Malware

MuddyRot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

From February to July 2024, more than 50 phishing emails were observed across 10+ sectors with hundreds of recipients.

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

Effectively, the implant spawns a cmd.exe process (FUN_1400016e0) and reads the command to execute from the socket.

T1559Inter-Process CommunicationEvidence1

The shell command and its output are marshaled between the processes via pipes during the session.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

BugSleep operators have demonstrated multiple file-obfuscation techniques to avoid detection.

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

Payloads are then encrypted by subtracting a static value from each byte in the buffer (in this sample it is three).

T1071Application Layer ProtocolEvidence2

This remote access tool (RAT) gives operators reverse shell and file input/output (I/O) capabilities on a victim’s endpoint using a bespoke command and control (C2) protocol.

T1071.001Web ProtocolsEvidence1

Word lure (airline tickets, reports) -> HTTP_VIP -> AnyDesk (return to RMM abuse pattern).

T1095Non-Application Layer ProtocolEvidence1

BugSleep implant implements a bespoke C2 protocol over plain TCP sockets.

T1105Ingress Tool TransferEvidence1

The next set of commands are responsible for downloading files onto the compromised system or uploading files to the C2 server (PutFile and GetFile, respectively).

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 months ago

ip.v4●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

talosintelligence otherNews

Oct 30, 2024

Writing a BugSleep C2 server and detecting its traffic with Snort

A novel remote access implant that communicates over a bespoke plain-TCP C2 protocol with simple byte-subtraction obfuscation. It supports beaconing, reverse shell via cmd.exe, file upload/download, persistence, and command execution on compromised Windows systems.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

MuddyRot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

From February to July 2024, more than 50 phishing emails were observed across 10+ sectors with hundreds of recipients.

Execution

2 techniques

T1059.003Windows Command ShellEvidence1

Effectively, the implant spawns a cmd.exe process (FUN_1400016e0) and reads the command to execute from the socket.

T1559Inter-Process CommunicationEvidence1

The shell command and its output are marshaled between the processes via pipes during the session.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence1

BugSleep operators have demonstrated multiple file-obfuscation techniques to avoid detection.

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

Payloads are then encrypted by subtracting a static value from each byte in the buffer (in this sample it is three).

T1071Application Layer ProtocolEvidence2

This remote access tool (RAT) gives operators reverse shell and file input/output (I/O) capabilities on a victim’s endpoint using a bespoke command and control (C2) protocol.

T1071.001Web ProtocolsEvidence1

Word lure (airline tickets, reports) -> HTTP_VIP -> AnyDesk (return to RMM abuse pattern).

T1095Non-Application Layer ProtocolEvidence1

BugSleep implant implements a bespoke C2 protocol over plain TCP sockets.

T1105Ingress Tool TransferEvidence1

The next set of commands are responsible for downloading files onto the compromised system or uploading files to the C2 server (PutFile and GetFile, respectively).

INDICATORS OF COMPROMISE

IOCs tracked for this family

9 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

5 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app7 months ago

ip.v4●●●●●●●●●●●●View more in app2 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

talosintelligence otherNews

Oct 30, 2024

Writing a BugSleep C2 server and detecting its traffic with Snort

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching9

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.