Shark

ESET, noting that initial access to the network was achieved by means of spear-phishing as well as remote access and administration software like ITbrain and TeamViewer

Scheduled Task - T1053.005

Command and Scripting Interpreter: Windows Command Shell – T1059.003. Siamesekitten uses CMD commands to gain a foothold.

User Execution: Malicious File – T1204.002. Siamesekitten uses malicious files (Excel and Portable Executable) to drop the malware.

Scheduled Task - T1053.005

Scheduled Task - T1053.005

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The victim is contacted through social media. In this instance, the profile is impersonating a manager from ChipPc’s HR department... The victim is then directed to a website that is embedded with malware and is designed to impersonate the company’s legitimate website.

Akira has used legitimate names and locations for files to evade defenses.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

Deobfuscate/Decode Files or Information – T1140. Siamesekitten encodes their data in Base64, and uses passwords for files and macros.

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

The attack script first conducts SYN scanning to check if a specific port is open. It also reads the banner information of the response from the host.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

Examples in the content include malware extracting or unpacking ZIP, RAR, CAB, tar.gz, and other archived content, such as 'Emotet has used a self-extracting RAR file to deliver modules to victims' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'

Marlin makes use of Microsoft's OneDrive API for its C2 operations. | The ToneDeaf backdoor primarily communicated with its C&C over HTTP/S but included a secondary method, DNS tunneling, which does not function properly," the researchers said. "Shark has similar symptoms, where its primary communication method uses DNS but has a non-functional HTTP/S secondary option.

Initially, HTTP requests are sent to the C&C domain to download a malicious payload.

Application Layer Protocol: DNS – T107.004. Siamesekitten uses DNS Tunneling to communicate with the malware.

The Milan backdoor malware infects the computer or server after one or more lure files are downloaded... The DanBot RAT is downloaded to the infected system.

Data Encoding: Non-Standard Encoding – T1132.002. Siamesekitten encodes the data that is sent to the C2 based on their own protocol.

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC... they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer.

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.