URSNIF

Danabot operators upload other malware to their infrastructure for further spreading.

distributing large volumes (of spam, exploit kit, bundle…)

TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020. More recently, they have delivered Pikabot and DarkGate malware.

The most common vectors for TA544 campaigns are messages with Microsoft Office documents that contain macros, that, when enabled, install URLZone and/or Ursnif.

The operators are known to use that feature to maintain a constant feed of fresh login credentials for SMTP accounts, plus a list of valid emails to spam.

It may be delivered via password-protected Zip files; Microsoft Office document attachments with malicious macros; or compressed JScript, JavaScripts, or Visual Basic scripts.

Ursnif 4779 is deployed via one of two primary methods: (1) Microsoft Excel attachments with malicious macros... or (2) steganographic images that conceal malicious PowerShell commands which install Ursnif.

There is no indication of TA544 abandoning their primary payload delivery mechanism (malicious Microsoft Office VBA macros), although we have seen an increase in the use of steganographic images.

By relying on basic social engineering – an attack technique that takes advantage of human traits such as curiosity, trust and greed in order to obtain confidential information or to have the victim perform a certain action – it is suffice to say that certain threat actors (both criminal and nation state) are exploiting these unprecedented times for various nefarious means.

These messages often contain Microsoft Excel Documents with macros, that when enabled, download and install URLZone and/or Ursnif 1000.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Thread Local Storage (TLS) callback injection is a technique that entails manipulating pointers within a portable executable (PE) to redirect a process to malicious code before it reaches the code’s legitimate entry point.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

When the user enables the document macro, the obfuscated code downloads and installs malware, usually URLZone and/or Ursnif as noted above.

One notable characteristic of TA544 is their use of steganography, which is the process of concealing code within images.

Thread Local Storage (TLS) callback injection is a technique that entails manipulating pointers within a portable executable (PE) to redirect a process to malicious code before it reaches the code’s legitimate entry point.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

It filters out security researchers and sandboxes using checks including Maxmind, task counts, task names, and recent file counts.

Most Ursnif 1000 campaigns use a robust combination of geofencing techniques to verify that users are located in Japan.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. APT28 has used the WindowStyle parameter to conceal PowerShell windows.

Dreambot provides the needed credentials / keylogging / VNC / SOCKS

the malware injects itself into the web browser and capture every HTTP POST request, which makes credential and stealing credit card easy.

After the infection, a webinject is deployed by Dreambot on the victim browsers and when that victims logs into the online banking service, credentials are intercepted to be later reused by the carder.

Victims fingerprinting : the malware can collect local information about the victim computer, OS type, IP address, computer name, list of Anti-Virus applications, check if the computer is attached to a Domain Controller etc.

It filters out security researchers and sandboxes using checks including Maxmind, task counts, task names, and recent file counts.

Most Ursnif 1000 campaigns use a robust combination of geofencing techniques to verify that users are located in Japan.

Dreambot provides the needed credentials / keylogging / VNC / SOCKS

the malware injects itself into the web browser and capture every HTTP POST request, which makes credential and stealing credit card easy.

After the infection, a webinject is deployed by Dreambot on the victim browsers and when that victims logs into the online banking service, credentials are intercepted to be later reused by the carder.

The main feature of the module is injecting code into the web browser that will monitor which websites the victims are visiting. If a banking website is identified, ISFB injects a small snippet of JavaScript into the online banking website to steal the login credentials.

Some used RC6 some Serpent for the same bot version.

Indicators the NetmanageIT Threat Intelligence team shared about a June 2023 Ursnif campaign targeting Italy report many remote destinations hosting Ursnif tier 1 command and controls sharing the same hostname

In the log we can see that: A client 96.57.xx.xxx Sent a web request “GET tuneappservice.org/l3k42hj56h634gkj2lk14356jk4gh23k5jl6h4/gate.php?ped=RTY3M0E4NjhDQ0I5JE1DLTEwNw” We can see here what looks like a malware callback, it’s in fact Riltok.

That’s why carders use a VNC connection to the victim's computer or a SOCKS proxy to tunnel their connection. Dreambot offers both of those techniques by design.

The service is described as a Fast flux but in reality it’s more a simple proxy system. BraZZZers rents a pool of VPSs all around the internet and uses them as proxy IPs in order to hide the real IP of a server.

with the first integration of Tor onion as available C2.

One of the very important features of Dreambot is the capability to drop a 2nd stage implant to any infected bot.

When a victim is infected by Dreambot, a VNC connection and/or a SOCKS proxy is set-up on the victim computer... he will connect directly to the victim's computer by using that VNC server and just like that he would be on the same computer at the same time with the victim, operating over a hidden desktop.

The domains involved are resolving to a list of IPs, (we observed from 1 up to more than 20 IPs per domain) that are just redirecting the traffic to the real server.

The story we are writing here will try to explain how, from a simple mistake made by an operator, we managed to collect and exploit a lot of precious information from a “Fast Flux” network called BraZZZerS Fast Flux between end of 2018 and 2022.

On top of the usual .top domains used as CnC gateway, we saw the infrastructure hosting shops like larek.info or magazzz.top

File stealer: A module that makes exfiltration of specific files from the victims hard drive possible.

TA551 is a threat actor tracked by Proofpoint since 2016. This actor frequently leverages thread hijacking to distribute malicious Office documents via email.