URSNIF

Danabot operators upload other malware to their infrastructure for further spreading.

distributing large volumes (of spam, exploit kit, bundle…)

TA577, are a Russia-based threat group that have been reported to deliver payloads including Qbot, IcedID, SystemBC, SmokeLoader, Ursnif, and Cobalt Strike in ongoing phishing campaigns since 2020. More recently, they have delivered Pikabot and DarkGate malware.

The most common vectors for TA544 campaigns are messages with Microsoft Office documents that contain macros, that, when enabled, install URLZone and/or Ursnif.

The operators are known to use that feature to maintain a constant feed of fresh login credentials for SMTP accounts, plus a list of valid emails to spam.

It may be delivered via password-protected Zip files; Microsoft Office document attachments with malicious macros; or compressed JScript, JavaScripts, or Visual Basic scripts.

Ursnif 4779 is deployed via one of two primary methods: (1) Microsoft Excel attachments with malicious macros... or (2) steganographic images that conceal malicious PowerShell commands which install Ursnif.

((source=" WinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode="1") OR (source=" WinEventLog:Security" EventCode="4688") | WHERE (Image LIKE "%reg.exe%" AND ParentImage LIKE "%cmd.exe%")

There is no indication of TA544 abandoning their primary payload delivery mechanism (malicious Microsoft Office VBA macros), although we have seen an increase in the use of steganographic images.

These messages often contain Microsoft Excel Documents with macros, that when enabled, download and install URLZone and/or Ursnif 1000.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

Thread Local Storage (TLS) callback injection is a technique that entails manipulating pointers within a portable executable (PE) to redirect a process to malicious code before it reaches the code’s legitimate entry point.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.

Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.

One notable characteristic of TA544 is their use of steganography, which is the process of concealing code within images.

Thread Local Storage (TLS) callback injection is a technique that entails manipulating pointers within a portable executable (PE) to redirect a process to malicious code before it reaches the code’s legitimate entry point.

The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.

It filters out security researchers and sandboxes using checks including Maxmind, task counts, task names, and recent file counts.

Most Ursnif 1000 campaigns use a robust combination of geofencing techniques to verify that users are located in Japan.

Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden. APT28 has used the WindowStyle parameter to conceal PowerShell windows.

During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].

Dreambot provides the needed credentials / keylogging / VNC / SOCKS

the malware injects itself into the web browser and capture every HTTP POST request, which makes credential and stealing credit card easy.

After the infection, a webinject is deployed by Dreambot on the victim browsers and when that victims logs into the online banking service, credentials are intercepted to be later reused by the carder.

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.

It filters out security researchers and sandboxes using checks including Maxmind, task counts, task names, and recent file counts.

Most Ursnif 1000 campaigns use a robust combination of geofencing techniques to verify that users are located in Japan.

Dreambot provides the needed credentials / keylogging / VNC / SOCKS

the malware injects itself into the web browser and capture every HTTP POST request, which makes credential and stealing credit card easy.

After the infection, a webinject is deployed by Dreambot on the victim browsers and when that victims logs into the online banking service, credentials are intercepted to be later reused by the carder.

The main feature of the module is injecting code into the web browser that will monitor which websites the victims are visiting. If a banking website is identified, ISFB injects a small snippet of JavaScript into the online banking website to steal the login credentials.

Some used RC6 some Serpent for the same bot version.

Indicators the NetmanageIT Threat Intelligence team shared about a June 2023 Ursnif campaign targeting Italy report many remote destinations hosting Ursnif tier 1 command and controls sharing the same hostname

In the log we can see that: A client 96.57.xx.xxx Sent a web request “GET tuneappservice.org/l3k42hj56h634gkj2lk14356jk4gh23k5jl6h4/gate.php?ped=RTY3M0E4NjhDQ0I5JE1DLTEwNw” We can see here what looks like a malware callback, it’s in fact Riltok.

That’s why carders use a VNC connection to the victim's computer or a SOCKS proxy to tunnel their connection. Dreambot offers both of those techniques by design.

The service is described as a Fast flux but in reality it’s more a simple proxy system. BraZZZers rents a pool of VPSs all around the internet and uses them as proxy IPs in order to hide the real IP of a server.

with the first integration of Tor onion as available C2.

One of the very important features of Dreambot is the capability to drop a 2nd stage implant to any infected bot.

When a victim is infected by Dreambot, a VNC connection and/or a SOCKS proxy is set-up on the victim computer... he will connect directly to the victim's computer by using that VNC server and just like that he would be on the same computer at the same time with the victim, operating over a hidden desktop.

The domains involved are resolving to a list of IPs, (we observed from 1 up to more than 20 IPs per domain) that are just redirecting the traffic to the real server.

The story we are writing here will try to explain how, from a simple mistake made by an operator, we managed to collect and exploit a lot of precious information from a “Fast Flux” network called BraZZZerS Fast Flux between end of 2018 and 2022.

On top of the usual .top domains used as CnC gateway, we saw the infrastructure hosting shops like larek.info or magazzz.top

File stealer: A module that makes exfiltration of specific files from the victims hard drive possible.

TA551 is a threat actor tracked by Proofpoint since 2016. This actor frequently leverages thread hijacking to distribute malicious Office documents via email.