MalwareExploits 1 CVE

Sobaken RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0199Microsoft Office and WordPad Remote Code Execution VulnerabilityExploited in the wild

Among these tricks are using right-to-left override to obscure the attachments’ real extension, email attachments disguised as RAR self-extracting archives, and a combination of a specially crafted Word document carrying a CVE-2017-0199 exploit. | Sobaken is a heavily modified version of the Quasar RAT.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The analyzed campaigns have been based on basic social engineering, but also using several tricks to better lure the victims into downloading and executing the malware, served as email attachments.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

Then, it creates a scheduled task that runs the payload every 10 minutes to ensure its persistence.

T1059Command and Scripting InterpreterEvidence1

a dropper drops a malicious payload file (Vermin, Quasar or Sobaken malware) into the %APPDATA% folder

T1203Exploitation for Client ExecutionEvidence1

and a combination of a specially crafted Word document carrying a CVE-2017-0199 exploit

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Then, it creates a scheduled task that runs the payload every 10 minutes to ensure its persistence.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Then, it creates a scheduled task that runs the payload every 10 minutes to ensure its persistence.

Stealth

4 techniques

T1036MasqueradingEvidence1

Among these tricks are using right-to-left override to obscure the attachments’ real extension | Among these tricks are using right-to-left override to obscure the attachments’ real extension, email attachments disguised as RAR self-extracting archives

T1497Virtualization/Sandbox EvasionEvidence1

To make sure that the malware runs on targeted machines only and avoids automated analysis systems and sandboxes, the attackers have deployed several measures.

T1497.001System ChecksEvidence1

The malware terminates if neither Russian or Ukrainian keyboard layouts are installed, and also if the target system’s IP address is located outside these two countries

T1497.003Time Based ChecksEvidence1

To determine whether it is run in an automated analysis system, it tries to reach a randomly generated website name/URL and checks if the connection to the URL fails, as would be expected on a real system.

Discovery

3 techniques

T1497Virtualization/Sandbox EvasionEvidence1

To make sure that the malware runs on targeted machines only and avoids automated analysis systems and sandboxes, the attackers have deployed several measures.

T1497.001System ChecksEvidence1

The malware terminates if neither Russian or Ukrainian keyboard layouts are installed, and also if the target system’s IP address is located outside these two countries

T1497.003Time Based ChecksEvidence1

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

they share parts of their infrastructure and connect to the same C&C servers.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Jul 17, 2018

Vermin one of three RATs used to spy on Ukrainian government institutions

A heavily modified version of Quasar RAT used in the same espionage campaign. Functionality was removed to reduce size, while anti-sandbox and other evasion techniques were added.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Sobaken RAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-0199Microsoft Office and WordPad Remote Code Execution VulnerabilityExploited in the wild

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence1

The analyzed campaigns have been based on basic social engineering, but also using several tricks to better lure the victims into downloading and executing the malware, served as email attachments.

Execution

3 techniques

T1053.005Scheduled TaskEvidence1

Then, it creates a scheduled task that runs the payload every 10 minutes to ensure its persistence.

T1059Command and Scripting InterpreterEvidence1

a dropper drops a malicious payload file (Vermin, Quasar or Sobaken malware) into the %APPDATA% folder

T1203Exploitation for Client ExecutionEvidence1

and a combination of a specially crafted Word document carrying a CVE-2017-0199 exploit

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Then, it creates a scheduled task that runs the payload every 10 minutes to ensure its persistence.

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Then, it creates a scheduled task that runs the payload every 10 minutes to ensure its persistence.

Stealth

4 techniques

T1036MasqueradingEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

To make sure that the malware runs on targeted machines only and avoids automated analysis systems and sandboxes, the attackers have deployed several measures.

T1497.001System ChecksEvidence1

The malware terminates if neither Russian or Ukrainian keyboard layouts are installed, and also if the target system’s IP address is located outside these two countries

T1497.003Time Based ChecksEvidence1

Discovery

3 techniques

T1497Virtualization/Sandbox EvasionEvidence1

To make sure that the malware runs on targeted machines only and avoids automated analysis systems and sandboxes, the attackers have deployed several measures.

T1497.001System ChecksEvidence1

The malware terminates if neither Russian or Ukrainian keyboard layouts are installed, and also if the target system’s IP address is located outside these two countries

T1497.003Time Based ChecksEvidence1

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

they share parts of their infrastructure and connect to the same C&C servers.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Jul 17, 2018

Vermin one of three RATs used to spy on Ukrainian government institutions

A heavily modified version of Quasar RAT used in the same espionage campaign. Functionality was removed to reduce size, while anti-sandbox and other evasion techniques were added.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.