The Week in Review from Stamus Labs

Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.

Current Stamus Threat Intelligence (STI) release version: 1156

This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):

New threat detection(s) added [1]: 4 (Angry Stealer, Librarian Ghouls, Malicious DGA Domain, Emmenhtal Loader)
Major changes to detections(s) [2]: 369
Updated threat detection(s) [3]: 492

Note: a "method" as referenced below, is a discrete detection vector for a given threat.

New Threat(s) Detected

The following detections were added to your Stamus Security Platform this past week:

Angry Stealer (Data Theft)

CYFIRMA’s recent discovery of a new dropper binary highlights this trend, revealing a targeted effort to deploy and distribute a powerful information-stealing malware named “Angry Stealer.” This malware has surfaced on various platforms, such as online websites and Telegram, where it is being advertised as a tool for illicit data theft.

The dropper binary analysed by our research team is a 32-bit Windows executable written in .NET. The dropper is designed to create and execute two distinct payloads, “Stepasha.exe” and “MotherRussia.exe,” both of which play critical roles in the malware’s operation. The primary payload, “Stepasha.exe,” functions as the “Angry Stealer,” a comprehensive tool for extracting and exfiltrating a broad spectrum of data from infected systems. This includes browser data (such as passwords, cookies, and autofill information), cryptocurrency wallet details, VPN and application data, system information, and more. The stealer is meticulously designed to bypass security measures, collect high-value data, and transmit it to a predefined Telegram channel, controlled by the attacker. Upon investigation, it was found to be based on Rage Stealer, sharing identical code, behaviour, and functionality. Cyfirma

Total number of detection methods: 1
Kill chain phase(s): actions on objectives

Librarian Ghouls (Data Theft)

In short, Librarian Ghouls send malicious RAR archives with .SCR files, the names of which imitate office documents. If the victim runs the file, the malware downloads additional payload to the computer, collects data of interest to the attackers in archives and sends them to the attackers. Kaspersky

Total number of detection methods: 3
Kill chain phase(s): command and control

Malicious DGA Domain (Generic CnC)

A malicious domain is a website or domain that has been created or used with the intent of spreading malware, stealing sensitive information, facilitating phishing attacks, or other malicious activities. These domains are typically registered by threat actors and embedded into malware.

Threat actors often establish multiple C2 servers to maintain redundancy and evade detection by security solutions. These servers can be located anywhere in the world, making it difficult for cybersecurity professionals to trace and disrupt malicious activities. C2 servers can be hosted on legitimate websites, compromised servers, cloud services, or even on peer-to-peer networks to make detection more challenging. Malicious IP addresses can easily be blocked with firewalls, effectively disabling callbacks. By using domain names instead, a malicious actor can simply point the record to a new IP, effectively ignoring the block.

Domain Generator Algorithm (DGA) is a technique used by threat actors to dynamically generate a large number of domain names for command and control communication with malware-infected devices. This helps attackers evade detection and mitigation efforts by security tools and researchers.

One of the challenges in defending against DGA-based malware is that security professionals must be able to detect and block new, unseen domain names in real-time. This requires advanced threat intelligence capabilities and dynamic analysis of network traffic to identify suspicious patterns that may indicate DGA activity.

Stamus Networks has developed specialized detection methods to identify such domains.

Total number of detection methods: 48
Kill chain phase(s): command and control

Emmenhtal Loader (Loader)

The shortcut file launches an embedded PowerShell script which spawns an execution of the LOLBIN mshta.exe to read an HTA concatenated to a legitimate PE file downloaded from an attacker-controlled C2. The PE file is a legitimate Windows binary except that it is padded with HTA data that embeds a malicious JavaScript code. Once interpreted and executed by mshta.exe, the JavaScript decodes and runs a PowerShell decrypter script. The latter decrypts an obfuscated PowerShell loader which finally downloads and runs either CryptBot or Lumma stealer. Ornagecyberdefense

Emmenhtal Loader - Malpedia |

Total number of detection methods: 71
Kill chain phase(s): command and control, delivery
MITRE ATT&CK: T1071

Major Detection Changes

The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):

Card Skimmer (Data Theft)

Web skimming is a form of internet or carding fraud whereby a payment page on a website is compromised when malware is injected onto the page via compromising a third-party script service in order to steal payment information. Wikipedia

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery, actions on objectives
Methods added: 177

Fake Browser (Trojan)

Attackers are utilizing hacked web sites that promote fake browser updates to infect targets with banking trojans. In some cases, post exploitation toolkits are later executed to encrypt the compromised network with ransomware.

Between May and September 2019, FireEye has conducted multiple incident response cases where enterprise customers were infected with malware through fake browser updates.

Hacked sites would display these "fakeupdates" through JavaScript alerts that state the user is using an old version of a web browser and that they should download an offered "update" to keep the browser running "smoothly and securely".

bleepingcomputer

Added kill chain phase(s): exploitation
Previously supported kill chain phase(s): delivery, exploitation, command and control
MITRE ATT&CK added: T1189
Previously existing MITRE ATT&CK: T1189
Methods added: 21

Keitaro (Phishing)

Cyber criminals violated the law TDS (Traffic Direction System) platform Keitaro and used it to redirect them users in exploit kits RIG and Fallout in order to infect them with malicious software.

TDS platforms are designed for redirection of users in particular sites. Legitimate TDS platforms, such as Keitaro, are mainly used by individuals and companies that want to advertise services or their products. Platforms drive users to the pages that companies want, targeting specific customers and promoting an ad campaign. techbizweb

Added kill chain phase(s): exploitation
Previously supported kill chain phase(s): exploitation, delivery, command and control
Methods added: 1

Lumma (Data Theft)

Lumma is an information stealer written in C, sold as a Malware-as-a-Service by LummaC on Russian-speaking underground forums and Telegram since at least August 2022. Lumma's capabilities are those of a classic stealer, with a focus on cryptocurrency wallets, and file grabber capabilities. Malpedia

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): actions on objectives, command and control, installation
MITRE ATT&CK added: T1071
Previously existing MITRE ATT&CK: T1005, T1071, T1573
Methods added: 90

RAT Generic (RAT)

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. Remote Access Trojans often mimic similar behaviors of keylogger applications by allowing the automated collection of keystrokes, usernames, passwords, screenshots, browser history, emails, chat lots, etc. Remote Access Trojans differ from keyloggers in that they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer. This backdoor into the victim machine can allow an attacker unfettered access, including the ability to monitor user behavior, change computer settings, browse and copy files, utilize the bandwidth (Internet connection) for possible criminal activity, access connected systems, and more. Malwarebytes

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): installation, command and control, actions on objectives, delivery
MITRE ATT&CK added: T1573
Previously existing MITRE ATT&CK: T1071, T1041, T1573
Methods added: 1

SocGholish (Social Engineering)

It leverages compromised websites and performs some of the most creative fingerprinting checks we’ve seen, before delivering its payload (NetSupport RAT). Malwarebytes

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, exploitation, delivery, reconnaissance, actions on objectives
MITRE ATT&CK added: T1189
Previously existing MITRE ATT&CK: T1027, T1189, T1071
Methods added: 11

Stealer and Exfiltration (Data Theft)

The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.

Info stealers may use many methods of data acquisition. The most common are:

hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes

Added kill chain phase(s): actions on objectives
Previously supported kill chain phase(s): actions on objectives, command and control, installation, delivery, exploitation
Methods added: 1

TA4903 (APT)

An advanced persistent threat (APT) is a stealthy computer network threat actor, typically a nation state or state-sponsored group, which gains unauthorized access to a computer network and remains undetected for an extended period. In recent times, the term may also refer to non-state sponsored groups conducting large-scale targeted intrusions for specific goals.

Such threat actors' motivations are typically political or economic. To date, every major business sector has recorded instances of attacks by advanced actors with specific goals seeking to steal, spy or disrupt. These include government, defense, financial services, legal services, industrial, telecoms, consumer goods, and many more. Some groups utilize traditional espionage vectors, including social engineering, human intelligence and infiltration to gain access to a physical location to enable network attacks. The purpose of these attacks is to place custom malicious code on one or multiple computers for specific tasks.

Source: Wikipedia

Added kill chain phase(s): delivery
Previously supported kill chain phase(s): delivery
Methods added: 3

TA582 (APT)