EyePyramid

There's also Francesca Maria Occhionero, who along with her brother was arrested in January 2017 and charged with disseminating a malware program called EyePyramid that was used to hack the email accounts of Italian politicians, Vatican cardinals and the president of the European Central Bank.

As can be seen the spreading relied on spearphishing e-mails with attachments, which relied on social engineering to get the victim to open and execute the attachment.

The malware was spread using spear-phishing emails... the Police Report does not include any technical details about how the malware was spread other than the use of spear phishing messages with malicious attachments using spoofed email addresses.

Moreover, there are checks to ensure the malware has Administrator privileges, and for the system uptime via a Windows Management Instrumentation (WMI) query to LastBootUpTime.

the victim to open and execute the attachment

Another method adds the current user to the domain administrators.

For instance, it creates a registry key named 'default.reg' and it is added to the registry by directly invoking the regedit command.

Then, there is some code to achieve persistence using the CurrentVersion\Run and CurrentVersion\RunOnce registry keys.

Another method adds the current user to the domain administrators.

Then, there is some code to achieve persistence using the CurrentVersion\Run and CurrentVersion\RunOnce registry keys.

Another interesting spawned thread is the one for checking the User Account Control (UAC) via the registry key 'EnableLUA' and disabling it through the control panel.

The sample is written in .Net and it is heavily obfuscated... The author paid attention to hide the core functionalities by using either known .Net obfuscators or cryptography to hide crucial information such as URLs, email addresses and credentials.

Also the attackers relied on executable files masking the extension of the file with multiple spaces.

After authentication, the agent downloads the resource and writes it to the disk in encrypted form. Next, the file is read and decrypted, with the decryption key being used as the temporary filename. Finally, the file is deleted.

The sample cannot be debugged, and it does not run inside virtual machines due to several and sometimes trivial (but effective) anti-debugging and anti-vm checks... If this is less than 46.5 GB and the operating system is Windows XP, this is not a valid environment.

Moreover, there are checks to ensure the malware has Administrator privileges, and for the system uptime via a Windows Management Instrumentation (WMI) query to LastBootUpTime.

The sample cannot be debugged, and it does not run inside virtual machines due to several and sometimes trivial (but effective) anti-debugging and anti-vm checks.

For instance, it creates a registry key named 'default.reg' and it is added to the registry by directly invoking the regedit command.

Additionally in the code there is also support for Active Directory and LDAP. The code concerning Active Directory lists the administrative members of the domains and it checks if the current user is in this list.

The sample cannot be debugged, and it does not run inside virtual machines due to several and sometimes trivial (but effective) anti-debugging and anti-vm checks... If this is less than 46.5 GB and the operating system is Windows XP, this is not a valid environment.

Moreover, there are checks to ensure the malware has Administrator privileges, and for the system uptime via a Windows Management Instrumentation (WMI) query to LastBootUpTime.

The sample cannot be debugged, and it does not run inside virtual machines due to several and sometimes trivial (but effective) anti-debugging and anti-vm checks.

...charged with disseminating a malware program called EyePyramid that was used to hack the email accounts of Italian politicians, Vatican cardinals and the president of the European Central Bank.

The attachments were ZIP and 7zip archives, which contained the EyePyramid malware.

The sample interacts with Command and Control servers and can download additional files. This C&C communication is authenticated with a username and password. | Exfiltration The exfiltration is done mainly via email and partially via WebDAV and HTTP. Regarding emails, they are sent via SMTP protocol... The message is then uploaded to the IMAP server in a specific folder.

The sample interacts with Command and Control servers and can download additional files.

it identified a number of C&C servers and e-mails addresses used by the malware for exfiltration of stolen data.

E-mail Addresses used for exfiltration ... purge626@gmail[.]com ... tip848@gmail[.]com ... dude626@gmail[.]com

Specifically, this code is interested in the Windows Firewall and a long list of possible antivirus software... this sample really pays attention to disable all possible security software and security checks.