4-October-2022
Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.
Current Stamus Threat Intelligence (STI) release version: 562
This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):
Note: a "method" as referenced below, is a discrete detection vector for a given threat.
The following detections were added to your Stamus NDR this past week:
OriginLogger is a variant of Agent Tesla. As such, the majority of tools and detections for Agent Tesla will still trigger on OriginLogger samples. Palo Alto
OriginLogger - malpedia |
This threat can steal your personal information, such as your user names and passwords. It sends the stolen information to a malicious hacker. Microsoft
XCSSET is a macOS modular backdoor that targets Xcode application developers. XCSSET was first observed in August 2020 and has been used to install a backdoor component, modify browser applications, conduct collection, and provide ransomware-like encryption capabilities. MIRE
XCSSET - sentinelone | XCSSET - malpedia | XCSSET - microsoft |
Brute Ratel C4 (BRc4), the newest red-teaming and adversarial attack simulation tool to hit the market. While this capability has managed to stay out of the spotlight and remains less commonly known than its Cobalt Strike brethren, it is no less sophisticated. Instead, this tool is uniquely dangerous in that it was specifically designed to avoid detection by endpoint detection and response (EDR) and antivirus (AV) capabilities. Palo Alto
Astaroth is a Trojan and information stealer known to affect companies in Europe, Brazil, and throughout Latin America. It has been known publicly since at least late 2017. MITRE
Astaroth - malpedia |
A typical infostealer, capable of obtaining credentials for browsers, crypto currency wallets, browser cookies, credit cards, and creates screenshots of the infected system. All stolen data is bundled into a zip-file that is uploaded to the c2. Malpedia
CryptBot - microsoft |
The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):
APT38 is a financially-motivated threat group that is backed by the North Korean regime. The group mainly targets banks and financial institutions and has targeted more than 16 organizations in at least 13 countries since at least 2014.
North Korean group definitions are known to have significant overlap, and the name Lazarus Group is known to encompass a broad range of activity. Some organizations use the name Lazarus Group to refer to any activity attributed to North Korea. Some organizations track North Korean clusters or groups such as Bluenoroff, APT37, and APT38 separately, while other organizations may track some activity associated with those group names by the name Lazarus Group. MITRE
Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers.
These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc.
The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes.
There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them. Kaspersky
Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East. MITRE
The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.
Info stealers may use many methods of data acquisition. The most common are:
hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes
Delf is a large family of malicious programs, many of which are associated with data theft. F-secure
Erbium is a piece of malicious software classified as a stealer. Malware within this category is designed to extract vulnerable data from infected devices. Our researchers discovered Erbium while inspecting malware-selling hotspots. Pcrisk
Gamaredon Group is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns. MITRE
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
Adversaries may employ various forms of Masquerading on the file to increase the likelihood that a user will open it.
While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it. This activity may also be seen shortly after Internal Spearphishing. MITRE
Molerats is a politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States. MITRE
Malware framework that we named NetDooka after the names of some of its components. The framework is distributed via a pay-per-install (PPI) service and contains multiple parts, including a loader, a dropper, a protection driver, and a full-featured remote access trojan (RAT) that implements its own network communication protocol. During our analysis, we discovered that NetDooka was being spread via the PrivateLoader malware which, once installed, starts the whole infection chain. Trendmicro
A Trojan horse or Trojan is a type of malware that is often disguised as legitimate software. Trojans can be employed by cyber-thieves and hackers trying to gain access to users' systems. Users are typically tricked by some form of social engineering into loading and executing Trojans on their systems. Once activated, Trojans can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. Kaspersky
Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security.
Remcos has been observed being used in malware campaigns.
OSX/Shlayer is a Trojan designed to install adware on macOS. It was first discovered in 2018. MITRE
Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects. This can be accomplished by requesting the RECEIVE_SMS or SEND_SMS permissions depending on what the malware is attempting to do. If the app is set as the default SMS handler on the device, the SMS_DELIVER broadcast intent can be registered, which allows the app to write to the SMS content provider. The content provider directly modifies the messaging database on the device, which could allow malicious applications with this ability to insert, modify, or delete arbitrary messages on the device. MITRE
It leverages compromised websites and performs some of the most creative fingerprinting checks we’ve seen, before delivering its payload (NetSupport RAT). Malwarebytes
The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.
Info stealers may use many methods of data acquisition. The most common are:
hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes
DPRK APT actor tracked by Proofpoint as TA444 Malpedia
A Trojan downloader is a type of Trojan horse that downloads and installs files, often malicious programs. A Trojan horse is a type of software that looks legitimate but can be malicious in nature. Sometimes these programs can be downloaded onto a device without the user’s knowledge or consent. A Trojan’s purpose is to damage, disrupt, steal, or generally inflict some other harm on your computer and devices. Norton
A dropper is a kind of Trojan that has been designed to "install" some sort of malware (virus, backdoor, etc.) to a target system. The malware code can be contained within the dropper (single-stage) in such a way as to avoid detection by virus scanners or the dropper may download the malware to the target machine once activated (two stage). Wikipedia
This type of Trojan modifies data on the victim computer so that the victim can no longer use the data, or it prevents the computer from running correctly. Once the data has been “taken hostage” (blocked or encrypted), the user will receive a ransom demand.
The ransom demand tells the victim to send the malicious user money; on receipt of this, the cyber criminal will send a program to the victim to restore the data or restore the computer’s performance. Kaspersky
Malicious programs of this family secretly send information to the criminal from the user’s infected Android mobile device. Kaspersky
A Trojan horse or Trojan is a type of malware that is often disguised as legitimate software. Trojans can be employed by cyber-thieves and hackers trying to gain access to users' systems. Users are typically tricked by some form of social engineering into loading and executing Trojans on their systems. Once activated, Trojans can enable cyber-criminals to spy on you, steal your sensitive data, and gain backdoor access to your system. Kaspersky
The following threat detection(s) were improved this past week with new or updated threat methods.
| Name of threat | New coverage | Total coverage | Last updated | ||||
|---|---|---|---|---|---|---|---|
| New Detection methods | Kill chain phases | Protocols involved | Detection methods | Kill chain phases | Protocols involved | ||
| APT38 | 3 | command and control | dns, tls | 106 | command and control, delivery | dns, http, tcp, tls | 2022-10-01 |
| Astaroth | 4 | command and control, delivery | http | 4 | command and control, delivery | http | 2022-09-27 |
| Backdoor | 3 | command and control | dns | 369 | actions on objectives, command and control, delivery, installation | dns, ftp, http, icmp, smtp, tcp, tls, udp | 2022-10-01 |
| Bahamut | 1 | command and control | dns | 25 | command and control | dns, http, tls | 2022-10-01 |
| Banker Stealer | 2 | command and control | dns | 199 | actions on objectives, command and control, delivery | dns, http, smtp, tcp, tls | 2022-09-30 |
| Brute Ratel | 6 | command and control | dns, http | 6 | command and control | dns, http | 2022-09-27 |
| CryptBot | 4 | command and control, actions on objectives, delivery | http | 4 | command and control, actions on objectives, delivery | http | 2022-09-27 |
| Delf | 2 | actions on objectives, command and control | http | 107 | actions on objectives, command and control, delivery, installation | dns, http, smtp, tcp, tcp-pkt, tls | 2022-09-27 |
| Erbium | 2 | command and control | dns | 11 | command and control | dns, http, tls | 2022-09-28 |
| Gamaredon | 2 | command and control | http | 121 | actions on objectives, command and control, delivery | dns, http | 2022-09-30 |
| MalDoc | 2 | command and control, delivery | http, dns | 475 | actions on objectives, command and control, delivery | dns, http, tcp, tls | 2022-09-29 |
| Molerats | 1 | command and control | dns | 53 | command and control, delivery | dns, http, tls | 2022-09-28 |
| NetDooka | 2 | command and control | tcp, http | 4 | command and control | http, tcp | 2022-09-30 |
| OriginLogger | 4 | command and control | dns | 6 | command and control | dns | 2022-09-27 |
| Piom | 2 | command and control | dns | 20 | command and control | dns, http | 2022-10-01 |
| QQpass | 6 | command and control | http | 8 | command and control | http | 2022-09-27 |
| Remcos | 1 | command and control | tcp | 858 | command and control, delivery | dns, http, tcp, tcp-pkt | 2022-10-01 |
| Shlayer | 10 | command and control | dns | 17 | command and control, delivery | dns, http | 2022-09-27 |
| SmsThief | 1 | command and control | dns | 135 | actions on objectives, command and control, delivery | dns, http, tcp, tls, udp | 2022-10-01 |
| SocGholish | 15 | command and control, delivery | dns, http | 149 | actions on objectives, command and control, delivery, reconnaissance | dns, http, tcp, tls | 2022-10-01 |
| Stealer and Exfiltration | 4 | actions on objectives, command and control | http | 226 | actions on objectives, command and control, exploitation, installation | dns, ftp, http, smtp, tcp, tcp-pkt, tls | 2022-09-30 |
| TA444 | 5 | command and control | dns, tls | 98 | command and control | dns, http, tls | 2022-09-30 |
| Trojan Downloader | 1 | delivery | http | 203 | actions on objectives, command and control, delivery, installation | dns, http, tcp, tls, udp | 2022-09-28 |
| Trojan Dropper | 2 | command and control, delivery | http, dns | 274 | actions on objectives, command and control, delivery, installation | dns, http, tcp, tls, udp | 2022-10-01 |
| Trojan-Ransom-Android | 1 | command and control | dns | 16 | actions on objectives, command and control | dns, http, tcp, tls | 2022-09-30 |
| TrojanSpy-Android | 6 | command and control | dns | 391 | actions on objectives, command and control, delivery | dns, http, tcp, tls | 2022-10-01 |
| Wacapew | 1 | command and control | http | 6 | command and control | http, tls | 2022-09-28 |
| XCSSET | 8 | command and control | dns | 8 | command and control | dns | 2022-09-27 |
Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website
ABOUT STAMUS NETWORKS ™
Stamus Networks believes in a world where defenders are heroes, and a future where those they protect remain safe. As organizations face threats from well-funded adversaries, we relentlessly pursue solutions that make the defender’s job easier and more impactful. The global leader in Suricata-based network security solutions, Stamus Networks helps enterprise security teams know more, respond sooner and mitigate their risk with insights gathered from cloud and on-premise network activity. Our Stamus Security Platform combines the best of intrusion detection (IDS), network security monitoring (NSM), and network detection and response (NDR) systems into a single solution that exposes serious and imminent threats to critical assets and empowers rapid response.
© 2014-2024 Stamus Networks, Inc. All rights Reserved.
