MalwareExploits 1 CVE

ComboJack

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-8579Microsoft Windows DirectX Elevation of Privilege VulnerabilityExploited in the wild

That leads us to the payload, which we have dubbed ComboJack because of how it attempts to hijack a combination of digital currencies.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

Unit 42 and Proofpoint researchers observed an interesting malspam campaign targeting Japanese and American users. This particular campaign tried to entice users by claiming a passport was lost and that the attached PDF contained a scanned copy of the document.

T1566.001Spearphishing AttachmentEvidence1

This particular campaign tried to entice users by claiming a passport was lost and that the attached PDF contained a scanned copy of the document.

Execution

2 techniques

T1059.001PowerShellEvidence1

This embedded remote object is an HTA file which was located at hXXps://a.doko[.]moe/tnejln which contains encoded PowerShell commands.

T1203Exploitation for Client ExecutionEvidence1

the PDF contained an embedded RTF file which contains an embedded remote object that attacks CVE-2017-8579

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Finally, the payload sets the following registry key to ensure persistence: HKCU \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ NVIDIA – C : \ ProgramData \ NVIDIA \ NVDisplay . Container . exe

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Stealth

2 techniques

T1218.005MshtaEvidence1

This embedded remote object is an HTA file which was located at hXXps://a.doko[.]moe/tnejln which contains encoded PowerShell commands.

T1564Hide ArtifactsEvidence1

It then uses the built-in Windows tool, attrib.exe (used for setting file attributes), to set both hidden and system attributes to itself. This hides the file from the user

Collection

1 technique

T1115Clipboard DataEvidence1

In the event a wallet of interest is discovered, ComboJack will replace it with a hardcoded wallet that the attacker presumably owns | Every half second it checks the contents of the clipboard. The contents of the clipboard are checked for various criteria to determine if the victim has copied wallet information

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Decoding the contents of the HTA file yields the following PowerShell command which downloads and executes a file

INDICATORS OF COMPROMISE

IOCs tracked for this family

28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

25 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

paloalto researchcenter historicNews

Apr 17, 2018

SquirtDanger: The Swiss Army Knife Malware from Veteran Malware Author TheBottle

Malware family previously noted for clipboard cryptocurrency wallet swapping behavior similar to SquirtDanger.

palo alto networks unit 42 blogNews

Mar 5, 2018

Sure, I’ll take that! New ComboJack Malware Alters Clipboards to Steal Cryptocurrency

Clipboard-hijacking currency stealer that persistently monitors the Windows clipboard and replaces copied cryptocurrency and digital payment wallet addresses (e.g., Bitcoin, Ethereum, Monero, Litecoin, Qiwi, WebMoney, Yandex Money) with attacker-controlled addresses to redirect victim transactions.

paloalto researchcenter historicNews

Mar 5, 2018

Sure, I’ll take that! New ComboJack Malware Alters Clipboards to Steal Cryptocurrency

Clipboard-stealing malware that monitors the victim's clipboard and replaces copied cryptocurrency and digital wallet addresses with attacker-controlled addresses to redirect funds. It also establishes persistence by copying itself to ProgramData and setting a Run registry key.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching28

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

ComboJack

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2017-8579Microsoft Windows DirectX Elevation of Privilege VulnerabilityExploited in the wild

That leads us to the payload, which we have dubbed ComboJack because of how it attempts to hijack a combination of digital currencies.

via paloalto researchcenter historicresearchcenter.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566PhishingEvidence1

T1566.001Spearphishing AttachmentEvidence1

This particular campaign tried to entice users by claiming a passport was lost and that the attached PDF contained a scanned copy of the document.

Execution

2 techniques

T1059.001PowerShellEvidence1

This embedded remote object is an HTA file which was located at hXXps://a.doko[.]moe/tnejln which contains encoded PowerShell commands.

T1203Exploitation for Client ExecutionEvidence1

the PDF contained an embedded RTF file which contains an embedded remote object that attacks CVE-2017-8579

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Stealth

2 techniques

T1218.005MshtaEvidence1

This embedded remote object is an HTA file which was located at hXXps://a.doko[.]moe/tnejln which contains encoded PowerShell commands.

T1564Hide ArtifactsEvidence1

It then uses the built-in Windows tool, attrib.exe (used for setting file attributes), to set both hidden and system attributes to itself. This hides the file from the user

Collection

1 technique

T1115Clipboard DataEvidence1

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Decoding the contents of the HTA file yields the following PowerShell command which downloads and executes a file

INDICATORS OF COMPROMISE

IOCs tracked for this family

28 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

25 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

hash.sha256●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

paloalto researchcenter historicNews

Apr 17, 2018

SquirtDanger: The Swiss Army Knife Malware from Veteran Malware Author TheBottle

Malware family previously noted for clipboard cryptocurrency wallet swapping behavior similar to SquirtDanger.

palo alto networks unit 42 blogNews

Mar 5, 2018

Sure, I’ll take that! New ComboJack Malware Alters Clipboards to Steal Cryptocurrency

paloalto researchcenter historicNews

Mar 5, 2018

Sure, I’ll take that! New ComboJack Malware Alters Clipboards to Steal Cryptocurrency

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching28

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.