MalwareUsed by 1 actor

Win64/Spy.Banker.AX

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

The purpose of this blog post is to deliver technical details of this as-yet minimally documented malware... The third and final stage is the relatively large module (~730 KB) that contains the main features of the malware: to communicate with the C&C and receive orders from operators... more than enough of the kind to clearly characterize it as a remote access Trojan (RAT).

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

a trusted but compromised website redirects to a landing page booby-trapped with an exploit | the threat is delivered sneakily, via a watering hole attack, whereby a trusted but compromised website redirects to a landing page booby-trapped with an exploit

Execution

3 techniques

T1059.003Windows Command ShellEvidence1

The initial stage is a console application expecting at least one parameter

T1203Exploitation for Client ExecutionEvidence1

redirects to a landing page booby-trapped with an exploit. If the exploit kit successfully delivers the intended malware, the malicious payload ... is executed on the victim’s computer

T1569.002Service ExecutionEvidence1

to (auto)start one of them as a service

Persistence

1 technique

T1543.003Windows ServiceEvidence1

the dropper tries to change the configuration of a system service in order to load the dropped loader as a service. The service is configured to start automatically by the service control manager during system startup

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

The module injects itself into all running sessions on the compromised Windows system

T1543.003Windows ServiceEvidence1

Stealth

5 techniques

T1027.007Dynamic API ResolutionEvidence1

The dropper employs dynamic API loading instead of having Windows functions in its import table

T1036MasqueradingEvidence1

the files borrow their creation time from the system’s shlwapi.dll

T1055Process InjectionEvidence1

The module injects itself into all running sessions on the compromised Windows system

T1070.004File DeletionEvidence1

The dictionary of the commands is like this: ... “DEL”, “WIPE”

T1140Deobfuscate/Decode Files or InformationEvidence1

the remaining two are necessary to extract binaries of the next stage from resources ... The loader is decrypted, while the module is just extracted and dropped as-is

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The dictionary of the commands is like this: “DRIV”, “DIR”, “DIRP”, “CHDR”

T1083File and Directory DiscoveryEvidence1

The dictionary of the commands is like this: “DRIV”, “DIR”, “DIRP”, “CHDR”

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

Many of the commands are self-explanatory ... DOWN is to download

T1573Encrypted ChannelEvidence1

There is only one encrypted URL stored in the module. Communication is encrypted.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

UPLD is to exfiltrate data

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app10 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Feb 16, 2017

Demystifying targeted malware used against Polish banks

A multi-stage Lazarus-like malware family used in watering-hole attacks against financial-sector targets. It uses a dropper, loader, and final module; dynamically loads APIs; decrypts later stages with RC4 or Spritz; installs components as auto-start services; injects into running Windows sessions; and provides RAT capabilities including file operations, command execution, download/upload, process killing, and C2 communications.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

Win64/Spy.Banker.AX

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Lazarus

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

Execution

3 techniques

T1059.003Windows Command ShellEvidence1

The initial stage is a console application expecting at least one parameter

T1203Exploitation for Client ExecutionEvidence1

redirects to a landing page booby-trapped with an exploit. If the exploit kit successfully delivers the intended malware, the malicious payload ... is executed on the victim’s computer

T1569.002Service ExecutionEvidence1

to (auto)start one of them as a service

Persistence

1 technique

T1543.003Windows ServiceEvidence1

Privilege Escalation

2 techniques

T1055Process InjectionEvidence1

The module injects itself into all running sessions on the compromised Windows system

T1543.003Windows ServiceEvidence1

Stealth

5 techniques

T1027.007Dynamic API ResolutionEvidence1

The dropper employs dynamic API loading instead of having Windows functions in its import table

T1036MasqueradingEvidence1

the files borrow their creation time from the system’s shlwapi.dll

T1055Process InjectionEvidence1

The module injects itself into all running sessions on the compromised Windows system

T1070.004File DeletionEvidence1

The dictionary of the commands is like this: ... “DEL”, “WIPE”

T1140Deobfuscate/Decode Files or InformationEvidence1

the remaining two are necessary to extract binaries of the next stage from resources ... The loader is decrypted, while the module is just extracted and dropped as-is

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

The dictionary of the commands is like this: “DRIV”, “DIR”, “DIRP”, “CHDR”

T1083File and Directory DiscoveryEvidence1

The dictionary of the commands is like this: “DRIV”, “DIR”, “DIRP”, “CHDR”

Command and Control

2 techniques

T1105Ingress Tool TransferEvidence1

Many of the commands are self-explanatory ... DOWN is to download

T1573Encrypted ChannelEvidence1

There is only one encrypted URL stored in the module. Communication is encrypted.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

UPLD is to exfiltrate data

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

6 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha1●●●●●●●●●●●●View more in app10 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Feb 16, 2017

Demystifying targeted malware used against Polish banks

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.