di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Agent Tesla is a prolific strain of spyware, that is being sold online since 2014. It is advertised in dark-web forums as a legitimate monitoring soft

agent-Tesla.jpg

Agent Tesla is a prolific strain of spyware, that is being sold online since 2014. It is advertised in dark-web forums as a legitimate monitoring software not intended for malicious purposes. However, its extensive password extraction features are clearly used for malicious purposes by many actors.
Deep Instinct’s Research Team recently came across a very interesting infection chain found in one of our production sites. The uniqueness of the infection chain is due to its long and inordinately complex process; starting with an RTF document attached to a phishing email, it ends with the dropping of an Agent Tesla executable on the victim machine. The multiple stages of the infection process include the use of OLE Objects within the RTF document and the execution of obfuscated VBA code contained in OOXML packages within the OLE Objects. In turn, the VBA code executes Powershell, which finally drops the malicious executable. Dozens of similar RTF droppers were found to be active very recently, possibly indicating a wide attack wave of Agent Tesla, utilizing this infection process.
The full infection flow is explained in the following diagram:
<img class="alignnone wp-image-7124 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteee9254e12008749/611a7bee9eb2a616133ac147/infection-flow-Diagram.jpg" alt="" width="679" height="257" />
<h3>Infection flow</h3>
Phishing RTF 
The infection chain begins with the execution of an RTF file, which arrives as an attachment in a phishing email. Once executed, the user is presented with five consecutive requests to enable macros. The five requests are due to the fact that the RTF contains five embedded OLE objects, which each contain an OOXML package. Inside each OOXML package lies a VBA macro, and when the user enables macros, one of the macros will execute at a time.
The VBA code contained in each of the OOXML packages is rather short and has been designed with many spaces and line breaks to make reading and organizing the code difficult
<img class="alignnone wp-image-7120 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4f6e035ae897f944/611a7bf24cdb8e163746e4e1/image1.png" alt="snippet of initial spaced VBA code" width="965" height="565" />
A snippet of initial spaced VBA code.
&nbsp;
To hinder static analysis of the code, the main variable used in the code is contained in a specific cell of the spreadsheet in each OOXML package. The variable is a long obfuscated string, which can be found in xl/sharedStrings.xml in the OOXML package.
Indeed, static analysis tools such as oletools and oledump did not help in providing any details regarding the functionality of the VBA code. In addition, dynamic analysis of the VBA using ViperMonkey was not successful. However, manual debugging of each of the five VBA code parts revealed that each part is responsible for creating part of a PowerShell code, which will form the next stage of the infection process.
<img class="alignnone wp-image-7121 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/07/image2-1000x31.png" alt="" width="1000" height="31" />
A snippet of Powershell code created from the execution of the VBA macro in the first OLE Object.
&nbsp;
Once all five parts are run, the resulting Powershell code is executed.
PowerShell execution
The PowerShell code formed in the previous step is highly obfuscated
<img class="alignnone wp-image-7122 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/07/image3-1000x218.png" alt="obfuscated Powershell, with a large encoded blob" width="1000" height="218" />
Obfuscated Powershell, with a large encoded blob).
&nbsp;
After debugging the code, which is deobfuscated through the function af23a, it is still obfuscated, but its function becomes clear – the main purpose of this PowerShell code is to attempt to bypass AMSI, and download a file using WebClient().DownloadFile.
<img class="alignnone wp-image-7127 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/07/image4.1-1000x422.png" alt="Partially deobfuscated PowerShell code. Red squares are obfuscated strings responsible for AMSI bypass, and blue square is the download URL" width="1000" height="422" />
Partially deobfuscated PowerShell code. Red squares are obfuscated strings responsible for AMSI bypass, and blue square is the download URL
&nbsp;
The AMSI bypass is attempted through the provision of an empty buffer to the AmsiScanBuffer function – the strings which are relevant to the bypass are the red squares in the above image and can be deobfuscated using function af23a in the PowerShell script. This has already been attempted in the past by a very similar Agent Telsa infection process.<a href="#_ftn1" name="_ftnref1">[1]</a> The URL which is accessed to download the file, which appears obfuscated as the string '09411248125b1a495b0d044707560e0753075b040c1b05570c4e5b04501804470217030e580416041950', is de-obfuscated to "hxxps://cleranoffacem[.]com/nbhyerd/bomb[.]exe" (blue square in image 4), and the file downloaded from this URL is Agent Tesla, which will be overviewed in the following section.
<h3>AgentTesla download and execution</h3>
The AgentTesla executable is download from hxxps://cleranoffacem[.]com/nbhyerd/bomb[.]exe to AppData\Roaming\u565.exe. Then, the executable starts performing several tasks:
<ul>
<li>Creates a scheduled task using schtasks.exe, to execute the AgentTesla executable.</li>
<li>Disables task manager through the registry using reg.exe. The specific command used is “REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr”.</li>
<li>Searches for WIFI passwords using netsh wlan show profile.</li>
<li>Tries to steal a variety of credentials: putty/WinSCP, browser, FTP, and Mail credentials.</li>
<li>It then sends stolen credentials to dir.fb@tolipgoldenplaza.com, including the credentials Golden@#$2019.</li>
</ul>
<h3>An Earlier Precedent?</h3>
It is interesting to note that a very similar infection flow involving an RTF file that contained five OLE Objects was identified in March 2018.<a href="#_ftn2" name="_ftnref2">[2]</a> In that instance, the file that was dropped following the infection chain was Lokibot. Considering the striking similarity between the two cases, it appears that the attack was either executed by the same actors or created using the same framework. However, we could not find data to further elucidate the greater likelihood of the two options.
In addition, despite this method being several years old, it is apparently still used effectively in the wild, with dozens of similar RTF files found in a recent attack wave.
<h3>Conclusion</h3>
The sophisticated and complex infection chain covered in this article, while not new, is still being used extensively in the wild. This indicates that a complex attack chain, involving many stages, is not only difficult to analyze but can also help attackers evade detection. In this case, evasion may be achieved through the use of multiple stages, each responsible for only a small portion of the attack, making each stage more difficult to detect. In addition, in this attack, and many other attacks in recent years, internal Windows tools are being abused by the attackers. In this attack, the tools abused were schtasks.exe, reg.exe, and netsh, evidence of the continued trend of attackers to abuse dual-use tools.
<a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a>’s customers are protected from this threat, which is prevented at multiple execution stages. The initial RTF dropper was prevented in production pre-execution, using <a href="https://www.deepinstinct.com/what-is-deep-learning/" target="_blank" rel="noopener noreferrer">deep learning-based static analysis</a>. Moreover, this RTF dropper was prevented with Deep Instinct’s <a href="https://www.deepinstinct.com/architecture/" target="_blank" rel="noopener noreferrer">prediction model (D-Brain)</a> released more than 20 months prior to the appearance of this dropper. If the dropper were to execute, PowerShell execution would be prevented with <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">Deep Instinct’s script protection</a>, and the Agent Tesla executable is prevented both statically using the D-Brain, and dynamically using advanced behavioral analysis protection.
&nbsp;
IOCs
RTF: ce212984a9ed60ef6015bfb2f930a0f501a2f6f373c9fa68af54fe8f68d4de9e
Agent Tesla download URL: hxxps://cleranoffacem[.]com/nbhyerd/bomb[.]exe
Agent Tesla: 756feeaec24bcada5d473a53931ac665c2a159083f408d41e7fe1c8fcb0b9a6b
Similar RTF files
840a22c718e33120f6e47c310497148ca903912a46458fbf9f21edc8976074ce
842ad0c1407a7c87c9f76a7a55d56f36dfef501495f56dbad4d28f04b807b63a
b0f8dd641769a080b640dbaa2666b5982344642335372ee4680fa5a6e771991d
ce212984a9ed60ef6015bfb2f930a0f501a2f6f373c9fa68af54fe8f68d4de9e
c03f438d814bd52be15b47743b44519263aaeded731dcfac7e9070628a41d70a
20ae23fa54d2f997c50f85b9977899255822fbe200e17d933b430561adcd1e12
859a9f0c613775907c2cda4d946159e7991ee6f9be430fe5658e95e7e5a0388b
a60c7244206b635d18c244028c1b1dc4c07da716e0ff78529692bc667f117195
2bbc9c51a29557cf8934de723236bf2f5683391d3d57d7d86410221d30b53bd3
3fe1d15c026ad8fa1c510ac3d4982f38be59e84cef34119fff0aad6fad35bc54
f11ee07c633a0ad6a88ec9cb3e798dda02d6459b5eb35eb00d403d8445b0c554
402f2be1b65ae460898ccbf47a475430cc5c64c548228481ad062934f6a85aa2
eec9b14da6a2745f089361002429d13b044d66dedf944e951b39f9d243ae3df9
786f2eaa675e1ee953a159eb4a4ccb734b1adf16ede28dd7b801df9a612a4167
fd26d992e3014118d345027e8a3c482519d75ef0fda12241d244e3a80abeda67
2f9d34c9752df5565c79ed5d0dab3e4c48f5c3de22f54180388a90e3e0b30c9a
d8be93b858f4ddfe0f6dab717e269665a56d862b86781da908fafa31be2ec509
518eb357618f85a419cdeba49b45f8a98441a6a2df1edebb2376cd0a0e98f56f
256777b273432143492346edc89f678e386cb4569e8fd48645e28245977f5856
6d0636869e65966bbb79fb58a0af016e9af41420978a43b5c2eb1ed462a24724
a114858d777f74faafadca52424a9fca33426dc5f3c4777453348e359115ac6d
bf36d5e468b5c654a47ebf07b4a0ef9e192307674960f7fdf22d6e3cb3e85177
6189ddb04b9bbb45474ed48c6685d316c06458da3d9b430727ade08cc344f235
dc1b5e7c4aeb32c2370fc03983502639d31c2c4fdecdb12b6248351daa38129a
d7f2a3ec1aae489bc44b7819ce6f4e5029282b8f8d2064fccfe1804278c38d11
d6779d721788c2826a9cd43cb01c3279c8aaca4a3210c5331125c08a9be32557
1a8ee2fcf777abbcc6d3eda5a52f5cdb2269cc8a6e7e339b01c04d47138bb702
a16cdca08584f03a1deaefa94393914bb317e80bd2a2b9f5da7c0b4355a1fddd
52f2e17287a2f975d30fdda43b44c67b5f70a168ccf97696b7d95a962d46dd7a
167760bf97f12f6ef1d66ca2db17a5a0ed2d594f86f3d8716c83e7d66d502f3e
0d873ad2a42333ee77bb18bb92c920afe94fe3c108de28fc4bb89901eb12161c
8ac06f7b667d0ae9fc2e0940efba2d580af0dab54825275b7f85cb5ac37c6f05
e5ade604474407fc742a5b99996b1aae86695493eb71d5fc2478fb78238a0799
c4d7f76ca3ccc9a7f8763e4688cc2660a1164674f14c86fd384153b5e2fa566f
b2c6e93875ed9728da141566603ad47a71a82d3867313744ceca367158c2b20c
356c459692775dae1f20998c5d39f51a4b94ac01de509fa609844eee8adab19f
<a href="#_ftnref1" name="_ftn1">[1]</a> <a href="https://r00tten.com/in-depth-analysis-rtf-file-drops-agent_tesla/">https://r00tten.com/in-depth-analysis-rtf-file-drops-agent_tesla/</a>
<a href="#_ftnref2" name="_ftn2">[2]</a> <a href="https://twitter.com/DissectMalware/status/977087605719302144">https://twitter.com/DissectMalware/status/977087605719302144</a>

Agent Tesla: A Lesson in How Complexity Get’s You Under the Radar

Cyber-attackers don’t let good opportunities for attack go to waste, and the Coronavirus pandemic is no exception. Attackers are using the pandemic to

covid19.jpg

Cyber-attackers don’t let good opportunities for attack go to waste, and the Coronavirus pandemic is no exception. Attackers are using the pandemic to generate massive amounts of mal-spam and phishing, to increase their chances of infecting targets. In fact, this might be the first case in which biological viruses help spread computer viruses.
In the past few weeks, dozens of malware campaigns have started using COVID-19 themed mal-spam and phishing emails. This blog post will outline some of the campaigns that are involved, and how users and organizations can protect themselves from these, and other campaigns.
&nbsp;
<h3>Prominent COVID-19 themed campaigns</h3>
Some of the most prominent malware campaigns of 2019 have kept apace in 2020, and are adjusting their strategies to take advantage of current events.
For example, <a href="https://www.bleepingcomputer.com/news/security/trickbot-malware-targets-italy-in-fake-who-coronavirus-emails/" target="_blank" rel="noopener noreferrer">Trickbot</a>, the sophisticated financial malware, used fake emails from the WHO in order to lure victims into downloading a Word document attached to the email. Once the document is downloaded it then executes VBA macros and downloads Trickbot. Unsurprisingly, <a href="https://securityaffairs.co/wordpress/99963/malware/coronavirus-news-emotet-trickbot.html">Emotet malware</a> also uses the Coronavirus to spread, through phishing emails and also through a different approach, adding strings related to the Coronavirus pandemic into its executable payloads. One such example included strings from a CNN article, placed inside an Emotet executable payload and in the details section of the payload, in order to fool unsuspecting users, and possibly evade detection by security products.
In addition to high-profile cybercriminal malware, <a href="https://www.zdnet.com/article/state-sponsored-hackers-are-now-using-coronavirus-lures-to-infect-their-targets/" target="_blank" rel="noopener noreferrer">nation-state actors</a> have also started using emails discussing COVID-19 in order to infect their targets. For example, the Russian-attributed group APT28 started using COVID-19 themed documents as bait against their targets, located in Ukraine. Other attack groups from China and North Korea have been found to use similar techniques.
A very original manipulation of the situation used a legitimate coronavirus live heat-map to <a href="https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-malware/" target="_blank" rel="noopener noreferrer">spread malware</a>. In this attempt, which might be an effort to spread the Azorult password stealer, a real JAR based Coronavirus live map is downloaded. However, the JAR file includes a malicious loader in addition to the map, which can download payloads according to the choice of the attacker.

<img data-image="4mb3o7crm4i8" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt611737d57cdd6e19/611a7d0dd7c42016a845ae1f/heatmap.png" data-sys-asset-uid="blt611737d57cdd6e19" alt="heatmap.png"><h6> A recent snapshot of the Johns Hopkins Coronavirus data map, available at coronavirus.jhu.edu.</h6>
These are only partial examples of the way attackers are manipulating the current situation in order to spread malware.
&nbsp;
<h3>How to protect yourself</h3>
Users and organizations can protect themselves from these threats in several different ways.
<ul>
<li>First of all, as many phishing emails pose as emails from the WHO, it should be noted that WHO communications only come from @who.int email addresses. In addition, the WHO website has a link in which scams can be reported: <a href="https://www.who.int/about/report_scam/en/">https://www.who.int/about/report_scam/en/</a>.</li>
<li>Do not open emails from unknown senders. Moreover, do not open attachments from unknown or untrusted senders. Advice regarding best practice in the COVID-19 pandemic should be taken from the web-pages of official organizations, such as the WHO or your nation’s government ministries.</li>
<li>Make sure you work from home safely. <a href="https://www.deepinstinct.com/2020/03/17/working-from-home-in-the-new-era-of-covid19/" target="_blank" rel="noopener noreferrer">Tips and security guidelines</a> are provided on this subject.</li>
<li>Make sure the <a href="https://www.deepinstinct.com/endpoint-protection/">endpoints solutions</a> you are using are installed with an advanced security solution that prevents <a href="https://www.deepinstinct.com/2018/11/25/reinventing-prevention-with-deep-learning/">malware</a> no matter where you are, be it work or home.</li>
</ul>
&nbsp;
Deep Instinct’s <a href="https://www.deepinstinct.com/deep-learning-cybersecurity/">deep learning</a> technology is able to prevent both known and unknown malware. Specifically, Deep Instinct protects against all malware campaigns mentioned in this article and is the only <a href="https://www.deepinstinct.com/">cybersecurity company</a> that can prevent known and unknown <a href="https://www.deepinstinct.com/2020/02/16/a-jar-of-malware/" target="_blank" rel="noopener noreferrer">JAR malware</a> pre-execution, using our <a href="https://www.deepinstinct.com/what-is-deep-learning/" target="_blank" rel="noopener noreferrer">deep learning</a> brain.

Attackers Abuse the COVID-19 Pandemic to Spread Malware

Formbook is a long-lived information stealer, which has been around for several years. We have also published about it in the past.  A recent attack w

shutterstock_724170373.jpg

Formbook is a long-lived information stealer, which has been around for several years. We have also <a href="https://www.deepinstinct.com/2019/01/27/info-stealer-formbook-continues-activity-and-uses-a-new-malware-friendly-file-hosting-service/" target="_blank" rel="noopener noreferrer">published</a> about it in the past.  A recent attack wave of Formbook was recently prevented by Deep Instinct in one of its customer sites. This wave appears to target victims globally. The attack begins with a malicious PDF dropper, which then drops an Office document, which in turn downloads the final Formbook payload.
Initial analysis of this PDF document aroused our suspicion, as it seems to exploit CVE-2017-11882, a known MS-Office equation editor vulnerability exploited often in Office and RTF documents. Upon further investigation, we found the PDF dropper employs an interesting infection chain, involving an Office file, which ends in the dropping and execution of the Formbook information stealer.
<h3>Infection flow</h3>
General flow:
<img class="alignnone wp-image-6516 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/02/flowchart_guy_blog-1000x356.png" alt="" width="1000" height="356" />
The infection flow starts with the victim receiving an email with a PDF attachment. The email subject is a standard quotation request, so the malicious PDF file tries to trick the victim by being named “REQUEST FOR QUOTE.pdf”. Based on the email recipient and Deep Instinct production telemetry, it appears this attack wave is targeting victims all around the globe.
Once the PDF is downloaded and executed, it runs an OpenAction event which leads to the user being presented with a decoy message, and a warning window, which asks the user if the file “is secured and verified however docx, PDF,.xlam” should be opened.
[caption id="attachment_6520" align="alignnone" width="923"]<img class="wp-image-6520 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt992d42771b8b482c/611a7d84c856491607fd0ca9/image1.jpg" alt="" width="923" height="814" /> The warning that is shown to the user when the PDF document attempts to open the embedded XLAM document[/caption]
If the user opens the file, an XLAM (an Excel Macro-Enabled Add-In) document, which is embedded in the PDF, is executed. This document exploits CVE-2017-11882 to download the Formbook payload through svchost.exe. The document attempts to download the Formbook payload from hxxp://challengerevertprocessupdate.duckdns.org/office/vbc.exe. The PE payload has a PDF icon, to fool unsophisticated users.
Once the Formbook payload is downloaded, it performs the following actions, which are similar to previous Formbook campaigns:
<ul>
<li>Attempts to harvest and steal browser and mail credentials</li>
<li>Takes screenshots</li>
<li>Attempts to contact and post data to C2 servers (IOCs provided later)</li>
<li>Persists through an AutoStart registry key</li>
</ul>
The payload is signed with an invalid X509 certificate belonging to CyberLink Corp, which is a large multimedia software company located in Taiwan. Since the signature is invalid, it appears the attempts of the attacker to distribute this file as a signed CyberLink file were unsuccessful.
&nbsp;
<h3>Evasion techniques</h3>
In this new attack wave, Formbook deploys several evasion and anti-analysis techniques, which complicate the analysis of each stage in the infection flow. Initially, the PDF file can’t be analyzed with regular PDF static analysis tools, such as Peepdf or pdftk, as both tools crash when trying to parse the file, probably due to mishandling of specific objects inside the malicious PDF file. In addition, the XLAM document arrives encrypted which complicates analysis with Office static analysis tools, such as oletools. However, the XLAM file is decrypted on execution and can be analyzed dynamically. XLAM is also a rarely used format, so it might not be blocked by certain network <a href="https://www.deepinstinct.com/about-us/">security products</a>.
In addition, the final PE payload is written in .NET, and the .NET code of the file is highly obfuscated.
[caption id="attachment_6518" align="alignnone" width="879"]<img class="wp-image-6518 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt086c674b1ed0f8ae/611a7d891b6b321635693db8/image2.png" alt="" width="879" height="566" /> The obfuscated segment of the .NET PE payload[/caption]
In this case, as well, the file can be analyzed dynamically without difficulty. It should be noted that encrypted or obfuscated Formbook samples written in .NET were also seen in previous attack waves of Formbook.
The malware also includes some additional evasion techniques, such as a long sleep (several minutes) and several methods to detect virtualization.
&nbsp;
<h3>Refusing to be Characterized</h3>
Attackers constantly evolve in order to try and evade <a href="https://www.deepinstinct.com/about-us/">security solutions</a> and complicate the analysis of their malware. The complex execution flow of this Formbook attack is another innovative attempt by attackers to evade detection. In addition, the anti-analysis techniques incorporated in all files used in the infection flow are an attempt by attackers to make the characterization of the attack more difficult.
Deep Instinct’s customers are protected from this new attack wave of Formbook, which we prevent at the earliest possible stage.
&nbsp;
<h3>IOCs</h3>
Analyzed samples
PDF dropper: 520b9c0c81cd34a95c0439f8ed3addd5e39aed22de4798fb3ab9173f7fe251b1
XLAM dropper: e66786bb4fb9ec568a86c51a060284197f2342f09fd1a6568751d1570d9b36ee
PE payload: c7722bb0e745b981dc978a624139cf0cd6920a230c20ea552dfbd1a41be37849
PE X-509 SHA1 thumbprint: c55a46f6b27c446e4a6e74cfc7b376d18389d2b8
&nbsp;
Additional PDF droppers
af506c21aa740d0c978b920482f7cc4409592b30012ab3e66306c8866170ec34
91dd44d0e6ba45f7b5e5ae3a1fa104549f9220e4ee74b061c2c952bb552de08b
94ef08bfc650da4e4122432cf834f0a29be49b9ca05da0fa3ce074718f50db95
367912cc8ffd6db400090b1febd6b9ac6ec8eb8fa3b864ef2671d3074a53b821
19c04a3aa7862294f2ca566ee2ae37a0ad2cb410f6fab7bb762dbff985e7cfd9
520b9c0c81cd34a95c0439f8ed3addd5e39aed22de4798fb3ab9173f7fe251b1
98f4e7ed6333bbc48277880d2f3d6c23770cde9a7a3c0ddda92be60e6ca50165
87e421a1cfd5c98b9d0924ae5a48ec16b3650706b7580821fe013a6a505e7e3a
f6a8ef3d8e2bb663b2badbddeecb61f53a5b4aa0830d0cbb8e75bc22b5d952e6
5622caf6fff3d0cc6bff94812d42be49faa45a717445031d5cdfe63fd7bf3fba
387b19e579ff7130eb0154f74143ffc4ba66ff0a383c146c5f2c23a4ec172a41
c50e75f491c8bc525e41eb714440bb62dc4b46160ba38b9ed7d051d99499a89b
f4e33529d9aafbc00c0e1fef2c52892ed89a7ec32903ba0465023e7fbcd9a490
901b45b0897691db2f549a315fb12334d62f3ecff077adb3efd61defa241876c
80983238f2fa79d0938f63f241d0ebb8a98d1ffcc4b76e58f44d778e4c8bd6a0
f76dd2d60095b1880b1bd022cd28a39ed3700bacf4cdb90381461a5e50e55236
&nbsp;
Network Indicators
hxxp://challengerevertprocessupdate.duckdns.org/office/vbc.exe
hxxp://sindomac.com/lc/

Highly Evasive Formbook Campaign Targets Victims Globally

Executive Summary

 	Yesterday, January 14th 2020 Microsoft published a security advisory and the patch, for a zero-day vulnerability CVE-2020-0601 

shutterstock_520693948.jpg

Executive Summary
<ul>
<li>Yesterday, January 14th 2020 Microsoft published a security advisory and the patch, for a zero-day vulnerability CVE-2020-0601 which was disclosed recently by the National Security Agency – NSA. CVE-2020-0601 is a vulnerability in Windows CryptoAPI (Crypt32.dll) which is able to bypass and spoof the validation mechanisms of Elliptic Curve Cryptography (ECC) certificates.</li>
<li>There is no available information that indicates active exploitation of this vulnerability in-the-wild, but its publication and level of severity will surely entice threat groups to leverage it.</li>
<li>Organizations and individuals are urged to patch their systems as soon as possible. A patch was released by <a href="https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2020-0601#ID0EGB" target="_blank" rel="noopener noreferrer">Microsoft</a>.</li>
</ul>
Overview
The NSA disclosed a vulnerability, tracked as CVE-2020-0601, which affects the Windows CryptoAPI (Crypt32.dll). CryptoAPI handles cryptographic operations and is a very basic and widely used module in the Windows operating system.
The security <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601" target="_blank" rel="noopener noreferrer">advisory</a> from Microsoft provides the following details:
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.
 An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider.
 A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software.
The security update addresses the vulnerability by ensuring that Windows CryptoAPI properly validates ECC certificates.
What makes CVE-2020-0601 more severe and critical than others?
The vast majority of Windows software; be it security solutions, business applications, games, browsers, etc rely on Windows’ CryptoAPI to validate certificates. Certificates are used for code-signing files, establishing secure communications, identity authentication and more. CVE-2020-0601 compromises the integrity, and therefore the trust in one of the most fundamental identity and authentication mechanisms, which serves as the basis for multiple security boundaries across and between OS components, applications and entities.
Successful exploitation of this vulnerability would pose a severe security risk. If successfully exploited, it could enable an attacker to:
<ol>
<li>Sign malicious executables with certificates which would appear to belong to highly trusted owners. For example, a file signed with a Microsoft certificate is assumed to have been developed by Microsoft, and as a result will be trusted by security programs and other components of the operating system.</li>
<li>Fake certificates used to establish secured and encrypted communications. As a result, attackers could perform man-in-the-middle attacks or impersonations.</li>
</ol>
Is CVE-2020-0601 exploited and used in the wild?
According to the NSA and Microsoft, and all other available information, CVE-2020-0601 is not being currently exploited in the wild. Microsoft and the NSA have (for obvious reasons) still not provided detailed information regarding the technical aspects and root causes for the vulnerability, and therefore it remains unclear what is the level of skill, effort and resources needed to develop a successful exploit. At this point, we cautiously assume that it is not a trivial task and would require considerable resources and know-how. However, prominent threat groups, as well as state-level agencies will undoubtedly attempt to create an exploit as quickly as possible.
As part of the patch released for this vulnerability, Microsoft added a logging mechanism, which tracks attempts to exploit this vulnerability.
What to do?
CVE-2020-0601 is rare in its level of severity and criticality. It puts at risk common and widely adopted trust, authentication and privacy mechanisms which serve as pillars of the Windows eco-system. Patching systems as soon as possible is the safest and currently the only way to fully mitigate the risk posed by it. Deep Instinct recommends and urges its customers, all other organizations and individuals to update their Windows systems and apply the patch at the earliest time possible.

Microsoft Windows 10 Critical Patch (CVE-2020-0601) – what you need to know

Managed Service Providers (MSPs) are a rapidly growing industry, which provides various software applications and services, including cybersecurity se

Security-provider.jpg

<a href="https://www.deepinstinct.com/deep-instinct-for-mssps/" target="_blank" rel="noopener noreferrer">Managed Service Providers (MSPs)</a> are a rapidly growing industry, which provides various software applications and services, including cybersecurity services. Their services appeal to a wide range of organizations, especially to small-medium businesses (SMBs), which cannot otherwise access or maintain these services on their own, due to their size, budget, or manpower limitations.Due to their extensive customer base, MSPs have become an attractive attack target, as attackers can abuse their systems to reach many different organizations in a short period of time. Attacks against MSPs have escalated within the past several months, with several threat actors abusing different MSP providers to spread ransomware. In an industry-wide survey, 30% of MSP providers stated their main point of concern was <a href="https://www.datto.com/resources/dattos-2019-state-of-the-msp-report" target="_blank" rel="noopener noreferrer">cybersecurity and ransomware related incidents</a>, Interestingly, 82% consider <a href="https://www.datto.com/resources/dattos-2019-state-of-the-msp-report" target="_blank" rel="noopener noreferrer">antivirus as the most relevant security solution</a> for small-medium businesses (SMBs).This post will overview recent attacks against MSPs, explain why MSPs are an attractive attack surface, and explain how organizations can protect themselves from these types of attacks.<h3>What is an MSP?</h3>A managed service provider (MSP) provides remote management of a customer’s systems, while sometimes also providing network infrastructure and specialized applications, such as security and network management applications. Due to their limited IT capabilities and budgets, small and medium-sized businesses (SMBs) are typical customers of MSPs, as access to the services they wish to use through the MSP would otherwise be prohibitive.The MSP market is a rapidly growing one - the managed services market is expected to grow at an annual rate of over 9%, reaching a size <a href="https://www.statista.com/statistics/590884/worldwide-managed-services-market-size/" target="_blank" rel="noopener noreferrer">of $296 Billion by 2023</a>.<h3>The MSP Attack Surface</h3>As mentioned above, MSPs provide various services to multiple endpoints, and sometimes multiple customers, simultaneously. Several key factors increase the attack surface of MSP software and make it more susceptible to attack.Remote accessIn many cases, attackers can gain access to MSP software through public connections of these programs to the Internet and use default or weak credentials to access a program. As MSPs are located remotely from their clients, attackers often look to exploit the connection between the MSP and their clients.High PrivilegesMSP software often runs with high privileges, which enable it to modify customer systems, update, push new files, and edit various system attributes. Due to this, if threat actors are able to access and control MSP software, they are provided with wide access to the targeted MSP’s endpoints, and by using the MSP software they can perform actions on endpoints that require administrative permissions.Dual-use functionalityMany MSP applications can be termed ‘dual-use tools’, as they have their intended legitimate functionalities which can be repurposed by attackers, such as the ability to download and execute scripts on multiple endpoints. In fact, these tools can be abused to perform a type of file-less attack, “Living-Off-the-Land”, where attackers only use widely-used administrative tools or tools common to the targeted organization, in order to perform the attack. This technique and the reason it is classified as a file-less attack are described in detail in Deep Instinct’s whitepaper “<a href="https://info.deepinstinct.com/whitepaper-making-sense-of-fileless-malware" target="_blank" rel="noopener noreferrer">Making Sense of File-less Malware</a>”, published March 2018.In this typical attack scenario, an attacker might scan the Internet for RDP connections of popular MSP software, brute-force the password to these connections, and connect to an MSP application managing several clients. Then, the attacker can execute a <a href="/glossary/living-off-the-land-lotl" target="_self">“living-off-the-land” attack</a> by abusing the application in order to push a specific file to all endpoints (this can range from thousands to millions of endpoints), or to set a specific scheduled task or script to run on all the endpoints. This bypasses many security measures, as the MSP software is trusted by the organization, and actions which are performed within its context will usually be considered legitimate.<h3>Recent Attacks Against MSP Software</h3>The increase in attacks abusing MSP software has become very noticeable in the threat landscape. So far, reported attacks have all abused MSP tools to drop ransomware, however it is likely the same tools were used to drop other types of malware as well. Several attacks were reported during the past few months, and we strongly believe that just a few of them went public:February 2019 – <a href="https://www.zdnet.com/article/gandcrab-ransomware-gang-infects-customers-of-remote-it-support-firms/" target="_blank" rel="noopener noreferrer">A vulnerability in Kaseya VSA RMM</a>, CVE-2017-18362, was used to spread Gandcrab ransomware in multiple organizations. The main cause of the attack was MSPs which did not update their versions of Kasyea, in response Kaseya released a patch for the vulnerability in late 2017.April 2019 – following the reported <a href="https://www.bleepingcomputer.com/news/security/gandcrab-ransomware-shutting-down-after-claiming-to-earn-2-billion/" target="_blank" rel="noopener noreferrer">shutting down</a> of Gandcrab, a new ransomware family, <a href="https://www.bleepingcomputer.com/news/security/sodinokibi-ransomware-being-installed-on-exploited-weblogic-servers/" target="_self">Sodinokibi</a>, exploited a zero-day in Oracle’s WebLogic (CVE-2019-2725) to attack MSPs using the program. The vulnerability was exploited to run a PowerShell script on vulnerable systems, which downloaded and ran the ransomware executable.June 2019 – <a href="https://www.zdnet.com/article/ransomware-gang-hacks-msps-to-deploy-ransomware-on-customer-systems/" target="_blank" rel="noopener noreferrer">Sodinokibi strikes again</a>, this time by abusing several MSP tools: Webroot Management Console and Kaseya VSA RMM. In this attack, the operators of the ransomware initially infiltrated organizations through unsecured or badly secured RDP connections, and then used both tools to push Powershell scripts to all accessible endpoints. The scripts then downloaded a payload from Pastebin, which executed the ransomware and encrypted the endpoints. In some cases, the payload was an executable file which was executed as part of a file-based attack, in other cases additional scripts were downloaded, as part of a completely file-less attack.Deep Instinct protects its customers from these attacks, by preventing them at multiple stages. Deep Instinct’s script control mechanism prevents scripts, including PowerShell from executing, thus preventing the attack at its first stage. In addition, the deep learning prediction model, ‘D-Brain’ prevents the executable payloads before their execution, meaning the threat is prevented before it can touch any threatened system.<h3>Summary</h3><a href="https://www.deepinstinct.com/deep-instinct-for-mssps/" target="_blank" rel="noopener noreferrer">MSPs</a> provide much-needed services and applications to many organizations, especially SMBs, which would otherwise not have access due to size, budget, or manpower limitations.&nbsp; In this period burgeoning demand, MSPs are expanding their services to offer more value to their customers.The flip side, however, is that the risk profile of MSPs is also heightened. MSP software has become a target for cyber-criminals, who want to make a profit attacking the huge customer install base of MSPs. Organizations which use MSP software should know how to use this software safely, in order to protect themselves from attacks. To protect your organization, make sure to implement the following security measures:<ul><li>Monitor the access of your MSP software to the Internet or external services. If you must open some of them to external connections, make sure to enable connection to them only through a VPN or a TLS base connection, using two-factor authentication when connecting.</li><li>Don’t use default passwords or keys to access MSP programs. Use strong unique passwords and limit their exposure.</li><li>Restrict and monitor access to MSP software, and other powerful system tools, such as PowerShell, within your organization. Only users who use these tools and programs regularly should be able to access them.</li><li>Make sure all your computers and programs are updated regularly and on time. This will prevent the exploitation of known and patched vulnerabilities.</li><li>Deploy an advanced endpoint protection solution, which protects you from file-based and file-less attacks.</li></ul>&nbsp;For more information read Deep instinct's Whitepaper, <a href="https://info.deepinstinct.com/whitepaper-multi-tenancy-security-solution-for-mssps" target="_blank" rel="noopener noreferrer">Multi-Tenancy Security Solution for MSSPs</a><a href="https://info.deepinstinct.com/whitepaper-multi-tenancy-security-solution-for-mssps" target="_blank"><img class="alignnone wp-image-6157" src="https://www.deepinstinct.com/wp-content/uploads/2019/10/MSSP_Banner-450x188.png" width="617" height="258" style="width: 617px; height: 258px;"/></a>&nbsp;

The Growing Popularity and Vulnerability of the MSP

Recently we came across renewed activity of the infamous credential stealer Separ, which our product prevented in customers’ environments. Previous at

dual_use_malware.jpg

Recently we came across renewed activity of the infamous credential stealer Separ, which our product prevented in customers’ environments. Previous attacks based on earlier variants of Separ date back to&nbsp; November 2017, with related info-stealers being active in the wild as far back as <a href="https://securitynews.sonicwall.com/xmlpost/mail-and-browser-password-stealing-malware-july-5-2013/" target="_self">2013</a>.The credential stealer Separ is unique, as it uses a combination of very short script or batch files, and legitimate executables, to carry out all of its malicious business logic. Therefore, Separ is an excellent example of the advanced and evasive attack technique commonly termed as “<a href="/glossary/living-off-the-land-lotl" target="_self">Living Off the Land</a>”. In addition, Separ masquerades as a fake Adobe related program, using a fake PDF document as the initial infection vector, and malicious scripts and executable files named to resemble Adobe related programs.“Living off the Land” attacks are based on legitimate files which are either common within the organization attacked, or are widely-used administrative tools, and can be abused to perform malicious functions. These tools are sometimes referred to as “Dual-Use” tools. Although “Living off the Land” is considered a type of file-less attack, this is an inaccurate definition, as the attack does involve executable files. In many cases these files are already found on disk in the victim’s machine (hence the term “Living off the Land”). In other cases, they are written to disk, but as mentioned before they are not malicious per-se and therefore go unnoticed. This technique, and the reason it is classified as a file-less attack, are described in detail in Deep Instinct’s <a href="https://info.deepinstinct.com/whitepaper-making-sense-of-fileless-malware" target="_self">whitepaper</a> on file-less attacks, published in March 2018. The attack is ongoing Access to the hosting service used by Separ in this recent attack shows that its activity continues, and data stolen from many additional victims is being uploaded daily. The attack has affected hundreds of companies, located mainly in South East Asia and the Middle East, with some targets located in North America. Based on the names of the fake documents which initiate the attack, it appears the attacker is targeting business organizations, as most fake documents appear to be concerned with quotations, shipments, and equipment specifications.Although this specific attack wave is new, and has only surfaced within the past few weeks, our research shows that variants of Separ have been around for several years, with older variants sharing some of techniques and mechanisms outlined ahead. Infection chain and malicious logic According to previous waves of Separ seen in the wild, the attack begins with a phishing email containing a malicious attachment. In this particular instance, the attachment was a decoy PDF document, which was in fact a self-extracting archive. However, the decoy is very basic as the extension of this “document” is .exe. The self-extractor contains within itself all files used in the attack - a VB Script, two batch scripts, and four executable files, with the following names: adobel.vbs, adob01.bat, adob02.bat, adobepdf.exe, adobepdf2.exe, ancp.exe, and Areada.exe. Many of the files are named to resemble files related to Adobe. The role of each file will be outlined in detail.Overall, the attack flow is as follows: <img class="wp-image-4239 size-full alignnone" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt562bfab8e5d1d7b0/611a80b26492eb15e7f7424c/Picture1.2.png" width="924" height="72" style="width: 924px; height: 72px;"/>&nbsp;Once the user clicks on the “PDF document” attached to the phishing email, the self-extractor calls wscript.exe to run a VB Script called adobel.vbs, which is extracted from the initial self-extractor.[caption id="attachment_4231" align="alignnone" width="543"]<img class="wp-image-4231 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte61d1c5ecaef1c11/611a80b775cc581671070708/Picture2.png" width="543" height="200" style="width: 543px; height: 200px;"/> The content of adobel.vbs, which calls adob01.bat[/caption]This VB Script then calls a first batch script, adob01.bat, which sets up several directories and copies files to them, using xcopy.exe and attrib.exe, before launching a second batch script.[caption id="attachment_4232" align="alignnone" width="1122"]<img class="wp-image-4232 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt65b0e8a34fc26435/611a80b7aa5dd6163af5984b/Picture3.png" width="1122" height="437" style="width: 1122px; height: 437px;"/> The first batch script run by the VB Script, adob01.bat[/caption]The second batch script, adob02.bat, performs the main malicious actions:<ul><li>Opens an empty decoy jpg, which hides additional command windows.</li><li>Changes firewall settings.</li><li>Saves ipconfig /all results into a file.</li><li>Runs SecurityXploded’s Email and Browser Password Dumps, to steal credentials. Both password dumps are dropped by the self-extractor, masquerading as files related to Adobe PDF. The Email Password Dump is renamed adobepdf2.exe, and the Browser Password Dump is renamed adobepdf.exe.</li><li>Renames output files and uploads them to <a href="ftp://ftp.freehostia.com" target="_self">com</a> using FTP with hard coded usernames and passwords.</li><li>Runs a renamed but identical version of the executable sleep.exe, available from <a href="https://www.computerhope.com/dutil.htm" target="_self">https://www.computerhope.com/dutil.htm</a>.</li><li>Reruns the whole second batch script once a very long sleep is completed.</li></ul>[caption id="attachment_4233" align="alignnone" width="550"]<img class="wp-image-4233 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8db9a4d69a05be76/611a80b541804c1602840f4e/Picture4.png" width="550" height="845" style="width: 550px; height: 845px;"/> The second batch script, adob02.bat, with files names and credentials redacted[/caption]As can be seen above, the attackers make no attempt to hide their intentions, and use no obfuscation or evasion techniques. In addition, all the output file names and credentials used by the attackers are hard-coded in the scripts.In order to carry out the malicious logic of the attack, Separ uses password dumping tools by SecurityXploded, contained in the initial self-extractor, with which it steals various user credentials before uploading them to the hosting service.Separ also uses additional legitimate executables for actions: xcopy.exe, attrib.exe, sleep.exe (renamed Areada.exe), and ancp.exe. Details regarding ancp.exe are supplied in the next section. Stolen data uploaded to a legitimate FTP service Following infection and password extraction, the malware uses, ancp.exe, an FTP client, to upload files to <a href="ftp://ftp.freehostia.com" target="_self">freehostia.com</a>. Both the executable and the service are legitimate - ancp.exe’s source is NcFTP, a legitimate FTP software provider, while FreeHostia is a well-known and widely-used hosting service.The upload is performed using hard coded user names and passwords. Using these credentials, we were able to access the FTP, and view data organized into several clients.[caption id="attachment_4234" align="alignnone" width="972"]<img class="wp-image-4234 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8ff0ab8f0f64bf1b/611a80b50779a81633f9eca7/Picture5.png" width="972" height="325" style="width: 972px; height: 325px;"/> The list of clients displayed after logging in to the FTP server[/caption][caption id="attachment_4235" align="alignnone" width="520"]<img class="wp-image-4235 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta69a269540056c54/611a80b33661bc1698fda4a0/Picture6.png" width="520" height="339" style="width: 520px; height: 339px;"/> Email password dump with redacted credentials and ipconfig data[/caption][caption id="attachment_4236" align="alignnone" width="518"]<img class="wp-image-4236 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc0bfcce8ff54c3d0/611a80b36f5ab31627f0c401/Picture7.png" width="518" height="339" style="width: 518px; height: 339px;"/> Browser password dump with redacted credentials and ipconfig data[/caption]However, each client directory contained data belonging to several different victims, collected over the last few weeks. Uploaded data contains ipconfig results in addition to email and browser passwords.We were able to access the FTP server several times, and the growth in the number of victims was clearly visible, meaning the attack is ongoing and successfully infecting many victims.Conclusions Although the attack mechanism used by this malware is very simple, and no attempt has been made by the attacker to evade analysis, the growth in the number of victims claimed by this malware shows that simple attacks can be very effective. The use of scripts and legitimate binaries, in a “Living off the Land” scenario, means the attacker successfully evades detection, despite the simplicity of the attack. Due to the mechanisms used in the attack, and despite the lack of obfuscation or evasion by the attacker, this and similar attacks have been present in the wild for several years. This shows that many security solutions have difficulties detecting “Living off the Land” attack scenarios. Meanwhile, it should also be noted that the attack can be modified easily to evade detection and complicate analysis.As written in our white paper on file-less malware, the abuse of admin tools, or of legitimate internal tools of organizations, requires organizations to change their defense mechanisms to protect themselves from attacks. To be better protected, organizations should have tight control over the users allowed to access administrative or native tools, and over the actions that can be performed by these tools.In order to guard from these types of attacks, organizations should also undertake the following:<ol><li>Deploy an advanced endpoint protection solution which can detect and mitigate file-less attacks. Using its advanced Deep Learning and behavioral capabilities, Deep Instinct protects customers from this attack on several levels. Using its Deep Learning engine, Deep Instinct scans and prevents dual use tools in run-time. Many solutions do not scan these files due to their legitimate origin, ignoring the fact these files can be abused easily. Additionally, Deep Instinct’s script control mechanism prevents scripts from executing.</li><li>Restrict the use of scripts and scripting tools in your organization, by applying different policies to different areas of the network. Allow scripts to run from read-only network locations or access only specific machines.</li><li>In any case, do not click on unknown or untrusted links, and do not open email attachments which are unknown or untrusted. Infection through social engineering is the most common method of infection.</li></ol><img class="wp-image-4241 size-full alignnone" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf658f6d341891f6d/611a80b2e57b2516924f8b43/2019_02_13_13_28_25_Deep_Instinct_Monitor_2.png" width="1152" height="709" style="width: 1152px; height: 709px;"/>We are in the process of notifying all relevant parties which have been affected by the attack.&nbsp;IOC’sOriginal sha256: fc1b755217ee2d12b05b5211602a83dcc0ad0ce2f1271b904e1a125a38927780Additional files used in attack:adobel.vbs: 57ba3dc168281294422f27dc30afe5c09acbeda502a492cf405ccf474244da9cadob01.bat: d3eca6fa868f31550ea7255bfebc76cb24bded8b4fac4422ee51a8f00e57d9d1adob02.bat: 8c6dc16cb7f420399628346d4bd3b1ea10b8e32300b2cdf849f9f160e2afc5b4adobepdf.exe: 33b237733b583272993c01eff9fcac6b223323bb11f3e4611ce0a69f98a98dd2adobepdf2.exe: 2f21b1ff10c823e9d2a425b48377cef195ccd93ea90ab6cc201e913c38c20e4eancp.exe: 4db932edcda31e6e14e271fc8759d34bcd83eaeae77c0da910bc9661f9f20d71Areada.exe: ddd90e3546e95b0991df26a17cf26fa2f1c20d6a1fd4ffccf1e9b3ec3d3810d5&nbsp;Recent similar samples7c9f50fb47d205fea9422af09a1218342a8b0cfbf4435d9cd808fb530af4b23b01ddf47d2013e56022e58433081aa11ae8871e1ac698e1dafdb4242f08b4281b00c5014631aa95c6ca453ec2453aed3fad5bca04d4f08ec6f3d259f16d090ad85139eba0915b425491d4009c44b3164b6e99f83ae6c8a18da9e33d2297d31ce093fba1c4cdcc400cbdf449db03f57c188efea8f5e05c682e8701c46d14054d6675e5c5f30034d28efa8f35df16018474c9ec32a46b8c28edde429d649dac90358f654cee2a1b5b907102fb23bf894bc42d8736a30caa08a7618f17bcad8f6e8e1595db70ae30253676f0f1e205509226a752960b25fb92fc4d020952afdb73d4c225c488312f5cbd876072215aaeca66eda206448f90f35ca59d9c9f825b35289dca69ef52e20f766ce0dd1338484626a529cea6989703203975deff3cda380b&nbsp;Network<a href="ftp://ftp.freehostia.com" target="_self">ftp.freehostia.com</a>198.23.57.8:21

A New Wave of the Separ Info-Stealer is Infecting Organizations through “Living off the Land” Attack Methods

Cyber criminals are constantly looking for new and sophisticated ways in which to avoid being detected and successfully perform a malicious attack. Th

1-1.jpg

Cyber criminals are constantly looking for new and sophisticated ways in which to avoid being detected and successfully perform a malicious attack. This was most evident in the past few years. Apart from the <a href="https://www.darkreading.com/vulnerabilities---threats/advanced-threats/how-to-prepare-for-wannacry-20-/a/d-id/1332057" target="_blank" rel="noopener noreferrer">rise in ransomware attacks</a>, there has also been an increase in the amount of fileless attacks, which pose a threat to organizations and challenge for security solutions due to the use of sophisticated attack techniques and various non-executable file formats.The increase in fileless attacks can be attributed to a few reasons: for one, the fact that the malicious logic of the attack often occurs in memory, makes traditional static detection insufficient. It also complicates post event analysis, it’s easy for attackers to hide behind and more. For these reasons, the security industry hasn’t remained idle, and various security solutions have added additional capabilities to combat these types of threats.<h4>Fileless Attacks Explained</h4>The definition of what is considered <a href="https://info.deepinstinct.com/whitepaper-making-sense-of-fileless-malware" target="_blank" rel="noopener noreferrer">fileless attack</a> is wide, as the term “fileless attack” encompasses several possible attack scenarios, only some of which don’t write any files to disk, while very few scenarios are completely fileless. A widely accepted definition of a fileless attack is an attack during which no portable executable (PE) file is written to and executed from disk.<h4>So what falls under the category of the current accepted definition of a fileless attack?</h4>Executable-less attacks: attacks based on a dropper, usually a document or scripts, which is written to disk, and then executes the next stages of the attack. These are the most common forms of fileless attacks.Dual-use attacks: attacks based on legitimate files which are either common to the organization attacked or are widely-used administrative tools, which can be abused to perform malicious functions. These files are usually written to disk, but can also be used as memory payloads.Code injection attacks: attacks based on code injection which are loaded dynamically into the memory of a process.<h4>Combating Fileless Attacks</h4>The increasing awareness of these types of attacks by the security industry is making it harder for attackers. Moreover, if you put aside the organizations choice of security solution, there are some steps organizations and users can take in order to protect themselves and lessen the likelihood of becoming infected:<ol><li>Restrict the use of scripts and scripting languages inside the organization, by applying different policies to different areas of the network. Allow scripts to run from read-only network locations or access specific machines only.</li><li>Restrict and monitor the use of interactive PowerShell &nbsp;within the organization.</li><li>Scan PE files and macro scripts which can be allowed to run within the organization.</li><li>Make sure all your computers and programs are updated regularly and on time. This will prevent the exploitation of known and patched vulnerabilities.</li></ol>With that in mind, it’s important to understand that due to the growth in knowledge of both users and security vendors, malicious actors are expected to increase both the amount of fileless attacks, and the sophistication level of them while developing new ways through which fileless attacks can be conducted.By using advanced methodologies and deep learning, Deep Instinct protects its customers from executable-less attacks, dual-use and code-injection attack. Try our <a href="https://www.deepinstinct.com/prevent-fileless-malware" target="_self">fileless malware protection solution. </a>Advanced heuristics, which also protect against file-based attacks, quickly prevent code-injection and in-memory attacks. And finally, Deep Instinct’s unique deep learning model protects against dual-use tools utilized in <a href="/glossary/living-off-the-land-lotl" target="_self">living-off-the-land attacks</a>, and against dropper files used in non-PE attacks, blocking these attacks pre-execution.To learn about the anatomy of fileless attacks, and get an in-depth explanation of the challenges and solutions involved, download this free whitepaper &gt;&gt;<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5" target="_blank"><img id="hs-cta-img-9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5" class="hs-cta-img" style="width: 800px; height: 200px;" src="https://no-cache.hubspot.com/cta/default/2183098/9f0fcd97-4cbb-4c1e-a394-77449a0fa9f5.png" alt="New call-to-action" width="800" height="200"/></a> hbspt.cta.load(2183098, '9f0fcd97-4cbb-4c1e-a394-&lt;span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"&gt;﻿&lt;/span&gt;77449a0fa9f5', {});

Discover how Deep Instinct DSX protects your NAS storage more effectively than Trellix.

Guy Propper

From Guy Propper.