DangerAds uses multi-byte XOR for decryption, while shellcode is loaded directly in the process. In the shellcode stage, DangerAds uses a set of open-source scheme sRDI (https://github.com/monoxgas/sRDI/blob/master/shellcodeRDI/shellcodeRDI.c)) to load and execute DLL programs. The shellcode finally loads the attached DLL program at its tail and calls the export function EnumWinEvent. The DLL program loaded by this shellcode is the AtlasAgent Trojan developed by AtlasCross.

Internal MISP references

UUID e7628f0e-e4ae-4dde-988b-07e93a4c20e3 which can be used as unique global reference for DangerAds in MISP communities and other software using the MISP galaxy

External references

• https://nsfocusglobal.com/warning-newly-discovered-apt-attacker-atlascross-exploits-red-cross-blood-drive-phishing-for-cyberattack/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

AtlasAgent

AtlasAgent used in this attack activity is Trojan horse program developed by AtlasCross. The main functions of the Trojan are to obtain host information, process information, prevent opening of multi-programs, inject specified shellcode and download files from CnC servers. The Trojan communicates with the CnC through HTTP protocol, encrypts communication data using Base64 encoding after RC4 encryption, and encrypts key APIs using two encryption methods at the same time.

Internal MISP references

UUID f162df7a-725b-40ef-add2-43ce74eb50a4 which can be used as unique global reference for AtlasAgent in MISP communities and other software using the MISP galaxy

External references

• https://nsfocusglobal.com/warning-newly-discovered-apt-attacker-atlascross-exploits-red-cross-blood-drive-phishing-for-cyberattack/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

RDP Wrapper

Internal MISP references

UUID bea5f660-a106-4983-a11a-0e0b6ce348d2 which can be used as unique global reference for RDP Wrapper in MISP communities and other software using the MISP galaxy

External references

• https://asec.ahnlab.com/en/57873/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TightVNC

open-source VNC tool

Internal MISP references

UUID e596e014-c0b7-491a-afee-3588fbfc61c1 which can be used as unique global reference for TightVNC in MISP communities and other software using the MISP galaxy

External references

• https://asec.ahnlab.com/en/57873/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

RevClient

Malware

Internal MISP references

UUID cdd432b0-8899-4e7d-ad4a-b18741ade11d which can be used as unique global reference for RevClient in MISP communities and other software using the MISP galaxy

External references

• https://asec.ahnlab.com/en/57873/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

Colibri Loader

Colibri Loader is a piece of malware that first appeared on underground forums in August 2021 and was advertised to “people who have large volumes of traffic and lack of time to work out the material“. As it names suggests, it is meant to deliver and manage payloads onto infected computers.

Internal MISP references

UUID 63615901-dd49-4541-801f-327a6963c88b which can be used as unique global reference for Colibri Loader in MISP communities and other software using the MISP galaxy

External references

• https://www.malwarebytes.com/blog/threat-intelligence/2022/04/colibri-loader-combines-task-scheduler-and-powershell-in-clever-persistence-technique - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

BUSHWALK

A mitigation bypass technique was recently identified that led to the deployment of a custom webshell tracked as BUSHWALK. Successful exploitation would bypass the initial mitigation provided by Ivanti on Jan. 10, 2024. At this time, Mandiant assesses the mitigation bypass activity is highly targeted, limited, and is distinct from the post-advisory mass exploitation activity. BUSHWALK is written in Perl and is embedded into a legitimate CS file, querymanifest.cgi. BUSHWALK provides a threat actor the ability to execute arbitrary commands or write files to a server. BUSHWALK executes its malicious Perl function, validateVersion, if the web request platform parameter is SafariiOS. It uses Base64 and RC4 to decode and decrypt the threat actor’s payload in the web request’s command parameter.

Internal MISP references

UUID 0752d766-2c2a-43ce-aebd-6a4e214cd43c which can be used as unique global reference for BUSHWALK in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value

LIGHTWIRE

The original LIGHTWIRE webshell sample contains a simpler obfuscation routine. It will initialize an RC4 object and then immediately use the RC4 object to decrypt the issued command./nMandiant has identified an additional variant of the LIGHTWIRE web shell that inserts itself into a legitimate component of the VPN gateway, compcheckresult.cgi./nThe new sample utilizes the same GET parameters as the original LIGHTWIRE sample./nThe new variant of LIGHTWIRE features a different obfuscation routine. It first assigns a string scalar variable to $useCompOnly. Next, it will use the Perl tr operator to transform the string using a character-by-character translation. The key is then Base64-decoded and used to RC4 decrypt the incoming request. Finally, the issued command is executed by calling eval.

Internal MISP references

UUID 5b9d5714-9eb9-4e3b-b437-26a9b50a633e which can be used as unique global reference for LIGHTWIRE in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value

CHAINLINE

CHAINLINE is a Python webshell backdoor that is embedded in a Ivanti Connect Secure Python package that enables arbitrary command execution./nCHAINLINE was identified in the CAV Python package in the following path: /home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/health.py. This is the same Python package modified to support the WIREFIRE web shell./nUnlike WIREFIRE, which modifies an existing file, CHAINLINE creates a new file called health.py, which is not a legitimate filename in the CAV Python package. The existence of this filename or an associated compiled Python cache file may indicate the presence of CHAINLINE./nUNC5221 registered a new API resource path to support the access of CHAINLINE at the REST endpoint /api/v1/cav/client/health. This was accomplished by importing the maliciously created Health API resource and then calling the add_resource() class method on the FLASK-RESTful Api object within /home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/init.py.

Internal MISP references

UUID 87e353c6-e0e8-427a-b55f-61cbd2853c57 which can be used as unique global reference for CHAINLINE in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value

FRAMESTING

FRAMESTING is a Python webshell embedded in a Ivanti Connect Secure Python package that enables arbitrary command execution./nFRAMESTING was identified in the CAV Python package in the following path: /home/venv3/lib/python3.6/site-packages/cav-0.1-py3.6.egg/cav/api/resources/category.py. Note that this is the same Python package modified to support the WIREFIRE and CHAINLINE web shells./nWhen installed, the threat actor can access FRAMESTING web shell at the REST endpoint /api/v1/cav/client/categories with a POST request. Note that the legitimate categories endpoint only accepts GET requests./nThe web shell employs two methods of accepting commands from an attacker. It first attempts to retrieve the command stored in the value of a cookie named DSID from the current HTTP request. If the cookie is not present or is not of the expected length, it will attempt to decompress zlib data within the request's POST data. Lastly, FRAMESTING will then pass the decrypted POST data into a Python exec() statement to dynamically execute additional Python code./nNote that DSID is also the name of a cookie used by Ivanti Connect Secure appliances for maintaining user VPN sessions. FRAMESTING likely uses the same cookie name to blend in with network traffic.

Internal MISP references

UUID a9470d3d-ecfd-408b-ba1e-f3ca65791e0d which can be used as unique global reference for FRAMESTING in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value

IMPACKET

IMPACKET is a Python library that allows for interaction with various network protocols. It is particularly effective in environments that rely on Active Directory and related Microsoft Windows network services.

Internal MISP references

UUID 7b02521e-422e-49a2-96fc-ad6c13057a6c which can be used as unique global reference for IMPACKET in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value

IODINE

IODINE is a network traffic tunneler that allows for tunneling of IPv4 traffic over DNS.

Internal MISP references

UUID 94ae63e7-7f92-4657-812c-2f27bf50ca21 which can be used as unique global reference for IODINE in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value

ENUM4LINUX

ENUM4LINUX is a Linux Perl script for enumerating data from Windows and Samba hosts.

Internal MISP references

UUID c44c5c54-435a-453a-a128-43ca18b82c37 which can be used as unique global reference for ENUM4LINUX in MISP communities and other software using the MISP galaxy

External references

• https://www.mandiant.com/resources/blog/investigating-ivanti-zero-day-exploitation - webarchive

Associated metadata

Metadata key	Value

SPAWNANT

SPAWNANT is an installer that leverages a coreboot installer function to establish persistence for the SPAWNMOLE tunneler and SPAWNSNAIL backdoor. It hijacks a legitimate dspkginstall installer process and exports an sprintf function adding a malicious code to it before redirecting a flow back to vsnprintf.

Internal MISP references

UUID e6cf28a6-94a9-4aab-b919-ad2f6a7e3b87 which can be used as unique global reference for SPAWNANT in MISP communities and other software using the MISP galaxy

External references

• https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SPAWNMOLE

SPAWNMOLE is a tunneler that injects into the web process. It hijacks the accept function in the web process to monitor traffic and filter out malicious traffic originating from the attacker. The remainder of the benign traffic is passed unmodified to the legitimate web server functions. The malicious traffic is tunneled to a host provided by an attacker in the buffer. Mandiant assesses the attacker would most likely pass a local port where SPAWNSNAIL is operating to access the backdoor.

Internal MISP references

UUID 6c89c51f-1b97-4966-abc1-9cf526bb2892 which can be used as unique global reference for SPAWNMOLE in MISP communities and other software using the MISP galaxy

External references

• https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SPAWNSLOTH

SPAWNSLOTH is a log tampering utility injected into the dslogserver process. It can disable logging and disable log forwarding to an external syslog server when the SPAWNSNAIL backdoor is operating.

Internal MISP references

UUID 2c237974-edc2-460a-90b5-20f699560da3 which can be used as unique global reference for SPAWNSLOTH in MISP communities and other software using the MISP galaxy

External references

• https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

ROOTROT

ROOTROT is a web shell written in Perl embedded into a legitimate Connect Secure .ttc file located at /data/runtime/tmp/tt/setcookie.thtml.ttc by exploiting CVE-2023-46805 and CVE-2024-21887.

Internal MISP references

UUID 69d0512d-c12a-4e17-a335-deba012a8499 which can be used as unique global reference for ROOTROT in MISP communities and other software using the MISP galaxy

External references

• https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

TONERJAM

TONERJAM is a launcher that decrypts and executes a shellcode payload, in this case PHANTOMNET, stored as an encrypted local file and decrypts it using an AES key derived from a SHA hash of the final 16 bytes of the encrypted payload. TONERJAM maintains persistence via the Run registry key or by hijacking COM objects depending on the permissions granted to it upon execution.

Internal MISP references

UUID 540b3e66-edbf-40ee-ae05-474b27c1ff40 which can be used as unique global reference for TONERJAM in MISP communities and other software using the MISP galaxy

External references

• https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

GOST

A simple security tunnel written in Golang. Features: Listening on multiple ports, Multi-level forward proxy - proxy chain, Standard HTTP/HTTPS/HTTP2/SOCKS4(A)/SOCKS5 proxy protocols support, Probing resistance support for web proxy, Support multiple tunnel types, TLS encryption via negotiation support for SOCKS5 proxy, Tunnel UDP over TCP, TCP/UDP Transparent proxy, Local/remote TCP/UDP port forwarding, Shadowsocks protocol, SNI proxy, Permission control, Load balancing, Routing control, DNS resolver and proxy, TUN/TAP device

Synonyms

"synonyms" in the meta part typically refer to alternate names or labels that are associated with a particular GOST.

Known Synonyms
GO Simple Tunnel

Internal MISP references

UUID c9f26173-ba82-4ed2-adbd-e2e07f582f31 which can be used as unique global reference for GOST in MISP communities and other software using the MISP galaxy

External references

• https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement - webarchive
• https://github.com/ginuerzh/gost/blob/master/README_en.md - webarchive
• https://v2.gost.run/en/ - webarchive
• https://gost.run/en/ - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.

SLIVER

Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. Sliver's implants support C2 over Mutual TLS (mTLS), WireGuard, HTTP(S), and DNS and are dynamically compiled with per-binary asymmetric encryption keys.

Internal MISP references

UUID 84c2d789-64be-429b-aeee-253a4e0e2aff which can be used as unique global reference for SLIVER in MISP communities and other software using the MISP galaxy

External references

• https://github.com/BishopFox/sliver - webarchive
• https://bishopfox.com/tools/sliver - webarchive

Associated metadata

Metadata key	Value

Related clusters

To see the related clusters, click here.