🛡️ Overpower threats. Empower IT.
Built on years of malware detection and remediation, ThreatDown, powered by Malwarebytes, offers best-in-class endpoint security designed to take threats down, take complexity down, and take costs down.
Learn more.
Today at 1:00 PM, our
#Emotet
-infected machine that had received the special law enforcement file triggered its uninstallation routine.
More details here:
ℹ️ Malwarebytes' CrackMe returns!
Designed by
@hasherezade
, a Capture-The-Flag type of a task featuring techniques from real-life malware.
2 tracks, 3 winners for each:
➡️ Fastest to solve
➡️ Best write-up
Stay tuned for the details and link this Friday (Oct. 29).
A
#malspam
campaign is taking advantage of Kaseya VSA
#ransomware
attack to drop
#CobaltStrike
.
It contains an attachment named "SecurityUpdates.exe" as well as a link pretending to be security update from Microsoft to patch Kaseya vulnerability!
We are checking on the
#Emotet
'cleanup binary'.
It seems the actual date to trigger the uninstall routine is April 25.
More details to come.
/cc
@campuscodi
@LawrenceAbrams
ℹ️ The
#Conti
ransomware leaks are a true gold mine of information.
🚨 Remember to be careful when downloading files, as the AnonFiles website is pushing bogus extensions, VPNs, etc.
Some
#malvertising
domains:
freychang[.]fun
mpanyinady[.]com
sfultraight[.]xyz
atexceede[.]com
ℹ️ Malwarebytes' CrackMe returns!
Designed by
@hasherezade
, a Capture-The-Flag type of a task featuring techniques from real-life malware.
2 tracks, 3 winners for each:
➡️ Fastest to solve
➡️ Best write-up
Stay tuned for the details and link this Friday (Oct. 29).
ℹ️ Our latest blog covers
#Lazarus
Group in their most recent campaign.
🚨 New techniques 🚨
➡️ KernelCallbackTable to hijack control flow and shellcode execution
➡️ Windows Update client for malicious code execution
➡️ GitHub for C2 communication
Official Canadian
@zippo
website compromised with credit card skimmer.
- zippo[.]ca is running WordPress and WooCommerce
- skimmer hiding as fake jQuery script
- exfiltration via vetality[.]site/gate.php
@urlscanio
evidence:
ℹ️ We discovered a new Remote Access Trojan we call
#WoodyRat
used against 🇷🇺
➡️ Distributed via lures in archive format and recently Office documents with Follina exploit.
Read more about its capabilities in our blog:
ℹ️ We identified a new Python-based RAT targeting Azerbaijan from the same threat actor we profiled a month ago in what we call the Aurora campaign.
➡️ Research by
@h2jazi
ℹ️ New blog: Colibri Loader combines Task Scheduler and PowerShell in clever persistence technique
➡️ Rename Colibri as Get-Variable.exe inside %appdata% WindowsApps folder
➡️ Create scheduled task that starts default PowerShell every min
💡 Persistence
🚨
@Malwarebytes
customers were already protected against CVE-2021-40444 (zero-day).
There have been ITW attacks already, and one of the payloads is
#CobaltStrike
More details in our blog:
If you are a defender tracking online credit card skimmers, you need to watch out for these 2 tricks: steganography & WebSocket connections.
A big thanks to
@AffableKraut
for sharing intel with the community.
#Magecart
#skimming
After a noted absence, the
#Gootkit
banking Trojan returns en masse to hit Germany. In an interesting twist, some of the victims may receive the
#REvil
ransomware instead.
More details in our blog:
It looks like
#RIGEK
is exploiting CVE-2021-26411 (IE vulnerability). (cc
@nao_sec
).
Payload dropped is
#Dridex
4d3dcbadf6f445272f29d6b6740f667a795eb868df091700068fb1019423a8ae
🚨🚨🚨
#SnakeKeylogger
#Malspam
The maldoc exploits CVE-2017-11882 to drop the payload.
Maldoc:
Purchase Order Confirmation.xlsx
296bc6bf7c16699a05193f8af55aa58b
Download url (OpenDir):
http://198.144.176.204/man/ava.exe
Keylogger:
fc137a8683575750f4ee06d368fb211b
Long time no see, Underminer Exploit Kit👋
ℹ️ Targets both IE and Chrome browsers, payload is Amadey Stealer
➡️
#UnderminerEK
IP:
216.250.255[.]122
➡️ Amadey:
b3e4ddc5b9947b700ee667ee1d9cadbcfca74cd00210b0bb256981221f9fe62c
en[.]eredirected[.]xyz/xC0m3/
Some likely digital skimming/
#magecart
domains from earlier this month (2021/06/02):
cdn-doubleclick[.]net
chimpstatic-cdn[.]com
cloudflare-cdnjs[.]com
cloudflare-ssl[.]com
static-doubleclick[.]com
static-zdassets[.]com
tatic-hotjar[.]com
widget-freshworks[.]com
1/2
ℹ️ There was a time when even malware authors used 'password1234'. Not anymore 🔒
Payload is Emotet
fdd44369a079bf9d370046ce7b8c36c026d2ff00f52f9932dca2a79753130871
A script uploaded to VirusTotal in July 2021 appears to be related to the cloud video service skimmer attack reported by Palo Alto Networks.
Full script (w/ skimmer):
#Magecart
ℹ️ Rare sighting of 2 Exploit Kits still ITW, bringing back some old memories ☕️
➡️ PurpleFox EK
kvte[.]shop/index.php?subid=10087530
dtiipwmr[.]otsrhesa[.]rest
➡️ RIG EK
hgoawa[.]xyz/cryptotime
31.44.6[.]123
#Qbot
(
#Qakbot
) is back after a summer vacation!
Malwarebytes Anti-Exploit is able to block this new
#Qbot
campaign.
Excel doc -> Downloads Qbot -> Execution via regsvr32 -> Injects into explorer.exe
Example maldoc:
c099f27aacf6cfa9bedcfcf4bca786f0
ℹ️
#EpsilonRed
attempts to uninstall security products via a PowerShell script before launching its
#ransomware
payload.
Malwarebytes Tamper Protection will prevent this:
🚨🚨
#FormBook
continues to target Oil and Gas Companies.
Email subject:
Request for Tender for SAUDI ARAMCO - SAUDI ARABIAN REFINERY RENOVATIONS
The email contains two attachments: A pdf file and an excel document.
- Pdf file contains an embedded excel object
(1/4)
ℹ️ New blog: A deep dive into Saint Bot, a new downloader.
We have found it used as part of several campaigns, some of them targeting Ukraine and Georgia.
Dozens of fake favicon domains are hosted on 78.47.155[.]179 to facilitate
#Magecart
attacks.
Skimmer is known as 'ant and cockroach', uses favicons to load malicious JavaScript.
#Magecart
skimmer stealing from folks donating to Australia's bushfire effort.
Skimmer is 'ATMZOW', exfiltration domain vamberlo[.]com was already known.
🚨🚨 Malicious documents with "DocuSign" template used to distribute
#BazarBackdoor
After dropping the backdoor it injects itself into svchost.exe
Maldocs:
ee6260fbc01386e306cdd4bcd57e292a
ebb294f2f0625ed8d4b89e9e5290dd76
🚨 Microsoft Office's latest Zero-Day (MS-MSDT Office RCE ) is a bug and not a feature after all.
🙏 Kudos to
@CrazymanArmy
and
@nao_sec
for discovery/awareness.
➡️ Read our blog for more details and to make sure you are protected.
According to our crawlers, credit card skimming code was injected into wine store belonging to top French supermarket chain E. Leclerc.
This may be why the site is now in maintenance mode.
IOCs:
clipbutton[.]com[.]br/catalog/discount.php
tivents[.]de/media/wysiwyg/paypal4.gif
We've spotted a new
#Magecart
campaign that injects Magento sites with a
#skimmer
hosted on
@pastebin
.
-> Injected code mimics Yourviews plugin ("_yvsrc")
-> Skimmer loaded over 2K times
- IOCs -
Skimmer: pastebin[.]com/raw/RmAwMkAL
Exfiltration gate: magentoconnectors[.]com