Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recently, we found evidence that the developers who created the Sakabota tool, which was previously discussed in the xHunt campaign, had carried out two sets of testing activities in July and August 2018 on Sakabota in an attempt to evade detection.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
The cheat sheet also provides several examples of SQL injection techniques with a ticular focus on XAMPP servers.
Additional related activity was observed in July 2018, which involved spear-phishing emails that delivered macro-enabled documents to install PowerShell-based payloads.
Additional related activity was observed in July 2018, which involved spear-phishing emails that delivered macro-enabled documents to install PowerShell-based payloads.
WMIC with Bat Provides an example windows management interface command (WMIC) with arguments to run a batch script... Sakabota’s remotes tab... allows the actor to use Windows Management Instrumentation (WMI) to run commands on remote systems
The cheat sheet also suggests the actors will use scheduled tasks for persistence... The scheduled tasks in the examples have the names 'WindowsUpdateTolkit' and 'WindowsUpdateTolkit_1'... The -Rev-loop command attempts to continually create an SSH tunnel... by creating a scheduled task named update.windows
The cheat sheet shows significant batch and PowerShell scripting... Provides a PowerShell command to download powercat... The ‘Resources’ tab... install[s] ... a PowerShell backdoor
The cheat sheet includes examples of commands needed for persistence, network reconnaissance, pivoting, credential dumping...
The cheat sheet also suggests the actors will use scheduled tasks for persistence... The scheduled tasks in the examples have the names 'WindowsUpdateTolkit' and 'WindowsUpdateTolkit_1'... The -Rev-loop command attempts to continually create an SSH tunnel... by creating a scheduled task named update.windows
WDigest Provides the command line commands to use the 'reg' application to query and modify the WDigest registry key 'UseLogonCredential'... the cheat sheet provides the 'reg' command to set this key to '1' to enable it.
The Sakabota’s ‘ Resources ’ tab... has two buttons ‘ Shell ’ and ‘ Agent ’ that install a webshell and PowerShell backdoor, respectively.
The ‘ Digest ’ button allows the actor to attempt to circumvent a Mimikatz mitigation by setting the following registry key to ‘ 1 ’... UseLogonCredential
The cheat sheet also suggests the actors will use scheduled tasks for persistence... The scheduled tasks in the examples have the names 'WindowsUpdateTolkit' and 'WindowsUpdateTolkit_1'... The -Rev-loop command attempts to continually create an SSH tunnel... by creating a scheduled task named update.windows
WDigest Provides the command line commands to use the 'reg' application to query and modify the WDigest registry key 'UseLogonCredential'... the cheat sheet provides the 'reg' command to set this key to '1' to enable it.
The ‘ Digest ’ button allows the actor to attempt to circumvent a Mimikatz mitigation by setting the following registry key to ‘ 1 ’... UseLogonCredential
FireWall Provides six example commands to add, delete and show rules from the local Windows Firewall using the 'netsh' application.
the actor would likely make these pivots to other systems by performing credential dumping from the Windows registry and process memory.
LSASS Process Provides five example commands that use ProcDump, Mimikatz and PowerSploit's Out-Minidump function to dump the 'lsass.exe' process memory.
Ntds Provides example commands to save the 'Security Account Manager' (SAM) registry hive using the 'reg' application and Mimikatz's 'lsadump::sam' command.
The ‘ NTDS ’ portion allows an actor to obtain a copy of a domain controller by creating an installation media using the ‘ ntdsutil ’ application... to take a snapshot of the domain controller
Hydra Provides an example command on how to run the thc-hydra tool to brute force an RDP login on a single IP address using text files with the username and password combinations.
The ‘ Digest ’ button allows the actor to attempt to circumvent a Mimikatz mitigation by setting the following registry key to ‘ 1 ’... UseLogonCredential
the following commands within the auto-complete suggestions... such as gathering information on the user and network interfaces; ... ipconfig/all
Scan For Provides three commands that use for loops to scan a local subnet... to locate systems responding to ping requests... and to check for systems whose 'C:' drive is shared
This tab also allows the actor to scan IP addresses for specific services such as RDP, SMB, FTP, HTTP(s), telnet, and SSH. This tab also allows the actor to perform TCP port scan for systems on specified network ranges
This tab allows the actor to use an embedded ‘dsquery’ tool... to query Active Directory to gather information on computers, user and groups attached to the domain.
Get Users Provides the commands to run the Local.exe and Dsquery.exe tools to gather user information from a specified remote system or domain.
The specific arguments in the example command instruct Bloodhound to use the following collection methods... Default - Collects Group Membership, Local Admin, Sessions, and Domain Trusts
RDP NLA Provides a PowerShell command that disables Network Level Authentication (NLA) for RDP... The cheat sheet also has two 'reg' commands... to enable RDP sessions. | The commands also suggest that the threat group heavily relies on RDP to interact with compromised hosts, likely using secure shell (SSH) tunnels created with the Plink tool between the infected system and an actor-controlled domain.
The command in both examples use the psexec tool to run 'cmd.exe' on the remote system... The ‘PSEXEC’ portion of this tab allows the actor to install an embedded PSExec tool to the system and use it to connect to a remote system using supplied credentials.
Pass The Hash Provides two examples of arguments needed to pass-the-hash to run a command on a remote system using Mimikatz.
The -Tanbo command writes an embedded NirCmd application... and uses this tool to take a screenshot of the system.
WinRAR Provides WinRAR command line commands to recursively archive folders. One of the examples outputs multi-volume RAR archives split into 153,600KB files.
These tools not only use HTTP for their command and control (C2) channels, but certain variants of these tools use DNS tunneling or emails to communicate with their C2 as well.
The -Rev command saves an embedded PuTTY Link tool... and uses this tool... to create an SSH tunnel to allow the actor to create a remote RDP session on the system.
This section also provides an example PowerShell command to download powercat from 'hxxp://pasta58[.]com/pk.txt'... Download from CMD Provides a PowerShell command to download a file from 'hxxp://pasta58[.]com/r.t'
The commands show the actor: Creating an SSH tunnel (T1572) using Plink (RTQ.exe) to a remote host.
The ‘ FTP ’ portion of the tab allows the actor to select files from the system to upload to its C2 server hosted at ‘ pasta58[.]com ’ over FTP.
62 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.