QuasarRAT

Attackers are buying expired domains to exploit their reputation, traffic and DNS history, using them for malware delivery, scams and C2 infrastructure.

T1588.002 — Obtain Capabilities: Tool (Resource Development)

T1608 — Stage Capabilities (Resource Development)

The actor leveraged publicly disclosed vulnerabilities to gain initial access at scale.

The use of Microsoft OneNote documents to deliver malware via email is increasing. Multiple cybercriminal threat actors are using OneNote documents to deliver malware.

Proofpoint has observed threat actors deliver malware via OneNote documents, which are .one extensions, via email attachments.

Using the secondary batch script to silently execute Quasar RAT and establish persistence using a deceptive scheduled task named "Google Chrome Start"

Persistance via tâche planifiée nommée Google Chrome Start

In one case, the threat actor is said to have successfully exploited a website and collected information about the victim host using Linux commands.

File name back.bat Alternate name for the main Windows deployment script File name bai.bat Secondary batch script used for backdoor execution and persistence File name user.bat Script used to create a privileged local account

In order to detonate the payload, an end-user must interact with the OneNote document.

Using the secondary batch script to silently execute Quasar RAT and establish persistence using a deceptive scheduled task named "Google Chrome Start"

Persistance via tâche planifiée nommée Google Chrome Start

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

T1543.003 — Create or Modify System Process: Windows Service (Persistence)

Using the secondary batch script to silently execute Quasar RAT and establish persistence using a deceptive scheduled task named "Google Chrome Start"

Persistance via tâche planifiée nommée Google Chrome Start

T1543.003 — Create or Modify System Process: Windows Service (Persistence)

This vulnerability carries a high severity score of 8.4 and affects WinRAR on Windows operating systems due to a path traversal flaw.

establish persistence using a deceptive scheduled task named "Google Chrome Start"

Persistance via tâche planifiée nommée Google Chrome Start

Deleting initial payloads to cover its tracks and thwart forensic analysis

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

The client returns data to the server about the victim computer... Get system information

часть инфраструктуры Sable Squirrel используется для работы малвари: к доменам хак-группы обращались более 31 000 образцов вредоносов... некоторые сайты одновременно показывали посетителям спортивные трансляции и работали в качестве управляющих серверов для малвари.

T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)

Using a batch script that employs certutil to download a privilege escalation tool ("EfsPotato"), a secondary batch script, and Quasar RAT from a remote server

T1041 — Exfiltration Over C2 Channel (Exfiltration)

add specific directories to the Windows Defender exclusion list, effectively hiding the malware from antivirus scans