<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=2180921&amp;fmt=gif">

The Week in Review from Stamus Labs

Welcome to the weekly threat detection update report from Stamus Networks. Each week, you will receive this email with a summary of the updates.

 

Current Stamus Threat Intelligence (STI) release version: 439

 

This week, in addition to daily ruleset and IOC updates, we provided Stamus Security Platform customers with the following improved defense(s):

  • New threat detection(s) added [1]: 10 (AHKBOT, Lorenz, TA408, Monero, Nerbian RAT, ServStart, TA564, Earth Berberoka, PoshC2, Helminth)
  • Major changes to detections(s) [2]: 5
  • Updated threat detection(s) [3]: 110

 

Note: a "method" as referenced below, is a discrete detection vector for a given threat.

 

New Threat(s) Detected

The following detections were added to your Stamus NDR this past week:

 

AHKBOT (Trojan)

Cybersecurity researchers have uncovered an ongoing malware campaign that heavily relies on AutoHotkey (AHK) scripting language to deliver multiple remote access trojans (RAT) such as Revenge RAT, LimeRAT, AsyncRAT, Houdini, and Vjw0rm on target Windows systems. Thehackernews

AHKBOT - malpedia | AHKBOT - microsoft | AHKBOT - bleepingcomputer | AHKBOT - MITRE - Command and Scripting Interpreter | AHKBOT - MITRE - Multi-Stage Channels | AHKBOT - MITRE - Ingress Tool Transfer | AHKBOT - MITRE - System Information Discovery | AHKBOT - MITRE - File and Directory Discovery |
  • Total number of detection methods: 2
  • Kill chain phase(s): delivery

 

Lorenz (Ransomware)

Lorenz is a new variant of the Sz40 ransomware. It is designed to encrypt data and demand ransoms for the decryption. In other words, Lorenz renders affected files inaccessible and asks victims to pay - to recover access to their data. Pcrisk

Lorenz - malpedia | Lorenz - microsoft | Lorenz - MITRE - Data Encrypted for Impact | Lorenz - MITRE - Phishing | Lorenz - MITRE - System Information Discovery | Lorenz - MITRE - File and Directory Discovery | Lorenz - MITRE - Malicious File | Lorenz - MITRE - User Execution | Lorenz - MITRE - Ingress Tool Transfer | Lorenz - MITRE - Multi-Stage Channels |
  • Total number of detection methods: 2
  • Kill chain phase(s): command and control

TA408 (APT)

TA408 has been observed targeting Proofpoint customers much less often than TA406 and TA427. TA408 uses both credential harvesting and malware campaigns. Based on files uploaded to malicious file repositories, TA408 often targets organizations and individuals in East Asia. In 2020, TA408 targeted at least one pharmaceutical company with a World Health Organization (WHO) COVID-19-themed email. TA408 also conducts financially motivated campaigns, such as a Hyundai Pay-themed Kasse/Hdac wallet campaign observed in 2020. Proofpoint

TA408 - MITRE - Command and Control | TA408 - MITRE - Exfiltration |
  • Total number of detection methods: 5
  • Kill chain phase(s): command and control, delivery

 

Monero (Cryptocurrency)

In 2019, Unit 42 researchers documented cloud-targeted malware used by the Rocke Group to conduct cryptojacking attacks to mine for Monero. Since then, cybersecurity companies have had the malware on their radar, which hampered Rocke Group’s cryptojacking operation. In response, the threat actors updated the malware. Paloalto

Monero - malpedia | Monero - MITRE - Resource Hijacking |
  • Total number of detection methods: 2
  • Kill chain phase(s): installation, delivery

 

Nerbian RAT (RAT)

Remote Access Trojans are programs that provide the capability to allow covert surveillance or the ability to gain unauthorized access to a victim PC. Remote Access Trojans often mimic similar behaviors of keylogger applications by allowing the automated collection of keystrokes, usernames, passwords, screenshots, browser history, emails, chat lots, etc. Remote Access Trojans differ from keyloggers in that they provide the capability for an attacker to gain unauthorized remote access to the victim machine via specially configured communication protocols which are set up upon initial infection of the victim computer. This backdoor into the victim machine can allow an attacker unfettered access, including the ability to monitor user behavior, change computer settings, browse and copy files, utilize the bandwidth (Internet connection) for possible criminal activity, access connected systems, and more. Malwarebytes

Nerbian RAT - MITRE - Exploitation for Client Execution | Nerbian RAT - MITRE - Abuse Elevation Control Mechanism | Nerbian RAT - MITRE - Multi-Stage Channels | Nerbian RAT - MITRE - Ingress Tool Transfer |
  • Total number of detection methods: 2
  • Kill chain phase(s): command and control, actions on objectives

 

ServStart (Trojan)

ServStart is a trojan that installs a persistent service on the victim’s machine. The service exfiltrates information about the infected computer including machine name, username, keyboard language, and computer performance specifications. The malware server can respond with commands to download and execute files, or execute shell commands. ServStart has been observed using multiple dynamic DNS providers for its command and control infrastructure Talos

ServStart - MITRE - Ingress Tool Transfer | ServStart - MITRE - System Information Discovery | ServStart - MITRE - File and Directory Discovery | ServStart - MITRE - Data from Local System | ServStart - MITRE - Create or Modify System Process |
  • Total number of detection methods: 12
  • Kill chain phase(s): command and control, delivery
  • MITRE ATT&CK: T1041

 

Helminth (Backdoor)

Helminth is a backdoor that has at least two variants - one written in VBScript and PowerShell that is delivered via a macros in Excel spreadsheets, and one that is a standalone Windows executable. MITRE

Helminth - malpedia |
  • Total number of detection methods: 3
  • Kill chain phase(s): command and control
  • MITRE ATT&CK: T1041

TA564 (APT)

...also seen TA564 using coronavirus emails targeting Canadian users by spoofing the Public Health Agency of Canada in an attempt to deliver Ursnif. Ursnif is a common banking Trojan that can steal stored data, including passwords, from banking websites via web injections, proxies, and VNC connections. Proofpoint

TA564 - MITRE - Command and Control | TA564 - MITRE - Phishing |
  • Total number of detection methods: 10
  • Kill chain phase(s): command and control

 

Earth Berberoka (APT)

Recently discovered a new advanced persistent threat (APT) group that we have dubbed Earth Berberoka (aka GamblingPuppet). Based on our analysis, this group targets gambling websites. Our investigation has also uncovered that Earth Berberoka targets the Windows, Linux, and macOS platforms, and uses malware families that have been historically attributed to Chinese-speaking individuals. TrendMicro

Earth Berberoka - malpedia | Earth Berberoka - MITRE - Phishing | Earth Berberoka - MITRE - System Information Discovery | Earth Berberoka - MITRE - Command and Control | Earth Berberoka MITRE - Multi-Stage Channels | Earth Berberoka - MITRE - Abuse Elevation Control Mechanism | Earth Berberoka - MITRE - Service Stop | Earth Berberoka - MITRE - Ingress Tool Transfer |
  • Total number of detection methods: 22
  • Kill chain phase(s): command and control

 

PoshC2 (RAT)

PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS. MITRE

PoshC2 - github | PoshC2 - microsoft | PoshC2 - malpedia |
  • Total number of detection methods: 48
  • Kill chain phase(s): delivery, command and control, actions on objectives
  • MITRE ATT&CK: T1071

 

Major Detection Changes

The following detections were updated this past week with changes to kill chain phase(s) or MITRE ATT&CK tactic(s)/technique(s):

 

Orcus (RAT)

Orcus, previously known as Schnorchel, is a Remote Access Trojan — a malware that enables remote control of infected systems. Although Orcus RAT malware is mostly a typical member of the RAT family, it has some competitive advantages over similar malware and unique features.

In addition, Orcus RAT has a modular structure and it gives users the ability to create custom plugins for the malware. The modularity of this trojan gives it higher than standard scalability and management, allowing to tailor the malware to the needs of various campaigns.

The first time we heard about this malware was from a forum post by one of its authors. The post announced the development of a new RAT that was named Schnorchel at the time. Soon after the announcement, the malware became commercially available under the name “Orcus RAT” and was presented to the public as a legal software for remote administration, similar to Teamviewer. Interestingly, authors claimed that the abbreviation RAT stood for Remote Administration Tool and not Remote Access Trojan. Anyrun

  • Added kill chain phase(s): command and control
  • Previously supported kill chain phase(s): command and control
  • Methods added: 1

 

Remcos (RAT)

Remcos is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security.

Remcos has been observed being used in malware campaigns.

  • Added kill chain phase(s): command and control
  • Previously supported kill chain phase(s): command and control, delivery
  • Methods added: 1

Trojan Downloader (Downloader)

A Trojan downloader is a type of Trojan horse that downloads and installs files, often malicious programs. A Trojan horse is a type of software that looks legitimate but can be malicious in nature. Sometimes these programs can be downloaded onto a device without the user’s knowledge or consent. A Trojan’s purpose is to damage, disrupt, steal, or generally inflict some other harm on your computer and devices. Norton

  • Added kill chain phase(s): command and control
  • Previously supported kill chain phase(s): delivery, command and control, actions on objectives
  • MITRE ATT&CK added: T1041
  • Previously existing MITRE ATT&CK: T1587, T1071, T1041
  • Methods added: 1

 

Wacatac (Ransomware)

Ransom malware, or ransomware, is a type of malware that prevents users from accessing their system or personal files and demands ransom payment in order to regain access. The earliest variants of ransomware were developed in the late 1980s, and payment was to be sent via snail mail. Today, ransomware authors order that payment be sent via cryptocurrency or credit card. Malwarebytes

  • Added kill chain phase(s): command and control, delivery
  • Previously supported kill chain phase(s): command and control, actions on objectives, delivery
  • Methods added: 2

 

Other Threat Detection Update(s)

The following threat detection(s) were improved this past week with new or updated threat methods.

 

Name of threat New coverage Total coverage Last updated
  New Detection methods Kill chain phases Protocols involved Detection methods Kill chain phases Protocols involved  
AHKBOT 2 delivery http 2 delivery http 2022-05-09
Earth Berberoka 21 command and control dns 22 command and control dns 2022-05-09
Helminth 1 command and control dns 3 command and control dns 2022-05-09
Lorenz 2 command and control http 2 command and control http 2022-05-09
Monero 2 installation, delivery http 2 installation, delivery http 2022-05-09
Nerbian RAT 2 command and control, actions on objectives http 2 command and control, actions on objectives http 2022-05-09
Orcus 1 command and control dns 17 command and control dns, http, tcp, tls 2022-05-11
PoshC2 48 delivery, command and control, actions on objectives http, tls 48 delivery, command and control, actions on objectives http, tls 2022-05-12
Remcos 1 command and control tcp 808 command and control, delivery dns, http, tcp 2022-05-12
ServStart 12 command and control, delivery http, tcp 12 command and control, delivery http, tcp 2022-05-09
TA408 5 command and control, delivery http 5 command and control, delivery http 2022-05-09
TA564 10 command and control dns 10 command and control dns 2022-05-09
Trojan Downloader 1 command and control http 193 actions on objectives, command and control, delivery dns, http, tcp, tls, udp 2022-05-13
Wacatac 2 command and control, delivery tcp 8 actions on objectives, command and control, delivery http, tcp 2022-05-12

 

Additional Resources

Technical support
Join the conversation on Discord
Follow us Twitter
Follow us on LinkedIn
Subscribe to our YouTube channel
Stamus Networks website

Schedule a Demo of Stamus Security Platform

Request a Demo