Prikormka

The main infection vector that we identified during our research consists of spear-phishing emails with attached malicious executables or with a download link to a malicious file hosted on a remote server.

The main infection vector that we identified during our research consists of spear-phishing emails with attached malicious executables or with a download link to a malicious file hosted on a remote server.

The malware authors have also included a new value called roboconid, which represents the Operator’s ID. Our investigation allowed us to confirm that this ID is a unique number for the malware operator, who performs cyber operations and is assigned to infect, spy on, and track a particular target.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Astaroth can launch itself via DLL Search Order Hijacking.

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.

When the user clicks on a malicious attachment that is masquerading as a document, the Prikormka dropper displays a decoy document in order to trick victims and distract their attention...

After encryption, the original (but not the encrypted) files are deleted.

Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.

Thus, this simple check allowed the malware to bypass some sandboxes used for automatic sample processing.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Astaroth can launch itself via DLL Search Order Hijacking.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Agent Tesla can gather credentials from a number of browsers... APT33 has used a variety of publicly available tools like LaZagne to gather credentials... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge... SELECT action_url, username_value, password_value FROM logins; CryptUnprotectData

Agent Tesla can gather credentials from a number of browsers... APT3 has used tools to dump passwords from browsers... APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores... TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge

AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

ADVSTORESHELL can list connected devices. APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim. APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.

Thus, this simple check allowed the malware to bypass some sandboxes used for automatic sample processing.

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

This module is responsible for geo locating the infected computer.

The CORE module downloads additional components, which are used to harvest various types of data.

This module is responsible for collecting documents from removable media or fixed drives, connected via a USB interface.

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

The content is a MITRE ATT&CK-style listing of malware and threat actors that "can capture screenshots," "take screenshots," "perform screen captures," or "watch the victim's screen." It ends with references to "CopyFromScreen" and "xwd."

This module is responsible for recording sound from a microphone.

The communication is encrypted with the Blowfish cipher and then base64 encoded.

The DOWNLOADER module makes an HTTP request to one of its C&C servers... The communication is encrypted with the Blowfish cipher and then base64 encoded.

The DOWNLOADER module makes an HTTP request to one of its C&C servers, receives data, decrypts the data, saves it under the name hauthuid.dll and then loads the DLL.

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.

The CORE module checks periodically for such log files and when a log is available, it uploads it to the remote server.