DOCSLIB.ORG

Major Malware Threat Intelligence Report for Bangladesh Context

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Major Malware Threat Intelligence Report for Bangladesh Context Major Malware Threat Intelligence Report For Bangladesh Context Report Period: Jan - Sep, 2020 Published: October, 2020 Table of Contents About this Report .............................................................................................................................. 1 General Definition ............................................................................................................................. 2 Malware: AZORult ............................................................................................................................. 6 Malware: KPOT Stealer .................................................................................................................... 26 Malware: Oski Stealer...................................................................................................................... 31 Malware: FormBookFormgrabber.................................................................................................... 34 Malware: Loki PWS .......................................................................................................................... 38 Malware:Nexus Stealer.................................................................................................................... 44 Malware: TrickBot ........................................................................................................................... 46 Malware: Kinsing ............................................................................................................................. 50 Malware: Outlaw hacking group cryptocurrency miners .................................................................. 52 Advanced Persistent Threat (APT): Lazarus ...................................................................................... 54 a. Manuscrypt ........................................................................................................................ 54 b. CuriousLoadert .................................................................................................................. 60 c. SvcRAT ................................................................................................................................ 61 d. RATv3.ps ............................................................................................................................. 62 e. Linux.Dacls ......................................................................................................................... 63 f. MAC.Dacls .......................................................................................................................... 64 g. Win32.Dacls........................................................................................................................ 64 h. VHD Ransomware .............................................................................................................. 65 i. PowerRatankba .................................................................................................................. 66 j. PowerTask .......................................................................................................................... 68 k. HOPLIGHT .......................................................................................................................... 69 l. BISTROMATH ..................................................................................................................... 70 m. SLICKSHOES ................................................................................................................... 70 n. CROWDEDFLOUNDER ....................................................................................................... 71 o. HOTCROISSANT................................................................................................................. 72 p. ARTFULPIE .......................................................................................................................... 73 q. BUFFETLINE ........................................................................................................................ 74 r. KEYMARBLE ........................................................................................................................ 75 s. Dtrack ................................................................................................................................. 76 t. Dtrack.Stealer ..................................................................................................................... 78 u. BADCALL ............................................................................................................................ 79 v. Electricfish .......................................................................................................................... 80 w. RATv3.ps ............................................................................................................................. 81 x. Rising Sun .......................................................................................................................... 82 y. KillDisk ................................................................................................................................ 83 z. PowerSpritz ........................................................................................................................ 83 aa. Joanap ............................................................................................................................ 84 bb. Brambul .......................................................................................................................... 86 cc. BrowserPasswordDump................................................................................................. 87 dd. HARDRAIN...................................................................................................................... 87 ee. Gh0st............................................................................................................................... 88 ff. WannaCry ........................................................................................................................... 92 gg. DoublePulsar .................................................................................................................. 97 hh. Volgmer .......................................................................................................................... 98 ii. FASTCash .......................................................................................................................... 103 jj. Duuzer .............................................................................................................................. 104 kk. Destover ....................................................................................................................... 105 ll. Koredos ............................................................................................................................ 109 mm. KorDllBot ...................................................................................................................... 110 Advanced Persistent Threat (APT): Silence ..................................................................................... 113 a. Silence Backdoor ............................................................................................................. 113 b. Silence.ProxyBot .............................................................................................................. 114 c. APT.Silence.EDA.ps1 ........................................................................................................ 115 d. Truebot (Silence’s loader) ............................................................................................... 116 e. FlawedAmmyy.................................................................................................................. 119 f. Ammyy Admin ................................................................................................................. 122 g. Atmosphere ..................................................................................................................... 123 h. Smoke Bot ........................................................................................................................ 123 i. Silence’s ATM malware.................................................................................................... 127 j. Silence.SurveillanceModule ............................................................................................ 127 k. Perl IRC DDoS bot ........................................................................................................... 128 l. Kikothac ............................................................................................................................ 128 Advanced Persistent Threat (APT): OceanLotus ............................................................................. 130 a. Cobalt Strike..................................................................................................................... 130 b. METALJACK ...................................................................................................................... 135 c. KerrDown ......................................................................................................................... 135 d. OceanLotus.Denis ............................................................................................................ 137 e.
Load more

Recommended publications
  • TR-SBA-Research-0512-01: Fast and Efficient Browser Identification With
    Fast and Efficient Browser Identification with JavaScript Engine Fingerprinting Technical Report TR-SBA-Research-0512-01 Martin Mulazzani∗, Philipp Reschl; Markus Huber∗, Manuel Leithner∗, Edgar Weippl∗ *SBA Research Favoritenstrasse 16 AT-1040 Vienna, Austria [email protected] Abstract. While web browsers are becoming more and more important in everyday life, the reliable detection of whether a client is using a specific browser is still a hard problem. So far, the UserAgent string is used, which is a self-reported string provided by the client. It is, however, not a security feature, and can be changed arbitrarily. In this paper, we propose a new method for identifying Web browsers, based on the underlying Javascript engine. We set up a Javascript confor- mance test and calculate a fingerprint that can reliably identify a given browser, and can be executed on the client within a fraction of a sec- ond. Our method is three orders of magnitude faster than previous work on browser fingerprinting, and can be implemented in just a few hun- dred lines of Javascript. Furthermore, we collected data for more than 150 browser and operating system combinations, and present algorithms to calculate minimal fingerprints for each of a given set of browsers to make fingerprinting as fast as possible. We evaluate the feasibility of our method with a survey and discuss the consequences for user privacy and security. This technique can be used to enhance state-of-the-art session management (with or without SSL), as it can make session hijacking considerably more difficult. 1 Introduction Today, the Web browser is a central component of almost every operating sys- tem.
    [Show full text]
  • Technician User Guide for Version 10.0
    Stellar Repair for Outlook - Technician User Guide for Version 10.0 Legal Notices | About Stellar | Contact Us 1. Overview Stellar Repair for Outlook - Technician offers a complete solution to repair damaged Microsoft Outlook Personal Storage (PST) files. The software repairs corrupt PST files and restores all its content such as e-mails, attachments, contacts, calendars, tasks, journals and also repair accidently deleted or lost Mailbox items . This minimizes the loss from the PST corruption. Stellar Repair for Outlook - Technician scans and extracts data from a damaged PST file, repairs it and then saves it as a new usable PST file. To view repaired items, you need to import the new PST file into MS Outlook. Stellar Repair for Outlook - Technician also ensures recovery of accidentally deleted e-mails that you have emptied from the deleted items folder. After recovering the PST file, the software shows its original content. All folders from the original PST file get displayed along with their content in a three-pane structure. Key features: New and enhanced GUI. Option to preview the deleted item which is displayed in red color. Option to save the deleted items in repaired file. Option to save and load scan information. Option to save in DBX and MBOX format. Option to compact and save a PST file. Option to save in Office 365. Option to split and save a PST file. Enables you to view messages in a 3-view format. Enables selective recovery of the mails. Find option to search emails faster. Repairs e-mails, calendar entries, contacts, notes, tasks and journals from damaged PST files.
    [Show full text]
  • Maelstrom Web Browser Free Download
    maelstrom web browser free download 11 Interesting Web Browsers (That Aren’t Chrome) Whether it’s to peruse GitHub, send the odd tweetstorm or catch-up on the latest Netflix hit — Chrome’s the one . But when was the last time you actually considered any alternative? It’s close to three decades since the first browser arrived; chances are it’s been several years since you even looked beyond Chrome. There’s never been more choice and variety in what you use to build sites and surf the web (the 90s are back, right?) . So, here’s a run-down of 11 browsers that may be worth a look, for a variety of reasons . Brave: Stopping the trackers. Brave is an open-source browser, co-founded by Brendan Eich of Mozilla and JavaScript fame. It’s hoping it can ‘save the web’ . Available for a variety of desktop and mobile operating systems, Brave touts itself as a ‘faster and safer’ web browser. It achieves this, somewhat controversially, by automatically blocking ads and trackers. “Brave is the only approach to the Web that puts users first in ownership and control of their browsing data by blocking trackers by default, with no exceptions.” — Brendan Eich. Brave’s goal is to provide an alternative to the current system publishers employ of providing free content to users supported by advertising revenue. Developers are encouraged to contribute to the project on GitHub, and publishers are invited to become a partner in order to work towards an alternative way to earn from their content. Ghost: Multi-session browsing.
    [Show full text]
  • HTTP Cookie - Wikipedia, the Free Encyclopedia 14/05/2014
    HTTP cookie - Wikipedia, the free encyclopedia 14/05/2014 Create account Log in Article Talk Read Edit View history Search HTTP cookie From Wikipedia, the free encyclopedia Navigation A cookie, also known as an HTTP cookie, web cookie, or browser HTTP Main page cookie, is a small piece of data sent from a website and stored in a Persistence · Compression · HTTPS · Contents user's web browser while the user is browsing that website. Every time Request methods Featured content the user loads the website, the browser sends the cookie back to the OPTIONS · GET · HEAD · POST · PUT · Current events server to notify the website of the user's previous activity.[1] Cookies DELETE · TRACE · CONNECT · PATCH · Random article Donate to Wikipedia were designed to be a reliable mechanism for websites to remember Header fields Wikimedia Shop stateful information (such as items in a shopping cart) or to record the Cookie · ETag · Location · HTTP referer · DNT user's browsing activity (including clicking particular buttons, logging in, · X-Forwarded-For · Interaction or recording which pages were visited by the user as far back as months Status codes or years ago). 301 Moved Permanently · 302 Found · Help 303 See Other · 403 Forbidden · About Wikipedia Although cookies cannot carry viruses, and cannot install malware on 404 Not Found · [2] Community portal the host computer, tracking cookies and especially third-party v · t · e · Recent changes tracking cookies are commonly used as ways to compile long-term Contact page records of individuals' browsing histories—a potential privacy concern that prompted European[3] and U.S.
    [Show full text]
  • Web Browser Pioneer Backs New Way to Surf Internet (Update 2) 7 November 2010, by MICHAEL LIEDTKE , AP Technology Writer
    Web browser pioneer backs new way to surf Internet (Update 2) 7 November 2010, By MICHAEL LIEDTKE , AP Technology Writer (AP) -- The Web has changed a lot since Marc Facebook's imprint also is all over RockMelt, Andreessen revolutionized the Internet with the although the two companies' only business introduction of his Netscape browser in the connection so far is Andreessen. He also serves on mid-1990s. That's why he's betting people are Facebook's board of directors. ready to try a different Web-surfing technique on a new browser called RockMelt. RockMelt only works if you have a Facebook account. That restriction still gives RockMelt plenty The browser, available for the first time Monday, is of room to grow, given Facebook has more than built on the premise that most online activity today 500 million users. revolves around socializing on Facebook, searching on Google, tweeting on Twitter and After Facebook users log on RockMelt with their monitoring a handful of favorite websites. It tries to Facebook account information, the person's minimize the need to roam from one website to the Facebook profile picture is planted in the browser's next by corralling all vital information and favorite left hand corner and a list of favorite friends can be services in panes and drop-down windows. displayed in the browser's left hand pane. There's also a built-in tool for posting updates in a pop-up "This is a chance for us to build a browser all over box. again," Andreessen said. "These are all things we would have done (at Netscape) if we had known The features extend beyond Facebook and Twitter.
    [Show full text]
  • Spear Phishing Targeting Ics Supply Chain – Analysis
    SPEAR PHISHING TARGETING ICS SUPPLY CHAIN – ANALYSIS January 20, 2021 MARKEL PICADO 1 Table of Contents Introduction ................................................................................................................................................... 3 Threat Analysis ............................................................................................................................................... 3 Distribution Strategy .................................................................................................................................. 4 Spear Phishing............................................................................................................................................ 5 Identity Theft ......................................................................................................................................... 5 Toolkit .................................................................................................................................................... 8 AgentTesla v3 Analysis ........................................................................................................................... 9 Attack Surface .......................................................................................................................................... 16 MITRE ATT&CK Mapping ..................................................................................................................... 17 Threat Actor Infrastructure ................................................................................................................
    [Show full text]
  • Downloadable Email Program for My Pc 32 Best Free Email Clients
    downloadable email program for my pc 32 Best Free Email Clients. Here are 32 best free email client software . These let you manage and access all of your email accounts in one single place easily. All these email client software are completely free and can be downloaded to Windows PC. These free software offer various features, like: can be used with IMAP, SMTP, POP3 and Gmail, keeps your emails safe and secure, lets you open various emails simultaneously, provide protection from spam, lets you view your emails offline, manage and access all of your email accounts in one single place, supports PH, LDAP, IMAP4, POP3 and SMPT mail protocols etc. So, go through this list of free email client software and see which ones you like the most. Thunderbird. Thunderbird is a free and handy email client software for your computer. It can be used with IMAP, SMTP, POP3 and Gmail. It will also work with email accounts provided by MS Exchange Server. The user interface of Thunderbird is tabbed. It lets you open various emails simultaneously. Thunderbird keeps your emails safe and secure. It also has special filters for filtering the mail. Windows Live Mail. Windows Live Mail is a free email client for your computer. It works with various email accounts. It lets you access Yahoo, Gmail, Hotmail and emails from different servers which supports POP3 and SMTP. Its security features are excellent it will also provide protection from spam. You can also view your emails offline in this freeware. Zimbra Desktop. Zimbra Desktop is a free email client.
    [Show full text]
  • Web Browser a C-Class Article from Wikipedia, the Free Encyclopedia
    Web browser A C-class article from Wikipedia, the free encyclopedia A web browser or Internet browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier (URI) and may be a web page, image, video, or other piece of content.[1] Hyperlinks present in resources enable users to easily navigate their browsers to related resources. Although browsers are primarily intended to access the World Wide Web, they can also be used to access information provided by Web servers in private networks or files in file systems. Some browsers can also be used to save information resources to file systems. Contents 1 History 2 Function 3 Features 3.1 User interface 3.2 Privacy and security 3.3 Standards support 4 See also 5 References 6 External links History Main article: History of the web browser The history of the Web browser dates back in to the late 1980s, when a variety of technologies laid the foundation for the first Web browser, WorldWideWeb, by Tim Berners-Lee in 1991. That browser brought together a variety of existing and new software and hardware technologies. Ted Nelson and Douglas Engelbart developed the concept of hypertext long before Berners-Lee and CERN. It became the core of the World Wide Web. Berners-Lee does acknowledge Engelbart's contribution. The introduction of the NCSA Mosaic Web browser in 1993 – one of the first graphical Web browsers – led to an explosion in Web use. Marc Andreessen, the leader of the Mosaic team at NCSA, soon started his own company, named Netscape, and released the Mosaic-influenced Netscape Navigator in 1994, which quickly became the world's most popular browser, accounting for 90% of all Web use at its peak (see usage share of web browsers).
    [Show full text]
  • Böngésző Programok 23. Tétel
    23.tétel 1.0 Böngész ő programok használata, összehasonlítása. Az információ keresés technikái. Bogdán;Sleisz Böngész ő programok (Használata, összehasonlítása. Az információ keresés technikái) 23. tétel Az Internet kialakulása 20. század második felére helyezhet ő. Az ARPA rendszerb ől fejl ődött tovább az USA-ban, azóta folyamatosan fejlesztgetik a különböz ő protokollokat, illetve technológiákat, az adatforgalom sebességének növelése érdekében. Komoly tévhitet képez a világban, hogy az Internet az a böngész őben megjeleníthet ő weboldalak összessége. Nagy tévedés, ugyanis ez csak a HTTP protokoll által szolgáltatott tartalom, amely a teljes internetes adatforgalomnak kevesebb, mint az 1/10-ét képezi. Az internetet úgy kell elképzelni, mint egy hardvereszközt, ami az egész világot lefedi, a rajta elérhet ő szolgáltatásokat pedig nevezzük "szoftvereknek". Kétségkívül az egyik legelterjedtebb szolgáltatás ("szoftver") a 80-as port -on kommunikáló HTTP protokoll, amihez tartozik egy kommunikációs nyelv is. A HTTP protokoll célja hagyományos esetben- a távoli "szerveren/kiszolgálón" elhelyezked ő weboldal letöltése a helyi számítógépre. 1. A böngész ő a HTTP kommunikációs nyelven megfogalmazott kérést küld a szerver felé, hogy szeretnénk megjeleníteni a kért weboldalt 2. A szerver válaszol. Többféle üzenetet küldhet vissza a böngész őnek, és minden üzenethez tartozik egy azonosító szám is, úgynevezett Status Code. A legismertebb visszatérési érték talán a Not Found (a keresett weboldal nem található), melynek Status Code-ja a 404. Ilyet könnyedén el őidézhetünk, ha pl. nem létez ő oldalt próbálunk letölteni. A leggyakoribb azonban, ha a 200-as üzenetet kapjuk vissza, vagyis megjelenik az oldal. 3. Ezek után a böngész ő elkezdi letölteni a kért oldal forráskódját . A forráskód egy olyan leíró kód nagyrészt HTML nyelven, amely leírja, hogyan néz ki a weboldal.
    [Show full text]
  • Forensic Study and Analysis of Different Artifacts of Web Browsers in Private Browsing Mode
    || Volume 5 || Issue 6 || June 2020 || ISSN (Online) 2456-0774 INTERNATIONAL JOURNAL OF ADVANCE SCIENTIFIC RESEARCH AND ENGINEERING TRENDS FORENSIC STUDY AND ANALYSIS OF DIFFERENT ARTIFACTS OF WEB BROWSERS IN PRIVATE BROWSING MODE Rinchon Sanghkroo1, Dr. Deepak Raj Rao G.2 and Kumarshankar Raychaudhuri3 M.Sc. (Forensic Science) Final Semester Student, Cyber Forensic Division, LNJN National Institute of Criminology and Forensic Science (MHA), Delhi, India 1 Assistant Professor, Cyber Forensic Division, LNJN National Institute of Criminology and Forensic Science (MHA), Delhi, India2 Junior Research Fellow, Cyber Forensic Division, LNJN National Institute of Criminology and Forensic Science (MHA), Delhi, India3 [email protected], [email protected], [email protected] ------------------------------------------------------ ***-------------------------------------------------- Abstract: - Web browsers today have become one of the most commonly used applications in digital devices, storing and maintaining huge information on user activities. The privacy mode has been introduced to combat the privacy issues related with browsers. This feature keeps the browsing activities of a user private by not storing or removing the traces of artifacts related to the browsing session on the system. In this study, we test the effectiveness of this claim and to ensure ways in which a forensic investigation may be done in such cases. The private modes of different browsers have been tested in Windows and MAC OS by performing pre-defined browsing activities in each of the browsers in both the operating systems. Moreover, the default locations of normal web browser artifacts are also examined to find whether artifacts of private browsing activities are stored in such locations or not. Keywords: - Private Browsing, Windows, MAC, Safari, Microsoft Edge, Brave Browser ------------------------------------------------------ ***-------------------------------------------------- I INTRODUCTON artifacts related to it on the end device.
    [Show full text]
  • The Artist's Emergent Journey the Metaphysics of Henri Bergson, and Also Those by Eric Voegelin Against Gnosticism2
    Vol 1 No 2 (Autumn 2020) Online: jps.library.utoronto.ca/index.php/nexj Visit our WebBlog: newexplorations.net The Artist’s Emergent Journey Clinton Ignatov—The McLuhan Institute—[email protected] To examine computers as a medium in the style of Marshall McLuhan, we must understand the origins of his own perceptions on the nature of media and his deep-seated religious impetus for their development. First we will uncover McLuhan’s reasoning in his description of the artist and the occult origins of his categories of hot and cool media. This will prepare us to recognize these categories when they are reformulated by cyberneticist Norbert Wiener and ethnographer Sherry Turkle. Then, as we consider the roles “black boxes” play in contemporary art and theory, many ways of bringing McLuhan’s insights on space perception and the role of the artist up to date for the work of defining and explaining cyberspace will be demonstrated. Through this work the paradoxical morality of McLuhan’s decision to not make moral value judgments will have been made clear. Introduction In order to bring Marshall McLuhan into the 21st century it is insufficient to retrieve his public persona. This particular character, performed in the ‘60s and ‘70s on the global theater’s world stage, was tailored to the audiences of its time. For our purposes today, we’ve no option but an audacious attempt to retrieve, as best we can, the whole man. To these ends, while examining the media of our time, we will strive to delicately reconstruct the human-scale McLuhan from what has been left in both his public and private written corpus.
    [Show full text]
  • I. an Investigation of the Organic Compounds in the Media and Mycelium of Naucoria Confragosa
    Scholars' Mine Masters Theses Student Theses and Dissertations 1965 I. An investigation of the organic compounds in the media and mycelium of Naucoria confragosa. II. Study of the extra-cellular pigments of an unknown fungus Yueh-Tsun Chen Follow this and additional works at: https://scholarsmine.mst.edu/masters_theses Part of the Chemistry Commons Department: Recommended Citation Chen, Yueh-Tsun, "I. An investigation of the organic compounds in the media and mycelium of Naucoria confragosa. II. Study of the extra-cellular pigments of an unknown fungus" (1965). Masters Theses. 5238. https://scholarsmine.mst.edu/masters_theses/5238 This thesis is brought to you by Scholars' Mine, a service of the Missouri S&T Library and Learning Resources. This work is protected by U. S. Copyright Law. Unauthorized use including reproduction for redistribution requires the permission of the copyright holder. For more information, please contact [email protected]. 7 ( . I. A!J Il!VESTIGATIOU OF THE OaGAHIC CO:·~OUHDS Irr THZ ECDIA JJ!D ::YCELIUH OF IrAUCORIA . CON'FRAG00A II. STUDY OF THE EXTRA-CELLULAR PIG!!ENTS OF A...'l UI-Jt:NQ;;N ::!'tU!GUS BY YUEH TSUU CHEN1ttt31 A THESIS submitted to the faculty of the illv"IVERSITY OF HISSOUill: AT ROLLA in partial fulfillment of the requirement for the ' ·; Degree of !'..ASTER OF SCIENCE IN · CHE1-1ISTRY ROLLA, IliSSOURI 1965 T!1e funeal r:etabol1:~es excreted. into the cuture fluid by ba::;i- diom.ycetes zro,rl.ng on synthetic zlucose media as \'lOll as fol'·med in the ~.. cella of t::e orgaJl.is.~G uere investi~ated in this thesis.
    [Show full text]