MalwareUsed by 1 actorExploits 1 CVE

Jripbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2012-3213Oracle Java JRE Scripting Vulnerability in Java SE 6 and 7Exploited in the wild

Instead of Flash exploits, older Wild Neutron exploitation and watering holes used what was a Java zero-day at the end of 2012 and the beginning of 2013, detected by Kaspersky Lab products as Exploit.Java.CVE-2012-3213.b. | The main backdoor (aka “Jripbot”) ... In terms of functionality, the main backdoor is no different from many other Remote Access Tools (RATs).

via securelistsecurelist.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Wild Neutron

The main backdoor (aka “Jripbot”) ... In terms of functionality, the main backdoor is no different from many other Remote Access Tools (RATs).

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

The attackers injected a script into the forum that redirected visitors to another website ... that hosted a Java zero-day exploit. | This attack took advantage of a Java zero-day exploit and used hacked forums as watering holes.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

Older versions of this backdoor ... had a bit more functionality: ... Reverse shell ... Sometimes, they only drop a simple perl reverse shell | Commands from the C&C may instruct the bot to perform following actions: ... Execute an arbitrary command in the command line

T1203Exploitation for Client ExecutionEvidence1

The latest round of attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit.

Persistence

2 techniques

T1112Modify RegistryEvidence1

This information is then double-encrypted – first with RC4 and then with Windows CryptProtectData function – and saved to the registry.

T1547.001Registry Run Keys / Startup FolderEvidence1

Commands from the C&C may instruct the bot to perform following actions: ... Set the autorun value for itself in the registry Delete the autorun value for itself in the registry

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Commands from the C&C may instruct the bot to perform following actions: ... Set the autorun value for itself in the registry Delete the autorun value for itself in the registry

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Dropped executables, as well as some of the hardcoded strings are usually obfuscated with XOR ...

T1070.004File DeletionEvidence1

After executing the main backdoor, the dropper is securely deleted by overwriting its content with random numbers several times before renaming and removing the file.

T1497Virtualization/Sandbox EvasionEvidence1

The main backdoor module contains a number of evasion techniques, designed to detect or time out sandboxes and emulation engines.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

This information is then double-encrypted – first with RC4 and then with Windows CryptProtectData function – and saved to the registry.

T1553.002Code SigningEvidence1

During the 2015 attacks, Wild Neutron used a dropper signed with a stolen, yet valid Acer Incorporated certificate.

Discovery

3 techniques

T1046Network Service DiscoveryEvidence1

Older versions of this backdoor, used in the 2013 attacks, had a bit more functionality: ... Port scanning

T1082System Information DiscoveryEvidence1

Otherwise, it gathers some basic system information: Version of the operating system ... Username and computer name ... Information about logical drives ... Default web browser Proxy settings

T1497Virtualization/Sandbox EvasionEvidence1

The main backdoor module contains a number of evasion techniques, designed to detect or time out sandboxes and emulation engines.

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

After installing the main backdoor ... the attackers use a range of different tools to extract sensitive data and control the victim’s machine.

Collection

1 technique

T1113Screen CaptureEvidence1

Older versions of this backdoor, used in the 2013 attacks, had a bit more functionality: ... Collecting screenshots

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

Commands from the C&C may instruct the bot to perform following actions: ... Download file from the Internet and save it (optionally encrypted) to the disk Install or uninstall additional malware plugins

INDICATORS OF COMPROMISE

IOCs tracked for this family

41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

29 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

11 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app11 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securelistNews

Jul 8, 2015

Wild Neutron - Economic espionage threat actor returns with new tricks | Securelist

A modular backdoor/RAT used by the Wild Neutron espionage actor. It stores encrypted C2 configuration in the registry, performs anti-sandbox and stalling checks, gathers host information, generates a unique victim ID, communicates with C2 for tasking, supports persistence, file shredding, downloading payloads, plugin installation, system enumeration, self-update, and can recover from C2 disruption via dynamically generated domains.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching41

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actorExploits 1 CVE

Jripbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2012-3213Oracle Java JRE Scripting Vulnerability in Java SE 6 and 7Exploited in the wild

via securelistsecurelist.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Wild Neutron

The main backdoor (aka “Jripbot”) ... In terms of functionality, the main backdoor is no different from many other Remote Access Tools (RATs).

via securelistsecurelist.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1189Drive-by CompromiseEvidence1

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence1

T1203Exploitation for Client ExecutionEvidence1

The latest round of attacks in 2015 uses a stolen code signing certificate belonging to Taiwanese electronics maker Acer and an unknown Flash Player exploit.

Persistence

2 techniques

T1112Modify RegistryEvidence1

This information is then double-encrypted – first with RC4 and then with Windows CryptProtectData function – and saved to the registry.

T1547.001Registry Run Keys / Startup FolderEvidence1

Commands from the C&C may instruct the bot to perform following actions: ... Set the autorun value for itself in the registry Delete the autorun value for itself in the registry

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence1

Commands from the C&C may instruct the bot to perform following actions: ... Set the autorun value for itself in the registry Delete the autorun value for itself in the registry

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Dropped executables, as well as some of the hardcoded strings are usually obfuscated with XOR ...

T1070.004File DeletionEvidence1

After executing the main backdoor, the dropper is securely deleted by overwriting its content with random numbers several times before renaming and removing the file.

T1497Virtualization/Sandbox EvasionEvidence1

The main backdoor module contains a number of evasion techniques, designed to detect or time out sandboxes and emulation engines.

Defense Impairment

2 techniques

T1112Modify RegistryEvidence1

This information is then double-encrypted – first with RC4 and then with Windows CryptProtectData function – and saved to the registry.

T1553.002Code SigningEvidence1

During the 2015 attacks, Wild Neutron used a dropper signed with a stolen, yet valid Acer Incorporated certificate.

Discovery

3 techniques

T1046Network Service DiscoveryEvidence1

Older versions of this backdoor, used in the 2013 attacks, had a bit more functionality: ... Port scanning

T1082System Information DiscoveryEvidence1

Otherwise, it gathers some basic system information: Version of the operating system ... Username and computer name ... Information about logical drives ... Default web browser Proxy settings

T1497Virtualization/Sandbox EvasionEvidence1

The main backdoor module contains a number of evasion techniques, designed to detect or time out sandboxes and emulation engines.

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

After installing the main backdoor ... the attackers use a range of different tools to extract sensitive data and control the victim’s machine.

Collection

1 technique

T1113Screen CaptureEvidence1

Older versions of this backdoor, used in the 2013 attacks, had a bit more functionality: ... Collecting screenshots

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

41 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

29 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

11 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app3 months ago

domain●●●●●●●●●●●●View more in app11 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

securelistNews

Jul 8, 2015

Wild Neutron - Economic espionage threat actor returns with new tricks | Securelist

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching41

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.