Malware

TelAndExt

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

We first encountered a document with the name ... .docx ... The above document leverages the external template technique, allowing it to load a document template from a remote server ... After the victim opens the document and the remote template is downloaded, the malicious macro code in the template executes a batch script which tries to download and execute the next stage payload

Execution

2 techniques

T1204User ExecutionEvidence1

After the victim opens the document and the remote template is downloaded, the malicious macro code in the template executes a batch script

T1574Hijack Execution FlowEvidence1

The hidden trick of the malware’s persistence method is changing the default Telegram updater file – Telegram Desktop\Updater.exe , with one of its dropped payloads

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence The malware sets the registry key which is in the <Reg> value of the configuration file (which is almost always the key RunOnce )

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence The malware sets the registry key which is in the <Reg> value of the configuration file (which is almost always the key RunOnce )

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

The hidden trick of the malware’s persistence method is changing the default Telegram updater file – Telegram Desktop\Updater.exe , with one of its dropped payloads

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

Uploads relevant Telegram files from victim’s computer. These files allow the attackers to make full usage of the victim’s Telegram account

Command and Control

2 techniques

T1071.002File Transfer ProtocolsEvidence1

Uses FTP instead of SOAP for data exfiltration ... communicates with an FTP server using hard-coded credentials

T1105Ingress Tool TransferEvidence1

the malicious macro code in the template executes a batch script which tries to download and execute the next stage payload ... The program tries fetching updates for its current modules and also download several additional modules

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

Uses FTP instead of SOAP for data exfiltration ... The malware uses FTPS with hard-coded credentials ... uploads files to its C2 domain using the FTP protocol

INDICATORS OF COMPROMISE

IOCs tracked for this family

22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 years ago

hash.sha1●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

hash.md5●●●●●●●●●●●●View more in app6 years ago

hash.sha1●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

checkpoint research blogNews

Sep 18, 2020

Rampant Kitten - An Iranian Espionage Campaign - Check Point Research

Older Delphi-based Windows Telegram-focused infostealer closely related to TelB. It steals Telegram data, uses FTP for exfiltration, and persists through Telegram updater abuse.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching22

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

TelAndExt

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

Execution

2 techniques

T1204User ExecutionEvidence1

After the victim opens the document and the remote template is downloaded, the malicious macro code in the template executes a batch script

T1574Hijack Execution FlowEvidence1

The hidden trick of the malware’s persistence method is changing the default Telegram updater file – Telegram Desktop\Updater.exe , with one of its dropped payloads

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence The malware sets the registry key which is in the <Reg> value of the configuration file (which is almost always the key RunOnce )

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

Persistence The malware sets the registry key which is in the <Reg> value of the configuration file (which is almost always the key RunOnce )

Stealth

1 technique

T1574Hijack Execution FlowEvidence1

The hidden trick of the malware’s persistence method is changing the default Telegram updater file – Telegram Desktop\Updater.exe , with one of its dropped payloads

Credential Access

1 technique

T1528Steal Application Access TokenEvidence1

Uploads relevant Telegram files from victim’s computer. These files allow the attackers to make full usage of the victim’s Telegram account

Command and Control

2 techniques

T1071.002File Transfer ProtocolsEvidence1

Uses FTP instead of SOAP for data exfiltration ... communicates with an FTP server using hard-coded credentials

T1105Ingress Tool TransferEvidence1

Exfiltration

1 technique

T1048Exfiltration Over Alternative ProtocolEvidence1

Uses FTP instead of SOAP for data exfiltration ... The malware uses FTPS with hard-coded credentials ... uploads files to its C2 domain using the FTP protocol

INDICATORS OF COMPROMISE

IOCs tracked for this family

22 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app6 years ago

hash.sha1●●●●●●●●●●●●View more in app6 years ago

hash.sha256●●●●●●●●●●●●View more in app6 years ago

hash.md5●●●●●●●●●●●●View more in app6 years ago

hash.sha1●●●●●●●●●●●●View more in app6 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

checkpoint research blogNews

Sep 18, 2020

Rampant Kitten - An Iranian Espionage Campaign - Check Point Research

Older Delphi-based Windows Telegram-focused infostealer closely related to TelB. It steals Telegram data, uses FTP for exfiltration, and persists through Telegram updater abuse.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching22

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.