MalwareUsed by 1 actorExploits 1 CVE

Astrum

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2016-3351Microsoft Browser Information Disclosure VulnerabilityExploited in the wild

On September 13, 2016 Microsoft released a security bulletin fixing the CVE-2016-3351 vulnerability, which included a patch for Internet Explorer and Edge browsers. Researchers found exploitation dating back to January 2014, including a malvertising chain leading to Angler EK and dropping Reveton.

via proofpoint threat insight blogproofpoint.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

AdGholas

Figure 6: Another malvertising chain leveraging CVE-2016-3351 in september 2014 leading to Astrum

via proofpoint threat insight blogproofpoint.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Without requiring any user interaction, the initial script reports information about the victim’s machine to the attacker’s remote server.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

Millions of readers who visited popular news websites have been targeted by a series of malicious ads redirecting to an exploit kit exploiting several Flash vulnerabilities.

Execution

2 techniques

T1059.007JavaScriptEvidence1

If a malicious version of the image was received, it will decode some Javascript and variables from the alpha channel... After successful extraction, the JS code integrity is checked against a hash encoded at the end of the picture, then executed.

T1203Exploitation for Client ExecutionEvidence1

The landing page loads a Flash file that is able to exploit three different vulnerabilities (CVE-2015-8651, CVE-2016-1019, CVE-2016-4117), depending on the version of Flash found on the victim's system.

Stealth

4 techniques

T1027.003SteganographyEvidence1

The malicious version of the graphic has a script encoded in its alpha channel, which defines the transparency of each pixel.

T1218System Binary Proxy ExecutionEvidence1

The payload is then decrypted and launched via regsvr32.exe or rundll32.exe.

T1497Virtualization/Sandbox EvasionEvidence1

Using the known Internet Explorer vulnerability CVE-2016-0162, the encoded script attempts to verify that it is not being run in a monitored environment such as a malware analyst’s machine.

T1497.001System ChecksEvidence1

Upon successful exploitation, the executed shell code collects information on installed security products and performs – as paranoid as the cybercriminals behind this attack – yet another check to verify that it is not being monitored.

Discovery

3 techniques

T1083File and Directory DiscoveryEvidence1

It is particularly interested in presence software containing the following strings in their filenames: vmtoolsd.exe VBoxService.exe prl_tools_service.exe VBoxHook.dll SBIEDLL.DLL fiddler.exe charles.exe wireshark.exe...

T1497Virtualization/Sandbox EvasionEvidence1

Using the known Internet Explorer vulnerability CVE-2016-0162, the encoded script attempts to verify that it is not being run in a monitored environment such as a malware analyst’s machine.

T1497.001System ChecksEvidence1

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

If results are favorable, it will attempt to download the encrypted payload from the same server again, disguised as a gif image.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

proofpoint threat insight blogNews

Sep 13, 2016

Microsoft Patches CVE-2016-3351 Zero-Day - Exploited By AdGholas and GooNky Malvertising Groups | Proofpoint US

Named as the destination of a September 2014 malvertising chain that leveraged CVE-2016-3351. Researchers believe the chain reflects early AdGholas activity. The content does not describe Astrum's capabilities or establish that Astrum itself exploited the vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

Astrum

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2016-3351Microsoft Browser Information Disclosure VulnerabilityExploited in the wild

via proofpoint threat insight blogproofpoint.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

AdGholas

Figure 6: Another malvertising chain leveraging CVE-2016-3351 in september 2014 leading to Astrum

via proofpoint threat insight blogproofpoint.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1592Gather Victim Host InformationEvidence1

Without requiring any user interaction, the initial script reports information about the victim’s machine to the attacker’s remote server.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

Millions of readers who visited popular news websites have been targeted by a series of malicious ads redirecting to an exploit kit exploiting several Flash vulnerabilities.

Execution

2 techniques

T1059.007JavaScriptEvidence1

T1203Exploitation for Client ExecutionEvidence1

Stealth

4 techniques

T1027.003SteganographyEvidence1

The malicious version of the graphic has a script encoded in its alpha channel, which defines the transparency of each pixel.

T1218System Binary Proxy ExecutionEvidence1

The payload is then decrypted and launched via regsvr32.exe or rundll32.exe.

T1497Virtualization/Sandbox EvasionEvidence1

Using the known Internet Explorer vulnerability CVE-2016-0162, the encoded script attempts to verify that it is not being run in a monitored environment such as a malware analyst’s machine.

T1497.001System ChecksEvidence1

Discovery

3 techniques

T1083File and Directory DiscoveryEvidence1

T1497Virtualization/Sandbox EvasionEvidence1

Using the known Internet Explorer vulnerability CVE-2016-0162, the encoded script attempts to verify that it is not being run in a monitored environment such as a malware analyst’s machine.

T1497.001System ChecksEvidence1

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

If results are favorable, it will attempt to download the encrypted payload from the same server again, disguised as a gif image.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

proofpoint threat insight blogNews

Sep 13, 2016

Microsoft Patches CVE-2016-3351 Zero-Day - Exploited By AdGholas and GooNky Malvertising Groups | Proofpoint US

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.