The Week in Review from Stamus Labs

Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.

Current Stamus Threat Intelligence (STI) release version: 439

This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):

New threat detection(s) added [1]: 10 (AHKBOT, Lorenz, TA408, Monero, Nerbian RAT, ServStart, TA564, Earth Berberoka, PoshC2, Helminth)
Major changes to detections(s) [2]: 5
Updated threat detection(s) [3]: 110

Note: a "method" as referenced below, is a discrete detection vector for a given threat.

New Threat(s) Detected

The following detections were added to your Stamus NDR this past week:

AHKBOT (Trojan)

Cybersecurity researchers have uncovered an ongoing malware campaign that heavily relies on AutoHotkey (AHK) scripting language to deliver multiple remote access trojans (RAT) such as Revenge RAT, LimeRAT, AsyncRAT, Houdini, and Vjw0rm on target Windows systems. Thehackernews

Total number of detection methods: 2
Kill chain phase(s): delivery

Lorenz (Ransomware)

Lorenz is a new variant of the Sz40 ransomware. It is designed to encrypt data and demand ransoms for the decryption. In other words, Lorenz renders affected files inaccessible and asks victims to pay - to recover access to their data. Pcrisk

Total number of detection methods: 2
Kill chain phase(s): command and control

TA408 (APT)

TA408 has been observed targeting Proofpoint customers much less often than TA406 and TA427. TA408 uses both credential harvesting and malware campaigns. Based on files uploaded to malicious file repositories, TA408 often targets organizations and individuals in East Asia. In 2020, TA408 targeted at least one pharmaceutical company with a World Health Organization (WHO) COVID-19-themed email. TA408 also conducts financially motivated campaigns, such as a Hyundai Pay-themed Kasse/Hdac wallet campaign observed in 2020. Proofpoint

TA408 - MITRE - Command and Control | TA408 - MITRE - Exfiltration |

Total number of detection methods: 5
Kill chain phase(s): command and control, delivery

Monero (Cryptocurrency)

In 2019, Unit 42 researchers documented cloud-targeted malware used by the Rocke Group to conduct cryptojacking attacks to mine for Monero. Since then, cybersecurity companies have had the malware on their radar, which hampered Rocke Group’s cryptojacking operation. In response, the threat actors updated the malware. Paloalto

Monero - malpedia | Monero - MITRE - Resource Hijacking |

Total number of detection methods: 2
Kill chain phase(s): installation, delivery

Nerbian RAT (RAT)

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. Remote Access Trojans often mimic similar behaviors of keylogger applications by allowing the automated collection of keystrokes, usernames, passwords, screenshots, browser history, emails, chat lots, etc. Remote Access Trojans differ from keyloggers in that they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer. This backdoor into the victim machine can allow an attacker unfettered access, including the ability to monitor user behavior, change computer settings, browse and copy files, utilize the bandwidth (Internet connection) for possible criminal activity, access connected systems, and more. Malwarebytes

Nerbian RAT - MITRE - Exploitation for Client Execution | Nerbian RAT - MITRE - Abuse Elevation Control Mechanism | Nerbian RAT - MITRE - Multi-Stage Channels | Nerbian RAT - MITRE - Ingress Tool Transfer |

Total number of detection methods: 2
Kill chain phase(s): command and control, actions on objectives

ServStart (Trojan)

ServStart is a trojan that installs a persistent service on the victim’s machine. The service exfiltrates information about the infected computer including machine name, username, keyboard language, and computer performance specifications. The malware server can respond with commands to download and execute files, or execute shell commands. ServStart has been observed using multiple dynamic DNS providers for its command and control infrastructure Talos

ServStart - MITRE - Ingress Tool Transfer | ServStart - MITRE - System Information Discovery | ServStart - MITRE - File and Directory Discovery | ServStart - MITRE - Data from Local System | ServStart - MITRE - Create or Modify System Process |

Total number of detection methods: 12
Kill chain phase(s): command and control, delivery
MITRE ATT&CK: T1041

Helminth (Backdoor)

Helminth is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. MITRE

Helminth - malpedia |

Total number of detection methods: 3
Kill chain phase(s): command and control
MITRE ATT&CK: T1041

TA564 (APT)

...also seen TA564 using coronavirus emails targeting Canadian users by spoofing the Public Health Agency of Canada in an attempt to deliver Ursnif. Ursnif is a common banking Trojan that can steal stored data, including passwords, from banking websites via web injections, proxies, and VNC connections. Proofpoint

TA564 - MITRE - Command and Control | TA564 - MITRE - Phishing |

Total number of detection methods: 10
Kill chain phase(s): command and control

Earth Berberoka (APT)

Recently discovered a new advanced persistent threat (APT) group that we have dubbed Earth Berberoka (aka GamblingPuppet). Based on our analysis, this group targets gambling websites. Our investigation has also uncovered that Earth Berberoka targets the Windows, Linux, and macOS platforms, and uses malware families that have been historically attributed to Chinese-speaking individuals. TrendMicro

Earth Berberoka - malpedia | Earth Berberoka - MITRE - Phishing | Earth Berberoka - MITRE - System Information Discovery | Earth Berberoka - MITRE - Command and Control | Earth Berberoka MITRE - Multi-Stage Channels | Earth Berberoka - MITRE - Abuse Elevation Control Mechanism | Earth Berberoka - MITRE - Service Stop | Earth Berberoka - MITRE - Ingress Tool Transfer |

Total number of detection methods: 22
Kill chain phase(s): command and control

PoshC2 (RAT)

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS. MITRE

PoshC2 - github | PoshC2 - microsoft | PoshC2 - malpedia |

Total number of detection methods: 48
Kill chain phase(s): delivery, command and control, actions on objectives
MITRE ATT&CK: T1071

Major Detection Changes

The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):

Orcus (RAT)

Orcus, previously known as Schnorchel, is a Remote Access Trojan — a malware that enables remote control of infected systems. Although Orcus RAT malware is mostly a typical member of the RAT family, it has some competitive advantages over similar malware and unique features.

In addition, Orcus RAT has a modular structure and it gives users the ability to create custom plugins for the malware. The modularity of this trojan gives it higher than standard scalability and management, allowing to tailor the malware to the needs of various campaigns.

The first time we heard about this malware was from a forum post by one of its authors. The post announced the development of a new RAT that was named Schnorchel at the time. Soon after the announcement, the malware became commercially available under the name “Orcus RAT” and was presented to the public as a legal software for remote administration, similar to Teamviewer. Interestingly, authors claimed that the abbreviation RAT stood for Remote Administration Tool and not Remote Access Trojan. Anyrun

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control
Methods added: 1

Remcos (RAT)

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security.

Remcos has been observed being used in malware campaigns.

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery
Methods added: 1

Trojan Downloader (Downloader)

A Trojan downloader is a type of Trojan horse that downloads and installs files, often malicious programs. A Trojan horse is a type of software that looks legitimate but can be malicious in nature. Sometimes these programs can be downloaded onto a device without the user’s knowledge or consent. A Trojan’s purpose is to damage, disrupt, steal, or generally inflict some other harm on your computer and devices. Norton

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): delivery, command and control, actions on objectives
MITRE ATT&CK added: T1041
Previously existing MITRE ATT&CK: T1587, T1071, T1041
Methods added: 1

Wacatac (Ransomware)

Ransom malware, or ransomware, is a type of malware that prevents users from accessing their system or personal files and demands ransom payment in order to regain access. The earliest variants of ransomware were developed in the late 1980s, and payment was to be sent via snail mail. Today, ransomware authors order that payment be sent via cryptocurrency or credit card. Malwarebytes

Added kill chain phase(s): command and control, delivery
Previously supported kill chain phase(s): command and control, actions on objectives, delivery
Methods added: 2

Other Threat Detection Update(s)

The following threat detection(s) were improved this past week with new or updated threat methods.

Name of threat	New coverage			Total coverage			Last updated
	New Detection methods	Kill chain phases	Protocols involved	Detection methods	Kill chain phases	Protocols involved
AHKBOT	2	delivery	http	2	delivery	http	2022-05-09
Earth Berberoka	21	command and control	dns	22	command and control	dns	2022-05-09
Helminth	1	command and control	dns	3	command and control	dns	2022-05-09
Lorenz	2	command and control	http	2	command and control	http	2022-05-09
Monero	2	installation, delivery	http	2	installation, delivery	http	2022-05-09
Nerbian RAT	2	command and control, actions on objectives	http	2	command and control, actions on objectives	http	2022-05-09
Orcus	1	command and control	dns	17	command and control	dns, http, tcp, tls	2022-05-11
PoshC2	48	delivery, command and control, actions on objectives	http, tls	48	delivery, command and control, actions on objectives	http, tls	2022-05-12
Remcos	1	command and control	tcp	808	command and control, delivery	dns, http, tcp	2022-05-12
ServStart	12	command and control, delivery	http, tcp	12	command and control, delivery	http, tcp	2022-05-09
TA408	5	command and control, delivery	http	5	command and control, delivery	http	2022-05-09
TA564	10	command and control	dns	10	command and control	dns	2022-05-09
Trojan Downloader	1	command and control	http	193	actions on objectives, command and control, delivery	dns, http, tcp, tls, udp	2022-05-13
Wacatac	2	command and control, delivery	tcp	8	actions on objectives, command and control, delivery	http, tcp	2022-05-12

Additional Resources

Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website

Threat Detection Update