Raccoon Stealer

Volt Typhoon has obtained the victim's system current location.

This attack – known as ‘malvertising’ – is often aimed at users looking to download popular software applications.

[ATK-16] Malvertising

Selon Group-IB, les cybercriminels s’appuient également sur ... la prise de contrôle de médias sociaux pour disséminer les logiciels malveillants.

There is increasing interplay between social engineering and stolen credentials... These credentials can enable initial access directly or support more convincing social engineering attempts by allowing attackers to reference internal systems or mimic legitimate employee behavior.

Scattered Spider’s powerful initial access tactics ... include phone calls, SMS phishing, email phishing, MFA fatigue attacks, and SIM swapping. The domains used for email and SMS phishing abuse the Okta and Zoho ServiceDesk brands combined with the target’s name to make them appear legitimate.

When a user searches for a related term and clicks through to the malicious site, the attackers check the Referer header to confirm the user has come from a search engine, and then entice them into downloading malware disguised as a legitimate software application.

Les cybercriminels intègrent par exemple des liens permettant de télécharger des malwares dans des critiques de jeux populaires ou dans des loteries sur les médias sociaux.

There is increasing interplay between social engineering and stolen credentials... These credentials can enable initial access directly or support more convincing social engineering attempts by allowing attackers to reference internal systems or mimic legitimate employee behavior.

There is increasing interplay between social engineering and stolen credentials... These credentials can enable initial access directly or support more convincing social engineering attempts by allowing attackers to reference internal systems or mimic legitimate employee behavior.

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

There is increasing interplay between social engineering and stolen credentials... These credentials can enable initial access directly or support more convincing social engineering attempts by allowing attackers to reference internal systems or mimic legitimate employee behavior.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

The downloaded file was a VHD container which, when mounted, revealed Installer.bat, a batch file containing simple commands intended to raise execution privileges; add scanning exclusions for Windows Defender; and download and execute a remote batch script and an executable.

When successfully deployed and executed, information-stealing malware can harvest credentials (usernames, passwords, and session cookies) from infected environments and export them as logs to the attackers’ server.

These logs can hold credentials and tokens present on the compromised device, including corporate VPN, email, cloud, and SSO accounts... attackers authenticate with legitimate credentials, even bypassing MFA if they have a session cookie.

When successfully deployed and executed, information-stealing malware can harvest credentials (usernames, passwords, and session cookies) from infected environments and export them as logs to the attackers’ server.

The content repeatedly describes threat actors and malware stealing usernames, passwords, cookies, session tokens, and other saved credentials from web browsers such as Chrome, Firefox, Internet Explorer, Edge, Opera, Safari, and Yandex.

The content repeatedly describes malware and threat actors querying, enumerating, searching, reading, or checking Windows Registry keys and values, e.g., "ADVSTORESHELL can enumerate registry keys," "APT41 queried registry values to determine items such as configured RDP ports and network configurations," and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.

The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

T1087.004: Account Discovery: Cloud To establish a foundational understanding of the target environment, a threat actor might first locate the identities operating within it... AzureHound parameters that facilitate the MITRE technique Account Discovery: Cloud Account include the following: list users list devices list device-owners list service-principals list service-principal-owners

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.

DarkGate queries system locale information during execution. Later versions of DarkGate query GetSystemDefaultLCID for locale information to determine if the malware is executing in Russian-speaking countries.

Confucius has used a file stealer to steal documents and images... Patchwork developed a file stealer to search C:\ and collect files with certain extensions... Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.

Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information... AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration... Ember Bear engages in mass collection from compromised systems during intrusions.

These are packaged into logs and sold, validated by intermediaries, and eventually monetized as enterprise access

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

The batch script downloaded Raccoon Stealer, a prominent commodity infostealer, and Gozi/Ursnif, a backdoor.

Examples include: "FIN4 has used HTTP POST requests to transmit data," "SolarWinds Compromise, APT29 used HTTP for C2 and data exfiltration," and "PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server."

- 08.20.2019 16:56:51 Release date Panel is ready Cryptolocker is ready ... - 10.02.2019 15:28:23 1.6 ransomware update changed encryption algorithm added our own key generator (not pseudo keys)