More_eggs

As with most external attacks, phishing emails containing a malicious compressed zip file appears to be the primary delivery method.

The email attachment file analyzed by our team (screenshots-9201.jpg.zip) contains two shortcut files “ Screenshot-9501.JPG.lnk ” and “ Screenshot-9502.JPG.lnk ” disguised as jpeg.

The operators then send a link leading to a mock resume PDF through the organization‘s recruitment platform (e.g. Indeed, LinkedIn, or the organization‘s own career web page). The PDF purports to be broken, offering an embedded link to the malicious VenomLNK file on the branding website.

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

TerraLoader is a heavily obfuscated JavaScript loader which allows for command and control (C2) functionality on the affected host.

Persistence: Establish a registry foothold: ActXobj1.RegWrite("HKCU\\Environment\\UserInitMprLogonScript", ‘cscript /b /e:jscript “%APPDATA%\\Microsoft\\’ + PersFileName + ‘”‘);

Persistence: Establish a registry foothold: ActXobj1.RegWrite("HKCU\\Environment\\UserInitMprLogonScript", ‘cscript /b /e:jscript “%APPDATA%\\Microsoft\\’ + PersFileName + ‘”‘);

Defense Evasion T1027 Obfuscated Files or Information More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

This is done by using a common LOLbin technique which leverages the Windows binary file Ie4uinit.exe.

AppleSeed can call regsvr32.exe for execution. APT19 used Regsvr32 to bypass application control techniques. APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.

Msxsl.exe execution [T1220] In another effort to maintain persistence on the host, the script would leverage the msxsl.exe LOLbin to re-run this particular script file and then sleep.

Long sleeps [T1497.003] In an effort to evade heuristic detection and as an anti-debugging measure, malware may incorporate long sleep times... typeperf.exe "\\System\\Processor Queue Length" -si {sleep time in seconds} -sc 1

More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

Long sleeps [T1497.003] In an effort to evade heuristic detection and as an anti-debugging measure, malware may incorporate long sleep times... typeperf.exe "\\System\\Processor Queue Length" -si {sleep time in seconds} -sc 1

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Andariel has collected large numbers of files from compromised network systems for later extraction... APT28 has retrieved internal documents from machines inside victim environments... BADNEWS crawls the victim's local drives and collects documents... many listed groups and malware collect files, documents, credentials, payment card data, or other information from compromised hosts.

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic. More_eggs has used basE91 encoding, along with encryption, for C2 communication. Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

use the backdoor as a foothold into the victim’s network so as to exfiltrate data

Once accessed, the hackers exfiltrate data from the victim organization, spread to other computer hosts via TeamViewer, and encrypt files.