The Week in Review from Stamus Labs

Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.

Current Stamus Threat Intelligence (STI) release version: 391

This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):

New threat detection(s) added [1]: 5 (Gmobi, Scarab, TA445, SoulSearcher, HermeticWizard)
Major changes to detections(s) [2]: 109
Updated threat detection(s) [3]: 128

Note: a "method" as referenced below, is a discrete detection vector for a given threat.

New Threat(s) Detected

The following detections were added to your Stamus NDR this past week:

Gmobi (Trojan)

A Trojan SDK (Software Development Kit) incorporated into Android applications. It is designed to display advertisements, download and install software, and collect confidential information. The malware was detected in such applications as com.rock.gota (system software for Micromax AQ5001 firmware update), Trend Micro Dr.Safety, Dr.Booster, and Asus WebStorage. DrWeb

Gmobi - MITRE - User Execution | Gmobi - MITRE - Input Capture | Gmobi - MITRE - Screen Capture |

Total number of detection methods: 2
Kill chain phase(s): command and control
MITRE ATT&CK: T1041

Scarab (Ransomware)

Discovered by malware security researcher, Michael Gillespie, Scarab is a ransomware-type virus that stealthily infiltrates systems and encrypts various data. During encryption, Scarab appends filenames with the ".[resque@plague.desi].scarab" extension. Pcrisk

Scarab - microsoft | Scarab - malpedia | Scarab - MITRE - Data Encrypted for Impact |

Total number of detection methods: 1
Kill chain phase(s): command and control
MITRE ATT&CK: T1486

TA445 (APT)

Proofpoint researchers have identified a phishing campaign originating from an email address (ukr[.]net) that appears to belong to a compromised Ukranian armed service member. This discovery comes on the heels of alerts by the Ukrainian Computer Emergency Response Team (CERT-UA) and the State Service of Special Communications and Information Protection of Ukraine about widespread phishing campaigns targeting private email accounts of Ukrainian armed service members by ‘UNC1151’, which Proofpoint tracks as part of TA445. The email observed by Proofpoint may represent the next stage of these attacks. The email included a malicious macro attachment which utilised social engineering themes pertaining to the Emergency Meeting of the NATO Security Council held on February 23, 2022. The email also contained a malicious attachment which attempted to download malicious Lua malware named SunSeed and targeted European government personnel tasked with managing transportation and population movement in Europe. While Proofpoint has not definitively attributed this campaign to the threat actor TA445, researchers acknowledge that the timeline, use of compromised sender addresses aligning with Ukrainian government reports, and the victimology of the campaign align with published TA445 tactics to include the targeting and collection around refugee movement in Europe. Proofpoint

TA445 - malpedia | TA445 - microsoft | TA445 - MITRE - Phishing |

Total number of detection methods: 4
Kill chain phase(s): delivery, command and control

SoulSearcher (Backdoor)

In the world of cybersecurity, a backdoor refers to any method by which authorized and unauthorized users are able to get around normal security measures and gain high level user access (aka root access) on a computer system, network, or software application. Once they're in, cybercriminals can use a backdoor to steal personal and financial data, install additional malware, and hijack devices. [Malwarebytes] (https://www.malwarebytes.com/backdoor/)

Total number of detection methods: 5
Kill chain phase(s): command and control
MITRE ATT&CK: T1071

HermeticWizard (Lateral Movement)

HermeticWizard is a worm first observed on Feb. 23 that spreads HermeticWiper across hosts in a local network using Windows Management Instrumentation (WMI) and Server Message Block (SMB) services. Paloalto

HermeticWizard - malpedia | HermeticWizard - MITRE - Exploitation of Remote Services |

Total number of detection methods: 7
Kill chain phase(s): exploitation

Major Detection Changes

The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):

APT-C-35 (APT)

In March 2017, the 360 Chasing Team found a sample of targeted attacks that confirmed the previously unknown sample of APT's attack actions, which the organization can now trace back at least in April 2016. The chasing team named the attack organization APT-C-35. In June 2017, the 360 Threat Intelligence Center discovered the organization’s new attack activity, confirmed and exposed the gang’s targeted attacks against Pakistan, and analyzed in detail. The unique EHDevel malicious code framework used by the organization Malpedia

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): delivery, command and control
Methods added: 1

Anubis (Data Theft)

Targeting Android users, Anubis is malicious software classified as a banking Trojan. This malware attempts to steal banking information and can lead to victims' experiencing financial loss, privacy issues and other serious problems. Anubis has been observed being proliferated via deceptive/scam websites, which incorporate the Coronavirus/COVID-19 pandemic in some manner. Pcrisk

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control
Methods added: 2

AsyncRAT (RAT)

A remote access tool (RAT) is a piece of software that allows a remote user to control a system as if they had physical access to that system. An adversary may utilize existing RATs, modify existing RATs, or create their own RAT. MITRE

Added kill chain phase(s): command and control, delivery
Previously supported kill chain phase(s): command and control
Methods added: 5

Backdoor (Trojan)

Backdoors are designed to give malicious users remote control over an infected computer. In terms of functionality, Backdoors are similar to many administration systems designed and distributed by software developers.

These types of malicious programs make it possible to do anything the author wants on the infected computer: send and receive files, launch files or delete them, display messages, delete data, reboot the computer, etc.

The programs in this category are often used in order to unite a group of victim computers and form a botnet or zombie network. This gives malicious users centralized control over an army of infected computers which can then be used for criminal purposes.

There is also a group of Backdoors which are capable of spreading via networks and infecting other computers as Net-Worms do. The difference is that such Backdoors do not spread automatically (as Net-Worms do), but only upon a special “command” from the malicious user that controls them. Kaspersky

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, installation, delivery
Methods added: 2

Banker Stealer (Data Theft)

The term info stealer is self-explanatory. This type of malware resides in an infected computer and gathers data in order to send it to the attacker. Typical targets are credentials used in online banking services, social media sites, emails, or FTP accounts.

Info stealers may use many methods of data acquisition. The most common are:

hooking browsers (and sometimes other applications) and stealing credentials that are typed by the user using web injection scripts that are adding extra fields to web forms and submitting information from them to a server owned by the attacker form grabbing (finding specific opened windows and stealing their content) keylogging stealing passwords saved in the system and cookies Modern info stealers are usually parts of botnets. Sometimes the target of attack and related events are configured remotely by the command sent from the Command and Control server (C&C). Malwarebytes

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery, actions on objectives
MITRE ATT&CK added: T1041
Previously existing MITRE ATT&CK: T1041
Methods added: 29

Bitter (APT)

APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and non-government organizations. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery
Methods added: 1

Card Skimmer (Data Theft)

Web skimming is a form of internet or carding fraud whereby a payment page on a website is compromised when malware is injected onto the page via compromising a third-party script service in order to steal payment information. Wikipedia

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control
Methods added: 3

Cobalt Strike (Pentest Tools)

Cobalt Strike is a commercial, full-featured, penetration testing tool which bills itself as “adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors”. Cobalt Strike’s interactive post-exploit capabilities cover the full range of ATT&CK tactics, all executed within a single, integrated system.

In addition to its own capabilities, Cobalt Strike leverages the capabilities of other well-known tools such as Metasploit and Mimikatz. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, exploitation, delivery
Methods added: 3

Gamaredon (APT)

Gamaredon Group is a threat group that has been active since at least 2013 and has targeted individuals likely involved in the Ukrainian government. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns. MITRE

Added kill chain phase(s): delivery
Previously supported kill chain phase(s): actions on objectives, command and control, delivery
Methods added: 4

Gh0st (RAT)

gh0st RAT is a remote access tool (RAT). The source code is public and it has been used by multiple groups.

Source: MITRE

Added kill chain phase(s): actions on objectives
Previously supported kill chain phase(s): command and control, delivery
Methods added: 1

Hqwar (Data Theft)

Trojan-Banker programs are designed to steal user account data relating to online banking systems, e-payment systems and plastic card systems. The data is then transmitted to the malicious user controlling the Trojan. Email, FTP, the web (including data in a request), or other methods may be used to transit the stolen data. Kaspersky

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives
Methods added: 2

Kimsuky (APT)

Kimsuky is a North Korean-based threat group that has been active since at least September 2013. The group initially focused on targeting Korean think tanks and DPRK/nuclear-related targets, expanding recently to the United States, Russia, and Europe. The group was attributed as the actor behind the Korea Hydro & Nuclear Power Co. compromise. MITRE

Added kill chain phase(s): actions on objectives
Previously supported kill chain phase(s): command and control, actions on objectives, delivery
Methods added: 1

Loki (Data Theft)

Lokibot is a malware designed to collect credentials and security tokens from an infected machine. Lokibot has also been used to establish backdoors in enterprise environments. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): actions on objectives, command and control, delivery
MITRE ATT&CK added: T1486
Methods added: 2

MuddyWater (APT)

MuddyWater is an Iranian threat group that has primarily targeted Middle Eastern nations, and has also targeted European and North American nations. The group's victims are mainly in the telecommunications, government (IT services), and oil sectors. Activity from this group was previously linked to FIN7, but the group is believed to be a distinct group possibly motivated by espionage. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, delivery
Methods added: 4

PlugX (RAT)

PlugX is a remote access tool (RAT) that uses modular plugins. It has been used by multiple threat groups. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery
Methods added: 1

QakBot (Data Theft)

QAKBOT or QBOT is a malware that is capable of monitoring the browsing activities of the infected computer and logs all information related to finance-related websites.
Trendmicro

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): delivery, actions on objectives, command and control
Methods added: 1

RAT Generic (RAT)

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. Remote Access Trojans often mimic similar behaviors of keylogger applications by allowing the automated collection of keystrokes, usernames, passwords, screenshots, browser history, emails, chat lots, etc. Remote Access Trojans differ from keyloggers in that they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer. This backdoor into the victim machine can allow an attacker unfettered access, including the ability to monitor user behavior, change computer settings, browse and copy files, utilize the bandwidth (Internet connection) for possible criminal activity, access connected systems, and more. Malwarebytes

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): installation, command and control, actions on objectives
MITRE ATT&CK added: T1041
Previously existing MITRE ATT&CK: T1041
Methods added: 3

Remcos (RAT)

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security.

Remcos has been observed being used in malware campaigns.

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery
Methods added: 3

SideWinder (APT)

An actor mainly targeting Pakistan military targets, active since at least 2012. We have low confidence that this malware might be authored by an Indian company. To spread the malware, they use unique implementations to leverage the exploits of known vulnerabilities (such as CVE-2017-11882) and later deploy a Powershell payload in the final stages. Malpedia

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery, actions on objectives
Methods added: 1

SmsThief (Data Theft)

Adversaries may delete, alter, or send SMS messages without user authorization. This could be used to hide C2 SMS messages, spread malware, or various external effects. This can be accomplished by requesting the RECEIVE_SMS or SEND_SMS permissions depending on what the malware is attempting to do. If the app is set as the default SMS handler on the device, the SMS_DELIVER broadcast intent can be registered, which allows the app to write to the SMS content provider. The content provider directly modifies the messaging database on the device, which could allow malicious applications with this ability to insert, modify, or delete arbitrary messages on the device. MITRE

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, delivery, actions on objectives
Methods added: 2

Stealer and Exfiltration (Data Theft)

Info stealers may use many methods of data acquisition. The most common are:

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): actions on objectives, command and control, exploitation, delivery
Methods added: 2

SystemBC (RAT)

A commodity malware backdoor, SystemBC has evolved into a Tor proxy and remote control tool favored by actors behind the latest high-profile ransomware campaigns. Sophos

Added kill chain phase(s): installation
Previously supported kill chain phase(s): command and control
Methods added: 1

Trojan Downloader (Downloader)

A Trojan downloader is a type of Trojan horse that downloads and installs files, often malicious programs. A Trojan horse is a type of software that looks legitimate but can be malicious in nature. Sometimes these programs can be downloaded onto a device without the user’s knowledge or consent. A Trojan’s purpose is to damage, disrupt, steal, or generally inflict some other harm on your computer and devices. Norton

Added kill chain phase(s): command and control, delivery
Previously supported kill chain phase(s): delivery, command and control, actions on objectives
Methods added: 6

Trojan Dropper (Trojan)

A dropper is a kind of Trojan that has been designed to "install" some sort of malware (virus, backdoor, etc.) to a target system. The malware code can be contained within the dropper (single-stage) in such a way as to avoid detection by virus scanners or the dropper may download the malware to the target machine once activated (two stage). Wikipedia

Added kill chain phase(s): actions on objectives
Previously supported kill chain phase(s): command and control, delivery, installation, actions on objectives
Methods added: 1

TrojanSpy-Android (Data Theft)

Malicious programs of this family secretly send information to the criminal from the user’s infected Android mobile device. Kaspersky

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): command and control, actions on objectives, delivery
Methods added: 27

Ursnif (Data Theft)

Ursnif is a banking trojan and variant of the Gozi malware observed being spread through various automated exploit kits, Spearphishing Attachments, and malicious links. Ursnif is associated primarily with data theft, but variants also include components (backdoors, spyware, file injectors, etc.) capable of a wide variety of behaviors.

Added kill chain phase(s): command and control
Previously supported kill chain phase(s): delivery, command and control, actions on objectives, weaponization
Methods added: 1

Other Threat Detection Update(s)

The following threat detection(s) were improved this past week with new or updated threat methods.

Name of threat	New coverage			Total coverage			Last updated
	New Detection methods	Kill chain phases	Protocols involved	Detection methods	Kill chain phases	Protocols involved
APT-C-35	1	command and control	http	138	command and control, delivery	dns, http, tcp, tls	2022-03-19
Anubis	2	command and control	dns, tls	58	command and control	dns, http, tcp, tls	2022-03-19
AsyncRAT	5	command and control, delivery	http	419	command and control, delivery	http, tcp, tls	2022-03-18
Backdoor	2	command and control	dns, tls	374	actions on objectives, command and control, delivery, installation	dns, ftp, http, icmp, smtp, tcp, tls, udp	2022-03-17
Banker Stealer	29	command and control	dns, tls, http	164	actions on objectives, command and control, delivery	dns, http, smtp, tcp, tls	2022-03-17
Bitter	1	command and control	tcp	20	command and control, delivery	dns, http, tcp, tcp-pkt	2022-03-19
Card Skimmer	3	command and control	http, dns	13	command and control	dns, http, tls	2022-03-14
Cobalt Strike	3	command and control	dns, http	332	actions on objectives, command and control, delivery, exploitation	dns, http, smb, tcp, tls, udp	2022-03-19
Gamaredon	4	delivery	http	83	actions on objectives, command and control, delivery	dns, http	2022-03-18
Gh0st	1	actions on objectives	tcp	160	actions on objectives, command and control, delivery	dns, http, tcp	2022-03-19
Gmobi	2	command and control	http	2	command and control	http	2022-03-14
HermeticWizard	7	exploitation	tcp-pkt, tcp, smb	7	exploitation	tcp-pkt, tcp, smb	2022-03-14
Hqwar	2	command and control	dns, tls	24	actions on objectives, command and control	dns, http, tls	2022-03-15
Kimsuky	1	actions on objectives	http	83	actions on objectives, command and control, delivery	dns, ftp, http, tls	2022-03-15
Loki	2	command and control	http, dns	25	actions on objectives, command and control, delivery	dns, http, tls	2022-03-18
MuddyWater	4	command and control	http	33	actions on objectives, command and control, delivery	dns, http, tls	2022-03-14
PlugX	1	command and control	tcp-pkt	50	command and control, delivery	dns, http, tcp, tcp-pkt, tls, udp	2022-03-17
QakBot	1	command and control	http	20	actions on objectives, command and control, delivery	ftp, http, tcp, tls	2022-03-19
RAT Generic	3	command and control	tcp-pkt, tcp	55	actions on objectives, command and control, installation	dns, http, tcp, tcp-pkt, tls	2022-03-19
Remcos	3	command and control	tcp	801	command and control, delivery	dns, http, tcp	2022-03-19
Scarab	1	command and control	http	1	command and control	http	2022-03-14
SideWinder	1	command and control	dns	26	actions on objectives, command and control, delivery	dns, http, tls	2022-03-18
SmsThief	2	command and control	dns, tls	132	actions on objectives, command and control, delivery	dns, http, tcp, tls, udp	2022-03-15
SoulSearcher	5	command and control	dns, http	5	command and control	dns, http	2022-03-14
Stealer and Exfiltration	2	command and control	http	194	actions on objectives, command and control, delivery, exploitation	dns, ftp, http, smtp, tcp, tls	2022-03-17
SystemBC	1	installation	tcp	14	command and control, installation	dns, tcp	2022-03-14
TA445	4	delivery, command and control	http, dns	4	delivery, command and control	http, dns	2022-03-14
Trojan Downloader	6	command and control, delivery	http	181	actions on objectives, command and control, delivery	dns, http, tcp, tls, udp	2022-03-17
Trojan Dropper	1	actions on objectives	http	223	actions on objectives, command and control, delivery, installation	dns, http, tcp, tls, udp	2022-03-18
TrojanSpy-Android	27	command and control	dns, tls, tcp	359	actions on objectives, command and control, delivery	dns, http, tcp, tls	2022-03-18
Ursnif	1	command and control	tls	383	actions on objectives, command and control, delivery, weaponization	dns, http, tcp, tls, udp	2022-03-16

Additional Resources

Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website

Threat Detection Update