📌 Another malware campaign employs images with
#stego
Let's take a look at this sample ➡️
The
#malware
employs
#steganography
in several stages:
1️⃣ The modified "Google Update" app downloads multiple PE files and an image containing a DLL
2️⃣TrueUpdate,
UnkStealer🤷♀️ There is TitanStealer activity on these addresses, but the traffic structure and so on is very different from it. And the port is not 5000.
94.142.138[.]139
77.91.77[.]35
94.142.138[.]145
94.142.138[.]10
Ports: 5001/5005
Any ideas?
🧙♀️How do I use the magic spell number 8000167 to find samples exfiltrating data via Telegram✨
👩💻Works on all plans for all subscribers
@anyrun_app
1 - Go to Filter🔍
2 - Type SID (8000167)⌨️
3 - Get a list of samples📜
💡Hunting rules sids can also be taken from
@ET_Labs
Here’s how you can analyze a phishing link hidden inside a QR code:
1. Open the Static discovering window in ANYRUN
2. Click on the QR icon
3. Submit the link for analysis
4. Launch the task
Here’s a sample you can use 👉
🧙♀️Did you know that network rules from contain some magic?✨For example, Telegram exfiltration is now not a simple certificate detection🔏Adding a little potion, allowed the spell with the number 8000167 to work with TLS packets🪄I hope you like my magic💫
RedLine 📈Stealer 🦝 News ⌨️
A combination of changes in MC-NMF protocol values that does not allow detection by network rules.
Capturing a second authorization packet (green 218b) would be nice.
2023-12-07 (Thursday) - PDF file found on VirusTotal led to
#DarkGate
infection - Windows shortcut retrieved DarkGate install script from DNS TXT record - activity may have started as early as 2023-11-27 - IOCs available at
#TimelyThreatIntel
#Wireshark
🫦The elaboration of
#DarkGate
is impressive (again;)
💵There is a focus on more expensive assets (RDP, LSASS), which is why the rental price is so high.
🕵️♀️Now DNS traffic and standard ports.
👋Of course, this is no longer the 2351 port on which I found 223 public tasks
📌 DarkGate: new script delivery action via DNS
#DarkGate
v5, a multifunctional
#loader
, now has advanced modules, allowing it to gain the initial access to organizations' infrastructure inside the perimeter, potentially expanding the scope of its victims.
⚙ Its initiation
Based on a regular expression, I wrote a rule to detect similar suspicious domains.
🆕PHISHING [] Generic Phishing domain observed in TLS SNI
💡Use the filter to search by rule number [sid:8001050]
🫶Good luck!
Another sample was found based on a comparison of bigrams and autocorrelations of server responses from traffic.
The backdoor was previously described by
@xme
in the blog
<- (online)
An example of a really reliable JA3 hash, which very rarely falsely works due to a very strange set of clienthello fields, and if you also add a !443 port, as is often the case with
#Remcos
, it detects very well✨
#Remcos
version 3.x primarily focuses on TLS communication
Let's take a closer look at its JA3 hash.
The combination of ClientHello fields is shown in the attached images. When calculated in decimal values, it amounts to:
771,4865,51-43-13-10,25-24-23-21-19-16,
And if hashed
[STEALER] Collector ♻
FYI
@ET_Labs
let's compare the http headers of these two examples.
The first (earlier) is matched by rule number 2841213 (Babulya Stealer)
The second (later) one is matched by rule number 2843697 (Spy.Agent.PYU)
🤲I will share another find of a stealer written in Go😼
🤷♀️And as always, your attribution versions are welcome!
HTTP traffic is slightly described, partially decoded in the screenshot.
#Rootteam
Stealer and a future version of Windows👾
🕵️♀️Look in User-Agent :
Windows NT 123.9⚡️
Now covered by the rules🔧
Just in case, I made a rule for JSON, if the version continues to grow😅
*ੈ✩‧₊ 🐸 - Bot 🤝 ♠️- Bot ✩‧₊˚
Now I have an excellent reason to remember what JARM is 🥳
⚠️There are some regular expressions in the post, but beware of false positives!
Guys, thank you very much for the inspiration!
@embee_research
@g0njxa
📌 Comparison of QakBot and PikaBot servers configuration
#QakBot
is a malware loader and initial access tool. It was active until August and suddenly appeared in mid-December 2023.
#PikaBot
malware has a modular structure including a loader and a core with a Shell backdoor,
⚙️Here is another implementation of decrypting a 200-byte packet from the server.
⚡️If anyone did not know, the @
#Cyberchef
has an option with storage in registers.
🔍look in the flow control section
#Tofsee
is a veteran botnet that is still in service
Tofsee utilizes a one-byte encryption algorithm using a slightly modified Output Feedback (OFB) scheme with plaintext feedback.
This algorithm is used for the first packet from the server, which contains key information for
[PAYLOAD] Encoded PE EXE or DLL Windows file 🗄
Binary variant.
Obfuscating files by converting to strings of zeros and ones.
MZ => 0️⃣1️⃣0️⃣0️⃣1️⃣1️⃣0️⃣1️⃣ 0️⃣1️⃣0️⃣1️⃣1️⃣0️⃣1️⃣0️⃣
🧛♀️
[REMOTE] Remcos.RAT 🐙
Example of a custom protocol containing plaintext.
Usually TCP packets are encrypted with RC4🔐
Newer versions can already accept TLS🔑
===
Yellow - Magic + Size
Red - Command
Aquamarine - Delimiter
===
🧛♀️🍷
#Cyberchef
is extremely handy for creating not so simple decoders.
⚙️Check out my new decoder for the
#Lumma
configuration received from C2.
Only the recipe🔽
📡It's enough just to add the base64 data from the C2 connection to the input field.
The
#LummaStealer
malware can receive a configuration from the C&C server. The configuration is encrypted with a 32-byte XOR key, then encoded in Base64, and provided on request at the /c2conf URI.
Here is a
#Lumma
sample:
Use our
#CyberChef
recipe to
🔐Сrypt🤖Bot
There could be quite a lot of text here, but the most paradoxical evidence is noted in the photo 📸
Search by
#cryptbot
tag 🔍->
file[] - is waiting for rule📯))
DGA reminded me of one sample that I called \$CREEN ->
#LokiBot
is one of the most enduring credential stealers. On ANYRUN, the first tag for LokiBot was applied on March 6, 2018, making it one of the first public submissions.
🟥 - The aPLib compression algorithm is used to compress the decoded exfiltrated data and credentials from
📌The 'Eternity Project' encompasses
#malicious
software distributed via a
#MaaS
(Malware-as-a-Service) model.
🕵️♀️ Let's examine the network traffic generated by
#Ethernity
#Clipper
to understand its protocol and behaviors. This malicious software is designed to replace the
[STEALER] RedLine
FYI🌸
RedLine uses MC-NMF protocol.
Parsing handshake(in imgs).
Payload is located in the Via Record section.
<Version Record + Mode Record + Via Record + Known Encoding Record>
🌸to be continued...
How do we detect
#Arkei
Stealer in traffic
The configuration received from the server contains:
🟩 - Token
🟥 - Target application switches and a profile (migrated from
#Vidar
)
🟪 - Values from multipart data as indicators of exfiltration via HTTP POST (different from Vidar)
[STEALER] Hancitor 🕵️♂️
The encoded version contains the same variables as in the previously detected samples🧷
The request to identify the external IP address was also preserved untouched👈
Let's tweak our rules! 🔧
@ET_Labs
✍👧👍
🎯Track external SMB traffic according to the rule number 8000547
💻Do as I do in the screenshot and see the results.
💡Hint, in most cases it will be Storm-0978 CVE-2023-36884
⚠️“Caffeine” Phishing Service Domains
Now tagged as Caffeine by MRxC0DER details in the article ->
🔍Previous
@anyrun_app
submissions are filtered by rule number [8001156]
📌There is a suspicious substring:
LOG - on the login entry form and
PAS - on the
Explore the depths of cyber intrigue with our latest ThreatLabz blog on the emerging JanelaRAT variant. In it, we unveil its tactics for targeting LATAM’s financial sector, its cunning use of dynamic C2 infrastructure, and more. Read here:
↩️Redirecting via www[.bing.]com/ck/ to spear phishing by adding a direct link ➡️ to a suspicious myisp[.]cc which ends up redirecting ➡️to the login page✅
🔊DynamicRAT⚡️
Thanks a lot for the report!!!
Once I tortured him in the sandbox for 800 seconds 🕓 and saw reactions on the network to my activity⌨️😅🖱️
⬇️Here are some links⬇️
[STEALER] RedF0xx (New)🦊
== Nitro.Gen.Stealer ==
Full header order matching + hardcoded boundary elements "--8d9"🔩
URN, zip file name format and file names inside the archive are different🔧
🦸♀️
📜This story is about how I used those guys' non-working SQL server to get to the UBoat source code🔤
🤭Although you can just search on Github) lol
💁♀️But I didn’t know what it was then⁉️
🧙♀️The moral is: Error tracing is sometimes useful💋
📌 UBoat - HTTP Botnet Project
Communicates with the C2 server through HTTP requests that contain victim information in the URI:
Receives payload download responses. For example,
#LucaStealer
➡️
To gather additional evidence, let's delve into the error
An unkown
#stealer
has been spotted on YT!
C2 ⚙️
http://146.71.81.144/
Cookie Stealer, File Grabber, Crypto wallets, Password managers and Screenshoots, everything POST to C2
Take a look!👇👇 Just uploaded to VT
🔍 New on our blog:
#Gh0stBins
RAT analysis.
Gain insight into the rising
#cyberthreat
from China: 🇨🇳
🔹 Learn about its communication protocol
🔹 Check RDP stream recovery
🔹 Python scripts, YARA, and Suricata rules
Check
#malware
analysis 👇
Check out the
#Lu0Bot
malware analysis from ANYRUN!
We cover the code overview, explain the deobfuscation process, YARA and Suricata rules, and show what sets this Node.js threat apart. ⬇️
🤔"Poverty is the parent of crime." - Aristotle.
C2 server returns a string with the command and address:
givemedepspls
#146
.70.104.234
After that, the client forms a packet with service information and zip.
💁♀️How do you like this stealer?
😵💫Who came up with the idea of calling folders that way?
\Temp\YUOhtyugjKgdfgjFGghj676jj\
🌩️It looks like the author was electrocuted while typing!
💡Let's come up with a name for it, I propose to call it
⚡️Electrocuted
#FormBook
network traffic
Let's have a look at this
#malware
traffic and our focus will be the network exfiltration detection. Exfiltration requests are POSTs. The rules track the following:
🟩 - HTTP headers are custom and hard-coded
🟥 - Data is encrypted using RC-4 on SHA-1
📆August is coming to an end, like the whole summer 🏖️
This month I wrote 120 rules and that's fine😎
In the fall, there is usually a lot of interesting things in cybersecurity, which means we will make detections together with you🤝
Thanks for the researches!👍
📢 Catch up with ANYRUN updates in August
- Config extractors for
#Lu0Bot
,
#Strela
and more
#malware
families
- Added new and improved existing network rules
- Contributed new rules to
@EmergingThreats
community
Read more details in our blog 👇
🐙 Win32/Remcos RAT Checkin 🐙
Fragment of a possible future rule:
flow:established,to_server;
content:"|BA 49 B2 3C 5E 7E 69 43 28 63 8E|"; startswith;
content:"|39 84|"; distance:2; within:2;
classtype:command-and-control;
@ET_Labs
🙏
💡Online sandboxes are often focused on certain regions
🌐For me, Asia covers
🔍Recently I found there an interesting version of
#Gh0st
[ Easy Language and VMprotect ]
💚 - comp/uncomp size
💙 - magic bytes
❤️ - zlib message
⚡️Payload Encryption Update
🔍sid: 8000993 - use a filter!
💪You can find these threats⏬
#AgentTesla
*⃣
#Quasar
*⃣
📂All of them are in opendir, here is the taglink.
#⃣
#Lumma
Stealer now loads a 32-byte XOR encrypted configuration using the /c2conf URI🔐
🥚The Easter egg is to pass the key in the first bytes in the clear✨
🫶Thanks to the guys from for the analysis on the link! ➡️
Can you help me to attribute this?
I see fake HTTP traffic:
GET /favicon.ico HTTP/1.1 + data
(to_server & to_client)
Strange naming - svchosl.exe & winlogoc.exe (), data structure in which the server responded as a client😲
📧 If you see the triggering of rule 8000065 ⚡️
This means that a TLS stream containing a message body of a certain length was found in the sequence of SMTP protocol packets 🔍
It's not just a mail protocol detector📧
👩🏼🍳Complete your recipes with one more made with love especially for you🫶
🤔Follow the link to find out more about the rule :
2048558 - ET MALWARE [] DarkGate Check-In HTTP Header (POST)↘️
📌
#DarkGate
Loader downloads an encrypted payload
🔓Decrypt the payload using
#CyberChef
Follow the instructions:
1⃣ Take the DarkGate sample in ANYRUN ➡️
2⃣ Download the received encrypted data marked by the rule:
☑️ PAYLOAD []
💡In addition to tags, you can also filter by rules with the following numbers:
2036955, 2036934, 2854151, 2854152.
And also for hunting, use other numbers:
2036884, 2044301, 8000094, 2044305
Happy raccoon hunting🦝
#Raccoon
stealer is still popular
This
#malware
is known for stealing sensitive data from victims. Raccoon's scheme of work is similar to many others and consists of 3 main stages:
🟩 - Configuration
🟪 - Loading
🟦 - Exfiltration
Read more 👉
[REMOTE] XtremeRAT 🐭
Constants:
Сonstant for new connection "myversion".
In order not to rely on constants for detection it is better to use the server response.🎈
== IDS ==
stream_size: server, =, 4;
dsize: 3;
content: "|580d0a|";
💡Online sandboxes are often focused on certain regions
🌐For me, Asia covers
🔍Recently I found there an interesting version of
#Gh0st
[ Easy Language and VMprotect ]
💚 - comp/uncomp size
💙 - magic bytes
❤️ - zlib message