2024-08-29 UNDERGROUND Ransomware Samples

2024-08-29 Fortinet Ransomware Roundup - Underground

The Underground ransomware is likely spread by the RomCom group (also known as Storm-0978). The group exploits the Microsoft Office and Windows HTML RCE vulnerability (CVE-2023-36884). Other methods, such as phishing emails and access via Initial Access Brokers (IABs), may also be used.

• • Shadow Copies Deletion: It removes all shadow copies to prevent file recovery:
  • bash
  • Copy code
  • vssadmin.exe delete shadows /all /quiet
  • RDP Session Limits: Sets a 14-day limit on Remote Desktop sessions to maintain persistence:
  • bash
  • Copy code
  • reg.exe add HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services / v MaxDisconnectionTime / t REG_DWORD / d 1209600000 / f
  • SQL Server Service Stop: Halts the MS SQL Server service to disrupt operations:
  • bash
  • Copy code
  • net.exe stop MSSQLSERVER /f /m
  • Ransom Note Deployment: Drops a ransom note named “!!readme!!!.txt” in directories containing encrypted files.
• File Encryption: The ransomware encrypts files without altering their extensions, making it harder to visually identify encrypted files. It avoids encrypting critical system files (e.g., .sys, .exe, .dll) to maintain system functionality.
• Log and File Deletion: It creates and runs a script (temp.cmd) to delete the original ransomware file and clear Windows Event logs, complicating forensic analysis.
• Data Leak Site: The ransomware group maintains a site where they post stolen data from their victims, spanning industries such as construction, pharmaceuticals, and manufacturing. As of July 2024, they have listed 16 victims.
• Telegram Channel: The group also uses a Telegram channel to distribute stolen data, with links to files hosted on Mega, a cloud storage service.

Download

2024-08-23 ANGRY STEALER (Rage stealer variant) Telegram rat . Samples

2024-08-23 Cyfirma. A Comprehensive Analysis of Angry Stealer : Rage Stealer in a New Disguise (Telegram rat).

CYFIRMA analyzed malware known as "Angry Stealer", which is heavily advertised on platforms like Telegram,   a repackaged version of the previously identified "Rage Stealer"

• The dropper is a 32-bit Win32 executable written in .NET, which acts as the initial stage of the attack. Upon execution, it deploys two key payloads: "Stepasha.exe" and "MotherRussia.exe,
• Stepasha.exe - The Info-Stealer:
  • Once deployed, "Stepasha.exe" begins an extensive data collection process. It targets sensitive information stored on the infected system, including browser data (passwords, cookies, autofill data), cryptocurrency wallets, VPN credentials, and system information.
  • The collected data is then packaged into a ZIP file and exfiltrated to a remote Telegram channel. This process leverages hardcoded credentials and bypasses SSL validation, ensuring the data reaches the attacker without interruption.
  • The malware incorporates techniques to avoid detection, such as tampering with file timestamps and ensuring only one instance runs at a time.
• MotherRussia.exe - The Builder Tool:
  • This secondary payload acts as a builder, allowing the creation of additional malicious executables. The user provides specific inputs, such as bot tokens and chat IDs, which are then embedded into the generated executable.
  • The tool is likely designed for tasks related to remote desktop operations or bot interactions, making it easier for attackers to automate and scale their malicious activities.
• Angry Stealer" is a direct descendant of "Rage Stealer," sharing the same codebase and functionality. This rebranding approach allows cybercriminals to market the same malware under different names, reaching new buyers and avoiding detection by reusing proven tactics.
• The dropper was compiled in a .NET environment, likely within an isolated setup like Windows Defender Application Guard, suggesting that the developers took precautions to avoid detection during development.

Download

Download. Email me if you need the password.

2024-08-14 OSX BANSHEE infostealer Samples

2024-08-14 Elastic: Beyond the wail: deconstructing the BANSHEE infostealer

 This analysis of BANSHEE Stealer reveals a sophisticated macOS-based malware (sold for $3,000) developed by Russian threat actors, targeting both x86_64 and ARM64 architectures. BANSHEE Stealer is designed to collect a wide range of data from infected systems, including browser history, cookies, logins, cryptocurrency wallets, and around 100 browser extensions. The malware employs basic anti-analysis techniques, such as debugging and virtualization detection using the sysctl API and system profiling commands, and avoids infecting systems set to the Russian language.

 It uses AppleScripts for tasks like muting system sound, phishing for user passwords, and copying keychain data. The stolen data is then compressed, XOR-encrypted, Base64-encoded, and exfiltrated to a remote server.  

BANSHEE Stealer targets nine browsers for browser data collection—Chrome, Firefox, Brave, Edge, Vivaldi, Yandex, Opera, OperaGX, and Safari - extracting history, cookies, and login credentials. Interestingly, it focuses on Safari cookies using an AppleScript script, while other browsers have a broader range of data collected. The malware also scans for around 100 browser plugins, saving the data in a specified temporary directory.

BANSHEE Stealer targets wallets like Exodus, Electrum, Coinomi, Guarda, Wasabi, Atomic, and Ledger. It copies wallet-related files to a temporary directory for later exfiltration. The malware's functionality is structured in several C++ files, including Controller. cpp, which manages core tasks like anti-debugging measures using the sysctl API, language checks via CFLocaleCopyPreferredLanguages, and exfiltration processes.

The malware's exfiltration method involves compressing the collected data into a ZIP file using the ditto command, followed by XOR encryption and Base64 encoding. The resulting file is then exfiltrated via an HTTP POST request to a command-and-control server using the cURL command.

Download

 Download. (Email me if you need the password)

d556042c8a77ba52d39e211f208a27fe52f587047140d9666bbeca6032eae604 localfile~ x64

 

2024-08-22 PEAKLIGHT Stealthy Memory-Only Malware Samples

2024-08-22 Mandiant: Decoding the Stealthy Memory-Only Malware by: Aaron Lee, Praveeth DSouza

Analysis of complex memory-only malware that uses a multi-stage infection chain to evade detection. The attack starts with a malicious Microsoft Shortcut File (LNK) hidden in fake movie ZIP files. When executed, this file uses forfiles.exe and mshta.exe to run a heavily obfuscated PowerShell script, which downloads more payloads from a remote CDN. The script operates entirely in memory and uses custom decryption routines to handle encrypted payloads, protected by AES-CBC or AES-ECB and encoded in hexadecimal or Base64.

PEAKLIGHT further evades detection by employing DLL side-loading techniques to execute infostealers like Cryptbot and SHADOWLADDER malware, while dynamically unpacking ZIP files and running their contents in hidden directories. By using legitimate Windows tools and trusted content delivery networks for its operations.

Download

Download. (Email me if you need the password)

2024-08-21 MOONPEAK malware from North Korean UAT-5394 Samples

2024-08-21 Talos Intelligence 

MoonPeak malware from North Korean actors unveils new details on attacker infrastructure  

Cisco Talos has identified a new RAT family named "MoonPeak," a variant of the open-source XenoRAT malware. This RAT is currently being developed by the North Korean state-sponsored threat actor group UAT-5394.

 UAT-5394 moved from relying on cloud services to setting up their own infrastructure.

Servers identified in this campaign include 95.164.86.148, which served as a MoonPeak C2 on Port 9999, and 167.88.173.173, a server that was initially thought to be linked to the Gamaredon APT but was later found to be under UAT-5394's control. This server was used to compile MoonPeak v2 malware and connect to other C2s over Ports 9966 and 8936.

Talos also uncovered multiple test VMs, including 45.87.153.79 and 45.95.11.52, used to validate MoonPeak infections.  MoonPeak RAT modifies the original XenoRAT source code by changing the client namespace from "xeno rat client" to "cmdline." This change prevents MoonPeak from connecting to out-of-the-box XenoRAT C2 servers and ensures that any unauthorized or rogue implants cannot connect to their custom MoonPeak servers. 

Download

Download  (you can email me if you need the password scheme)

Malware Arsenal used by Ember Bear (aka UAC-0056,Saint Bear, UNC2589, Lorec53, TA471, Nodaria, Nascent Ursa, LorecBear, Bleeding Bear, and DEV-0586) in attacks targeting Ukraine (samples)

 

2023-02-18

Ember Bear (aka UAC-0056,Saint Bear, UNC2589, Lorec53, TA471, Nodaria, Nascent Ursa, LorecBear, Bleeding Bear, and DEV-0586) is an Advanced Persistent Threat (APT) group believed to be based in Russia. 

Their primary targets have been diplomatic and government entities in Europe, particularly Ukraine, and the United States. They have also targeted various industries, including defense, energy, and technology.

Download the full collection

Email me if you need the password (see in my profile)

 (209 MB. 218 samples listed in the hash tables below).

The malware arsenal collected here includes:

• Elephant framework (GrimPlant (Backdoor) and GraphSteel (Stealer).)
• Graphiron Backdoor
• OutSteel (LorecDocStealer)
• BabaDeda
• Cobalt Strike (Beacon)
• SaintBot Downloader
• WhisperGate Wiper

2020-12-13 SUNBURST SolarWinds Backdoor samples

2020-12-13 Fireeye 
Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor

The Resurgence of Russian Threat Actor, NOBELIUM

Download (627.7 MB). Email me if you need the password (see in my profile)
 

          Malware Inventory (work in progress)

KPOT info stealer samples

KPOT Stealer is a “stealer” malware that focuses on stealing account information and other data from various software applications and services

Download. Email me if you need the password (see in my profile)

Download 1  (from Didier Stevens' post)
Download 2  (Proofpoint)

Malware Inventory (work in progress)

APT Calypso RAT, Flying Dutchman Samples

2019-10-31 Calypso APT: new group attacking state institutions

Attackers exploit Windows SMB vulnerability CVE-2017-0143 or use stolen credentials to gain access, deploy the custom Calypso RAT and use it to upload other tools such as Mimikatz, EternalBlue and EternalRomance. They move laterally and steal data.

  

Download. Email me if you need the password (see in my profile)

 Malware Inventory (work in progress)

Masad Clipper and Stealer - Windows spyware exfiltrating data via Telegram (samples)

2019-09-25 Juniper. Masad Stealer: Exfiltrating using Telegram 

“Masad Clipper and Stealer” steals browser information, computer files,  and automatically replaces cryptocurrency wallets from the clipboard with its own.

It is written using Autoit scripts and then compiled into a Windows executable.
It uses Telegram to exfiltrate stolen information.

Download. Email me if you need the password (see in my profile)

Download 2

                             Malware Inventory (work in progress)

Amnesia / Radiation Linux botnet targeting Remote Code Execution in CCTV DVR samples

Amnesia / Radiation botnet samples 

Remote Code Execution in CCTV DVR (kerneronsec.com - 2016)

2017-04-06 Palo Alto Unit 42. New IoT/Linux Malware Targets DVRs, Forms Botnet

2016-08-11 CyberX Radiation IoT Cybersecurity campaign

Download. Email me if you need the password (see in my profile)

 Malware Inventory (work in progress)

Linux/AirDropBot samples

Malware Must Die:  MMD-0064-2019 - Linux/AirDropBot

Mirai variant targeting Linksys E-series - Remote Code Execution

tmUnblock.cgi 

Download. Email me if you need the password (see in my profile)

 Malware Inventory (work in progress)

HiddenWasp Linux malware backdoor samples

Intezer HiddenWasp Malware Stings Targeted Linux Systems 

Download. Email me if you need the password (see in my profile)

 Malware Inventory (work in progress)

Rootkit Umbreon / Umreon - x86, ARM samples

Pokémon-themed Umbreon Linux Rootkit Hits x86, ARM Systems
Research: Trend Micro

There are two packages
one is 'found in the wild' full and a set of hashes from Trend Micro (all but one file are already in the full package)

Download Email me if you need the password  

 

DDE Command Execution malware samples

Here are a few samples related to the recent DDE Command execution

DDE Macro-less Command Execution Vulnerability

 Download. Email me if you need the password  (updated sample pack)

Part II. APT29 Russian APT including Fancy Bear

This is the second part of Russian APT series.
"APT29 - The Dukes Cozy Bear: APT29 is threat group that has been attributed to the Russian government and has operated since at least 2008.1210 This group reportedly compromised the Democratic National Committee starting in the summer of 2015" (src.  Mitre ATT&CK)

Please see the first post here: Russian APT - APT28 collection of samples including OSX XAgent
Download (matching research listed above). Email me if you need the password 
Fancy_Bear_sourcecode (also on Github)

Malware Inventory (work in progress)

DeepEnd Research: Analysis of Trump's secret server story

 We posted our take on the Trump's server story. If you have any feedback or corrections, send me an email (see my blog profile on Contagio or DeepEnd Research)

Analysis of Trump's secret server story...

Part I. Russian APT - APT28 collection of samples including OSX XAgent

 This post is for all of you, Russian malware lovers/haters. Analyze it all to your heart's content. Prove or disprove Russian hacking in general or DNC hacking in particular, or find that "400 lb hacker" or  nail another country altogether.  You can also have fun and exercise your malware analysis skills without any political agenda.

The post contains malware samples analyzed in the APT28 reports linked below. I will post APT29 and others later.

Read about groups and types of targeted threats here: Mitre ATT&CK

List of References (and samples mentioned) listed from oldest to newest:

1. APT28_2011-09_Telus_Trojan.Win32.Sofacy.A
2. APT28_2014-08_MhtMS12-27_Prevenity
3. APT28_2014-10_Fireeye_A_Window_into_Russia_Cyber_Esp.Operations
4. APT28_2014-10_Telus_Coreshell.A
5. APT28_2014-10_TrendMicro Operation Pawn Storm. Using Decoys to Evade Detection
6. APT28_2015-07_Digital Attack on German Parliament
7. APT28_2015-07_ESET_Sednit_meet_Hacking
8. APT28_2015-07_Telus_Trojan-Downloader.Win32.Sofacy.B
9. APT28_2015-09_Root9_APT28_Technical_Followup
10. APT28_2015-09_SFecure_Sofacy-recycles-carberp-and-metasploit-code
11. APT28_2015-10_New Adobe Flash Zero-Day Used in Pawn Storm
12. APT28_2015-10_Root9_APT28_targets Financial Markets
13. APT28_2015-12_Bitdefender_In-depth_analysis_of_APT28–The_Political_Cyber-Espionage
14. APT28_2015-12_Kaspersky_Sofacy APT hits high profile targets
15. APT28_2015_06_Microsoft_Security_Intelligence_Report_V19
16. APT28_2016-02_PaloAlto_Fysbis Sofacy Linux Backdoor
17. APT29_2016-06_Crowdstrike_Bears in the Midst Intrusion into the Democratic National Committee << DNC (NOTE: this is APT29)
18. APT28_2016-07_Invincea_Tunnel of Gov DNC Hack and the Russian XTunnel
19. APT28_2016-10_ESET_Observing the Comings and Goings
20. APT28_2016-10_ESET_Sednit A Mysterious Downloader
21. APT28_2016-10_ESET_Sednit Approaching the Target
22. APT28_2016-10_Sekoia_Rootkit analysisUse case on HideDRV
23. APT28_2017-02_Bitdefender_OSX_XAgent  << OSX XAgent

Download

Download sets (matching research listed above). Email me if you need the password
          Download all files/folders listed (72MB)

Sample list