KryptoCibule

MITRE ATT&CK techniques ... Initial Access T1189 Drive-by Compromise KryptoCibule is spread through torrent and file-sharing websites.

To achieve persistence, KryptoCibule creates a scheduled task to be run every five minutes ... schtasks.exe /CREATE /SC MINUTE /MO 5 /TN " Adobe Update Task "

Among the commands it supports are EXEC, which allows execution of arbitrary commands and SHELL, which downloads a PowerShell script from the C&C.

MITRE ATT&CK techniques ... T1059.003 Command and Scripting Interpreter: Windows Command Shell Commands received from the KryptoCibule C&C are executed with cmd.exe.

MITRE ATT&CK techniques ... T1106 Native API KryptoCibule uses the System.Diagnostics.Process C# class to run processes.

KryptoCibule requires victims to run an installer from a downloaded torrent.

To achieve persistence, KryptoCibule creates a scheduled task to be run every five minutes ... schtasks.exe /CREATE /SC MINUTE /MO 5 /TN " Adobe Update Task "

To achieve persistence, KryptoCibule creates a scheduled task to be run every five minutes ... schtasks.exe /CREATE /SC MINUTE /MO 5 /TN " Adobe Update Task "

This file is scrambled with the open source program Obfuscar. This same tool is used on all of the malware's custom executables.

The malware is then installed to the hardcoded path %ProgramFiles(x86)%\Adobe\Acrobat Reader DC\Reader\update and uses legitimate Adobe Acrobat Reader executable names for the bundled Tor executable and its own.

MITRE ATT&CK techniques ... T1036.004 Masquerading: Masquerade Task or Service KryptoCibule tasks are named after legitimate and benign looking software.

KryptoCibule uses paths and filenames that match those of Adobe Reader for malware and Tor client.

Both are XOR-encrypted with keys contained in Setup.exe. When Setup.exe is executed, it decodes both the malware and the expected installer files.

Before first executing its payload and on every iteration of the main loop, the malware performs a check for running analysis software ... If any process with a matching name is found, it stops all running components and exits.

On every iteration of the main loop, the malware checks the battery level and the time since the last user input. It then starts or stops the miner processes based on this information.

MITRE ATT&CK techniques ... T1564.003 Hide Artifacts: Hidden Window KryptoCibule hides process windows using the windowstyle hidden option.

KryptoCibule uses System.Diagnostics.Process.GetProcesses to get a list of running processes.

KryptoCibule obtains information about host’s timezone, locale, power status, OS and hardware.

The third component walks through the filesystem of each available drive and looks for filenames that contain certain terms.

Before first executing its payload and on every iteration of the main loop, the malware performs a check for running analysis software ... If any process with a matching name is found, it stops all running components and exits.

On every iteration of the main loop, the malware checks the battery level and the time since the last user input. It then starts or stops the miner processes based on this information.

the malware performs a case-insensitive check of the rootSecurityCenter2\AntiVirusProduct WMI object for the strings avast, avg and eset

KryptoCibule searches all attached drives for a list of filenames.

KryptoCibule programmatically collect paths for files to be exfiltrated.

One of these provides a REST API that the malware uses for most communications ... KryptoCibule uses HTTP for C&C communication.

MITRE ATT&CK techniques ... T1071.002 File Transfer Protocols KryptoCibule downloads updates and additional tools via BitTorrent.

This sets up a SOCKS proxy on port 9050 that is used by the malware to relay all communications with the C&C servers through the Tor network.

KryptoCibule downloads additional tools using BitTorrent.

Additional URIs can be obtained one at a time with a request to %C&C%/server.

KryptoCibule uses port 9187 for SFTP server, and 9999 and 12461 for HTTP servers.

Logs, file locations and system info are automatically collected and sent to the KryptoCibule C&C.

Logs, file locations and system info are sent via the KryptoCibule HTTP C&C channel.

KryptoCibule exfiltrates files over SFTP.

The latest versions of KryptoCibule use XMRig ... and kawpowminer ... to mine cryptocurrency on victim systems.

These rules ... match the format of cryptocurrency wallet addresses and replace them with addresses of wallets controlled by the malware operator.

powershell -c "Add-MpPreference -ExclusionPath '<install path>'"

It also creates firewall rules using innocuous-looking names to explicitly allow inbound and outbound traffic from its components. A rule to block outbound traffic from the ESET Kernel Service (ekrn.exe) is also created