di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

DI_Threat_Research_Team_Blog_930x400.png

DarkBeatC2: The Latest MuddyWater Attack Framework

blog-image-muddyc2go.jpg

The contents of this blog post were originally scheduled to be presented during an upcoming cybersecurity conference. However, interest in this topic has heightened due to the war in Israel and a suspected ongoing attack against Israeli targets. As such, we have decided to publish the relevant findings from the presentation now.<h5>Executive Summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a previously unreported C2 framework suspected to be in use by MuddyWater</li><li>The C2 framework may have been in use by the MuddyWater group since at least 2020</li><li>The framework’s web component is written in the Go programming language – hence the name we gave it: MuddyC2Go</li><li>MuddyWater seems to have stopped using PhonyC2 and is now using MuddyC2Go instead</li></ul><h5>Background</h5>In June 2023, we published a report about <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a>, a custom C2 framework used by the MuddyWater APT group.While analyzing previous PhonyC2 infrastructure, Deep Instinct uncovered anomalies that indicated MuddyWater might be using an additional C2 framework.At that time, we lacked sufficient evidence to support this claim. However, after we published our PhonyC2 research, we observed two IP addresses previously related to MuddyWater, one of those addresses which was hosting PhonyC2 had switched to a different C2 framework delivering a PowerShell payload.This behavior heightened suspicions of a new C2 framework. However, without seeing and observing the initial payload, those IP addresses could have been internal tests by MuddyWater before fully deploying the C2.Recently, Deep Instinct observed similar C2 activity on a different cluster of IP addresses that has not been associated previously with MuddyWater.This new activity’s initial payload confirmed our assessment that this activity is related to MuddyWater.<h5>Current MuddyWater Activity Using MuddyC2Go</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous research</a> has shown typical MuddyWater TTPs include spear-phishing emails containing archives or links to archives that include various legitimate remote administration tools.If the receiving target opens the file inside the archive, it installs a remote administration tool that allows the attacker to execute additional tools and malware, including MuddyWater’s PhonyC2.Deep Instinct observed the following changes in recent activity:<ul><li>The archives are now password protected. This is done to evade email security solutions that scan files inside archives without a password.</li><li>Instead of using a remote administration tool where an operator executes a PowerShell script to connect to MuddyWater’s C2, a new executable is now being sent. This executable contains an embedded PowerShell script that automatically connects to MuddyWater’s C2, eliminating the need for manual execution by the operator.</li></ul>Let’s examine several examples of this new C2 framework.<h5>July 2023 – Attack Against Jordanian Company</h5>Deep Instinct identified a file named “offtec.exe” which is an executable. Offtec is also the name of a Jordanian company.When executed, it runs a PowerShell script which connects to a MuddyC2Go server located at the IP address 45.150.64[.]239.The executable was built using PowerGUI from Quest Software. This tool allows the user to generate an executable that runs an embedded PowerShell script that is provided by the user.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: PowerGUI logo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e55ad6e0e12cbe2/654af2a5b42e39040a69a428/fig1-PowerGUI-Logo.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: PowerGUI logo</figcaption></figure>After communicating with the C2, the communication is switched to dynamic DNS using the address “microsoftfice.ddns[.]net”The response from the C2 is again a PowerShell script that runs every 10 seconds and waits for commands from the operator using the C2:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt0f5f4af3edeedf94" alt="Figure 2: Part of the PowerShell code sent from the C2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0f5f4af3edeedf94/654af2a5b42e39040a69a424/fig2-Powershell-C2-Code.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Part of the PowerShell code sent from the C2</figcaption></figure><h5>September 2023 – Attacks Against an Iraqi Telecommunications Provider</h5>In September, Deep Instinct identified additional variants of executables created with PowerGUI. The executables have been spread via password-protected RAR archives.The archives were uploaded from Iraq and their file name included the word “Korek.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltaca79be7f5b4795d" alt="Figure 3: KorekPro file on VT" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaca79be7f5b4795d/654af2a5b3460c040a0b095a/fig3-KorekPro-VT.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: KorekPro file on VT</figcaption></figure><a href="https://en.wikipedia.org/wiki/Korek_Telecom" target="_blank">Korek</a> is an Iraqi-Kurdish mobile phone operator. MuddyWater targeted Korek in <a href="https://mp-weixin-qq-com.translate.goog/s/NN_iRvwA6yOHFS9Z3A0RBA?_x_tr_sl=auto&_x_tr_tl=en&_x_tr_hl=en&_x_tr_pto=wapp" target="_blank">2019</a>.In this attack, the C2 IP addresses and dynamic DNS were different: ghostrider.serveirc[.]com<h5>October 2023 – “Swords of Iron” War</h5>While Iranian involvement in the war is still being investigated, on October 11, the fourth day of the war, Deep Instinct identified a scan of the MuddyC2Go URL from Israel in VirusTotal.Because the URL is unique and responded with PowerShell, it likely indicates there was a recent attack against an Israeli target by MuddyWater. This is also supported by our recent discovery of <a href="https://www.deepinstinct.com/blog/muddywater-en-able-spear-phishing-with-new-ttps" target="_self">another active campaign</a> from MuddyWater against Israeli targets.Deep Instinct could not identify an associated PowerGUI executable for this attack, although there could have been a different initial access vector to the attack that didn’t rely on social engineering.The C2 IP address that was used this time is 94.131.109[.]65.<h5>Attribution</h5>While investigating the PhonyC2 framework (written in Python) and its infrastructure, Deep Instinct identified servers responding with a generic “web.go” header. This header suggests MuddyWater is using a web application written in the Go programming language.In 2022, Mandiant <a href="https://www.mandiant.com/resources/blog/telegram-malware-iranian-espionage" target="_blank">reported</a> that MuddyWater wrote malware using Go, showing they are capable of using this language. However, the malware is “client-side,” whereas the C2 framework is “server-side.” As such, they are likely unrelated.Deep Instinct was able to find traces of a Go-based C2 framework used by MuddyWater dating back to the beginning of 2020.Deep Instinct identified 162.223.89[.]11 as the first IP address publicly attributed to MuddyWater using MuddyC2Go.Both <a href="https://www.secureworks.com/blog/business-as-usual-for-iranian-operations-despite-increased-tensions" target="_blank">SecureWorks</a> and <a href="https://blog.talosintelligence.com/iranian-apt-muddywater-targets-turkey/" target="_blank">Talos</a> reported a malicious Excel file (63e404011aeabb964ce63f467be29d678d0576bddb72124d491ab5565e1044cf) in January and February. When this file is opened, the malicious execution chain eventually leads to the C2 server 162.223.89[.]11.In May 2020, this IP address was <a href="https://www.virustotal.com/gui/url/dfe4269ae77af4ebd2f20156c7d1fb0eff05af17c25de4acadfda1b8f64e352f/details" target="_blank">observed</a> using MuddyC2Go.The IP address 109.201.140[.]103 has not been previously associated with MuddyWater. However, multiple scans from January, including one from Egypt, which aligns with MuddyWater’s interests and timeframe of above reports, contains unique URLs that are used by MuddyC2Go. Additionally, there is <a href="https://www.virustotal.com/gui/url/44b00e2d17de6df7ff6bcd27cff9f932e6c41052e3dce4603a55cbf41e153aca/details" target="_blank">scan</a> for a file named ssf.zip on this IP. Secure Sockets Funneling (SSF) was mentioned in the SecureWorks report as a tool used by MuddyWater.SSF is a tool that has been <a href="https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/seedworm-apt-iran-middle-east" target="_blank">reported</a> by multiple security vendors to be part of MuddyWater’s arsenal.In February 2022, CISA <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-055a" target="_blank">published</a> indicators that signal MuddyWater activity, including the IP address 164.132.237[.]65.In March 2022, this address was <a href="https://www.virustotal.com/gui/url/39e38246cd33cd971ad6760207ad8faa7384536ef4a8cc487bcc4d4bc2d75390/details" target="_blank">observed</a> to be a MuddyC2Go server. It was previously <a href="https://www.security.ntt/blog/analysis-of-an-iranian-apts-e400-powgoop-variant" target="_blank">associated</a> with PowGoop.In April 2022, the IP address 141.95.177[.]130 was <a href="https://www.virustotal.com/gui/url/4a503712ccf32917b95fea40eb9d2ddc2f7c4e51552beb4cc179a6f1dd650f10/details" target="_blank">observed</a> hosting MuddyC2Go. Additionally, the passive DNS of this IP resolved to jbf1.nc1310022a[.]biz, a pattern that was already observed with PhonyC2 servers. A year later, in April 2023, Group-IB <a href="https://www.group-ib.com/blog/muddywater-infrastructure/" target="_blank">associated</a> this IP address to MuddyWater via a specific ETag header that was used in numerous MuddyWater servers.In the same report, Group-IB identified an LNK <a href="https://www.virustotal.com/gui/file/2528838a609aa143769efb37dff45af723868d4ed33eb1ce0e2d6ce64b2a1507/relations" target="_blank">file</a> from October 2022 that was communicating with the IP address 91.121.240[.]108. The <a href="https://www.virustotal.com/gui/url/c644ec1f939c1f072e7384ef6804f0a432f81b3c78acf8e0e9eedd44d6d0d55b/details" target="_blank">responses</a> from this IP indicate that it was MuddyC2Go. In addition, the LNK file was inside an archive named “request-for-service-no10102022.zip” The naming convention is very <a href="https://www.virustotal.com/gui/file/1670a59f573037142f417fb8c448a9022c8d31a6b2bf93ad77a9db2924b502af/details" target="_blank">similar</a> to the naming convention MuddyWater used in their <a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Syncro campaign</a>.Both Group-IB and Deep Instinct have <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">linked</a> the IP address 137.74.131[.]18 to MuddyWater. Deep Instinct initially observed PhonyC2 at this address, and after our publication, MuddyWater switched to MuddyC2Go on this IP address. Additionally, the IP address 137.74.131[.]20—which was previously reported by Group-IB —also started to host MuddyC2Go.<h5>Conclusion</h5>Due to the leak of PhonyC2 source code, MuddyWater stopped using the framework and switched to using a Go-based C2 framework. Since the actual source code of the new framework is not available, the full capabilities are unknown. However, based on past leaks and associated known activity, this is another framework that generates PowerShell payloads that MuddyWater uses in the “Actions on Objectives” phase in the “<a href="https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill-chain.html" target="_blank">Cyber Kill Chain</a>.” PowerShell has always been the bread and butter of MuddyWater operations.We recommend disabling PowerShell if it is not needed. If it is enabled, we recommend close monitoring of PowerShell activity.While it is not trivial to fingerprint the MuddyC2Go framework, as it looks like any other generic web application written in Go, Deep Instinct managed to identify previous attacks dating back to 2020 due to unique URL patterns generated by the framework.Currently, Deep Instinct has identified all known active MuddyC2Go servers hosted at “Stark Industries,” a VPS provider known to host malicious activity. Deep Instinct identified additional suspected MuddyC2Go servers hosted at Stark Industries without any malicious activity or known URL pattern.Additional IOCs and information regarding Iranian Threat Actors can be found in our <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">Git</a>.<h5>IOCs:</h5>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP Address</th><th>Description</th></tr></thead><tbody><tr><td>91.121.61[.]76</td><td>MuddyC2Go (2020)</td></tr><tr><td>109.201.140[.]103</td><td>MuddyC2Go (2020)</td></tr><tr><td>162.223.89[.]11</td><td>MuddyC2Go (2020)</td></tr><tr><td>164.132.237[.]65</td><td>MuddyC2Go (2022)</td></tr><tr><td>141.95.177[.]130</td><td>MuddyC2Go (2022) – (jbf1.nc1310022a[.]biz)</td></tr><tr><td>91.121.240[.]108</td><td>MuddyC2Go (2022)</td></tr><tr><td>137.74.131[.]18</td><td>MuddyC2Go (2023) – (qjk2.6nc051221c[.]co)</td></tr><tr><td>137.74.131[.]20</td><td>MuddyC2Go (2023)</td></tr><tr><td>45.150.64[.]239</td><td>MuddyC2Go (2023) – (microsoftfice.ddns[.]net)</td></tr><tr><td>95.164.46[.]35</td><td>MuddyC2Go (2023) – (ghostrider.serveirc[.]com)</td></tr><tr><td>45.67.230[.]91</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>94.131.109[.]65</td><td>MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.46[.]199</td><td>MuddyC2Go (2023) – (Stark Industries</td></tr><tr><td>185.248.144[.]158</td><td>Suspected MuddyC2Go (2023) – (Stark Industries) – (mbcaction.hopto[.]org)</td></tr><tr><td>94.131.98[.]14</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]23</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>45.150.64[.]39</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr><tr><td>95.164.38[.]99</td><td>Suspected MuddyC2Go (2023) – (Stark Industries)</td></tr></tbody></table>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>34212eb9e2af84eceb6a8234d28751b6</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>3c6486dfb691fc6642f1d35bdf247b90</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>55b99af81610eb65aabea796130a0462</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d7ca8f3b5e21ed56abf32ac7cb158a7e</td><td>PowerShell response from 137.74.131[.]18</td></tr><tr><td>d3a2dee3bb8fcd8e8a0d404e7d1e6efb</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>4a70b1e4cb57c99502d89cdbbed48343</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>f08aa714fd59b68924843cbfddac4b15</td><td>PowerShell response from 137.74.131[.]20</td></tr><tr><td>db0e68d7d81f5c21e6e458445fd6e34b</td><td>offtec.exe (C2: 45.150.64[.]239)</td></tr><tr><td>dbcc0e9c1c6c1fff790caa0b2ffc2fe5</td><td>PowerShell script embedded in offtec.exe</td></tr><tr><td>e07adc4ee768126dc7c7339f4cb00120</td><td>PowerShell response from 45.150.64[.]239</td></tr><tr><td>feede05ba166a3c8668fe580a3399d8f</td><td>Performance.rar – Password protected archive</td></tr><tr><td>9894b84916f9264d897fe3b4a83bc608</td><td>KorekFile.rar – Password protected archive</td></tr><tr><td>9957250940377b39e405114f0a2fe84b</td><td>Performance/KorekFile.exe (C2: 95.164.46[.]35)</td></tr><tr><td>245c3ed373727c21ad9ee862b767e362</td><td>PowerShell script embedded in Performance/KorekFile</td></tr><tr><td>22971759adf816c6fb43104c0e1d89d6</td><td>PowerShell response from 95.164.46[.]35</td></tr><tr><td>5e0cc23a6406930a40696594021edb5f</td><td>KorekPro.rar – Password protected archive</td></tr><tr><td>79a638b2f2cc82bfe137f1d12534cda5</td><td>d.exe (C2: 95.164.46[.]35)</td></tr><tr><td>fc523904ca6e191eb2fdb254a6225577</td><td>PowerShell script embedded in d.exe</td></tr><tr><td>b867ec1cef6b1618a21853fb8cafd6e1</td><td>PowerShell response from 45.67.230[.]91</td></tr><tr><td>57641ce5af4482038c9ea27afcc087ee</td><td>PowerShell response from 94.131.109[.]65</td></tr><tr><td>fe5f94e5df19d95df26aaf774daad9df</td><td>PowerShell response from 95.164.46[.]199</td></tr></tbody></table>

MuddyC2Go – Latest C2 Framework Used by Iranian APT MuddyWater Spotted in Israel

MuddyWater Unleashed a New Social Engineering Campaign Against Israel During the Israel-Hamas War.

blog-muddywater-en-able.jpg

<h5>Executive summary:</h5><ul><li>Deep Instinct’s Threat Research team has identified a new campaign from the “MuddyWater” group</li><li>The campaign has been observed attacking two Israeli targets</li><li>The campaign exhibits updated TTPs to previously reported MuddyWater activity</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Campaign overview " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6790e59d9363b777/65426ffc4ed3b2001a90c710/fig1-muddywater-campaign-overview.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Campaign overview</figcaption></figure><h5>Introduction</h5><a href="https://www.deepinstinct.com/blog/new-muddywater-threat-old-kitten-new-tricks" target="_self">Previous</a> research showed that MuddyWater has sent spear-phishing emails, starting back in 2020, with direct links, as well as PDF, RTF, and HTML attachments containing links to archives hosted on various file-sharing platforms.Those archives contained installers for various legitimate remote administration tools.Before launching the new campaign during the Israel-Hamas war, MuddyWater <a href="https://twitter.com/k3yp0d/status/1719269176101990574" target="_blank">reused</a> previously known remote administration tools, utilizing a new file-sharing service called “<a href="https://www.storyblok.com/" target="_blank">Storyblok</a>.”On October 30th Deep Instinct identified two archives hosted on “Storyblok” containing a new multi-stage infection vector. It contains hidden files, an LNK file that initiates the infection, and an executable file designed to unhide a decoy document while executing <a href="https://www.n-able.com/features/advanced-monitoring-agent" target="_blank">Advanced Monitoring Agent</a>, a remote administration tool.This is the first public report about MuddyWater utilizing this remote administration tool.<h5>The Multi-stage Social Engineering Campaign</h5>While Deep Instinct could not verify the spreading mechanism of the new campaign, it most likely starts with a spear-phishing email, similar to previous campaigns.The content of the email lures the victim into downloading an archive hosted at “a.storyblok[.]com”In this analysis, we examine the “defense-video.zip” file.When the archive is extracted, several folders must be navigated until a LNK shortcut, which looks like another folder named “Attachments,” is found:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 2: LNK Shortcut" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte46c4bf1b082e1d5/65427050a67ffd001b94e1c9/fig2-muddywater-hidden-lnk-shortcut.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: LNK Shortcut</figcaption></figure>However, there are additional hidden folders and files extracted from the archive:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 3: Hidden folders" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltad15ce5115cba266/654270aa2149b10407ad84f5/fig3-muddywater-hidden-folders.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Hidden folders</figcaption></figure>When the victim opens the LNK file, the infection chain starts.By examining the LNK file, we can see that it executes an executable from one of the hidden directories:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: LNK command line arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64dfe55de3f736ef/654270df7265fb04074f77da/fig4-muddywater-lnk-command-line-arguments.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: LNK command line arguments</figcaption></figure>The file “Diagnostic.exe” has been used in both archives Deep Instinct observed. The purpose of this file is to execute another executable called “Windows.Diagnostic.Document.EXE,” which is located in the hidden directory named “.end” under a “Windows.Diagnostic.Document” hidden directory.The file named “Windows.Diagnostic.Document.EXE” is a signed, legitimate installer for “Advanced Monitoring Agent.”In addition to executing the remote administration tool, “Diagnostic.exe” also opens a new Windows Explorer window of the hidden “Document” folder. This is done to fool the victim that opened the LNK file into thinking that it was indeed a folder.The decoy document is an official memo from the Israeli Civil Service Commission, which can be publicly downloaded from their <a href="https://www.gov.il/he/departments/news/disciplinary-treatment-statements-against-israel-wartime-news" target="_blank">website</a>.The memo describes what to do in case a government worker expresses opinions against the Israeli state on social networks:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: Decoy document" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc8cf7596101ee9db/654270fca184e7001b4f934b/fig5-muddywater-csc-decoy-document.png" height="auto" style="margin: auto;text-align: center;width: auto;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Decoy document</figcaption></figure><h5>Conclusion</h5>MuddyWater continues to attack Israeli targets in various ongoing campaigns.In this campaign, MuddyWater employs updated TTPs. These include a new public hosting service, employing a LNK file to initiate the infection, and utilizing intermediate malware that mimics the opening of a directory while executing a new remote administration tool.After the victim has been infected, the MuddyWater operator will connect to the infected host using the legitimate remote administration tool and will start doing reconnaissance on the target.After the reconnaissance phase, the operator will likely execute PowerShell code which will cause the infected host to beacon to a custom C2 server.MuddyWater has used <a href="https://www.deepinstinct.com/blog/phonyc2-revealing-a-new-malicious-command-control-framework-by-muddywater" target="_self">PhonyC2</a> in the past. However, Deep Instinct recently observed MuddyWater using a new C2 framework named MuddyC2Go – a detailed blog will be published soon, stay tuned.<h5>IOCs:</h5>File<table style="width: 100%;"><thead class="bg-grey"><tr><th>MD5</th><th>Description</th></tr></thead><tbody><tr><td>37c3f5b3c814e2c014abc1210e8e69a2</td><td>Archive containing Atera Agent</td></tr><tr><td>16923d827a440161217fb66a04e8b40a</td><td>Atera Agent Installer</td></tr><tr><td>7568062ad4b22963f3930205d1a14df7</td><td>Archive containing Atera Agent</td></tr><tr><td>39eea24572c14910b67242a16e24b768</td><td>Archive containing Atera Agent</td></tr><tr><td>2e09e53135376258a03b7d793706b70f</td><td>Atera Agent Installer</td></tr><tr><td>1f0b9aed4b2c8d958a9b396852a62c9d</td><td>Archive containing SimpleHelp</td></tr><tr><td>065f0871b6025b8e61f35a188bca1d5c</td><td>SimpleHelp Installer</td></tr><tr><td>146cc3a1a68be349e70b79f9115c496b</td><td>defense-video.zip</td></tr><tr><td>dd247ccd7cc3a13e1c72bb01cf3a816d</td><td>Attachments.lnk</td></tr><tr><td>8d2199fa11c6a8d95c1c2b4add70373a</td><td>Diagnostic.exe</td></tr><tr><td>04afff1465a223a806774104b652a4f0</td><td>Advanced Monitoring Agent Installer</td></tr><tr><td>6167f03c8b2734c20eb02d406d3ba651</td><td>Decoy Document (defense-video.zip)</td></tr><tr><td>e8f3ecc0456fcbbb029b1c27dc1faad0</td><td>attachments.zip</td></tr><tr><td>952cc4e278051e349e870aa80babc755</td><td>Decoy Document (attachments.zip)</td></tr></tbody></table>Network<table style="width: 100%;"><thead class="bg-grey"><tr><th>IP or URL</th><th>Description</th></tr></thead><tbody><tr><td>ws.onehub[.]com/files/7f9dxtt6</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/253959/x/b92ea48421/form.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/255988/x/5e0186f61d/questionnaire.zip</td><td>URL to Archive of Atera Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/94f59e378f/questionnaire.zip</td><td>URL to Archive of SimpleHelp</td></tr><tr><td>146.70.149[.]61</td><td>MuddyWater’s SimpleHelp server</td></tr><tr><td>146.70.124[.]102</td><td><a href="https://twitter.com/MichalKoczwara/status/1719294254206288001" target="_blank">Suspected MuddyWater’s SimpleHelp server</a></td></tr><tr><td>37.120.237[.]204</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>37.120.237[.]248</td><td>Suspected MuddyWater’s SimpleHelp server</td></tr><tr><td>a.storyblok[.]com/f/259837/x/21e6a04837/defense-video.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr><tr><td>a.storyblok[.]com/f/259791/x/91e2f5fa2f/attachments.zip</td><td>URL to Archive of Advanced Monitoring Agent</td></tr></tbody></table>Additional IOCs regarding MuddyWater can be found in our GitHub page: <a href="https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors" target="_blank">https://github.com/deepinstinct/Israel-Cyber-Warfare-Threat-Actors</a>

MuddyWater eN-Able spear-phishing with new TTPs

blog-image-rusty-flag.jpg

Key takeaways:<ul><li>The Deep Instinct Threat Lab has discovered a new operation against Azerbaijanian targets</li><li>The operation has at least two different initial access vectors</li><li>The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language</li><li>One of the lures used in the operation is a modified document that was used by the Storm-0978 group. This could be a deliberate “false flag”</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Attack Flow" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc500e8e577b407b5/65028d348606a8f21cc873d7/fig1-AttackFlowRusty.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Attack Flow</figcaption></figure><h5>LNK Vector:</h5>Deep Instinct Threat Lab observed a malicious LNK file with low detections named “1.KARABAKH.jpg.lnk.”The file has a double extension to lure the victim to click an image that is related to a military incident in <a href="https://en.wikipedia.org/wiki/Nagorno-Karabakh" target="_blank">Nagorno-Karabakh</a>.The LNK downloads and executes an MSI installer hosted by DropBox:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 2: LNK arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt72f719f046aed339/65028d5ef41335980a8918e4/fig2-LNK-Arguments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 2: LNK arguments</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 3: OSINT information about MSI uploader from Dropbox" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcdb6b050e52030ad/65028d8d7960981affb2dee1/fig3-osint-about-MSI-uploader-Dropbox.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 3: OSINT information about MSI uploader from Dropbox</figcaption></figure>The MSI file drops an implant written in Rust, an xml file for a scheduled task to execute the implant, and a decoy image file:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: Decoy image file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6930cc293aa4cf67/65028dc568d8e111ac604833/fig4-decoy-image.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Decoy image file</figcaption></figure>The image file includes watermarks of the <a href="https://mod.gov.az/en" target="_blank">symbol</a> of the Azerbaijanian MOD.<h5>Office False Flag Vector:</h5>Once we identified the LNK campaign the Deep Instinct Threat Lab attempted to identify additional, related files.Deep Instinct Threat Lab quickly found another MSI file hosted on DropBox that drops a different variant of the same Rust implant; however, the identification of the initial access vector for this campaign was trickier.The DropBox URL was masked with a URL shortener (hxxps://t[.]]ly/8CYQW) and the evidence showed that this URL was invoked via exploitation of Microsoft Equation Editor CVE-2017-11882.Deep Instinct Threat Lab identified a file named “Overview_of_UWCs_UkraineInNATO_campaign.docx” that was invoking the request to this shortened URL; however, this filename and its content are known to be associated with a <a href="https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/" target="_blank">Storm-0978</a> campaign utilizing CVE-2023-36884.The identified file even had a comment on VirusTotal that it is related to the Storm-0978 campaign:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: VT comment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte13eea8de10129de/65028e2f9e7ba645b2cabbf9/fig5-VT_comments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: VT comment</figcaption></figure>After further investigation it was revealed that this is a different file, not related to the Storm-0978 campaign. The embedded “afchunk.rtf” file has been replaced and CVE-2023-36884 is not used. Instead, CVE-2017-11882 is used to download and install the MSI file.This action looks like a deliberate false flag attempt to pin this attack on Storm-0978.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 6: OSINT information about MSI uploader for Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0ad88745f4ac3c5a/65028e6ba26337c73b96b6af/fig6-osint-information-msi-uploaderd.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 6: OSINT information about MSI uploader for Office vector</figcaption></figure>Even though the initial lure is an Office file, the delivered MSI file also open a decoy file, this time a PDF invoice:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 7: PDF decoy dropped by Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb1f227360da24a9/6502909f1c72d8a20e8b120c/fig7-PDF-decoy-droppedPDF.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 7: PDF decoy dropped by Office vector</figcaption></figure><h5>MSI Analysis:</h5>While the initial vectors are different, the execution is the same and it is done by invoking msiexec with URL to DropBox.Using a Linux file command or msitools it seems that the MSI files were created by “MSI Wrapper” <a href="https://www.exemsi.com/" target="_blank">https://www.exemsi.com/</a>, which is often used by threat actors to drop malicious files.The MSI installers are dropping and executing the Rust implant along with a decoy file and xml file for scheduled task.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 8: MSI Metadata" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a1c244f60882ab6/650291e21709f57bfebf53c1/fig8-msi-metadata.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: MSI Metadata</figcaption></figure><h5>Rust Implant Analysis:</h5>Each attack had its unique file names and metadata. One of the file Rust Implants named “WinDefenderHealth.exe” is written in Rust. It is expected to gather information and send it to the attacker server, which is still active at the time of this research.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte9120922332ab068" alt="Figure 9: Metadata of the Rust malware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9120922332ab068/6502913d3a3d4841e1f6efba/fig9-Rust-defender-healthCheckmetadataVT.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Metadata of the Rust malware</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 10: Rust compiler" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9e4e043348197e65/65029386f4133504258918f5/fig10-Rust-malware-compiler.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Rust compiler</figcaption></figure>Rust is becoming more popular among malware authors. Security products are not yet detecting Rust malware accurately, and the reverse engineering process is more complex. The Rust standard library is not familiar to tools like IDA and Ghidra. It results in tagging large portions of the code as unknown, and it is difficult to differentiate the code of the standard library from the code of the malware. To overcome this, the plugin GhidRust was used, but it didn't detect the functions of the standard library. In addition, BinDiff was used. A simple Rust binary was compiled and compared against the malware, but very little code was shared. Some open projects for Rust were used in the malware such as Tokio (a runtime for writing reliable, asynchronous, and slim applications with the Rust programming language), hyper (a fast and correct HTTP implementation for Rust) and Serde JSON (a framework for serializing and deserializing Rust data structures efficiently and generically). After that part, we moved on to dynamic analysis.Once the file is executed it goes to sleep for 12 minutes. This is a known method to avoid security researchers and sandbox’s easy analysis.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 11: “Sleep” for 12 minutes" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt70fbe3ef467a938d/650293edeb5afe09bc4a7884/fig11-sleep-12-minutes-to-avoid-easy-reversing.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: “Sleep” for 12 minutes</figcaption></figure>Then it starts collecting information about the infected machine:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 12: “Collect” information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt43287626dd55bb8c/650321cc796098004ab2e260/fig12-Collect-information.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: “Collect” information</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 13: Processes collecting information about the PC" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3d7dc9d84a471c52/650295df1c72d858748b1217/fig13-ExfilProccesses.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Processes collecting information about the PC</figcaption></figure>The malware then reads the output of the above executions by redirecting their StdOut to a named pipe. It is notable that the values of StdIn, StdOut, and StdErr match the handles of the processes to the named pipes.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 14: “Read” the collected information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbb4b1a45002b971a/650297073a3d489d5af6efd7/fig14-tsdoutNamedPipes.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: “Read” the collected information</figcaption></figure>The information is gathered leveraging the following template:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 15: Sample of the collected info before encryption" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6497946a4527cebe/6502975576c8e45ee3b5f637/fig15-collected-info.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Sample of the collected info before encryption</figcaption></figure>The above information is then encrypted and sent to the attacker server using an uncommon, hardcoded port 35667:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 16: Encrypted information being sent to the server" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt474685ab5f698b32/6502977d9bf26140fd6bcd01/fig16-encrypted-information-sent-toC2.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted information being sent to the server</figcaption></figure>We have built a script to decrypt the information, available in our <a href="https://github.com/deepinstinct/Rusty-Flag-DecryptData" target="_blank">Git</a>, that the malware is sending.All analyzed files above have a low detection rate on VT at the time. There are zero detections on first seen and most of the detections are generic ones.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 17: Detections of the RUST implant in VT. All detections are generic." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt831a4c472c34a419/650297c50433c0d28e25462b/fig17-VT_Detections.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Detections of the RUST implant in VT. All detections are generic.</figcaption></figure>While the other Rust implant still has zero detections:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 18: 2nd Rust implant VT detections" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3926fc166ca5accf/65029808a8cf8b810b3e0b3f/fig18-sengforVTDet.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: 2nd Rust implant VT detections</figcaption></figure><h5>Conclusion:</h5>Deep Instinct Threat Lab could not attribute these attacks to any known threat actor. There is a possibility that these files are part of a red team exercise.Regardless of the above statement, the fact that both Rust implants had zero detections when first uploaded to VirusTotal shows that writing malware in esoteric languages can bypass many security solutions.<h5>MITRE:</h5><table><thead class="bg-grey"><tr><th>Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Discovery</td><td>T1082 System Information Discovery</td><td>The malware executes systeminfo.exe to gain information about the infected computer</td><td>systeminfo.exe</td></tr><tr><td>Discovery</td><td>T1016 System Network Configuration Discovery</td><td>Gain detailed information about the network interfaces on the system</td><td>ipconfig.exe /all</td></tr><tr><td>Discovery</td><td>T1033 System Owner/User Discovery</td><td>Gain user, group, and privileges information for the users</td><td>Whoami.exe /all</td></tr><tr><td>Discovery</td><td>T1087 Account Discovery</td><td>Gain information about local or domain accounts on a system</td><td>Net.exe user</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Gain a list of currently running processes, including detailed information about each one</td><td>Tasklist.exe /v</td></tr><tr><td>Persistence</td><td>T1053 Scheduled Task/Job</td><td>Create a scheduled task using the xml file</td><td>Schtasks.exe</td></tr><tr><td>Command and Control</td><td>T1132 Data Encoding</td><td>Encrypted communication</td><td>Encrypted information sent to the C2. A tool for decrypting the information is provided in our Git.</td></tr></tbody></table><h5>IOC:</h5>78.135.73[.]140<table><thead class="bg-grey"><tr><th>SHA256</th><th>Description</th></tr></thead><tbody><tr><td>463183002d558ec6f4f12475cc81ac2cb8da21549959f587e0fb93bd3353e13e</td><td>Archive containing malicious Office file</td></tr><tr><td>edc531d255b9ae8ae6902dc676f24e95a478576cad297e08e2bbc0b8fe03e4ce</td><td>Malicious Office file</td></tr><tr><td>1546bb5bfc25741434148b77fe51fed7618432a232049b3f6f7210e7fb1f3f0e</td><td>MSI file from hxxps://t[.]ly/8CYQW</td></tr><tr><td>387304b50852736281a29d00ed2d8cdb3368d171215f1099b41c404e7e099193</td><td>SangforUD.EXE Rust implant</td></tr><tr><td>0742cd9b92661f23f6b294cc29c814de027b5b64b045e4807fc03123b153bcd5</td><td>Decoy PDF file</td></tr><tr><td>04725fb5a9e878d68e03176364f3b1057a5c54cca06ec988013a508d6bb29b42</td><td>Malicious LNK file</td></tr><tr><td>35f2f7cd7945f43d9692b6ea39d82c4fc9b86709b18164ad295ce66ac20fd8e5</td><td>MSI file from LNK vector</td></tr><tr><td>5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db</td><td>WinDefenderHealth.EXE Rust implant</td></tr><tr><td>e508cafa5c45847ecea35539e836dc9370699d21522839342c3f3573bf550555</td><td>Decoy JPEG file</td></tr></tbody></table>

Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets

blog-phonyc2-muddywater.jpg

PhonyC2: Revealing a New Malicious Command & Control Framework by MuddyWater

emotet-returns-2023-blog.jpg

Earlier this week, on Tuesday, March 7th, Emotet was observed for the first time this year sending new malspam to infect victims. This is significant because the last time Emotet was seen sending malicious spam was in <a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">November</a> of 2022. This current wave is different from the one in November, though, including new evasion techniques that we will detail in this blog. Deep Instinct’s Threat Research team has been tracking Emotet over the last year and has written about its periods of silence and reemergence with new tactics. We will continue to track the malware and alert the community to any changes or activity. <ul><li>November 17, 2022: <a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">Emotet Vacation Is Over: No Rest For The Wicked</a></li><li>June 9, 2022: <a href="/blog/emotet-malware-returns-in-2022" target="_self">Emotet Malware Returns in 2022</a></li></ul>The first to observe and tweet about Emotet’s return was <a href="https://twitter.com/ilbaroni_/status/1633087980561735680" target="_blank">@ilbaroni_</a>: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt06f56e90c1fd7d11" alt="Figure 1: First public observation of Emotet’s return" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt06f56e90c1fd7d11/640a621ee5ffbf108e0bbf3f/fig1-first-public-observation-of-emotets-return.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: First public observation of Emotet’s return</figcaption></figure> <h3>Delivery via Thread Hijacking Emails  </h3>The delivery method that Emotet used is the same as in November, however, this time the attached zip files are not password protected. Deep Instinct’s Threat Research team observed thread-hijacked emails sent to companies around the globe, including in Japan: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt20e3927b313134eb" alt="Figure 2: Thread-hijacked mail in Japanese" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt20e3927b313134eb/640a621e6d0cf81016ab9102/fig2-thread-hijacked-mail-in-japanese.png" height="auto" /><figcaption style = "text-align: center;" >Figure 2: Thread-hijacked mail in Japanese</figcaption></figure> <h3>Changes to Emotet Malspam </h3>In November, Emotet was sending malicious Excel files in the archives. Now Emotet is sending archives with malicious Word files. The Word files include macros that, if enabled, start the infection chain. The first page contains an image that tries to lure the receiver to enable macros: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf706d459b420f0d1" alt="Figure 3: Social engineering lure on first page" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf706d459b420f0d1/640a621ea7d98e0267ed3669/fig3-social-engineering-lure-on-first-page.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Social engineering lure on first page</figcaption></figure> The second page is blank, while pages 3-7 are excerpts from the novel “<a href="https://en.wikipedia.org/wiki/Moby-Dick" target="_blank">Moby-Dick</a>” which are written in white font to make the pages appear blank. The whole document has 14,801 characters and 2,587 words; the text is added as part of an evasion technique. Many security tools will classify a Word document with just an image and a macro as malicious, which is true in most cases. Some people still use macros for legitimate reasons, despite there being little reason to do so with the advances we have made in technology in the 21st century. Adding textual context to a file with macros might fool some security tools into thinking that the file is benign: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9396b636b76e97a8" alt="Figure 4: Changing the font color reveals the hidden text" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9396b636b76e97a8/640a621f325d0044fe5fabb6/fig4-changing-font-color-reveals-hidden-text.png" height="auto" /><figcaption style = "text-align: center;" >Figure 4: Changing the font color reveals the hidden text</figcaption></figure> The Word document in the example contains several long and obfuscated macros which download and execute a ZIP file containing the Emotet DLL from one of several compromised websites. If that’s not enough, the most interesting change made by Emotet that it now artificially inflates the size of the Word document to over 500mb: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt4771a740a24441f5" alt="Figure 5: Zero bytes are added to the end of the document." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4771a740a24441f5/640a621fe35cc90ebcbd3896/fig5-zero-bytes-are-added-to-end-of-document.png" height="auto" /><figcaption style = "text-align: center;" >Figure 5: Zero bytes are added to the end of the document.</figcaption></figure> This is done by simply adding zero bytes at the end of the document. Deep Instinct researchers have <a href="/blog/the-russian-spyagent-a-decade-later-and-rat-tools-remain-at-risk" target="_self">seen this technique previously</a> used to inflate the final payloads, such as executables or DLL files. The result is like the one before, and because the files are so big, many security products and sandboxes don’t scan them, which breaks the automatic analysis and IOC extraction. As mentioned earlier, the macros download a ZIP file from compromised hosts which contain a DLL file which is the Emotet loader. This DLL is also inflated with zero bytes to a file size of over 500mb. The combination of both the initial attack vector and the payload being artificially inflated might completely blind products that solely rely on static analysis. Despite these changes the behavior of the loader appears the same. In the past Emotet used to copy a local version of the certutil.exe; this time Emotet drops a specific version of renamed certutil into “&lt;AppData&gt;\Local\Temp.” The hash of the observed version is: 4224312da8c3a37b95dd78236fca5ca316021c5de6e517d0ddc753ee26932e6a Emotet is still using process injection, therefore, security products that do not rely solely on static detection have a better chance at stopping the current wave. <h3>IOC </h3>DOC: a13b394e4017c0c77faf4fab6c3aea4de3443f11610cc85a1d677249b9b2bc3a DLL: efcf59f4423df8fdacbfa8c3d23b6a3e4722bab65c31ea8a7f32daadddfa7adc For the full list of IOCs (278) visit our <a href="https://github.com/deepinstinct/Emotet-IOCs" target="_blank">GitHub page</a>.

Emotet Again! The First Malspam Wave of 2023

ducktail-blog.jpg

DUCKTAIL: Threat Operation Re-emerges with New LNK, PowerShell, and Other Custom Tactics to Avoid Detection

malicious-JARs-blog.png

Throughout 2022, Deep Instinct observed various combinations of <a href="https://en.wikipedia.org/wiki/Polyglot_(computing)" target="_blank">polyglot</a> files with malicious JARs.The initial technique dates to around 2018 when it used signed MSI files to bypass Microsoft code signing verification. A year later, in 2019, <a href="https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html" target="_blank">Virus Total</a> wrote about the MSI+JAR polyglot technique. Microsoft decided not to fix the issue at that time. Then in <a href="https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi" target="_blank">2020</a>, this technique was again abused in malicious campaigns and Microsoft assigned <a href="https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd" target="_blank">CVE-2020-1464</a> to address the issue.Despite being fixed, Deep Instinct observed in 2022 that the technique was still in use and included new types of polyglots which do not necessarily exploit the CVE; rather, attackers now use the polyglot technique to confuse security solutions that don’t properly validate the JAR file format.<h3>What is polyglot?</h3>A polyglot file is created by combining two or more file formats together in such a way that each format can be interpreted individually without an error.This is a little tricky as you can’t make polyglots from any arbitrary combination of file formats, although there are quite a few <a href="https://github.com/Polydet/polyglot-database" target="_blank">options</a> to choose from.<h3>Why JAR?</h3><a href="https://en.wikipedia.org/wiki/JAR_(file_format)" target="_blank">JAR</a> files are essentially ZIP archives. What’s special about ZIP files is that they’re identified by the presence of an end-of-central directory record which is located at the end of the archive. This means that any “junk” we append in the beginning of the file will be ignored and the archive is still valid.Other file formats have a special magic header at the beginning of the file, and they should be read from the start, unlike JAR. One of these formats is MSI.If those two are combined, we receive a file that is both a valid MSI and a valid JAR.<h3>The 2022 Campaigns</h3>Throughout 2022, Deep Instinct observed <a href="https://www.jaiminton.com/reverse-engineering/strrat" target="_blank">StrRAT</a> and <a href="https://www.youtube.com/watch?v=YJ8PZ6elyLE" target="_blank">Ratty</a> samples being distributed as polyglots or as JAR files with junk appended in the beginning.Both RATs are known threats. For StrRAT, there is a configuration extractor. For Ratty, we wrote a config extractor of our own, which we shared with the community in GitHub: <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">https://github.com/deepinstinct/RattyConfigExtractor</a>While we couldn’t determine whether the files belong to a single threat actor or to several threat actors, the usage of the Bulgarian hosting “BelCloud LTD” has been observed in many of the samples.Additionally, we found a few Ratty and StrRAT samples that shared the same C2 server.For simplicity we will categorize the files by what is appended to them.<h3>#1 MSI:</h3>Sample 5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991If we inspect the file with the Linux file command, we see it’s an MSI file:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2e9f9f745ae627ca" alt="Figure 1: Linux file identifies sample as MSI file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e9f9f745ae627ca/63bee84a47588310a1913f9b/fig1-linux-file-indentifies-sample-as-msi-file.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Linux file identifies sample as MSI file</figcaption></figure>However, the file contains a valid JAR as well. Our Ratty configuration extractor was able to successfully extract the C2 server information.This sample has been observed being sent using <a href="https://sendgrid.com/" target="_blank">Sendgrid</a>. While this is not unique, some of the StrRAT samples that were MSI+JAR polyglots have been sent via Sendgrid as well.Some of the StrRAT samples using the MSI+JAR polyglot have been observed spreading with URL shortening services such as cutt.ly and rebrand.ly. In some cases, the samples were hosted on Discord.<h3>#2 CAB:</h3><a href="https://www.file-recovery.com/cab-signature-format.htm" target="_blank">CAB</a> files have a unique magic header and are interpreted from the beginning to the end, which makes them a perfect candidate for a polyglot with JAR files.We have observed both Ratty and StrRAT samples using CAB+JAR polyglots.In particular, we found the Ratty sample f620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de and the StrRAT sample 2f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e571 both using the CAB+JAR polyglot and using the same C2 server, donutz.ddns[.]net<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltfb077af360e7081e" alt="Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb077af360e7081e/63bee84a7a6762171d821d17/fig2-strRAT-and-Ratty-linked-to-the-same-c2-server.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net</figcaption></figure><h3>#3 HEX Trash / Fake PE:</h3>We are not sure if the files were made by mistake or on purpose by the threat actor, but those JAR files have HEX values appended to them:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt05d5b955bdf7dc33" alt="Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt05d5b955bdf7dc33/63bee84a98b11c3ccecf6af5/fig3-sample-with-hex-values-appended.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended.</figcaption></figure>The appended textual hex value is of an executable file. While those files are not polyglots because the appended hex is just “junk” text, the Linux “file” command would return “data” such as the file type.In this way attackers can confuse and bypass security solutions that would simply check the type of file using the Linux “file” command.<h3>#4 Binary Junk:</h3><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8585c56be6e04e2b" alt="Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8585c56be6e04e2b/63bee84ad7b1d54534245dfa/fig4-sample-with-appended-binary-data.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data.</figcaption></figure>This variation is once again not truly a polyglot, and it is not clear if this is a mistake or if it was done on purpose. The appended content seems to be a part of some binary, but the appended data appears to be missing the beginning of the appended file.The result is the same: a valid JAR file that is detected as “data” by checking the file type.<h3>Is this effective? (YES!)</h3>While Ratty and StrRAT are well known threats, some of those appended JAR files receive very low detections in VirusTotal:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt14594c18eb515964" alt="Figure 5: Low detection rate for CAB+JAR polyglot" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt14594c18eb515964/63bee84aab6fbb46e5b71f9c/fig5-low-detection-rate-for-cab-jar-polyglot.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Low detection rate for CAB+JAR polyglot</figcaption></figure>The VirusTotal detection rate doesn’t tell the true capabilities of specific vendors as some products behave differently when files are executed dynamically.That said, we can clearly see that JAR files with appended content can stay undetected, at least until executed, even for known threats.<h3>Can this be any worse? Yes, my friends, it can...</h3>Let’s think about this from a detection engineering perspective. If we failed to identify a JAR file because we relied on the simple file type check, like Linux “file” command, the easy solution would be just to “scan” every file with the JAR extension. If you want to, you can even throw a validation that the file is a valid JAR by checking the presence of the end of a central directory record at the end of the file.However, this is still not sufficient. JAVA does not care about the file extension and will happily execute a valid JAR file with any extension. The only downfall in renaming the “.jar” extension is that the JAR needs to be executed from the command line instead of simply clicking on it to execute.We have created an HTML+JAR polyglot to demonstrate this:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt234fc58952190333" alt="Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt234fc58952190333/63bee84a438f80612c397515/fig6-html-jar-polyglot-with-html-extension-properly-rendered-in-the-browser-and-properly-executed-by-jre.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE</figcaption></figure>This file is also available in our <a href="https://github.com/deepinstinct/JAR-Polyglot-POC" target="_blank">GitHub</a> along with the <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">Ratty</a> malware configuration extractor.<h3>Conclusion</h3>The proper detection for JAR files should be both static and dynamic. It’s inefficient to scan every file for the presence of an end of central directory record at the end of the file.Defenders should monitor both “java” and “javaw” processes. If such a process has “-jar” as an argument the filename passed as an argument should be treated as a JAR file regardless of the file extension or the output of the Linux “file” command. Incident responders and the cyber community are welcome to use the Ratty malware configuration parser provided from Deep Instinct in case of infection to get to the IOC fast and quickly move on to remediation steps.<h3>MITRE ATT&CK:</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Initial Access</td><td>T1566.002 Phishing: Spearphishing Link</td><td>Attackers use URL shortening services that leads to the payload.</td><td>Rebrand[.]ly/afjlfvp</td></tr><tr><td>Defense Evasion</td><td>T1036.001 Masquerading: Invalid Code Signature</td><td>Attackers append a signed MSI file.</td><td>85d8949119dad6215ae0a21261b037af</td></tr><tr><td>Defense Evasion</td><td>T1027.001 Obfuscated Files or Information: Binary Padding</td><td>Attackers append junk data at the beginning of the file causing “file” command to return a different file type.</td><td>cb17f27671c01cd27a6828faaac08239</td></tr><tr><td>Command and Control</td><td>T1102 Web Service</td><td>Attackers used Discord's content delivery network (CDN) to deliver malware.</td><td>https://cdn[.]discordapp[.]com/attachments/938795529683480586/941658014962823208/Package_info[.]jar</td></tr></tbody></table>&nbsp;<h3>IOC:</h3>d51d269b62e55d4af8a4bd72dcf3c5115ad27fe5466640041c658c0325194451534a4b0e17723755dd8cbdcdec309004ef59c3dfacb87fac86da4548780d2f1b08921a6b0b2903b9c991acb869930c7cab3cbaf11e002be9c88400af48c3fa2159a02230a78b87c97eebbf7cdba40ea17c7d9411d706fd255c2a6a025584fd9fa9ac4ae704da346a0f3d2960b084d8f314c0fd60a934116e3c75647c713314b647fc7fc1658acfa2f7a0b388bea6b52787f186bf8297ce189a575d547dfbd8e0a80add76ff8ad0e1c3bdab9459546fd724e1f4034248d1542aec1264c02d3857f0e57c84ba1958cabf24cfec4a0d50be6b7bc0e45c639d08a53097494373ae9ee7812ff64dbe51584d3090e008b464510dbb87ac860c68d89e224621755021f941ef2dfa736e9a24a1a29a373357ac249dad99f86f1cc0283ddd4765fa14e54a8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cadf79ba296aeab13be409ee3ef435f47a8888f7186a062fa481603ec32f3d6b678262e6824f0c4c765e73a7041362d7a3a8d63dab1be91ecf5e80623ac6e2f389eb6a0dcd8c9bc11794837e8f9350e2816ae7a60d148f3e6f436c2645f450feeabf620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de54814775c2f266cafe3d4ddc58bc400360aad8cea95e0d3ee74ceceb927cb3b82f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e57174c8d5e01e2bb52c6f5cd7863168085ff81bea970b5309ec180c2e1a299096dff2b36a7df3d0b4d63bbbc529b7a27282e5626300e1353d2596866e4a82165f644f00914f63181c0afbfff41a95f5f1364c61d78ffb250ec8ef3102b3d3bd7003a989289cd6df1b1c38dbda84eb3b286bb8fb7a2af9beb1e55b029dbf861bac83521a2e7ee2558d83e29bceb68a8c4ea0ecce4bddcb05cc0d3b0365522f126d1f19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcfe3be7066e6922d7460dea80ca5b7fef8f4abc7b1f056d8f329c03b306e8ca9b0788f1abb67d6f21cf299e2f67a2b414d169e8ab16cc8a61bf698e5c7f14829995e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f81979910c14d804efe1db9377bfe3d5e06ba37a4817cc4bd0f6404ed7d705219295e8151056554bca75450d07fcc5df7c1ca4686a2fefbe76cc9fb60343364678ca8744f2d7e93978c0991e376466810adf18262e4a7fb2864c7a87f22e3fa71adb6519496251bb063e4ee3769139a34ccfbdd81ba52b004836da7aaabd5e5e67f87478d00d85589908ba95536822dea356afb5a9148628a7e2207c6e850024c0ba434d928551a303110983871266af840df71bf7427dcff242688c105f04d4aa87806be2d67077cbcab70d47a95b8da25a2a35fe1f1099ed71d8b06f8e78dd741fc2b7d0703f8f70aff6e3975f3b7c8d037b5a0d3d1b8e4a91b2a6c65227c7932dded59e0468a7249fd6bc2b911434b0c7afa2a9d92473e2402a1a3ad357119c579d63fe72f76f147bce32338a4b0b88c3d59dd3e85406ab1b3b273aab7cb7227fae52964eceee84de3d0b8b3565100c1e45dab1b4b5ff7c61f03a198a56714c03ca32d8c04d3a6e6e5058c10a56890a9dcf41ac5e47a22dc1002e89415ee0f37c7f05

Malicious JARs and Polyglot files: “Who do you think you JAR?”

A new MuddyWater threat campaign was discovered by Deep Instinct. We analyze this threat below. 

MuddyWater-Blog.png

New MuddyWater Threat: Old Kitten; New Tricks

Polonium-APT-Group-blog.png

The Polonium APT group activity was first detected by <a href="https://www.microsoft.com/en-us/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/" target="_blank">Microsoft</a> in June 2022. The group is based in Lebanon and exclusively attacks Israeli companies.The group takes its name from chemical elements in the periodic table: “<a href="https://en.wikipedia.org/wiki/Polonium" target="_blank">Polonium</a> is a chalcogen. A rare and highly radioactive metal with no stable isotopes.”At the beginning of October 2022, <a href="https://www.welivesecurity.com/2022/10/11/polonium-targets-israel-creepy-malware/" target="_blank">ESET</a> published comprehensive research about the threat group, which <a href="https://github.com/eset/malware-ioc/tree/master/polonium" target="_blank">included</a> over a hundred hashes of malicious files. Of those files, 13 samples were found in public malware repositories that could be further analyzed.During the analysis of the public samples Deep Instinct’s threat research team discovered three additional samples from the Polonium arsenal that were not in the original files disclosed.Deep Instinct discovered that Polonium is using small components to make investigation more difficult, as well as a multi-step attack flow to make it harder to detect. The samples found by the Deep Instinct Threat Research reveal additional components and alternatives to the original Polonium attack tools. We outline the new methods below.<h3>#1: Additional MegaCreep Loader:</h3>In ESET’s report, they detail a MegaCreep loader (md5: 287007b3b0c0762f79e3b8a1cf2cef86) that calls “MainZero,” an external component file that, according to ESET, contains the main code of the MegaCreep backdoor.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt58f28e95223a9e65" alt="Figure 1: On the Right – New MegaCreep loader, On the Left – MegaCreep loader analyzed by ESET" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt58f28e95223a9e65/638e7680196547511e1c392e/fig01-new-megacreep-loader.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: On the Right – New MegaCreep loader, On the Left – MegaCreep loader analyzed by ESET</figcaption></figure>The “new” file discovered by Deep Instinct (md5: 19fe1fd29122a5092f7b680e5762fc19) is most likely another loader for MegaCreep. The main difference between the two is that the new loader found doesn’t have functionality by itself to create a service for persistence.However, thanks to the “End-user Sightings” feature in VirusTotal, we can see that the version without the service has an auto-start registry key persistence named “MicrosoftMegUpdate.”<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt294e3a195ca15b9d" alt="Figure 2: MicrosoftMegUpdate persistence" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt294e3a195ca15b9d/638e7680b250891091612361/fig02-MicrosoftMegUpdate_-persistence.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: MicrosoftMegUpdate persistence</figcaption></figure>The paths where the file has been observed on disk are in Users AppData subfolders:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltec660442e09b0027" alt="Figure 3: Paths “TaskManager.exe” has been observed in the wild, VirusTotal." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec660442e09b0027/638e76809ec8cb5e23a5b1e3/fig03-paths-taskmanager-exe-observed-in-wild.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Paths “TaskManager.exe” has been observed in the wild, VirusTotal.</figcaption></figure>To visualize the connections between the components we created a Maltego graph:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt0e4bff5a6654ae7e" alt="Figure 4: Relationship graph between MegaCreep Loader and its components" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0e4bff5a6654ae7e/638e7680c1672c63e5e718bc/fig04-relationship-graph-megacreep-loader.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Relationship graph between MegaCreep Loader and its components</figcaption></figure>Since “MainZero” is not publicly available, this graph could be missing additional components.There is also a possibility that a few different versions of MainZero exist.<h3>#2: Additional files of possible new “Creepy” malware:</h3>While hunting for additional files, Deep Instinct identified two additional files used by Polonium.Those two files, along with the MegaCreep loader we mentioned earlier, were uploaded on the same day, seconds apart, from Israel, using Sysinternals:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt570ade9f628c8572" alt="Figure 5: VirusTotal results of files uploaded from Israel at 2022-09-23 16:01" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt570ade9f628c8572/638e7680b6458e671e0c0157/fig05-virustotal-results.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: VirusTotal results of files uploaded from Israel at 2022-09-23 16:01</figcaption></figure>This most likely shows that someone was doing initial triage on infected systems.The additional files are also written in .NET, as is most Polonium malware. Moreover, the files appeared in the same machine as the “MegaCreep” loader we mentioned earlier:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt15bc55dc4295ffd6" alt="Figure 6: Paths “RLVBUp.exe” has been observed in the wild" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt15bc55dc4295ffd6/638e7680b477ba0429bf0cbb/fig06-paths-rlvbup-exe-observed-in-wild.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: Paths “RLVBUp.exe” has been observed in the wild</figcaption></figure>It’s interesting to note that although Polonium reuses the same file on multiple computers, they randomize the paths where they run the malware from, as can be seen in figure 5. However, it always seems to be in some sub-folder under “AppData.”Both files also use the “Microsoft.VisualBasic.CompilerServices” library and import external components named ClassVB.dll or ClassVB2.dll. This could indicate that they used a VisualBasic component and not just C#.The ClassVB DLLs are also not publicly available, therefore, the exact functionality is unknown. They might be a variant of “MegaCreep” or a possible previously unidentified “VBCreep” backdoor.<h3>#3: RLVB.exe:</h3>The code of this file is very short; it is a loader for the main functionality which resides in “ClassVB.dll.”<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltc0a2a46dc730badc" alt="Figure 7: RLVB code thar is using external ClassVB component" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc0a2a46dc730badc/638e768069941f33dd187d8e/fig07-rlvb-code-thar-using-external-classvb.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7: RLVB code thar is using external ClassVB component</figcaption></figure>This file also has an auto-start registry key, but under “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CLVBUpdate”RLVBUp.exe This file also uses VisualBasic and imports an external file with a similar name to the one in “RLVB.exe.”An auto-start registry key under “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CLVB11Update” exists here as well.This file imports “PRLib.dll” which is mentioned in ESET research as part of “MegaCreep.”<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltba100281c55838f1" alt="Figure 8: RLVBUp code that is using external ClassVB2 component and PRLib" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltba100281c55838f1/638e76812253035cc6d42d2f/fig08-rlvbup-code-using-external-classvb2-prlib.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: RLVBUp code that is using external ClassVB2 component and PRLib</figcaption></figure>RLVBUp reads/writes data from two external files named “WindMin.dll” and “UnInstall.dll:”<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltfac233ee317c1c56" alt="Figure 9: RLVBUp code thar is using external files “WindMin.dll” and “UnInstall.dll”" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfac233ee317c1c56/638e7681b03b1e106d29c87f/fig09-rlvbup-code-thar-using-external-files-windmin-dll-uninstall-dll.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: RLVBUp code thar is using external files “WindMin.dll” and “UnInstall.dll”</figcaption></figure>The replace function with “##” is <a href="https://www.welivesecurity.com/wp-content/uploads/2022/10/Figure-8.-Example-of-MegaCreep-calling-methods-from-separate-DLLs.png" target="_blank">similar</a> to the one in “MegaCreep.”Most of the external libraries are custom and not publicly available. Therefore, their functionality is not fully uncovered.Since “RLVBUp” uses “PRLib,” “RLVBUp” might be a module related to “MegaCreep” or a shared module among different Polonium backdoors.To visualize all the currently known connections we made another Maltego graph:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt9109d3b8387fbb20" alt="Figure 10: Relationship graph between Files using PRlib" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9109d3b8387fbb20/638e7680e133455e0fe8d89b/fig10-relationship-graph-between-files-using-prlib.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Relationship graph between Files using PRlib</figcaption></figure><h3>Conclusion</h3>Polonium was uncovered only recently and is focused on attacking Israeli companies exclusively.Mapping all the known components for their attack tools will help security teams identify similar activity and may lead to uncovering the missing puzzle parts.<h3>IOC</h3><table><thead class="bg-grey"><tr><th>Filename</th><th>MD5 Hash</th></tr></thead><tbody><tr><td>TaskManager.exe</td><td>19fe1fd29122a5092f7b680e5762fc19</td></tr><tr><td>RLVB.exe</td><td>dbec8d9a3ea34d69733e7f5f5134f62d</td></tr><tr><td>RLVBUp.exe</td><td>a544bb442fe4342e300bc8beaef66796</td></tr></tbody></table>&nbsp;

Announcing DSX for Cloud - Amazon S3, natively integrated zero-day data security for AWS S3.

Simon Kenin

From Simon Kenin.