The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to known malware. This post will list weekly statistics collected from July 18th, 2022 (Monday) to July 24th, 2022 (Sunday).
For the main category, info-stealer ranked top with 44.7%, followed by backdoor with 40.3%, downloader with 14.5%, and ransomware with 0.6%.
Top 1 – Agent Tesla
AgentTesla is an infostealer that ranked first place with 27.0%. It is an info-stealer that leaks user credentials saved in web browsers, emails, and FTP clients.
It uses e-mail to leak collected information, and there are samples that used FTP or Discord API. C&C information of recently collected samples is as follows.
- server : mail.activandalucia[.]com (185.162.171[.]75)
sender : marketing9@activandalucia[.]com
receiver : sales9@activandalucia[].com
user : marketing9@activandalucia[.]com
pw : iyke****89@$ - server : mail.irw.com[.]br (200.219.229[.]6)
sender : [email protected][.]br
receiver : purchase@technospeedglobal[.]com
user : [email protected][.]br
pw : Eve****10@ - server : mail.palumalimited[.]com (174.136.29[.]110)
sender : francisco@palumalimited[.]com
receiver : ranjqnupreti3@gmail[.]com
user : francisco@palumalimited[.]com
pw : +D&G****4#(M
As most are distributed through spam emails disguised as invoices, shipment documents, and purchase orders, the file names contain such words shown above (Invoice, Shipment, P.O. – Purchase Order). Multiple collected samples were disguised as files with extensions of pdf and xlsx.
- PO – 43387709210_August 2022_06543001111.exe
- ITEMS LIST AND SPECIFICATION.exe
- Swift Copy.pdf.Cab.exe
- DHL_119040 documento de recibo, pdf.exe
- Purchase Order.PDF(2).CAB
- Awb – 1666547433_INVOICE AND SHIPPING DOCUMENTS.pdf.exe
- E700 quotation20111209.exe
Top 2 – RedLine
RedLine malware ranked second place with 22.6%. The malware steals various information such as web browsers, FTP clients, cryptocurrency wallets, and PC settings. It can also download additional malware by receiving commands from the C&C server. Like BeamWinHTTP, there have been numerous cases of RedLine being distributed under the disguise of a software crack file.
The following are the confirmed C&C server domains for RedLine:
- hxxp://176.124.200[.]85:38461/
- hxxp://94.23.190[.]57:25565
- hxxp://101.99.93[.]104:80/
- hxxp://193.106.191[.]81:23196/
- hxxp://185.143.223[.]73:31800
- hxxp://timenist[.]agency:80/
- hxxp://45.155.204[.]124:23180/
- hxxp://nicehash[.]at:1338/
- hxxp://wayototo.duckdns[.]org:23349/
- hxxp://synchbrokers[.]asia:80/
- hxxp://194.36.177[.]32:40788/
Top 3 – Formbook
Formbook ranked third place with 10.7%.
Like other info-stealer, it is mainly distributed through spam emails. The distributed file names are close to each other.
- PURCHASE.EXE PO_76638800.exe
- Quotation#Q21Y05754.PDF.exe
- DHL#NO67898745678.PDF.exe
- PO_3737390.exe
- PO0278374554JULY2022.exe
- Payment#000110011000111.pdf.exe
As Formbook is injected into normal processes (one is a running explorer.exe and the other in system32), the malicious behaviors are performed by these normal processes. Besides user credentials in the web browser, the malware can steal various information through keylogging, clipboard grabbing, and web browser form grabbing.
Below is the list of confirmed C&C server URLs of Formbook.
- hxxp://www.momentums6[.]com/tn61/
- hxxp://www.banceout3[.]com/ceah/
- hxxp://www.renaziv[.]online/mh76/
- hxxp://www.mujid24s[.]com/rsea/
- hxxp://www.trascrss[.]com/g6k0/
- hxxp://www.baintsras[.]com/zzun/
- hxxp://www.drevom[.]online/fs44/
- hxxp://www.caobatins[.]com/vcir/
Top 4 – GuLoader
GuLoader, which ranked fourth place with 8.8%, is a downloader malware that downloads additional malware and runs it. It was packed with Visual Basic language in the past to avoid detection, but now distributed in a form of NSIS installer. It used to be known as CloudEye, but named GuLoader because Google Drive is frequently used as a download URL. In addition to Google Drive, various URLs such as One Drive from Microsoft can also be used.
- hxxp://mailcrononline[.]com/js/CQLBwaYG72.bin
- hxxp://212.192.246[.]226/droidneworiginwithfilterdroid@keefort_FeuyKnV62.bin
- hxxps://softteethailand[.]com/myspecailbin_AHFBFmrZqX5.bin
- hxxps://cihno[.]shop/SFDmIGRZ/bin_dKHDX76.bin
- hxxps://lemendoza[.]com/xxxx/gumabelt_LXBWuAzBCv16.bin
- hxxps://njpersonalchefs[.]com/med_ijBQUbYPt220.rP=
- hxxps://lemendoza[.]com/ccff/gumabelt_FQBBEYYJV212.bqO
- hxxps://fetchtechsolutions[.]com/myspecailbin_PXmNVAeYoF159.bin
Instead of being downloaded in a file form, GuLoader is downloaded on memory to avoid detection, and downloaded file is encoded, not PE. It then runs after decoding in the memory, downloading malware such as infostealer (Formbook, AgentTesla) and RAT (Remcos, NanoCore).
As most are distributed through spam emails disguised as invoices, shipment documents, and purchase orders, the file names contain such words shown above (Invoice, Shipment, P.O. – Purchase Order). Some samples have extensions disguised as document files such as pdf and xlsx or Auto CAD blueprint files such as dwg.
- 009facturas y datos bancarios.png.exe
- inswell.exe
- Inv_059485_TRTY00947.exe
- Inv_RUFTY_2374859.exe
- New order for the month dated 07202022.exe
- nova narudžba za mjesec 0002466556.exe
- Richiesta di preventivo ordine nr 001 – AUDIO OHM S.r.l..exe
- Technical Specifications Requirements_Rev0.exe
Top 5 – NanoCore
This week, NanoCore ranked fifth place with 7.5%. It is a RAT malware developed with .NET. Like njRAT, it can perform various commands given by the attacker such as information leakage including keylogging.
Similar to AgentTesla, Formbook, AveMaria, and Remcos, the NanoCore is packed with .NET packing and distributed through attached files in spam emails. As such, the file names reported are not much different from those of other malware distributed through spam emails.
- easy#.exe
- melon#.exe
- build.exe
- a3190c.exe
The following list is the confirmed C&C server domains for NanoCore.
- gandigod.ddns[.]net:54984
- xp230522.ddns[.]net:1990
- brewsterchristophe.ddns[.]net:5899
- derananocore.ddns[.]net:1187
- 411speed.duckdns[.]org:40111
Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.
The post ASEC Weekly Malware Statistics (July 18th, 2022 – July 24th, 2022) appeared first on ASEC BLOG.
Article Link: ASEC Weekly Malware Statistics (July 18th, 2022 – July 24th, 2022) - ASEC BLOG