di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

chatgpt-malicious-wishes-blog.png

Listing preview

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

image_media_card

Malicious JARs and Polyglot files: “Who do you think you JAR?”

New MuddyWater Threat: Old Kitten; New Tricks

Polonium APT Group: Uncovering New Elements

Emotet’s Vacation is Over: No Rest for the Wicked

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Malicious Office files: 20+ Years of Microsoft Office Exploits

MIT Explores How Deep Learning is Transforming Cybersecurity

Trending at Deep Instinct

carousel_cards

listing_preview

VSTO-blog.png

<h3>Introduction</h3>Office Visual Basic for Applications (VBA) macros have been a <a href="/blog/types-of-dropper-malware-in-microsoft-office" target="_self">core tool</a> in most threat actors’ arsenals for decades.Their capabilities have enabled clever — and just <a href="https://www.trustedsec.com/blog/malicious-macros-for-script-kiddies/" target="_blank">clever-enough</a> — threat actors to deliver a dizzying array of malware to countless devices around the world. During that time, they have served as what is quite possibly the most commonplace attack vector to infect and compromise Windows PCs. They also acted as a significant component of the first link in a malicious kill-chain that resulted in network compromises, data breaches, and ransomware incidents.This threat landscape prominence has recently been stifled by Microsoft’s long-awaited decision to <a href="https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked" target="_blank">block-by-default</a> any VBA macro in Office files bearing the mark-of-the-web (indicating that the file did not originate from the local machine). This significantly reduced this attack surface and forced threat actors to adapt and explore alternative attack vectors.One of these, which is gaining popularity, is the usage of .LNK (shortcut) files. An example of this can be seen in one of our <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">recent reports</a>.Another such example is Visual Studio Tools for Office (VSTO). Below we explore some “in-the-wild” examples of how VSTO can become a significant attack vector.<h3>What is VSTO?</h3>A software development toolset, VSTO is available in Microsoft’s Visual Studio IDE. It enables Office Add-In’s (a type of Office application extension) to be developed in .NET and also allows for Office documents to be created that will deliver and execute these Add-In’s.Additionally, VSTO Add-In’s can be associated with the specific Office application they were developed for (Word, Excel, etc.) and will execute every time that application is booted, offering up an interesting persistence option on top of the code-execution ability.VSTO Add-In’s can be packaged alongside Office documents (Local VSTO), or, alternatively, fetched from a remote location when a VSTO-Bearing Office document is opened (Remote VSTO). This, however, may require bypass of trust-related security mechanisms.<h3>VSTO as a Threat Vector</h3>In the current threat landscape’s observed state, VSTO is still an uncommon vector (despite being initially <a href="https://bohops.com/2018/01/31/vsto-the-payload-installer-that-probably-defeats-your-application-whitelisting-rules/" target="_blank">discussed</a> quite <a href="https://twitter.com/gN3mes1s/status/939146796605018113" target="_blank">some time ago</a>). But as is often the case when an esoteric attack vector is involved, it also goes largely undetected by most security vendors, which may lead to it increasing in popularity in the near-term future.VSTO-bearing Office files contain several indicators which differentiate them from non-VSTO Office files, the primary of which is a contained “custom.xml” XML which contains “_AssemblyLocation” and “_AssemblyName” properties used by the Office application to locate the Add-In and install it.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltae692c45fce8c9be" alt="Figure 1 - Example of a " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltae692c45fce8c9be/63da8c54df2bf910c80316e8/fig01-custom-xml-referring-local-vsto-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1 - Example of a "custom.xml" XML referring to a local VSTO Add-In.</figcaption></figure><h3>Local VSTO</h3>When VSTO is employed in its local “flavor” the .NET compiled .DLL “Add-In” and its dependencies are stored alongside the Office document created to execute it, commonly in a “container” such as an .ISO file.In the example detailed below, which targets Portuguese-speaking users, we can see a malicious .ISO file which contains a malicious Word document and a hidden VSTO “Add-In” and its dependencies:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt54d82b8f46d9881c" alt="Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt54d82b8f46d9881c/63da8c54c8540a111ada8b4b/fig02-malicious-iso-hidden-files-not-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blta83b367d030dd885" alt="Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta83b367d030dd885/63da8c545b2c1e6188c56ec2/fig03-malicious-iso-hidden-files-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO "Add-In" payload.</figcaption></figure>Once the victim opens the malicious Word document, they are encouraged to install the “Add-In” in a very similar fashion to the way victims were encouraged to click the “Enable Content” button and allow a malicious VBA macro to execute.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt41d8d794383d1aa8" alt="Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41d8d794383d1aa8/63da8c540cf395166a6e22fb/fig04-word-doc-prompts-user-to-allow-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow "Add-In" installation.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt1785537237489441" alt="Figure 5 - Malicious " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1785537237489441/63da8c54e480c910d1acbbb7/fig05-malicious-custom-xml-contained-by-eventos-referring-to-hidden-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5 - Malicious "custom.xml" contained by “Eventos_CDG_1Maio.docx” referring to the hidden “Add-In” present locally on the .ISO file.</figcaption></figure>Once allowed by the user, the malicious “Add-In” will be executed.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltfd8952f6b1cd8776" alt="Figure 6 - VSTO installation prompt." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfd8952f6b1cd8776/63da8c542d94ad4c89edc84d/fig06-vsto-installation-prompt.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6 - VSTO installation prompt.</figcaption></figure>Examining the “Add-In” payload reveals it serves to execute an encoded and compressed PowerShell snippet:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltff7e2e81ed5f2a4f" alt="Figure 7 - " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff7e2e81ed5f2a4f/63da8c544ad09d10da61ae0b/fig07-eventos_cdg_1maio.dll-payload-core.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7 - "Eventos_CDG_1Maio.dll” payload “core”.</figcaption></figure>An interesting point of note is that the above code’s parent .NET namespace is “schell_test.” This appears to be a reference to a <a href="https://medium.com/@airlockdigital/make-phishing-great-again-vsto-office-files-are-the-new-macro-nightmare-e09fcadef010" target="_blank">post by Daniel Schell</a>, which predates the appearance of this sample by approximately two weeks.Decoding and decompressing from the above, the snippet is intended to deliver and execute additional PowerShell code from a Command & Control server:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt2deb8b0052b3ec77" alt="Figure 8 - Decoded and decompressed PowerShell snippet." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2deb8b0052b3ec77/63da8c543d28dd4dde642bc5/fig08-decoded-and-decompressed-powershell-snippet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8 - Decoded and decompressed PowerShell snippet.</figcaption></figure>Unfortunately, we were unable to obtain this additional 2nd-stage code as it had gone offline prior to our investigation of this sample.<h3>Remote VSTO</h3>VSTO can also be employed in remote fashion, i.e., the Add-In can be stored separately of the Office document created to deliver and execute it. This can make an attack employing VSTO even more challenging to detect or prevent. However, it can also be more complex for an attacker to execute because it requires bypassing various trust-related security mechanisms using a trusted publisher certificate, for example.In the example below, we can see a reference to a remotely stored VSTO “Add-In” taken from a malicious Word document:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltf4e068fa4bdd09dc" alt="Figure 9 - Remote VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4e068fa4bdd09dc/63da8c545ca8a710cf4b7226/fig09-remote-vsto-custom-xml.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9 - Remote VSTO "custom.xml" XML.</figcaption></figure>Examining the “Add-In” .DLL payload, which was obtained by cross-referencing threat intelligence data, we can see the following contained code which is intended to download a password protected .ZIP archive, extract it in the user’s %\AppData\Local\ folder, and execute a contained “conhost.exe” file.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt29d36f5d1f3a9676" alt="Figure 10 - “3rd stage” payload delivery and execution code." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt29d36f5d1f3a9676/63da8c54e4e29e75dc5df0ee/fig10-3rd-stage-payload-delivery-and-execution-code.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10 - “3rd stage” payload delivery and execution code.</figcaption></figure>Unfortunately, we were unable to obtain the 3rd-stage archive and its contained payload (“conhost.exe”) as it had gone offline prior to our investigation of this sample.<h3>POC of VTSO Attack Scenarios</h3>Partly as an academic exercise, and partly because the final payloads related to the above-described samples were unavailable, we decided to put together a proof of concept (POC) of how VSTO can be used in multiple types of attack scenarios.

In the above video, you can see a demonstration of our proof of concept delivering and executing a Meterpreter payload as well as establishing persistence on the victim’s machine.The POC code can be found in our public <a href="https://github.com/deepinstinct/VSTO-POC" target="_blank">GitHub repository</a>Please note that we used a simple, highly detectable, Meterpreter payload. This required us to disable <a href="/vs-microsoft-defender" target="_self">Microsoft Windows Defender</a> to film the above video. However, the rest of the POC components went completely undetected.<h3>Conclusion</h3>While VSTO Add-In's are relatively uncommon in the threat landscape due to the capabilities offered both in terms of execution (in theory – an entire fully-featured malware strain can be written and developed in .NET as a VSTO Add-In) and in terms of persistence, we expect more threat actors to adopt and employ them soon. This is particularly true of nation-state and other “high caliber” actors who are more likely to gain the ability to bypass the trust mechanisms present in the Windows environment by means such as a stolen (or otherwise obtained) trusted certificate.<h3>IOCs</h3>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930 E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48 0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151 B3282DC58AD961911D94B712CEA11F649B0BA785D7FF74D7ED9946E1260DD521 40C9D3D58CE5DB0C6D18184E5813C980CD7B72EFC7505C53CD13E60860EF8157 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C hxxps://34.241.171.114/ hxxp://classicfonts.live/<h3>MITRE Mapping</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>T1204.002User Execution: Malicious File</td><td>User must open a malicious document</td><td>E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48</td></tr><tr><td>Execution</td><td>T1059.001Command and Scripting Interpreter: PowerShell</td><td>PowerShell code is executed</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151</td></tr><tr><td>Defense Evasion</td><td>T1553.005Subvert Trust Controls: Mark-of-the-Web Bypass</td><td>.ISO container file used</td><td>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930</td></tr><tr><td>Defense Evasion</td><td>T1027Obfuscated Files or Information</td><td>Obfuscation used; Password protected file used.</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151, 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C</td></tr><tr><td>Persistence</td><td>T1137.006Office Application Startup: Add-ins</td><td>VSTO Add-In's may be used for persistence</td><td>E62E05D9DE5DAAB900FC32941727870C018D7CFD46E2BAC43EF360B80B3A0B31</td></tr></tbody></table>

No Macro? No Worries. VSTO Being Weaponized by Threat Actors

Since its release in November 2022, ChatGPT has been gaining popularity, being asked everything from how to explain quantum computing to writing a birthday poem. The big question on everyone’s mind in the cybersecurity industry: Will ChatGPT become a tool for attackers to create and accelerate more sophisticated attacks? Our research below demonstrates how dangerous ChatGPT can be in the wrong hands. There is also the potential for researchers to use this tool to thwart attacks and for software developers to improve their code. However, we did find the AI is better at creating malware than providing ways to detect it. As with most technological advances, malware authors have found ways to abuse ChatGPT to spread malware. Examples of malicious content created by the AI tool, such as phishing messages, information stealers, and encryption software, have all been shared online. OpenAI has taken several measures to prevent misuse of their new tool and implemented mechanisms that can help their software recognize when a user asks it to create malicious content/code. For example, if a person asked ChatGPT to write ransomware, the software checks for flagged words such as ‘steal’ and ‘ransom,’ and refuses to comply. However, as we demonstrate below, there is a way to get past these controls. It comes down to how you ask the question. <h3>It's All About Phrasing </h3>ChatGPT attempts to avoid providing malicious code. In the below image, you can see the reply I got when I asked the software to provide a Go keylogger: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf04bbd046f350972" alt="Figure 1: ChatGPT’s refusal to provide a keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf04bbd046f350972/63c8427ae6cd4a7779d9f929/fig01-chatgpt-refused-to-provide-keylogger.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: ChatGPT’s refusal to provide a keylogger</figcaption></figure> However, when I rephrased my request and described what the program should do, without using the word ‘keylogger,’ my request was fulfilled. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt198cc2bb388f3945" alt=" Figure 2: Successfully getting a Go keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt198cc2bb388f3945/63c8427a1864e26d0032af7d/fig02-chatgpt-successfully-creating-go-keylogger.png" height="auto" /><figcaption style = "text-align: center;" > Figure 2: Successfully getting a Go keylogger</figcaption></figure><h3>Go Eddie the AV Evader </h3>To see what other tricks this new puppy could do, and how well the anti-malware solution dealt with them, I decided to ask the AI for a more destructive malware — ransomware. For obvious reasons, I couldn’t just ask for ransomware outright and instead needed to beat around the bush a little in my request, as can be seen below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltd641b177c5591cf9" alt="Figure 3: Successfully getting a Go ransomware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd641b177c5591cf9/63c8427a3431f93ff7f79ecc/fig03-chatgpt-successfully-creating-go-ransomware.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Successfully getting a Go ransomware</figcaption></figure> The above reply was accompanied by a Go script which did everything that had been requested. All I needed to do was add two missing imports, change the default AES key, as well as the default string ChatGPT used as the dropped text files’ content, and I got a working piece of ransomware. I also removed the bot’s comments to make the program more difficult to detect. Then I compiled the scripts into PE32 and PE64 files, made sure they ran without any issues, and uploaded them to VirusTotal to check how well the anti-malware solutions dealt with them. The results were alarming. Only 4 out of 69 engines detected the PE32, and only 2 out of 71 caught the PE64 version. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt41a233c745211f9b" alt="Figure 4: The PE32 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41a233c745211f9b/63c8427a83026010f1038cae/fig04-pe32-variant-detection-rate-on-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 4: The PE32 variant’s detection rate on VirusTotal</figcaption></figure> <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1230d55deef0ef1d" alt="Figure 5: The PE64 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1230d55deef0ef1d/63c8427a08b84c3d9e4c9a63/fig05-pe64-variant-detection-rate-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 5: The PE64 variant’s detection rate on VirusTotal</figcaption></figure> The files may have been missed because the script that was compiled to create them was written in Go — an uncommon language that was chosen for this research precisely for this reason. Another possibility is that the simplicity of the ransomware, which uses a symmetric encryption algorithm (AES), doesn’t upload any files to a remote IP, like most modern ransomware does, and doesn’t avoid encrypting specific filetypes. In any case, this is still ransomware, and the inability of most anti-malware solutions to detect it, at least statically, demonstrates clearly how dangerous ChatGPT can be when in the wrong hands. <h3>Bug by Design </h3>As previously stated, I had to add imports to the Go ransomware to make it work. A similar thing happened when I asked ChatGPT to create the keylogger — it left the implementation of one of the functions to me, as can be seen in the image below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt747488b5780f7d87" alt="Figure 6: Omitted file transfer implementation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt747488b5780f7d87/63c8427ae97936109ef2be6d/fig06-omitted-file-transfer-implementation.png" height="auto" /><figcaption style = "text-align: center;" >Figure 6: Omitted file transfer implementation</figcaption></figure> I had suspected that this might not be a bug, but a way for the AI solution to avoid delivering functioning malware. The message below, which I received from the bot, just made me more confident in my assumption. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1ac3ef584c795933" alt="Figure 7: Information about message content" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1ac3ef584c795933/63c8427ab2a32b3f99e44c16/fig07-information-about-message-content.png" height="auto" /><figcaption style = "text-align: center;" >Figure 7: Information about message content</figcaption></figure> As you can see, ChatGPT was aware that the provided ransomware code could not be executed, and even knew which libraries were needed to make it run. This, combined with the answer I received after asking the AI why it hadn’t imported these libraries itself, strengthened my belief that the bot provided inexecutable code by design. <h3>Jekyll vs Hyde </h3>Even though ChatGPT can be used to create malware, it can also be used to help security researchers defend against malware. For example, by writing YARA rules to detect different attack techniques. In the below image, you can see an example of a YARA rule which was created to detect MITRE ATT&CK sub-technique T1055.002 (process injection). <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9aff6f0361088df1" alt="Figure 8: YARA rule to detect process injection, prone to false positives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9aff6f0361088df1/63c8427a1327af10d8774158/fig08-yara-rule-to-detect-process-injection-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 8: YARA rule to detect process injection, prone to false positives</figcaption></figure> This rule was too general and would likely generate a lot of false positives, so I asked the AI for a more specific rule and got the below reply. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte277265c707d0169" alt="Figure 9: YARA rule to detect process injection, prone to false negatives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte277265c707d0169/63c8427a7dbd6a1641ea2d84/fig09-make-above-yara-rule-less-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 9: YARA rule to detect process injection, prone to false negatives</figcaption></figure> This may generate less false positives, but it will also have more false negatives, meaning it will miss more malware that performs process injection. In any case, I wanted to check if the bot would write code that bypassed its own rule, and as can be seen below, even though it had some reservations, it did. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt96a5835ed986ed03" alt=" Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt96a5835ed986ed03/63c8427aca4ee4418bab9b69/fig10-chatgpt-agreement-to-write-malware-that-bypasses-its-own-yara-rule.png" height="auto" /><figcaption style = "text-align: center;" > Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule</figcaption></figure>Apparently, ChatGPT did such a good job at writing the malware that it failed to write a YARA rule that could detect its own work and provided a rule that was prone to false positives instead. All in all, it seems that the AI solution is better at creating malware than providing ways to detect it. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7f1475512190800e" alt="Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7f1475512190800e/63c842845156964aea434e3c/fig11-chatgpts-inability-to-write-yara-rule-to-detect-its-own-work.png" height="auto" /><figcaption style = "text-align: center;" >Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work</figcaption></figure><h3>ChatGPT as a Research and Analysis Tool </h3>Like many modern tools, ChatGPT has an API that allows third-party applications to query the AI and receive replies using a script instead of the online user interface. Some individuals have already used this API to create impressive open-source analysis tools that can make cybersecurity researcher's jobs a lot easier. Notable examples of such tools are <a href="https://github.com/JusticeRage/Gepetto" target="_blank">Gepetto</a> and <a href="https://github.com/moyix/gpt-wpre" target="_blank">GPT-WPRE</a>, which add meaningful comments to code decompiled using IDA and Ghidra, respectively. Another helpful tool is <a href="https://github.com/fr0gger/IATelligence" target="_blank">IATelligence</a>, a script that extracts the content of the Import Address Table (IAT) from PE files and adds information about MITRE ATT&CK techniques that can be implemented using the imported libraries. These are mere examples of the potential ChatGPT has as an analysis tool, and with some thought and effort this AI might even be able to integrate into SIEM systems and do much of the work currently done by tier-1 analysts. <h3>A Tangled Future </h3>While ChatGPT will not build malicious code for the everyday person who has no knowledge of how to execute malware, it does have the potential to accelerate attacks for those who do. I believe ChatGPT will continue to develop measures to prevent this, but as shown, there will be ways to ask the questions to get the results you are looking for. With the advances in AI-based solutions in general, and the capabilities ChatGPT has demonstrated, it seems that the future of malware creation and detection will be tangled with the advances in the AI field, and their availability to the public. Our opinion is that threat actors will continue to find ways to utilize these tools to their own advantage, and cybersecurity professionals, who from our research benefit less from these tools (at least as for now), will have to find new ways to defend against malware created with them. <h3>Hashes of Generated Ransomware </h3>894853e4422fcc697ec25dc4a6132cda800f66cd77994c0d4918bb7dec33bad3 eddie4-32.exe bedcf4cf0e16da111220f5239b55960847d3893f13a6db6aa7f97ca01150fc77 eddie4-54.exe

malicious-JARs-blog.png

Throughout 2022, Deep Instinct observed various combinations of <a href="https://en.wikipedia.org/wiki/Polyglot_(computing)" target="_blank">polyglot</a> files with malicious JARs.The initial technique dates to around 2018 when it used signed MSI files to bypass Microsoft code signing verification. A year later, in 2019, <a href="https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html" target="_blank">Virus Total</a> wrote about the MSI+JAR polyglot technique. Microsoft decided not to fix the issue at that time. Then in <a href="https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi" target="_blank">2020</a>, this technique was again abused in malicious campaigns and Microsoft assigned <a href="https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd" target="_blank">CVE-2020-1464</a> to address the issue.Despite being fixed, Deep Instinct observed in 2022 that the technique was still in use and included new types of polyglots which do not necessarily exploit the CVE; rather, attackers now use the polyglot technique to confuse security solutions that don’t properly validate the JAR file format.<h3>What is polyglot?</h3>A polyglot file is created by combining two or more file formats together in such a way that each format can be interpreted individually without an error.This is a little tricky as you can’t make polyglots from any arbitrary combination of file formats, although there are quite a few <a href="https://github.com/Polydet/polyglot-database" target="_blank">options</a> to choose from.<h3>Why JAR?</h3><a href="https://en.wikipedia.org/wiki/JAR_(file_format)" target="_blank">JAR</a> files are essentially ZIP archives. What’s special about ZIP files is that they’re identified by the presence of an end-of-central directory record which is located at the end of the archive. This means that any “junk” we append in the beginning of the file will be ignored and the archive is still valid.Other file formats have a special magic header at the beginning of the file, and they should be read from the start, unlike JAR. One of these formats is MSI.If those two are combined, we receive a file that is both a valid MSI and a valid JAR.<h3>The 2022 Campaigns</h3>Throughout 2022, Deep Instinct observed <a href="https://www.jaiminton.com/reverse-engineering/strrat" target="_blank">StrRAT</a> and <a href="https://www.youtube.com/watch?v=YJ8PZ6elyLE" target="_blank">Ratty</a> samples being distributed as polyglots or as JAR files with junk appended in the beginning.Both RATs are known threats. For StrRAT, there is a configuration extractor. For Ratty, we wrote a config extractor of our own, which we shared with the community in GitHub: <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">https://github.com/deepinstinct/RattyConfigExtractor</a>While we couldn’t determine whether the files belong to a single threat actor or to several threat actors, the usage of the Bulgarian hosting “BelCloud LTD” has been observed in many of the samples.Additionally, we found a few Ratty and StrRAT samples that shared the same C2 server.For simplicity we will categorize the files by what is appended to them.<h3>#1 MSI:</h3>Sample 5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991If we inspect the file with the Linux file command, we see it’s an MSI file:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2e9f9f745ae627ca" alt="Figure 1: Linux file identifies sample as MSI file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e9f9f745ae627ca/63bee84a47588310a1913f9b/fig1-linux-file-indentifies-sample-as-msi-file.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Linux file identifies sample as MSI file</figcaption></figure>However, the file contains a valid JAR as well. Our Ratty configuration extractor was able to successfully extract the C2 server information.This sample has been observed being sent using <a href="https://sendgrid.com/" target="_blank">Sendgrid</a>. While this is not unique, some of the StrRAT samples that were MSI+JAR polyglots have been sent via Sendgrid as well.Some of the StrRAT samples using the MSI+JAR polyglot have been observed spreading with URL shortening services such as cutt.ly and rebrand.ly. In some cases, the samples were hosted on Discord.<h3>#2 CAB:</h3><a href="https://www.file-recovery.com/cab-signature-format.htm" target="_blank">CAB</a> files have a unique magic header and are interpreted from the beginning to the end, which makes them a perfect candidate for a polyglot with JAR files.We have observed both Ratty and StrRAT samples using CAB+JAR polyglots.In particular, we found the Ratty sample f620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de and the StrRAT sample 2f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e571 both using the CAB+JAR polyglot and using the same C2 server, donutz.ddns[.]net<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltfb077af360e7081e" alt="Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb077af360e7081e/63bee84a7a6762171d821d17/fig2-strRAT-and-Ratty-linked-to-the-same-c2-server.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net</figcaption></figure><h3>#3 HEX Trash / Fake PE:</h3>We are not sure if the files were made by mistake or on purpose by the threat actor, but those JAR files have HEX values appended to them:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt05d5b955bdf7dc33" alt="Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt05d5b955bdf7dc33/63bee84a98b11c3ccecf6af5/fig3-sample-with-hex-values-appended.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended.</figcaption></figure>The appended textual hex value is of an executable file. While those files are not polyglots because the appended hex is just “junk” text, the Linux “file” command would return “data” such as the file type.In this way attackers can confuse and bypass security solutions that would simply check the type of file using the Linux “file” command.<h3>#4 Binary Junk:</h3><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8585c56be6e04e2b" alt="Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8585c56be6e04e2b/63bee84ad7b1d54534245dfa/fig4-sample-with-appended-binary-data.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data.</figcaption></figure>This variation is once again not truly a polyglot, and it is not clear if this is a mistake or if it was done on purpose. The appended content seems to be a part of some binary, but the appended data appears to be missing the beginning of the appended file.The result is the same: a valid JAR file that is detected as “data” by checking the file type.<h3>Is this effective? (YES!)</h3>While Ratty and StrRAT are well known threats, some of those appended JAR files receive very low detections in VirusTotal:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt14594c18eb515964" alt="Figure 5: Low detection rate for CAB+JAR polyglot" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt14594c18eb515964/63bee84aab6fbb46e5b71f9c/fig5-low-detection-rate-for-cab-jar-polyglot.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Low detection rate for CAB+JAR polyglot</figcaption></figure>The VirusTotal detection rate doesn’t tell the true capabilities of specific vendors as some products behave differently when files are executed dynamically.That said, we can clearly see that JAR files with appended content can stay undetected, at least until executed, even for known threats.<h3>Can this be any worse? Yes, my friends, it can...</h3>Let’s think about this from a detection engineering perspective. If we failed to identify a JAR file because we relied on the simple file type check, like Linux “file” command, the easy solution would be just to “scan” every file with the JAR extension. If you want to, you can even throw a validation that the file is a valid JAR by checking the presence of the end of a central directory record at the end of the file.However, this is still not sufficient. JAVA does not care about the file extension and will happily execute a valid JAR file with any extension. The only downfall in renaming the “.jar” extension is that the JAR needs to be executed from the command line instead of simply clicking on it to execute.We have created an HTML+JAR polyglot to demonstrate this:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt234fc58952190333" alt="Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt234fc58952190333/63bee84a438f80612c397515/fig6-html-jar-polyglot-with-html-extension-properly-rendered-in-the-browser-and-properly-executed-by-jre.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE</figcaption></figure>This file is also available in our <a href="https://github.com/deepinstinct/JAR-Polyglot-POC" target="_blank">GitHub</a> along with the <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">Ratty</a> malware configuration extractor.<h3>Conclusion</h3>The proper detection for JAR files should be both static and dynamic. It’s inefficient to scan every file for the presence of an end of central directory record at the end of the file.Defenders should monitor both “java” and “javaw” processes. If such a process has “-jar” as an argument the filename passed as an argument should be treated as a JAR file regardless of the file extension or the output of the Linux “file” command. Incident responders and the cyber community are welcome to use the Ratty malware configuration parser provided from Deep Instinct in case of infection to get to the IOC fast and quickly move on to remediation steps.<h3>MITRE ATT&CK:</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Initial Access</td><td>T1566.002 Phishing: Spearphishing Link</td><td>Attackers use URL shortening services that leads to the payload.</td><td>Rebrand[.]ly/afjlfvp</td></tr><tr><td>Defense Evasion</td><td>T1036.001 Masquerading: Invalid Code Signature</td><td>Attackers append a signed MSI file.</td><td>85d8949119dad6215ae0a21261b037af</td></tr><tr><td>Defense Evasion</td><td>T1027.001 Obfuscated Files or Information: Binary Padding</td><td>Attackers append junk data at the beginning of the file causing “file” command to return a different file type.</td><td>cb17f27671c01cd27a6828faaac08239</td></tr><tr><td>Command and Control</td><td>T1102 Web Service</td><td>Attackers used Discord's content delivery network (CDN) to deliver malware.</td><td>https://cdn[.]discordapp[.]com/attachments/938795529683480586/941658014962823208/Package_info[.]jar</td></tr></tbody></table>&nbsp;<h3>IOC:</h3>d51d269b62e55d4af8a4bd72dcf3c5115ad27fe5466640041c658c0325194451534a4b0e17723755dd8cbdcdec309004ef59c3dfacb87fac86da4548780d2f1b08921a6b0b2903b9c991acb869930c7cab3cbaf11e002be9c88400af48c3fa2159a02230a78b87c97eebbf7cdba40ea17c7d9411d706fd255c2a6a025584fd9fa9ac4ae704da346a0f3d2960b084d8f314c0fd60a934116e3c75647c713314b647fc7fc1658acfa2f7a0b388bea6b52787f186bf8297ce189a575d547dfbd8e0a80add76ff8ad0e1c3bdab9459546fd724e1f4034248d1542aec1264c02d3857f0e57c84ba1958cabf24cfec4a0d50be6b7bc0e45c639d08a53097494373ae9ee7812ff64dbe51584d3090e008b464510dbb87ac860c68d89e224621755021f941ef2dfa736e9a24a1a29a373357ac249dad99f86f1cc0283ddd4765fa14e54a8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cadf79ba296aeab13be409ee3ef435f47a8888f7186a062fa481603ec32f3d6b678262e6824f0c4c765e73a7041362d7a3a8d63dab1be91ecf5e80623ac6e2f389eb6a0dcd8c9bc11794837e8f9350e2816ae7a60d148f3e6f436c2645f450feeabf620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de54814775c2f266cafe3d4ddc58bc400360aad8cea95e0d3ee74ceceb927cb3b82f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e57174c8d5e01e2bb52c6f5cd7863168085ff81bea970b5309ec180c2e1a299096dff2b36a7df3d0b4d63bbbc529b7a27282e5626300e1353d2596866e4a82165f644f00914f63181c0afbfff41a95f5f1364c61d78ffb250ec8ef3102b3d3bd7003a989289cd6df1b1c38dbda84eb3b286bb8fb7a2af9beb1e55b029dbf861bac83521a2e7ee2558d83e29bceb68a8c4ea0ecce4bddcb05cc0d3b0365522f126d1f19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcfe3be7066e6922d7460dea80ca5b7fef8f4abc7b1f056d8f329c03b306e8ca9b0788f1abb67d6f21cf299e2f67a2b414d169e8ab16cc8a61bf698e5c7f14829995e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f81979910c14d804efe1db9377bfe3d5e06ba37a4817cc4bd0f6404ed7d705219295e8151056554bca75450d07fcc5df7c1ca4686a2fefbe76cc9fb60343364678ca8744f2d7e93978c0991e376466810adf18262e4a7fb2864c7a87f22e3fa71adb6519496251bb063e4ee3769139a34ccfbdd81ba52b004836da7aaabd5e5e67f87478d00d85589908ba95536822dea356afb5a9148628a7e2207c6e850024c0ba434d928551a303110983871266af840df71bf7427dcff242688c105f04d4aa87806be2d67077cbcab70d47a95b8da25a2a35fe1f1099ed71d8b06f8e78dd741fc2b7d0703f8f70aff6e3975f3b7c8d037b5a0d3d1b8e4a91b2a6c65227c7932dded59e0468a7249fd6bc2b911434b0c7afa2a9d92473e2402a1a3ad357119c579d63fe72f76f147bce32338a4b0b88c3d59dd3e85406ab1b3b273aab7cb7227fae52964eceee84de3d0b8b3565100c1e45dab1b4b5ff7c61f03a198a56714c03ca32d8c04d3a6e6e5058c10a56890a9dcf41ac5e47a22dc1002e89415ee0f37c7f05

A new MuddyWater threat campaign was discovered by Deep Instinct. We analyze this threat below. 

MuddyWater-Blog.png

SpyAgent-Malware-Blog.png

Deep Instinct Threat Lab researchers have observed changes in the distribution scheme of SpyAgent (A.K.A. TeamSpy/TVRat/TeamBot/Sheldor), a malware that likely originated over a decade ago based on the historical timeline below.&nbsp;SpyAgent is a malware that abuses legitimate, well-known remote access tools (RAT). The recent changes observed by our team allow the malware to stay stealthy while bypassing and evading many security products.&nbsp;Attackers evading existing security controls is a trend we see increasing. This is a problem for the industry as most security solutions that were developed with an “assume breach” mindset will miss these stealthy attacks until is it far too late to stop the damage.&nbsp;&nbsp;<h3>Historical Background on SpyAgent:&nbsp;</h3><ul><li>In a report from <a href="https://web.archive.org/web/20111226101507/go.eset.com/us/resources/white-papers/CARO_2011.pdf" target="_blank">2011</a>, a malware named “Sheldor” used DLL search order hijacking to abuse TeamViewer 5.0 for malicious activities.</li><li>In a report from <a href="https://web.archive.org/web/20130508171555/https:/www.crysys.hu/teamspy/teamspy.pdf" target="_blank">2013</a>, a malware named “TeamSpy” used DLL search order hijacking to abuse TeamViewer 6.0 for malicious activities. The report also shows a relationship between “Sheldor” and “TeamSpy.”</li><li>In a report from <a href="https://vms.drweb.com/virus/?_is=1&i=8415393" target="_blank">2016</a>, a malware named “Spy-Agent” used DLL search order hijacking to abuse TeamViewer 6.0 for malicious activities. The report contains unique URI patterns that the malware uses to communicate with the C&C server.</li><li>SpyAgent’s main capabilities are leveraged to enhance the usage of TeamViewer by hooking some of the functions used by legitimate applications.</li><li>The most important thing that SpyAgent does is obtain the client's unique ID, which is required to connect to a computer using TeamViewer.</li><li>Other hooks disable logging and hide the GUI of the application to make it stealthy and avoid detection.</li></ul><h3>10 years later:&nbsp;</h3><ul><li>A report published in <a href="https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html" target="_blank">2021</a> showed that the “Spy-Agent” malware has been observed shifting from hijacking TeamViewer to hijacking “Safib Assistant,” a Russian replica of TeamViewer.</li><li>The report demonstrates the distribution scheme of the malware, using fake crypto applications as a theme.</li><li>The fake applications are actually downloaders of multiple malware families, which include different RATs and stealers, such as RedLine. “SpyAgent” is one of the downloaded malware families.&nbsp;</li></ul><h3>Recent Changes&nbsp;</h3>In May 2022, a small change was observed in the fake crypto campaign first seen in 2021. Instead of using NSIS or Inno Setup droppers, executable files over 700MB were used to evade detection. This is because many security products limit the size of scanned files to compensate for performance issues. This is similar to the way the “Quartz.dll” SpyAgent files are inflated to 1GB+, as noted in the 2021 report. This is done by simply appending a large overlay of zeros to the file, and this technique allows the file to be compressed to the actual size without the overlay.&nbsp;&nbsp;<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt102c6360c03796fb" alt="Figure 1: Overlay of zeros appended at the end of the file to inflate its’ size to avoid detection" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt102c6360c03796fb/63459a085e9a09115c79d6c9/russian-spyagent-fig1.png" /><figcaption >Figure 1: Overlay of zeros appended at the end of the file to inflate its’ size to avoid detection</figcaption></figure>Due to their large size, the files are not stored in public malware repositories or sandboxes.&nbsp;The large overlayed executables are droppers which use Microsoft’s .NET ClickOnce launch utility “<a href="https://app.any.run/tasks/379dee24-c7f4-4255-a581-64d218fbe9f5/" target="_self">AppLaunch.exe</a>” to download and execute malware files from the web.&nbsp;More malicious files related to this change can be found by <a href="https://www.virustotal.com/gui/file/0cfdd88e61fc93fbdc189de21b2cdaec357c2d8a82cddb532db894530d7d9a66/relations" target="_self">searching</a> the included txt file inside the zip:&nbsp;<figure style = "float: none;width: 395px;max-width:395px;"><img asset_uid="blt8ce5dfe10c64c982" alt="Figure 2: Contents of the text file included in the zip archive" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8ce5dfe10c64c982/63459a078c820a10568b92e0/russian-spyagent-fig2.png" /><figcaption >Figure 2: Contents of the text file included in the zip archive</figcaption></figure><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltccc00e625446508b" alt="Figure 3: More archives containing the same text file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltccc00e625446508b/63459a08b8e4f9110c2ef96c/russian-spyagent-fig3.png" /><figcaption >Figure 3: More archives containing the same text file</figcaption></figure>The text translates from Russian into:&nbsp;<ol><li>We execute the client inside the archive&nbsp;</li><li>We enter our wallets to receive payments&nbsp;</li><li>We are happy everyday because of the profit!&nbsp;</li></ol>In June 2022, additional changes were observed.&nbsp;The SpyAgent theme is no longer related to crypto applications.&nbsp;The dropper files are once again Inno Setup files, however, they no longer download any additional malware except “SpyAgent” bundled with “Safib Assistant.”&nbsp;Since “Safib Assistant” is a legitimate tool, similar to TeamViwer, just less known, this change lowers the detection rate for the campaign as the only real malware is “SpyAgent.”&nbsp;However, as previously was reported, the “SpyAgent” DLL files are very large.&nbsp;<a href="https://attack.mitre.org/techniques/T1027/001/" target="_self">T1027.001</a> is a known MITRE technique that adversaries use to “decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.”&nbsp;Example file&nbsp; 1565d137d235b65af1d1e4963ebc02eaf36cc81f870534674983bc6f67e5e274 is an Inno Setup file that during the writing of this article was detected by four security vendors:&nbsp;&nbsp;<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blteafcc1b7aee600af" alt="Figure 4: Detection rate at first submission (2022-07-18 06:04:01 UTC)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteafcc1b7aee600af/63459a073aad9e1061a0b515/russian-spyagent-fig4.png" /><figcaption >Figure 4: Detection rate at first submission (2022-07-18 06:04:01 UTC)</figcaption></figure>This file is inside three different zip files, which are not related to a crypto theme.&nbsp;The dropper silently installs “Safib Assistant,” the software’s main executable hash is b8dde42c70d8c4a3511d5edffbc9f7f0c03dbda980e29693e71344f76da6bb0f and it is detected by only two security vendors, although it is not malicious without the SpyAgent DLL:&nbsp;&nbsp;<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blta72402839e4df85a" alt="Figure 5: Metadata of the “Safib Assistant” main executable" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta72402839e4df85a/63459a0759c8ec116d140164/russian-spyagent-fig5.png" /><figcaption >Figure 5: Metadata of the “Safib Assistant” main executable</figcaption></figure>The SpyAgent C&C server is thief[.]lol which resolved during the analysis to the IP address 185.125.206[.]172.&nbsp;&nbsp;During our investigation, the C&C was still working, allowing us to confirm that the malware bundled with “Safib Assistant” is indeed “SpyAgent:”&nbsp;<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt8e6b9196b6a5b3b1" alt="Figure 6: SpyAgent C2 panel" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8e6b9196b6a5b3b1/63459a089bac8c116ac5aaba/russian-spyagent-fig6.png" /><figcaption >Figure 6: SpyAgent C2 panel</figcaption></figure><h3>Conclusion&nbsp;</h3>Both TeamViewer and “Safib Assistant” are legitimate remote admin tools, however, without the spy-agent malware DLL which adds stealth they are less useful for cybercriminal operations.&nbsp;&nbsp;On the other hand, there are several other legitimate remote admin tools that don’t require any additional malicious DLL files to be stealthy which are used as-is by cybercriminals.&nbsp;Deep Instinct classifies such tools as dual-use because they are 3rd-party software that is not necessarily allowed to be used in a corporate network as it can be used maliciously.&nbsp;Deep Instinct blocks the Safib Assistant application.&nbsp;<img asset_uid="blt9330fd6adbcf9974" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9330fd6adbcf9974/6345b7bfa75f39138053b89d/russian-spyagent-fig7_new.png" height="auto"/><h3>MITRE ATT&CK:&nbsp;</h3><table><thead class="bg-grey"><tr><th width="15%" style="width: undefined; height: auto;height: auto;"> Tactic</th><th width="20%" style="width: undefined; height: auto;height: auto;"> Technique</th><th width="40%" style="width: undefined; height: auto;height: auto;"> Description</th><th width="25%" style="width: undefined; height: auto;height: auto;"> Observable</th></tr></thead><tbody><tr><td>Discovery&nbsp;</td><td>T1082 System Information Discovery&nbsp;</td><td>SpyAgent computes environment hash as an MD5 of the string created by concatenating the following:&nbsp;&nbsp;Value 1 = to_uppercase(crc32(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid))&nbsp;Value 2 = to_uppercase(crc32(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName))&nbsp;Value 3 = to_uppercase(crc32(user name))&nbsp;Value 4 = to_uppercase(crc32(computer name))&nbsp;</td><td>&lt;C&C domain&gt;/&lt;C&C path&gt;?id=&lt;9digit number&gt;&stat=&lt;environment hash&gt;&nbsp;</td></tr><tr><td>Defense Evasion&nbsp;</td><td>T1027.001 Obfuscated Files or Information: Binary Padding&nbsp;</td><td>SpyAgent’s quartz.dll was artificially inflated to the size of 1GB&nbsp;</td><td>e2eea1960d77aa8a7153ff448601974c&nbsp; – 7z file containing “Safib Assistant” bundled with SpyAgent’s quartz.dll&nbsp;</td></tr><tr><td>&nbsp;</td><td>&nbsp;</td><td>SpyAgent’s dropper executable was artificially inflated to the size of 700MB&nbsp;</td><td>c72710b4c1f85eca7d1441e1191faa9b – zip file containing dropper.&nbsp;</td></tr><tr><td>&nbsp;</td><td>T1574.002 Hijack Execution Flow: DLL Side-Loading&nbsp;</td><td>SpyAgent hooks and patches various API functions called by the original DLLs used by TeamViewer and Safib Assistant&nbsp;</td><td><a href="https://www.welivesecurity.com/2011/01/14/sheldor-shocked/" target="_self">tv.dll</a>&nbsp;<a href="https://blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer" target="_self">msimg32.dll</a>&nbsp;avicap32.dll&nbsp;quartz.dll&nbsp;</td></tr><tr><td>&nbsp;</td><td>T1140 Deobfuscate/Decode Files or Information&nbsp;</td><td>SpyAgent comes with a config file (.cfg) that contains an encrypted configuration. The bitmap file (.bmp) is used for deriving the key to decrypt the config file&nbsp;</td><td>80896fc71f5f9825a554858e15988713 – bmp file&nbsp;6f496789009980fe92070f4e0d670797 – cfg file&nbsp;</td></tr><tr><td>Command and Control&nbsp;</td><td>T1219 Remote Access Software&nbsp;</td><td>SpyAgent’s quartz.dll uses the “Safib Assistant”&nbsp;</td><td>8002d9e5851728eb024b398cf19de390 - Assistant.exe&nbsp;</td></tr><tr><td>&nbsp;</td><td>&nbsp;</td><td>SpyAgent’s avicap32.dll uses TeamViewer&nbsp;</td><td>28c4c35aed7949277a9c68a04a113114 - TeamViewer.exe&nbsp;</td></tr><tr><td>&nbsp;</td><td>T1071.001 Web Protocols&nbsp;</td><td>SpyAgent uses HTTP for command and control&nbsp;</td><td>&lt;C&C domain&gt;/&lt;C&C path&gt;?id=&lt;9digit number&gt;&stat=&lt;environment hash&gt;&nbsp;</td></tr></tbody></table>&nbsp;<h3>IOC&nbsp;</h3>1565d137d235b65af1d1e4963ebc02eaf36cc81f870534674983bc6f67e5e274&nbsp;Active Spy Agent C2:&nbsp; 23.19.227[.]217&nbsp; 45.66.151[.]237&nbsp; 108.62.118[.]48&nbsp; jmai[.]ink&nbsp;

The Russian SpyAgent – a Decade Later and RAT Tools Remain at Risk

bumblebee-blog.png

<h2>Summary</h2>Deep Instinct recently prevented a targeted Bumblebee malware attack in one of our clients’ environments. The attack, which was detected and prevented before execution, involved an obfuscated PowerShell script, a .VHD file (a type of disk image file similar to .ISO), a DLL, and spear phishing correspondence.Currently, the relevant IoCs (indicators of compromise) are not detected by most security vendors. This blog will provide a detailed review of these IoCs and provide technical details of the stages of the full Bumblebee malware attack.<h2>Spear Phishing and Delivery</h2>Phishing attacks have become threat actors’ tool of choice for malware delivery. The concept is quite simple: an attacker crafts a dropper and attaches it to an email with a compelling message meant to fool the target into opening the file. However, greater awareness and training on how to spot and avoid these attacks is leading threat actors to employ more sophisticated means to launch spear phishing attacks.The most successful spear phishing campaigns rely on deception to gain a potential victim’s trust – often including personal details about the recipient in the phishing note or sending the harmful email from a domain that is very similar to one that the recipient trusts. Threat actors also commonly impersonate close friends and colleagues to trick their targets into opening compromised messages.Deep Instinct prevented an infection that started with a clever spear phishing attack where the malicious actor pretended to be someone from a well-known organization, using a domain with an almost identical name, impersonating an employee, and using a highly relevant subject line to trick the target into opening the note.To further establish trust, the attacker did not include any attachments or requests to download files from a remote location in their first email – they only introduced themselves as the person they were impersonating and used the promise of a new business opportunity to increase their odds of getting a response.After the initial contact had been established and “trust” earned, the threat actor invited the recipient to a meeting with them. Files were sent to be reviewed before the meeting, and the recipient was informed that another email with a link to the file sharing platform “Smash” would also be sent.<figure style = "float: none;width: 710px;max-width:710px;"><img asset_uid="blt24726846cc45e671" alt="Figure 1 – The second email." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt24726846cc45e671/6305073b42742b5fcbe71d68/figure-1-second-email.png" /><figcaption >Figure 1 – The second email.</figcaption></figure>The attacker used a domain “hognose1” registered with porkbun.com, with Postfix smtpd.The “Smash” link was provided in a separate email leading to a .VHD file. The file contained an .LNK (shortcut file), which executes a hidden PowerShell script that resides in the disk image file as well.<h2>VHD container</h2>The malicious VHD contains a shortcut file which runs a hidden PowerShell script when executed.<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="bltac5fa5895209da22" alt="Figure 2 - VHD container, as seen when mounted." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac5fa5895209da22/6305073b7048695fabde5bb0/figure-2-vhd_container.png" /><figcaption >Figure 2 - VHD container, as seen when mounted.</figcaption></figure><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt264bdad9889ae324" alt="Figure 3 – VHD container, hidden files shown." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt264bdad9889ae324/6305073b89a31e1a31bb9913/figure-3-vhd-container-hidden-files.png" /><figcaption >Figure 3 – VHD container, hidden files shown.</figcaption></figure><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt0c70137179538ec8" alt="Figure 4 - Shortcut file runs hidden PowerShell script." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0c70137179538ec8/6305073b6c88de0c92879719/figure-4-short-file-powershell-script.png" /><figcaption >Figure 4 - Shortcut file runs hidden PowerShell script.</figcaption></figure>Following Microsoft’s default disablement of Office Macro and requiring a few more steps to enable it, the combination of a disk image file (.ISO/.VHD, etc.) and shortcut file has been gaining in popularity as a “replacement” to Office Macros in the threat landscape.<h2>Price Quote for PowerShell Loader</h2>“quoutefile.ps1” - 1st Stage PowerShell loaderOnce executed by the .LNK file, “quoutefile.ps1” will hide the open PowerShell window and continue running. This is likely a measure to avoid using the “-windowstyle hidden” PowerShell command line parameter, which can lead to an increased chance of detection.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltd5ceabec3a8eec51" alt="Figure 5 - PowerShell code snippet to hide open window." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd5ceabec3a8eec51/6305073b27ca1b5cd53ebb41/figure-5-powershell-code-hide-open-window.png" /><figcaption >Figure 5 - PowerShell code snippet to hide open window.</figcaption></figure>An interesting point of note: the code employs light, but effective, obfuscation intended to break up suspicious strings and evade static scanning.Having hidden the active PowerShell window, the code continues to de-obfuscate a series of more than 100 “elem” variables which contain Gzip compressed data streams by replacing the first character in the stream with the character “H” and forming a Gzip stream header by using “insert” and “remove” instead of the much more common “replace” method; the valid Gzip stream is then appended to an array.This is another example of how cybercriminals use simple and very effective measures to evade static scanning.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltf9dc431e352118c8" alt="Figure 6 - " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf9dc431e352118c8/6305073bedb1c60e03cb2249/figure-6-obfuscated-gzip-streams.png" /><figcaption >Figure 6 - "Obfuscated" Gzip streams.</figcaption></figure>The code then iterates through the array of Gzip compressed streams, decompresses them, and forms the 2nd stage code block which will then be executed by “Invoke-Expression.” <figure style = "float: none;width: 705px;max-width:705px;"><img asset_uid="blt214473fadff0b986" alt="Figure 7 – 2nd stage is de-compressed and executed." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt214473fadff0b986/6305073ba7a7565fca362884/figure-7-2nd-stage-decompressed.png" /><figcaption >Figure 7 – 2nd stage is de-compressed and executed.</figcaption></figure><h2> 2nd Stage PowerShell loader</h2>The 2nd stage of the PowerShell loader is composed of a very large, very well written (even commented) code block which loads an embedded 64-bit .DLL to memory.This stage also continues the theme of simple, effective obfuscation intended to evade static analysis.<img asset_uid="bltc3eb6e9178b83cf3" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc3eb6e9178b83cf3/6305073b5409c27e6b218499/figure-8-suspicious-string-breakup.PNG" height="auto"/><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt468fd911684ec903" alt="Figures 8-9 – Suspicious string “breakup.”" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt468fd911684ec903/6305073ba7a7565fca362880/figure-9-suspicious-string-breakup.png" /><figcaption >Figures 8-9 – Suspicious string “breakup.”</figcaption></figure>The loader validates the embedded file and performs multiple checks to ensure the file is loaded properly on the executing system.<img asset_uid="blt859522e7af966466" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt859522e7af966466/6305073bd39eb86e3e1ea765/figure-10-file-validation-check.png" height="auto"/><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt1fd012a46a4d2d70" alt="Figures 10-11 – file validation and check." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1fd012a46a4d2d70/6305073beb5fa90e5bab9d32/figure-11-file-validation-check.png" /><figcaption >Figures 10-11 – file validation and check.</figcaption></figure><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blte8fcccd514caf812" alt="Figure 12 – References to the payload .DLL exported functions." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte8fcccd514caf812/6305073b2013f35e0c878745/figure-12-references-payload.PNG" /><figcaption >Figure 12 – References to the payload .DLL exported functions.</figcaption></figure>Finally, the loader sleeps for five seconds and calls its main function in order to load the payload .DLL to memory.Note the “replacement trick” used here to conceal the executable MZ header; similar in fashion to the Gzip stream “obfuscation” used in the 1st stage.<figure style = "float: none;width: 705px;max-width:auto;"><img asset_uid="blt8d8f4c359a1df23d" alt="Figure 13 – Main function called to load payload .DLL" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8d8f4c359a1df23d/6305073b8799d85e06ba4c09/figure-13-main-function-called.png" /><figcaption >Figure 13 – Main function called to load payload .DLL</figcaption></figure><h2> Link to Bumblebee Malware</h2>The final DLL is a 64-bit Bumblebee payload.It is protected by what appears to be a unique private crypter that is present in all Bumblebee binaries. The crypter uses an export function named “setPath:”<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltddb9c2247c2392a3" alt="Figure 14 – Crypter export function “setPath.”" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltddb9c2247c2392a3/6305073b7756c36f738905ac/figure-14-crypter-function.png" /><figcaption >Figure 14 – Crypter export function “setPath.”</figcaption></figure>Even before unpacking the sample (simply by looking at the strings of the file) it is clear that no major changes are made.The “stolen” open-source <a href="https://github.com/LordNoteworthy/al-khaser" target="_self">code</a> for the anti-vm is still present:<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt40b93a31825eea02" alt="Figure 15 – Strings associated with Anti-VM Code." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt40b93a31825eea02/6305073ba2fb716e3cda65b1/figure-15-anti-vm-code.png" /><figcaption >Figure 15 – Strings associated with Anti-VM Code.</figcaption></figure>The code is a huge collection of various techniques used to identify if a program is executed in a virtual machine or using emulation and if debuggers and sandboxes indicators are present in the running environment.<figure style = "float: none;width: 705px;max-width:705px;"><img asset_uid="blted5d6b1afb552ee2" alt="Figure 16 – Open-source code used for Anti-VM." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blted5d6b1afb552ee2/6305073b18709f7d37715086/figure-16-open-source-code.png" /><figcaption >Figure 16 – Open-source code used for Anti-VM.</figcaption></figure>There are checks for processes of known malware analysis and debugging tools as well as processes related to virtualization.Specific registry keys are queried to identify whether the system is virtual. In addition, there are checks for DLL and SYS files and specific folders that will exist only in a virtual machine.The MAC address is also checked as virtual network cards can be easily identified by the name of their virtualization vendor.Various WMI queries are done for system information, such as fan information.<figure style = "float: none;width: 567px;max-width:567px;"><img asset_uid="blt35daff78fc82e254" alt="Figure 17 – Bumblebee hooking various Windows functions." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt35daff78fc82e254/6305073bee94c17098cdb45e/figure-17-bumblebee-hooking.png" /><figcaption >Figure 17 – Bumblebee hooking various Windows functions.</figcaption></figure>A full, detailed overview of Bumblebee malware can be found <a href="https://elis531989.medium.com/the-chronicles-of-bumblebee-the-hook-the-bee-and-the-trickbot-connection-686379311056" target="_self">here</a>.<h2>Link to the Threat Actor</h2>The observed attack chain is consistent with <a href="https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/" target="_self">EXOTIC LILY</a> activity.The attackers registered a visually similar domain, using a lowercase “L” instead of a lowercase “I” which spoofed a legitimate U.S.-based cybersecurity company.The attackers created an email box impersonating an employee of the company and sent business proposal leads.The mails are written in proper English, including an email signature which looks very similar to the signature used by the company. The domain in the email signature is changed to the fake domain created by the attackers.Although it might be coincidental, the attackers chose to send the mails around the time of Black Hat USA; this might be because many sales teams are out of office and attend the conference and we speculate that they may have less security measures outside the office and are constantly networking, making it more realistic that a business proposal email would be sent, received, and read during the show.One notable change in EXOTIC LILY’s activity is the addition of the “<a href="https://bazaar.abuse.ch/browse/tag/Smash/" target="_self">Smash</a>” file transfer platform to deliver Bumblebee.As noted by Google’s TAG, “EXOTIC LILY seems to operate as a separate entity, focusing on acquiring initial access through email campaigns, with follow-up activities that include deployment of Conti and Diavol ransomware, which are performed by a different set of actors.”IBM <a href="https://securityintelligence.com/posts/from-ramnit-to-bumblebee-via-neverquest/" target="_self">found</a> connections and code similarities between Bumblebee, Ramnit, and Trickbot malware which seem to be developed by the same group that developed the Conti ransomware.However, “Conti” <a href="https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape" target="_self">no longer exists</a>, and as noted by IBM, Bumblebee has been linked to <a href="https://thedfirreport.com/2022/04/25/quantum-ransomware/" target="_self">Quantum ransomware</a>.<h2>Deep Instinct Prevention of Bumblebee Attack</h2>While Deep Instinct prevented the attack pre-execution the detection rate of the PowerShell payload was zero on VT when first seen, and even a few days after only three more generic detections were added.<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt6944a34bc2a0660b" alt="Figure 18 – Malicious PowerShell zero detection on first seen in VT." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6944a34bc2a0660b/6305073b3b2cfd60e1769794/figure-18-malicious-powershell.png" /><figcaption >Figure 18 – Malicious PowerShell zero detection on first seen in VT.</figcaption></figure><figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt7aed101e94d48d06" alt="Figure 19 – VirusTotal detection evolution for the malicious PowerShell." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7aed101e94d48d06/6305073b42742b5fcbe71d6c/figure-19-virustotal-detection.png" /><figcaption >Figure 19 – VirusTotal detection evolution for the malicious PowerShell.</figcaption></figure>The below prevention notification proves once again that a signature-based detection is not effective against new or modified attack flows.<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt8366713b7e5f6306" alt="Figure 20 – Prevention by Deep Instinct." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8366713b7e5f6306/6305073b9f41d80c9809efd4/figure-20-prevention-by-deep-instinct.png" /><figcaption >Figure 20 – Prevention by Deep Instinct.</figcaption></figure>If you’d like to learn more about our malware, ransomware, and <a href="/zero-day-attacks" target="_self">zero-day prevention capabilities</a> – including our industry-best $3M no-ransomware guarantee – we’d be delighted to <a href="/request-a-demo" target="_self">give you a demo</a>.<h2>IOCs</h2><table><colgroup data-width='669'><col style="width:37.3692%"/><col style="width:62.6308%"/></colgroup><tbody><tr> <td>container.vhd (sha256)</td> <td>91d29cfe549d8c7ade35f681ea60ce73a48e00c2f6d55a608f86b6f17f494d0d</td> </tr> <tr> <td>Quote.lnk (sha256)</td> <td>940182dd2eaf42327457d249f781274b07e7978b62dca0ae4077b438a8e13937</td> </tr> <tr> <td>quotefile.ps1 (sha256)</td> <td>d6cc3ac995484b99ed790b6f8ceb145492794eb5d01ec4a71123b9975e9bfd20</td> </tr> <tr> <td>stage2.ps1 (sha256)</td> <td>5d000af554dcd96efa066301b234265892b8bf37bf134f21184096bdc3d7230b</td> </tr> <tr> <td>payload.dll (sha256)</td> <td>0b0a5f3592df7b538b8d8db4ba621b03896f27c9f112b88d56761972b03e6e58</td></tr></tbody></table><a href="https://www.youtube.com/watch?v=M93qXQWaBdE" target="_self">https://www.youtube.com/watch?v=M93qXQWaBdE</a>

The Dark Side of Bumblebee Malware Loader

On April 14th the news broke that, Portuguese multinational energy giant Energias de Portugal (EDP) was hit by ransomware attacking the network of the

ragnar-1.jpg

On April 14th the news broke that, Portuguese multinational energy giant Energias de Portugal (EDP) was hit by ransomware attacking the network of the company’s 11,500 employees. The attack was by Ragnar Locker ransomware, which upon encrypting the systems demanded a 1,580 Bitcoin ransom fee, the equivalent to around $11 million. In their ransom note, the attackers claim to have stolen 10TB of sensitive company files which will be leaked if the ransom isn’t paid. According to security analysts, the methodology of the attack and the ransom demand both indicate the attack was well thought out with the attacker fully aware of its victim’s financial capabilities.Ragnar Locker is often delivered through MSPs tools such as ConnectWise, from which the attackers drop a highly targeted ransomware executable. This is a technique that has been used by other highly malicious ransomware campaigns, most notably, <a href="/blog/the-growing-popularity-and-vulnerability-of-the-msp" target="_self">Sodinokibi</a>. In this type of attack, the operators of the ransomware initially infiltrate organizations through unsecured or badly secured RDP connections and then used both tools to push Powershell scripts to all accessible endpoints. The scripts then downloaded a payload from Pastebin, which executes the ransomware and encrypts the endpoints. In some cases, the payload is an executable file that is executed as part of a file-based attack, in other cases additional scripts were downloaded, as part of a completely file-less attack.

Ragnar Locker is specifically targeting software commonly used by managed service providers, Below, is the list of targeted strings:<ul><li>vss</li><li>sql</li><li>memtas</li><li>mepocs</li><li>sophos</li><li>veeam</li><li>backup</li><li>pulseway</li><li>logme</li><li>logmein</li><li>connectwise</li><li>splashtop</li><li>kaseya</li></ul>Attackers first steal a victim's files and upload it to their servers. They then tell the victim that they will only release the files publicly if a ransom is not paid, in a tactic that has recently been dubbed - the ‘<a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/">Name & Shame Game’</a>.Ragnar Locker ransomware undermines the MSP’s security tools (as mentioned above, before the tools can block it from executing) and once inside, commences the encryption process. It contains a specific extension to use for encrypted files, an embedded RSA-2048 key.The ransomware appends a new file extension, such as ‘.ragnar_22015ABC’ to the file's name. The 'RAGNAR' file marker will also be added to the end of every encrypted file.Ragnar Locker will drop a ransom note named ‘.RGNR_[extension].txt.’ The ransom note contains information on the ransom amount, a bitcoin payment address, a TOX chat ID to communicate with the cybercriminals, and a backup email address if TOX does not work. In each case, the ransom amount is calculated individually.<img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1330b1c849b876c5/611a7cc13f43081646a0ef54/ransom-note.png"/>Amongst our customer environments, Deep Instinct found seven samples of this ransomware, and all were prevented statically with Deep Instinct’s current model in production. The previous model which was trained in Q3 of 2019 was also able to successfully detect and prevent the ransomware. This is a considerable feat considering that RagnarLocker went undetected by most other engines when it was first spotted in the wild. In the days following detection rates by other engines gradually improved.<img src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3e7b65499625fc3b/611a7c9bffd778164aa23654/ragnar-engine-detections.png"/>Not only could Deep Instinct&nbsp;prevent&nbsp;Ragnar Locker&nbsp;statically prior to execution, our solution was also able to label it as a ransomware attack. This classification was achievable due to our product’s enhancedThe implication of this is that without ever having been trained to identify this specific form of ransomware before, both of our engines (the pre-execution and on-execution engines) could prevent this attack the first time that it appeared in the wild.The IOC hashes associated with the malware:b670441066ff868d06c682e5167b9dbc85b5323f3acfbbc044cabc0e5a59418668eb2d2d7866775d6bf106a914281491d23769a9eda88fc078328150b8432bb39bdd7f965d1c67396afb0a84c78b4d12118ff377db7efdca4a1340933120f376dd5d4cf9422b6e4514d49a3ec542cffb682be8a24079010cda689afbb44ac0f4c2bd70495630ed8279de0713a010e5e55f3da29323b59ef71401b12942ba52f663096f288f49b25d50f4aea52dc1fc00871b3927fa2a81fa0b0d752b261a3059a8ee0fafbd7b84417c0fb31709b2d9c25b2b8a16381b36756ca94609e2a6fcf65fc6f4cfb0d11e99c439a13b6c247ec3202a9a343df63576ce9f31cffcdbaf761472f5f559f90988f886d515f6d6c52e5d30283141ee2f13f92f7e1f7e6b8e9eec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597

Ragnar Locker Ransomware: Unlocked by Deep Instinct

By: Jonathan Kaftzan

In last few years, the number of Infosec vendors increased dramatically. Though as you would expect the security landscape to 

prevention.jpg

By: Jonathan Kaftzan
In last few years, the number of Infosec vendors increased dramatically. Though as you would expect the security landscape to improve, it is actually doing much worse than in the past.  Nearly two-thirds of enterprise players have been compromised in the past year by attacks which originated on the endpoint, according to a <a href="https://www.barkly.com/ponemon-2018-endpoint-security-risk" target="_blank" rel="noopener noreferrer">Ponemon Institute survey</a>. The report says that figure is a 20% increase year-on-year.
Ponemon Institute showed that costs of a successful attack increased 42% year-over-year – with attacks on SMBs costing an average of $7,120,000 ($763 per endpoint), nearly two times the cost per endpoint for larger organizations ($440).
And, perhaps most astonishing, the survey showed that respondents estimated their current anti-virus platform is effective at blocking only 43% of attacks. This is because these solutions are only effective against known malware.
The report highlighted that the biggest threat to organizations are zero-day and fileless attacks.
The reasons for this may vary, but 2 main reasons are that over 350,000 machine-generated new malware is created daily which makes it almost impossible to have an effective solution against it and because many of these security vendors do not offer actual security. While they may offer data management solutions, BI suites, ways to analyze data, and different post-execution and post-infection management solutions, it is not what real security should be all about.
<h3>Prevention vs. Detection </h3>
In life, there are situations in which you want (and need) to prevent things from happening. For example, always better to put up an effective wall to prevent an intruder from getting in rather than have the alarm go off when it’s a little too late.
Same goes for cybersecurity.
Originally, the concept of cybersecurity was all about prevention: perimeter security, anti-virus programs – these original security solutions were about prevention, meaning not letting bad things happen or enter in the first place.
<h3>The Evolution of Prevention</h3>
Looking back at cybersecurity, in the early 1990s, technology was not where it is today. Once hackers realized what they can gain from cybercrime, they ratcheted up their game. The intricacy, impact and scale of their criminal activities quickly evolved. Polymorphic malware and encrypted code caused anti-virus programs to become less effective and that led to an assumption – wrong as it may be -- that it was not possible to prevent malware or unknown attacks.
In a way, the industry started to give up on the innovation of prevention technologies and instead moved into detect-and-response solutions.
However, thankfully, through innovative technology, we can now revive the original concept of what security is and should be about.
Hackers today have all the best technology readily available. So, the security against these worms, viruses, target breaches, IP theft, spyware and ransomware has to evolve, too.
Deep learning in cybersecurity, reinvents and redefines  “prevention” to its original classification: The idea that you can prevent attacks from happening.
When you prevent things from happening, you can save resources, costs, damages, time, and your reputation.
<a href="https://www.deepinstinct.com/2019/04/16/applications-of-deep-learning/" target="_blank" rel="noopener noreferrer">Deep learning</a> in cybersecurity is the most promising and most important technology today. Actually, deep learning has revolutionized pretty much every field it has been applied to. Deep learning has advanced AI and computer science by leaps. Deep learning is motivated by a prevention approach, and prevention solutions are the future of cybersecurity.
Real-time prevention harnesses deep learning technologies and provides 20%-30% better results than currently available cybersecurity solutions.
Real-time prevention means producing high detection rates and low false positive rates. Real-time prevention using deep learning in cybersecurity is specifically designed to keep safe any type of device, any operating system, and any file type.
As such, today’s real-time prevention technology is an essential cybersecurity solution to get – and stay -- one-step ahead of the next breach.
&nbsp;
To read more about the different approaches over time in cybersecurity, download the whitepaper "Reinventing Cybersecurity Prevention with Deep Learning"
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274"><img id="hs-cta-img-ffcc9f6f-5f5b-4387-90d3-58d48b011274" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/ffcc9f6f-5f5b-4387-90d3-58d48b011274.png" alt="New call-to-action" width="800" height="200" /></a>

Reinventing Prevention: Deep Learning in Cybersecurity

Emotet, one of the most prolific financial malware threats of the last two years is being spread en-masse these days as part of a wide E-mail campaign

shutterstock_394552096-1.jpg

Emotet, one of the most prolific financial malware threats of the last two years is being spread en-masse these days as part of a wide E-mail campaign. Since the beginning of November, Deep Instinct (as well as <a href="https://threatpost.com/emotet-campaign-ramps-up-with-mass-email-harvesting-module/139041/" target="_self">other security vendors</a>) has witnessed a significant rise in Emotet activity. Emotet variants that <a href="https://www.zdnet.com/article/emotet-malware-gang-is-mass-harvesting-millions-of-emails-in-mysterious-campaign/" target="_self">surfaced in October</a>, included new e-mail exfiltration capabilities. It seems that threat actors behind Emotet are now using harvested email accounts, trying to further expand the malware outreach.Data from Deep Instinct’s D-Cloud (Deep Instinct’s threat-intelligence and telemetry cloud) indicates the attack is focused in North-America, with some targets found in other parts of the world - EMEA and APAC. We have spotted targets spanning across multiple verticals such as healthcare, education, financial services and hospitality to name a few. Since the beginning of November, we’ve identified and prevented thousands of attempted infections, carried out by a large set of droppers and 2nd stage payloads, which are mutated repeatedly on a daily basis.<h5>Background</h5><a href="/glossary/emotet-malware" target="_self">Emotet</a> is one of the most prevalent financial malware threats of the last years. It first appeared in German speaking countries in Europe around mid-2014, and after two years without signiﬁcant activity, Emotet reappeared in 2017, attacking mainly in the UK and US.From its very ﬁrst version Emotet spread mainly via Spam campaigns, imitating financial statements, transfers and payment invoices. Once it is dropped and run, Emotet intercepts and logs network traﬃc, injects to browsers and tries to access banking sites, in order to steal and store financial data.In recent attacks (as of 2017), the dropper in use is usually an Office document containing VBA which downloads the PE payload, which might also drop additional malware. Emotet has developed since its reappearance in 2017 when it started adopting new evasion techniques. One example is searching for common applications found on security products such as debuggers and for common usernames found on sandboxing environments. And another is a rather rare code-injection technique where instead of using RunPE based process hollowing for injection, some new Emotet versions use windows API functions to create a Timers-queue timer, which call Emotet’s payload instead of calling the windows API callback function.<h5>Emotet’s Back, Again…</h5>Since its return to the financial malware scene in 2017, Emotet has been replicated and mutated frequently, both manually and by using automation to generate large numbers of variants. Emotet’s samples are based on continuous mutations (which vary in scope, complexity and evasion) of droppers and payloads for each target or attack wave. The latest attack wave is based on a set of mostly simple mutations of several dozen newly prepared droppers and payloads.In several occasions in 2018 Emotet’s infection infrastructure and droppers have also been used to spread other financial malware/spyware such as Trickbot and Dridex. We can confirm this is case in the latest Emotet campaign – several droppers communicate with C2s serving both Emotet and TrickBot payloads.As seen in previous attacks, the current campaign’s emails are financially related.<img class="aligncenter size-full wp-image-4710" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4b23bd14400c3ad4/611a80255739461637def3cb/Picture1.png" width="845" height="456" style="width: 845px; height: 456px;"/>[caption id="attachment_4711" align="aligncenter" width="839"]<img class="size-full wp-image-4711" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltedf1e5c6125d9dea/611a802521164f161dab5d47/Picture2.png" width="839" height="579" style="width: 839px; height: 579px;"/> Spam email and malicious attachment of the Emotet dropper, from the November 2018 campaign[/caption]&nbsp;&nbsp;The droppers are either PDFs carrying malicious JavaScript or MS-office files with an obfuscated malicious Macro embedded. The content of the documents aims to lure users to allow and run the active content which is essential for infection to occur.Once enabled and run, the malicious script (JS/VBA) will drop and execute Emotet’s payload with a simple cmd.exe command on the victim’s machine. As mentioned earlier, in some cases, the payload dropped is a of different malware strain known as Trickbot. This recurring scenario where Trickbot and Emotet share dropper and payload distribution infrastructures, or one is using the other as a secondary payload or a loader, might indicate a shared backend environment, in attackers have implemented a logic or mechanism which controls and decides the malware to serve.Associating many of the new payloads to Emotet can be done based on several static artifacts known to be related to Emotet. In addition, Deep-Instinct’s deep-learning malware classification module (a secondary neural network used to classify malware to threat types and families) classifies the payloads which are part of this campaign as Spyware, immediately upon prevention.[caption id="attachment_4758" align="aligncenter" width="974"]<img class="size-full wp-image-4758" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0098c78187874368/611a7fbff01a3a162c1ef8ea/Picture3.png" width="974" height="452" style="width: 974px; height: 452px;"/> Event page in Deep-Instinct’s management console following Emotet payload prevention[/caption]&nbsp;The new, large-scale campaign proves Emotet is here to stay and remains an imminent threat. Its polymorphic and mutating nature make its detecting challenging to many anti-malware products. New dropper and payloads variants are coming out daily and are successful at evading a wide range of solutions as is indicated by reports of infection as well as multi-scanner threat intelligence.Deep Instinct customers are fully protected from Emotet. All new droppers and payloads are detected and prevented pre-execution using Deep Instinct’s Deep-Learning based solution.&nbsp;IoC (prevalent samples)Droppersefdfe8f4b5aada41e97e47e1c439a2695e656c71dd973bb7789b13f5163877972074fc77244a06c505e78a81d8e97bb0869aa3f7812aadb2a8b8e8a1cf3c95eadaaf91eb4fb13da6233472df892398bd2ea8cd115398d7087121d6d42b0701edfef1c172e68f5812e669577b7d2f003cd0dc533d4d3d041f0f5969a40e39895b7eddb2b15af34d65a8aaf5a891cddfc60bf278f6de6bede09c76e854363e50b0533da9e9871ee55d5d60c2a7290f404948e75e1c18582e02d3df5ae0583b9ac2a809d9fddb75b1643e8aa4b77600a988f6649592603177a406a33629fc2577d11112203340b2d66f15b09046af6e776af6604343c1e733fe419fdf86f851caa31f09bdbe1013422deff83817196f4c3bf6a9c83481c485d69851c0c0ae9d5f929c1468cf0ec8794f7a75fb8537e1a42e24436bcf63298792eb62ff55ee517f38ba154a65b97dd287b4b85191759be5cae2bfb1b663bd5f6269dea7cb5e80f3a234cebe5a052d2d3a5c23059350443b4e6a133983029f9f8c3d275bb8a342402dd610a705417b20cca16f07ded6445e844816e83747cd3655c5191fb0ed6615916a34569bf87487070e6ddd5896b403b7dffb7d9a29341fda5813151a3511aaf600ad96a25485e893980b4d37bc4c8146c8b14644e4d6f9b6f6c4af9c2cd8a86c02ed455630207e7d6f6fcd205d5f041f7721d474e39ae6c95194952b23e63cdf064a9ec44e485f80efa82d29122c82dabb268dcca5b18ab6fe114ee657a6a84d0734985f67598ec0a0caf9ca31edd54bc93c5072ab0facc09f3d5164c8930afe0b15a15c61725f6f8f8981dc8ae068752de11018877c161bc578669fbdf65a610e8bb19a89fb67502ac0bfadf9f7e9cb0a1f6a239e886ab4d0066209cde3b0e219b5e022c1cb7ee7db9d922e90f885926db5e051ae54cdda107a3b98fc1b7dbb1b70d7e452d68eee61465edc3c8adcd7cf4a1ec155e8ddfe846db68c6807f9a0240be36c2dd40f30dc6ed9439b1d03b8ec602de20d52fa2c0c19411d365ac7c52ec4615e010a107133c1480a3a3a703a38924e64995b212ca50c65a57e88492d2f7ee884d642d6bb0c92907c1322face20646abde7ea4e3ccaee8cdd65e7bed8385a7461909257b9a1b154ee0a0f4db583283f741de418d622adbf7d32a4cb8a3a8c93b83bbf3a15771881a49594ad822947aee3cc5010f92817b02db7b3a54f4862ce1febc9746994796ede4ec763b77112fde15e63eeff5e1056cbec55adf44aaac5950c0405bd5afd633c56330709075d0f7b4afe49eb2842985db5ff6faa528ea86eaf014de4edf23460006f8cdff14824296552cf2f9db3d1ad03a2880f56d209dd8183f988088d5465f0035062f3c52c7541924a851cb7bba4564dac9d5c534ae4e830cf73ddc02a19368138b60bfe0cd8ab12d1bb89106872fb73553960c17dc600c05fc34a7ac198d6ae84f56c45f10dbddbb2f03420e7b0201d40f1617a25491c3d643a73d54effbd4352cfa35d47078a76d9fee607961f0573bfac70bb6ec457f876eaf97f6c27d88e7024b7ebf888fcd404573e5ce458d59cc27d7176349ecf5ae7f73d255fd3144b5c7bfff57f814afcdec7b62c9dd788b6d53a75b87903540c9362854bfb71f79dc3408a370b1c7aa829af6d12d04fa62fc0267c0fb0e2bcd06fc2182b48d3833173c373fc000ad30c9006e9ead9ec1a6f26fd8039cc157c4e9043521973fed5b0fe6ad374874063ebee389060272f61024da391df6bf7a128fad2e1fbe9e9af70539984717c40d96fd69ca007c26901c48b9caebb81a6d05b646ad0c345c4ef4b4f8a1ec08d703cd48f1d4f149095f47e7a1aba582d3578f14646617e19847cd2f2cb340f24d210131ad60048b4f15548a16bbb8473cab0b5d82cce325a1cfcd434e0641a52d0c100376fdbf6290c1a5af688d1d239d52d6332a737259c555ed2014ae6637e1c06fbe2fbb7bd3b180f8802f5d207d1043348768094e636fdb28bf8b4e1e49cff3196360d5317aa168fa396f9d66c21e2f60e2d27d3120457f9985791253e4e67df66a0f7efda961788005c06d787f37aaaa575b0a19aa886fbc8b78743a0834f5f75462ba34d9d894df211e5ddef4d5d13f37b145e50bce81b79c4b2108c76f17bc2295c9c20424bba55935ee9daffb5fc1ef635eca9afcde827b82221c1f6905c6b2d4ba1922f922ed96808ecd992117410d1a83ae3acca3499415387d7f3f73125de93c61c55426c2c36a8f07be30c7f7158311ebad7481f2a5cc2e3f2a97a80b68882f727a0ece5356668f247b6d306315dfaf756021628b33b4e6865109329b1bdff4632e9b9635c51dbf898411e938a4016c3af84a9a75466b2eb4eb7d0bd0f37bf0c84c242f39c9739fe82376ba340ca82e24462e88ec7b4f24a02063d0230c7d2371b0d458af5c5a4ffa274f2e3086a6ee4fbb8cacfa7f2e28026362481109ee0f88141016d51bbbb01392dbc6794f27b39606bddd5726b1534f649bb2d36f1f6e837f8931d09904410e9aeb45fd32f385d5fef1cc9d46a434421da798a87ddacd1327701363921f430b8cbdc6fa7ef8f110b27ecf1117b889a778d4e3f62d35e9e1a5df3d1a5f03d4ef4ab4a8bd718f5c3e475e9c11c3d15b72d6c9475fd36974c1e719a0b23194d56b2232c9bbdc0730880e3b29c9a791b18dff5bc7f25cad6fac2b2b8fe8d14146bc84cca2436f09a7211dc2466ba696f8ff0c70278ab53d10df7443266aaa17b97d93672bdf6b1894bc079f0afd621ab878accbb5d52eee457df3d02b809f9849deb9c2ab558a4dee62dc1da89e238854c31d96c175c88e501d76925a58f834ca2ca4385f6cad68879e4d279c0a24bbfb8e105e9ba54397e87ee1f5433822e7fa54e00135723727834499e280282d93ffe9d6f79adc224b012a2e3660a0c03a2c06786289db6e826a8b2e0129bf90355bec19d6bf399ce3fa5603537ddbdcbd9c4867001647e4cb6ad3a4b768964343ac732b6b4d41b0dcdae3595f1c81ea4fc091311a798e62667b9752bd7c7e6812caa44f30974f29bd6b8697f4a87cb3e423599f8ecdbec7b5876a8304d7b8809c0f426161008fb2478dcb2f446fd0edd034b24be8697cb45f22249dab86c46bd77cfdd8eac2c237aecf0d14de99578ae5360b7acb9e2b35a4b1b8ca59cacc57fe2642296065b25ba458f3781beec4f6da979af46ab095b237cd3f36807e493ce8690cb581d349f69615ce8174f9fa86e979ecc92a2bf0415036c3baad32b8caf8379568b40df61f617750d0cc4265c4d939f5e0f806d5d048806b0ea77022247cb940c6b098a0598fcdd8bd387ac355af3a33fa1158321b7f44681e836c4cf5cb6b5114da52d8dcdf1d35c56f5525925f9cae3f836be95674521b1462e02d55449147d95663d85a69dde1af58f34df91c6d3f24f89e57eab8d5ffdae152a8b24f49fef773c4cad82f486acc660055c02e3d7e8e6c0630b3874f2bf7de5a10a588c39c409b9e75d28dd7972f5140f08030bda9f6f8155360ade1fe357630959f7a73869d11d8e04714dfa7bded6a79014aadd51dd3d7c04547597afcfc31e5f0c3af528745003c1691260dcffadbcd02ef9de6fb65182e86c22b9112a1e6f03b425cf9552d513551a9d0b4f1e5cc48f3fcff224a5440bd277d7208c4d62d80e81bcc322f19a360c8aa27d1459747c743a61f605ae380f52ea5a42c0f2de6e16f0c000cd242131cbfbff359f3cb6f7b25c9b0016e9e223d9ae55eadaf9f0292c25feb4d7dd0430b6f86549e8f586504a746d03728e25298349487fbdfe05c773c6c708caa5426f22762a4a11d5d0f7c41a8210191c86a3ad4e1f88cbe3c2cdd0fc9b87b7f06b567dbfa30adaff783017ea921aebfb780136439c31d8ae0cfd38945c7d66665a65b7b7aad5e4926ed5827c731ebcecb51f02464ffe76c566dce08bca74af6f0213e4e62ae554bcf7edd8e36e2074aa67a1a9dd4573a5fd34359e9a0b551faff26cb55f4f67593036944adcd528b434b6d8ba77390fddefe16ba0e488d507211b384d34cf3eead7fc5a95a9982e8c933b1a647c86a2b97c1aaad5f8670272f3a6cd991bdef59513f9e951612739a36eee98f1e55f71b6bf80e9c87f4f9c1683c45739075dcc5241e2e98bb6003b971f116d4dc6f32146729441cae789e3fb4860f435fe1647e70a63f1655a4a4a455e0a53007d2bc3092d2ed1ba66ca53993255f154100d6e4675822aeff9474dd713cba9002fb3d769973a7cb59fd21e304ebbdc48c2814ff0692d69201e64518b13f6ba63ea1a958fe82f06581710a8ad9d88fff4396500be1f21e678330c57d24769c8dd4ea3ef673402fc8768d27f9d231ef22baf1d42dd648e8859b55458b152ad9500d8df9bf401cfa0505f03012ea99f5b216f78a6c661473c8967c3633b5b4541f0f037760050ca6a8b8717635ee4ce76baa1d4717d7b0f08ae0bb871149b457bea5c3cd9746f7a00ba499e42e461acf87f260bdc64b17e12af64d473d7f5cabfc82d7bd8a54e03ecb51567d81ac5dfa8dc1bd36670daede4e6c4828a30d1c386b48bcc6e7aaeb05493d97225552a0976bb4ce958a10b00af264baeab4e5d7bc57b1ef35f09d0f12a20f770d17ab10e22e6d2c66397072da9257ce8aed428c7d35f2f06ac9d19d16329e6c7cf8ea3bdfd5e393a39566a73bb5b7cceb303dbd7790be21de9b61e812537ef369ce7327fd536f46dbe3105f7c0273c80bcc03fc3afc5c709d0ffe34346895f0dde4ca74c900e855e4eea4d9ef40457fadc296220562c8ed2aa0ae5f99ff692826a82711c4d7dab4d62e330e1b4aebdb2e7dcbaaec834d3b3accd527299f71fd1056b9b88e5156d83ec6e928d13872177f3dfd5cbe82858026348fb76b9400e5c810b7642553dc08220a4261f158fa8b0ff5a9627b2c8c3871d4dbaea80dfc3c94f35f7f80d9f92203a1a638e68e4b3f61112608cf6deef9ec6ada125d068e84fa67d6b081e26753860de055d86907e9dPayload5f0df0c31c47da2cf9e379f392144bf8d2437d436d9ea7c14ff07f5d04a705e70ea0d10daa8441022afe01bc1bdae16d5a858b77311c3f71a6d1c535e645e62386b7c8c206ee81e2396a1c16a1014d3759479db9b133cb1906ad33e06cf915e9f2cbb164dd9defb79c2bc94f075dfaa84cd9fd285f44b8ea1d7ca1c81a537c22d69a3f1620bf2a442cd584a0a657fc93b47d4f08f446ca84f1d5471e669a59b9ef2301ce298dc73ed2022e5607400e8ce00a563ea2e6d78cfdafcfb7612fa8297c359f37bc807c4c2daf5b8f6b705f70f4fbf6fc62b4e02d48cb6b9679b274b021248a7f14f2159fd4768e64b1c531358a793c558966dca00aefcbb7ed217c678906c39fab5491d47a9502ff8914949afc920914257d31fbc7f92d8d58576b68a25625f7d1e3bcd30477059562cfa0d0ec618fc076d73b3ca02beabde7a5a601e6c95255a8926b0f99d7b83bd00b7062bea8e815838e7e8cda471edc32253ffb10339b0cc22729340f8e538735d29b8839fe325bb8d4f70a33026765dd7f71b2951f1946669138459a5185ea594d13fa358486cf05daab305d4174c1a1cf0579b2c5e2ce8d94d854f39b418afdbb373e1cf9e40d273046255350366e177156b98f3f1ddad7c13b3757ca200fa93d2afd33c52b1c7dc2f27caa8ecd989291f748a149821063817e9473392d7b3e330db8e4bfbba989bd8ad5f0ad31a1e0629ecce468da459d9023c5e6a64e2aa3bea761d05e423cea3f6e594f0569bc922ea4162b9084bebcb7655879818bf44c15571ce3161e8dd9b3ef5c8387e9c598c0234d2b641d37a926b7050f9fa179e6cb3439d0eea4e66b9ce4cd84d4ee3c60446c4f95caccb8371619ba3b340f6bf82b965db08b24286aa75ddcf71e9cde14d34180582e0912fee577fb52ea5f06ec43a8b241f4baa431ef1ed3a575f7ec0a11a51e42d1d8cd25db430abe8c665e361fc249ecf773b63721dd52c2db8e12be5095625cfd134c67b2ea0ddd16a2b7f1e639f4b71301efe22775ce5639a2338ff8576f9155a2f84c7a36f27deaa0a3f63bbcb426ace329e10edcbe7d9a8aa8a20cb133e3b29504f62f153921f4f91260c2a7288deeba3c1c8978ed101191a0ebd8cab9da07fc26a9dded88ef3c27f0cd5145f68620fb599f2d56ce1675a801bfa878ecafbb5d83f5c9d104a2e478a05d4350f9ad01aa82b66554f452f1336005461346412d5f1887c34fe7ee92a3fa9328c6003edfd345ad9020f1aed42a4a81341e3796650fb7488f2d2b7c6c88f5b02428cdc5b54a61f513a28b290450d10b24ff08667cda76b582c0771f85ad12167238e0f4bb12f479030d99c8a15d7f08eb9975

Emotet is back in full swing with massive, North-America focused E-Mail campaign

By: Deep Instinct Product Management

GDPR, a set of regulations that places new restrictions on how companies handle personal data, is about much m

gdpr_blog830x569_2.jpg

By: Deep Instinct Product Management
GDPR, a set of regulations that places new restrictions on how companies handle personal data, is about much more than just updating privacy policies. With more and more cyber-attacks in the headlines, the way people are protecting their data has become more crucial, and GDPR marks the turning point in security policies and is redefining the way we protect data.
We’re happy to announce that <a href="https://www.coalfire.com/">Coalfire Systems, Inc</a>., a leading independent industry provider of IT security, governance, and regulatory compliance services, has validated that the Deep Instinct Real-time Threat Prevention Platform is <a href="https://info.deepinstinct.com/whitepaper-gdpr-coalfire">suitable to meet the General Data Protection Regulation</a> (GDPR) for protection of personal data.
Our real-time threat prevention platform predicts and prevents known and unknown malware, across multiple vectors, and provides true adaptive defenses against the most advanced cyberattacks.
The European Union (EU) GDPR replaces the Data Protection Directive 95/46/EC and is designed to harmonize data privacy laws across Europe, to protect and empower all EU citizens’ data privacy, and to reshape the way organizations across the region approach data privacy.
The GDPR not only applies to organizations located within the EU, but also applies to organizations located outside of the EU if they offer goods or services to monitor the behavior of EU data subjects. It also applies to all companies processing and holding the personal data of data subjects residing in the EU, regardless of the company’s location.
According to Coalfire, “Deep Instinct supports GDPR Article 32 and 33 by recording any relevant activities (detected or blocked) that could result in a breach. The Deep Instinct UI console provides details about malware activities that were detected or prevented. Malware events can be investigated further to confirm when the event occurred, the status of event, the type, threat severity, lifecycle of the event, process chain information, and the affected device details of what happened.”
Coalfire conducted the validation by completing a multi-faceted technical assessment which included technical testing, reviewing the architecture of the endpoint solution, compliance validation and additional testing to cover macOS and the behavioral analysis feature developed for Windows.
“GDPR has made major headlines in 2018 and will continue to do so.  Deep Instincts Threat Protection Platform is an advanced technical measure that can support a robust cyber defense strategy” Said Nick Trenc, Practice Director at Coalfire. “A robust cyber defense strategy is a vital component to ensuring the privacy of personal data is maintained.”
By using deep learning, the most advanced AI technology to prevent threats that can steal private information from company employees and customers, we remain committed to delivering the highest level of protection.
&nbsp;
<a href="https://cta-redirect.hubspot.com/cta/redirect/2183098/f4959e43-eab2-4f9a-8466-976f9e1c73a1"><img id="hs-cta-img-f4959e43-eab2-4f9a-8466-976f9e1c73a1" class="hs-cta-img" style="border-width: 0px;" src="https://no-cache.hubspot.com/cta/default/2183098/f4959e43-eab2-4f9a-8466-976f9e1c73a1.png" alt="New call-to-action" width="800" height="200" /></a>

Coalfire determines Deep Instinct solution suitability for meeting the GDPR for full protection

Unit 221B Validates >99% Zero-Day and <0.1% False Positive Threat Prevention Accuracy

Unit 221B Validates >99% Zero-Day and <0.1% False Positive Threat Prevention Accuracy

Deep Instinct Threat Lab

From Deep Instinct Threat Lab.