T1105kaspersky.com
kaspersky.com 时间:2021-03-23 阅读:()
AZORultMalwareOVERALLCLASSIFICATIONISTLP:WHITETLP:WHITE04/16/2020Report#:202004161000AgendaIntroductionAttackvectorsFunctionalityoverviewMappingagainsttheMITREATT&CKFrameworkInfectionandCompromiseOriginationofAttacksFakeCoronavirusmapTripleEncryptionPersistenceIntrusionDetectionRules/SignaturesMitigationpracticesIndicatorsofCompromiseReferencesQuestions4/16/20202Non-Technical:managerial,strategicandhigh-level(generalaudience)Technical:Tactical/IOCs;requiringin-depthknowledge(sysadmins,IRT)SlidesKey:TLP:WHITEImagesource:NJCCICIntroductionAZORult–WhatisitMalware–InformationstealerandcryptocurrencytheftInitiallydetectedin2016whendroppedbytheChthonicbankingtrojanLatestversion:3.
2;UsedtotargetWindowsAKAPuffStealer,RuzaltoEasytooperate(userfriendly)Verycommon;SoldonRussianhackerforumsfor~$100Canbothbedroppedorserveasadropper(firstorsecondstage)Constantlychanging/evolvinginfectionvectorsandattackstagesandcapabilitiesEspeciallyrelevantduringtheCoronaviruspandemicUsedinCoronavirus-themedattacks3TLP:WHITEImagesource:BleepingComputer4/16/2020AZORult–AttackVectorsHowisAZORultdeliveredCommon:ExploitKits(especiallyFalloutExploitKit)OthermalwarethatactsasadropperRamnitEmotetPhishingMalspamInfectedwebsitesMalvertisementsFakeinstallersOnoccasion:.
isofileRemoteDesktopProtocol(RDP)exploitation4TLP:WHITEImagesource:AdAstraGames4/16/2020AZORult–FunctionalityoverviewAZORultpossessesthefollowingcapabilities:Steals:SystemlogincredentialsSystemreconnaissanceinfo(GUID,systemarchitectureandlanguage,usernameandcomputername,operatingsystemversion,systemIPaddressCryptocurrencywalletsMonero,uCoin,andbitcoincryptocurrenciesElectrum,Electrum-LTC,Ethereum,Exodus,JaxxandMistwalletsSteamandTelegramcredentials;SkypechathistoryandcredentialsPaymentcardnumbersCookiesandothersensitivebrowser-baseddata(especiallyautofill)DataExfiltration/CommunicationPushestoacommand-and-controlserver.
ScreenshotsExecutesfilesviaremotebackdoorcommands5TLP:WHITEImagesource:LinkedIn4/16/2020MappingAZORultagainsttheMITREATT&CKFrameworkMITREATT&CKTechniquesusedbyAZORult:6TLP:WHITEDomainIDNameUseEnterpriseT1134AccessTokenManipulationAZORultcancallWTSQueryUserTokenandCreateProcessAsUsertostartanewprocesswithlocalsystemprivileges.
EnterpriseT1503CredentialsfromWebBrowsersAZORultcanstealcredentialsfromthevictim'sbrowser.
EnterpriseT1081CredentialsinFilesAZORultcanstealcredentialsinfilesbelongingtocommonsoftwaresuchasSkype,Telegram,andSteam.
EnterpriseT1140Deobfuscate/DecodeFilesorInformationAZORultusesanXORkeytodecryptcontentandusesBase64todecodetheC2address.
EnterpriseT1083FileandDirectoryDiscoveryAZORultcanrecursivelysearchforfilesinfoldersandcollectsfilesfromthedesktopwithcertainextensions.
EnterpriseT1107FileDeletionAZORultcandeletefilesfromvictimmachines.
EnterpriseT1057ProcessDiscoveryAZORultcancollectalistofrunningprocessesbycallingCreateToolhelp32Snapshot.
EnterpriseT1093ProcessHollowingAZORultcandecryptthepayloadintomemory,createanewsuspendedprocessofitself,theninjectadecryptedpayloadtothenewprocessandresumenewprocessexecution.
EnterpriseT1012QueryRegistryAZORultcancheckforinstalledsoftwareonthesystemundertheRegistrykeySoftware\Microsoft\Windows\CurrentVersion\Uninstall.
EnterpriseT1105RemoteFileCopyAZORultcandownloadandexecuteadditionalfiles.
AzorulthasalsodownloadedaransomwarepayloadcalledHermes.
EnterpriseT1113ScreenCaptureAZORultcancapturescreenshotsofthevictim'smachines.
EnterpriseT1032StandardCryptographicProtocolAZORultcanencryptC2trafficusingXOR.
EnterpriseT1082SystemInformationDiscoveryAZORultcancollectthemachineinformation,systemarchitecture,theOSversion,computername,Windowsproductname,thenumberofCPUcores,videocardinformation,andthesystemlanguage.
EnterpriseT1016SystemNetworkConfigurationDiscoveryAZORultcancollecthostIPinformationfromthevictim'smachine.
EnterpriseT1033SystemOwner/UserDiscoveryAZORultcancollecttheusernamefromthevictim'smachine.
EnterpriseT1124SystemTimeDiscoveryAZORultcancollectthetimezoneinformationfromthesystem.
Source:https://attack.
mitre.
org/software/S0344/4/16/2020AZORult–InfectionandcompromiseExampleattack:InfectionvectorExecutionPersistenceReconnaissanceExfiltration7TLP:WHITEImagesource:TrendMicro4/16/2020AZORult–OriginationofattacksGeographicaldistributionofAZORultattacks:December2017throughDecember20188TLP:WHITEDataandimagesource:Kaspersky4/16/2020RecentAZORultusage–FakeCoronavirusmapFakeCoronavirustrackingmapdropsAZORultonvictimsystems:9TLP:WHITE4/16/2020LegitimateJohnsHopkinsCoronavirusMapLegitimatemap:10TLP:WHITE4/16/2020RecentAZORulttechnique–tripleencryptionObservedinaFebruary2020phishingcampaign:11TLP:WHITEDataandimagesource:ThreatPost4/16/2020AZORult-PersistenceAZORultcanestablishpersistence:InstallstandardbackdoorsCreateshiddenadminaccounttosetregistrykeytoestablishRemoteDesktopProtocol(RDP)connectionCamouflagesaslegitimateapplication(registryandscheduledtasks)SeeexampleoffakeGoogleupdatebinarybelowwhichcontainedAZORulttrojan:12TLP:WHITEImagesource:BleepingComputer4/16/2020AZORultIntrusionDetectionRules/SignaturesYaraRules:https://malpedia.
caad.
fkie.
fraunhofer.
de/yara/win.
azorulthttps://github.
com/Yara-Rules/rules/blob/master/malware/MALW_AZORULT.
yarhttps://malware.
lu/articles/2018/05/04/azorult-stealer.
htmlhttps://yoroi.
company/research/gootkit-unveiling-the-hidden-link-with-azorult/https://neonprimetime.
blogspot.
com/2019/02/malware-yara-rules.
htmlhttps://tccontre.
blogspot.
com/2019/01/interesting-azorult-mutex-name-that.
htmlSnortrules:https://www.
snort.
org/rule_docs/1-47339https://www.
snort.
org/rule_docs/1-49548https://snort.
org/rule_docs/1-4760213TLP:WHITE4/16/2020MitigationPractices:AZORultTheHHS405(d)ProgrampublishedtheHealthIndustryCybersecurityPractices(HICP),whichisafreeresourcethatidentifiesthetopfivecyberthreatsandthetenbestpracticestomitigatethem.
BelowarethepracticesfromHICPthatcanbeusedtomitigateAZORult.
14TLP:WHITEBackgroundinformationcanbefoundhere:https://www.
phe.
gov/Preparedness/planning/405d/Documents/HICP-Main-508.
pdfDEFENSE/MITIGATION/COUNTERMEASURE405(d)HICPREFERENCEProvidesocialengineeringandphishingtrainingtoemployees.
[10.
S.
A],[1.
M.
D]Developandmaintainpolicyonsuspiciouse-mailsforendusers;Ensuresuspiciouse-mailsarereported.
[10.
S.
A],[10.
M.
A]Ensureemailsoriginatingfromoutsidetheorganizationareautomaticallymarkedbeforereceived.
[1.
S.
A],[1.
M.
A]Applypatches/updatesimmediatelyafterrelease/testing;Develop/maintainpatchingprogramifnecessary.
[7.
S.
A],[7.
M.
D]ImplementIntrusionDetectionSystem(IDS);Keepsignaturesandrulesupdated.
[6.
S.
C],[6.
M.
C],[6.
L.
C]Implementspamfiltersattheemailgateways;Keepsignaturesandrulesupdated.
[1.
S.
A],[1.
M.
A]BlocksuspiciousIPaddressesatthefirewall;Keepfirewallrulesareupdated.
[6.
S.
A],[6.
M.
A],[6.
L.
E]Implementwhitelistingtechnologytoensurethatonlyauthorizedsoftwareisallowedtoexecute.
[2.
S.
A],[2.
M.
A],[2.
L.
E]Implementaccesscontrolbasedontheprincipalofleastprivilege.
[3.
S.
A],[3.
M.
A],[3.
L.
C]Implementandmaintainanti-malwaresolution.
[2.
S.
A],[2.
M.
A],[2.
L.
D]Conductsystemhardeningtoensureproperconfigurations.
[7.
S.
A],[7.
M.
D]DisabletheuseofSMBv1(andallothervulnerableservicesandprotocols)andrequireatleastSMBv2.
[7.
S.
A],[7.
M.
D]4/16/202015IndicatorsofCompromise:ThereareinstancesofobsoleteIOCsbeingreused,soanyorganizationattemptingtodefendthemselvesshouldconsiderallpossibilities.
NewIOCsareconstantlybeingreleased,especiallywithatoolasprominentandfrequentlyusedasAZORult.
Itisthereforeincumbentuponanyorganizationattemptingtodefendthemselvestoremainvigilant,maintainsituationalawarenessandbeeveronthelookoutfornewIOCstooperationalizeintheircyberdefenseinfrastructure.
AZORult:IndicatorsofCompromiseTLP:WHITEINDICATORTYPEDESCRIPTIONhttp://daticho.
ac[.
]ugDomainCommandandcontrolserverhttp://ravor.
ac[.
]ugDomainCommandandcontrolserverssl[.
admin[.
itybuy[.
itDomainCommandandcontrolserverhairpd[.
]com/stat/stella.
exeDomainMalwarestoragehairpd[.
]com/stat/sputik.
exeDomainMalwarestorageivanzakharov91[.
]example.
comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestoragehost.
colocrossing[.
]comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestorage185.
154.
21[.
]208IPaddressMalwarestorage192.
3.
179[.
]203IPaddressMalwarestorage08EB8F2E441C26443EB9ABE5A93CD942MD5Executable5B26880F80A00397BC379CAF5CADC564MD5ExecutableB0EC3E594D20B9D38CC8591BAFF0148BMD5ExecutableFE8938F0BAAF90516A90610F6E210484MD5Executable2274174ed24425f41362aa207168b491e6fb55cab208116070f91c049946097aMD5Executable6f51bf05c9fa30f3c7b6b581d4bbf0194d1725120b242972ca95c6ecc7eb79bcMD5Executablea75b318eb2ae6678fd15f252d6b33919203262eb59e08ac32928f8bad54ca612MD5Executable12791e14ba82d36d434e7c7c0b81c7975ce802a430724f134b7e0cce5a7bb185MD5Executable97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19MD5Executablef291c822ee0c5655b2900f1c8881e415MD5Executable4/16/2020ReferencesAnalyzinganAZORultAttack–EvasioninaCloakofMultipleLayershttps://blog.
minerva-labs.
com/analyzing-an-azorult-attack-evasion-in-a-cloak-of-multiple-layersSeamlessCampaignDeliversRamnitviaRIGEKat188.
225.
82.
158.
Follow-upMalwareisAZORultStealer.
https://malwarebreakdown.
com/2017/11/12/seamless-campaign-delivers-ramnit-via-rig-ek-at-188-225-82-158-follow-up-malware-is-azorult-stealer/TheSeamlessCampaignDropsRamnit.
Follow-upMalware:AZORultStealer,SmokeLoader,etc.
https://malwarebreakdown.
com/2017/07/24/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc/Let'sLearn:ReversingCredentialandPaymentCardInformationStealer'AZORultV2'https://www.
vkremez.
com/2017/07/lets-learn-reversing-credential-and.
htmlThreatActorsUsingLegitimatePayPalAccountsToDistributeChthonicBankingTrojanhttps://www.
proofpoint.
com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojanKasperskyThreats:TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/campaignAZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAMNewversionofAZORultstealerimprovesloadingfeatures,spreadsalongsideransomwareinnewcampaignhttps://www.
proofpoint.
com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongsideMalpedia:Azorulthttps://malpedia.
caad.
fkie.
fraunhofer.
de/details/win.
azorultcampaignTrendMicro:AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAM16TLP:WHITE4/16/2020ReferencesMaliciouscoronavirusmaphidesAZORultinfo-stealingmalwarehttps://www.
scmagazine.
com/home/security-news/news-archive/coronavirus/malicious-coronavirus-map-hides-azorult-info-stealing-malware/Battlingonlinecoronavirusscamswithfactshttps://blog.
malwarebytes.
com/social-engineering/2020/02/battling-online-coronavirus-scams-with-facts/AZORultCampaignAdoptsNovelTriple-EncryptionTechniquehttps://threatpost.
com/azorult-campaign-encryption-technique/152508/AZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AzorultTrojanStealsPasswordsWhileHidingasGoogleUpdatehttps://www.
bleepingcomputer.
com/news/security/azorult-trojan-steals-passwords-while-hiding-as-google-update/CBTAUThreatIntelligenceNotification:CommontoRussianUndergroundForums,AZORultAimstoConnecttoC&CServer,StealSensitiveDatahttps://www.
carbonblack.
com/2019/09/24/cb-tau-threat-intelligence-notification-common-to-russian-underground-forums-azorult-aims-to-connect-to-cc-server-steal-sensitive-data/AZORultMalwareAbusingRDPProtocolToStealtheDatabyEstablishaRemoteDesktopConnectionhttps://gbhackers.
com/azorult-malware-abusing-rdp-protocol/ReverseEngineering,MalwareDeepInsighthttps://vk-intel.
org/2017/07/Azorultloaderstageshttps://maxkersten.
nl/binary-analysis-course/malware-analysis/azorult-loader-stages/MITRE:AZORulthttps://attack.
mitre.
org/software/S0344/AZORULTVERSION2:ATROCIOUSSPYWAREINFECTIONUSING3IN1RTFDOCUMENThttps://cysinfo.
com/azorult-version-2-atrocious-spyware-infection-using-3-1-rtf-document/AZORult++:Rewritinghistoryhttps://securelist.
com/azorult-analysis-history/89922/TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/17TLP:WHITE4/16/2020QuestionsUpcomingBriefsCOVID-19CyberThreatsThreatModellingforMobileHealthSystemsProductEvaluationsRecipientsofthisandotherHealthcareSectorCybersecurityCoordinationCenter(HC3)ThreatIntelligenceproductsarehighlyencouragedtoprovidefeedbacktoHC3@HHS.
GOV.
RequestsforInformationNeedinformationonaspecificcybersecuritytopicSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
18TLP:WHITE4/16/202019HealthSectorCybersecurityCoordinationCenter(HC3)BackgroundHC3workswithprivateandpublicsectorpartnerstoimprovecybersecuritythroughouttheHealthcareandPublicHealth(HPH)SectorSector&VictimNotificationsWhitePapersDirectedcommunicationstovictimsorpotentialvictimsofcompromises,vulnerableequipmentorPII/PHItheftandgeneralnotificationstotheHPHaboutcurrentlyimpactingthreatsviatheHHSOIGDocumentthatprovidesin-depthinformationonacybersecuritytopictoincreasecomprehensivesituationalawarenessandprovideriskrecommendationstoawideaudience.
ThreatBriefings&WebinarBriefingdocumentandpresentationthatprovidesactionableinformationonhealthsectorcybersecuritythreatsandmitigations.
Analystspresentcurrentcybersecuritytopics,engageindiscussionswithparticipantsoncurrentthreats,andhighlightbestpracticesandmitigationtactics.
NeedinformationonaspecificcybersecuritytopicorwanttojoinourlistservSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
Products4/21/2020
2;UsedtotargetWindowsAKAPuffStealer,RuzaltoEasytooperate(userfriendly)Verycommon;SoldonRussianhackerforumsfor~$100Canbothbedroppedorserveasadropper(firstorsecondstage)Constantlychanging/evolvinginfectionvectorsandattackstagesandcapabilitiesEspeciallyrelevantduringtheCoronaviruspandemicUsedinCoronavirus-themedattacks3TLP:WHITEImagesource:BleepingComputer4/16/2020AZORult–AttackVectorsHowisAZORultdeliveredCommon:ExploitKits(especiallyFalloutExploitKit)OthermalwarethatactsasadropperRamnitEmotetPhishingMalspamInfectedwebsitesMalvertisementsFakeinstallersOnoccasion:.
isofileRemoteDesktopProtocol(RDP)exploitation4TLP:WHITEImagesource:AdAstraGames4/16/2020AZORult–FunctionalityoverviewAZORultpossessesthefollowingcapabilities:Steals:SystemlogincredentialsSystemreconnaissanceinfo(GUID,systemarchitectureandlanguage,usernameandcomputername,operatingsystemversion,systemIPaddressCryptocurrencywalletsMonero,uCoin,andbitcoincryptocurrenciesElectrum,Electrum-LTC,Ethereum,Exodus,JaxxandMistwalletsSteamandTelegramcredentials;SkypechathistoryandcredentialsPaymentcardnumbersCookiesandothersensitivebrowser-baseddata(especiallyautofill)DataExfiltration/CommunicationPushestoacommand-and-controlserver.
ScreenshotsExecutesfilesviaremotebackdoorcommands5TLP:WHITEImagesource:LinkedIn4/16/2020MappingAZORultagainsttheMITREATT&CKFrameworkMITREATT&CKTechniquesusedbyAZORult:6TLP:WHITEDomainIDNameUseEnterpriseT1134AccessTokenManipulationAZORultcancallWTSQueryUserTokenandCreateProcessAsUsertostartanewprocesswithlocalsystemprivileges.
EnterpriseT1503CredentialsfromWebBrowsersAZORultcanstealcredentialsfromthevictim'sbrowser.
EnterpriseT1081CredentialsinFilesAZORultcanstealcredentialsinfilesbelongingtocommonsoftwaresuchasSkype,Telegram,andSteam.
EnterpriseT1140Deobfuscate/DecodeFilesorInformationAZORultusesanXORkeytodecryptcontentandusesBase64todecodetheC2address.
EnterpriseT1083FileandDirectoryDiscoveryAZORultcanrecursivelysearchforfilesinfoldersandcollectsfilesfromthedesktopwithcertainextensions.
EnterpriseT1107FileDeletionAZORultcandeletefilesfromvictimmachines.
EnterpriseT1057ProcessDiscoveryAZORultcancollectalistofrunningprocessesbycallingCreateToolhelp32Snapshot.
EnterpriseT1093ProcessHollowingAZORultcandecryptthepayloadintomemory,createanewsuspendedprocessofitself,theninjectadecryptedpayloadtothenewprocessandresumenewprocessexecution.
EnterpriseT1012QueryRegistryAZORultcancheckforinstalledsoftwareonthesystemundertheRegistrykeySoftware\Microsoft\Windows\CurrentVersion\Uninstall.
EnterpriseT1105RemoteFileCopyAZORultcandownloadandexecuteadditionalfiles.
AzorulthasalsodownloadedaransomwarepayloadcalledHermes.
EnterpriseT1113ScreenCaptureAZORultcancapturescreenshotsofthevictim'smachines.
EnterpriseT1032StandardCryptographicProtocolAZORultcanencryptC2trafficusingXOR.
EnterpriseT1082SystemInformationDiscoveryAZORultcancollectthemachineinformation,systemarchitecture,theOSversion,computername,Windowsproductname,thenumberofCPUcores,videocardinformation,andthesystemlanguage.
EnterpriseT1016SystemNetworkConfigurationDiscoveryAZORultcancollecthostIPinformationfromthevictim'smachine.
EnterpriseT1033SystemOwner/UserDiscoveryAZORultcancollecttheusernamefromthevictim'smachine.
EnterpriseT1124SystemTimeDiscoveryAZORultcancollectthetimezoneinformationfromthesystem.
Source:https://attack.
mitre.
org/software/S0344/4/16/2020AZORult–InfectionandcompromiseExampleattack:InfectionvectorExecutionPersistenceReconnaissanceExfiltration7TLP:WHITEImagesource:TrendMicro4/16/2020AZORult–OriginationofattacksGeographicaldistributionofAZORultattacks:December2017throughDecember20188TLP:WHITEDataandimagesource:Kaspersky4/16/2020RecentAZORultusage–FakeCoronavirusmapFakeCoronavirustrackingmapdropsAZORultonvictimsystems:9TLP:WHITE4/16/2020LegitimateJohnsHopkinsCoronavirusMapLegitimatemap:10TLP:WHITE4/16/2020RecentAZORulttechnique–tripleencryptionObservedinaFebruary2020phishingcampaign:11TLP:WHITEDataandimagesource:ThreatPost4/16/2020AZORult-PersistenceAZORultcanestablishpersistence:InstallstandardbackdoorsCreateshiddenadminaccounttosetregistrykeytoestablishRemoteDesktopProtocol(RDP)connectionCamouflagesaslegitimateapplication(registryandscheduledtasks)SeeexampleoffakeGoogleupdatebinarybelowwhichcontainedAZORulttrojan:12TLP:WHITEImagesource:BleepingComputer4/16/2020AZORultIntrusionDetectionRules/SignaturesYaraRules:https://malpedia.
caad.
fkie.
fraunhofer.
de/yara/win.
azorulthttps://github.
com/Yara-Rules/rules/blob/master/malware/MALW_AZORULT.
yarhttps://malware.
lu/articles/2018/05/04/azorult-stealer.
htmlhttps://yoroi.
company/research/gootkit-unveiling-the-hidden-link-with-azorult/https://neonprimetime.
blogspot.
com/2019/02/malware-yara-rules.
htmlhttps://tccontre.
blogspot.
com/2019/01/interesting-azorult-mutex-name-that.
htmlSnortrules:https://www.
snort.
org/rule_docs/1-47339https://www.
snort.
org/rule_docs/1-49548https://snort.
org/rule_docs/1-4760213TLP:WHITE4/16/2020MitigationPractices:AZORultTheHHS405(d)ProgrampublishedtheHealthIndustryCybersecurityPractices(HICP),whichisafreeresourcethatidentifiesthetopfivecyberthreatsandthetenbestpracticestomitigatethem.
BelowarethepracticesfromHICPthatcanbeusedtomitigateAZORult.
14TLP:WHITEBackgroundinformationcanbefoundhere:https://www.
phe.
gov/Preparedness/planning/405d/Documents/HICP-Main-508.
pdfDEFENSE/MITIGATION/COUNTERMEASURE405(d)HICPREFERENCEProvidesocialengineeringandphishingtrainingtoemployees.
[10.
S.
A],[1.
M.
D]Developandmaintainpolicyonsuspiciouse-mailsforendusers;Ensuresuspiciouse-mailsarereported.
[10.
S.
A],[10.
M.
A]Ensureemailsoriginatingfromoutsidetheorganizationareautomaticallymarkedbeforereceived.
[1.
S.
A],[1.
M.
A]Applypatches/updatesimmediatelyafterrelease/testing;Develop/maintainpatchingprogramifnecessary.
[7.
S.
A],[7.
M.
D]ImplementIntrusionDetectionSystem(IDS);Keepsignaturesandrulesupdated.
[6.
S.
C],[6.
M.
C],[6.
L.
C]Implementspamfiltersattheemailgateways;Keepsignaturesandrulesupdated.
[1.
S.
A],[1.
M.
A]BlocksuspiciousIPaddressesatthefirewall;Keepfirewallrulesareupdated.
[6.
S.
A],[6.
M.
A],[6.
L.
E]Implementwhitelistingtechnologytoensurethatonlyauthorizedsoftwareisallowedtoexecute.
[2.
S.
A],[2.
M.
A],[2.
L.
E]Implementaccesscontrolbasedontheprincipalofleastprivilege.
[3.
S.
A],[3.
M.
A],[3.
L.
C]Implementandmaintainanti-malwaresolution.
[2.
S.
A],[2.
M.
A],[2.
L.
D]Conductsystemhardeningtoensureproperconfigurations.
[7.
S.
A],[7.
M.
D]DisabletheuseofSMBv1(andallothervulnerableservicesandprotocols)andrequireatleastSMBv2.
[7.
S.
A],[7.
M.
D]4/16/202015IndicatorsofCompromise:ThereareinstancesofobsoleteIOCsbeingreused,soanyorganizationattemptingtodefendthemselvesshouldconsiderallpossibilities.
NewIOCsareconstantlybeingreleased,especiallywithatoolasprominentandfrequentlyusedasAZORult.
Itisthereforeincumbentuponanyorganizationattemptingtodefendthemselvestoremainvigilant,maintainsituationalawarenessandbeeveronthelookoutfornewIOCstooperationalizeintheircyberdefenseinfrastructure.
AZORult:IndicatorsofCompromiseTLP:WHITEINDICATORTYPEDESCRIPTIONhttp://daticho.
ac[.
]ugDomainCommandandcontrolserverhttp://ravor.
ac[.
]ugDomainCommandandcontrolserverssl[.
admin[.
itybuy[.
itDomainCommandandcontrolserverhairpd[.
]com/stat/stella.
exeDomainMalwarestoragehairpd[.
]com/stat/sputik.
exeDomainMalwarestorageivanzakharov91[.
]example.
comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestoragehost.
colocrossing[.
]comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestorage185.
154.
21[.
]208IPaddressMalwarestorage192.
3.
179[.
]203IPaddressMalwarestorage08EB8F2E441C26443EB9ABE5A93CD942MD5Executable5B26880F80A00397BC379CAF5CADC564MD5ExecutableB0EC3E594D20B9D38CC8591BAFF0148BMD5ExecutableFE8938F0BAAF90516A90610F6E210484MD5Executable2274174ed24425f41362aa207168b491e6fb55cab208116070f91c049946097aMD5Executable6f51bf05c9fa30f3c7b6b581d4bbf0194d1725120b242972ca95c6ecc7eb79bcMD5Executablea75b318eb2ae6678fd15f252d6b33919203262eb59e08ac32928f8bad54ca612MD5Executable12791e14ba82d36d434e7c7c0b81c7975ce802a430724f134b7e0cce5a7bb185MD5Executable97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19MD5Executablef291c822ee0c5655b2900f1c8881e415MD5Executable4/16/2020ReferencesAnalyzinganAZORultAttack–EvasioninaCloakofMultipleLayershttps://blog.
minerva-labs.
com/analyzing-an-azorult-attack-evasion-in-a-cloak-of-multiple-layersSeamlessCampaignDeliversRamnitviaRIGEKat188.
225.
82.
158.
Follow-upMalwareisAZORultStealer.
https://malwarebreakdown.
com/2017/11/12/seamless-campaign-delivers-ramnit-via-rig-ek-at-188-225-82-158-follow-up-malware-is-azorult-stealer/TheSeamlessCampaignDropsRamnit.
Follow-upMalware:AZORultStealer,SmokeLoader,etc.
https://malwarebreakdown.
com/2017/07/24/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc/Let'sLearn:ReversingCredentialandPaymentCardInformationStealer'AZORultV2'https://www.
vkremez.
com/2017/07/lets-learn-reversing-credential-and.
htmlThreatActorsUsingLegitimatePayPalAccountsToDistributeChthonicBankingTrojanhttps://www.
proofpoint.
com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojanKasperskyThreats:TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/campaignAZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAMNewversionofAZORultstealerimprovesloadingfeatures,spreadsalongsideransomwareinnewcampaignhttps://www.
proofpoint.
com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongsideMalpedia:Azorulthttps://malpedia.
caad.
fkie.
fraunhofer.
de/details/win.
azorultcampaignTrendMicro:AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAM16TLP:WHITE4/16/2020ReferencesMaliciouscoronavirusmaphidesAZORultinfo-stealingmalwarehttps://www.
scmagazine.
com/home/security-news/news-archive/coronavirus/malicious-coronavirus-map-hides-azorult-info-stealing-malware/Battlingonlinecoronavirusscamswithfactshttps://blog.
malwarebytes.
com/social-engineering/2020/02/battling-online-coronavirus-scams-with-facts/AZORultCampaignAdoptsNovelTriple-EncryptionTechniquehttps://threatpost.
com/azorult-campaign-encryption-technique/152508/AZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AzorultTrojanStealsPasswordsWhileHidingasGoogleUpdatehttps://www.
bleepingcomputer.
com/news/security/azorult-trojan-steals-passwords-while-hiding-as-google-update/CBTAUThreatIntelligenceNotification:CommontoRussianUndergroundForums,AZORultAimstoConnecttoC&CServer,StealSensitiveDatahttps://www.
carbonblack.
com/2019/09/24/cb-tau-threat-intelligence-notification-common-to-russian-underground-forums-azorult-aims-to-connect-to-cc-server-steal-sensitive-data/AZORultMalwareAbusingRDPProtocolToStealtheDatabyEstablishaRemoteDesktopConnectionhttps://gbhackers.
com/azorult-malware-abusing-rdp-protocol/ReverseEngineering,MalwareDeepInsighthttps://vk-intel.
org/2017/07/Azorultloaderstageshttps://maxkersten.
nl/binary-analysis-course/malware-analysis/azorult-loader-stages/MITRE:AZORulthttps://attack.
mitre.
org/software/S0344/AZORULTVERSION2:ATROCIOUSSPYWAREINFECTIONUSING3IN1RTFDOCUMENThttps://cysinfo.
com/azorult-version-2-atrocious-spyware-infection-using-3-1-rtf-document/AZORult++:Rewritinghistoryhttps://securelist.
com/azorult-analysis-history/89922/TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/17TLP:WHITE4/16/2020QuestionsUpcomingBriefsCOVID-19CyberThreatsThreatModellingforMobileHealthSystemsProductEvaluationsRecipientsofthisandotherHealthcareSectorCybersecurityCoordinationCenter(HC3)ThreatIntelligenceproductsarehighlyencouragedtoprovidefeedbacktoHC3@HHS.
GOV.
RequestsforInformationNeedinformationonaspecificcybersecuritytopicSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
18TLP:WHITE4/16/202019HealthSectorCybersecurityCoordinationCenter(HC3)BackgroundHC3workswithprivateandpublicsectorpartnerstoimprovecybersecuritythroughouttheHealthcareandPublicHealth(HPH)SectorSector&VictimNotificationsWhitePapersDirectedcommunicationstovictimsorpotentialvictimsofcompromises,vulnerableequipmentorPII/PHItheftandgeneralnotificationstotheHPHaboutcurrentlyimpactingthreatsviatheHHSOIGDocumentthatprovidesin-depthinformationonacybersecuritytopictoincreasecomprehensivesituationalawarenessandprovideriskrecommendationstoawideaudience.
ThreatBriefings&WebinarBriefingdocumentandpresentationthatprovidesactionableinformationonhealthsectorcybersecuritythreatsandmitigations.
Analystspresentcurrentcybersecuritytopics,engageindiscussionswithparticipantsoncurrentthreats,andhighlightbestpracticesandmitigationtactics.
NeedinformationonaspecificcybersecuritytopicorwanttojoinourlistservSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
Products4/21/2020
- T1105kaspersky.com相关文档
- unsecurekaspersky.com
- executingkaspersky.com
- Botnetzeskaspersky.com
- serviceskaspersky.com
- rulekaspersky.com
- lysiskaspersky.com
RAKsmart新年钜惠：E3服务器秒杀$30/月起,新上韩国服务器,香港/日本/美国站群服务器,VPS月付$1.99起,GPU服务器,高防服务器_vps香港
RAKsmart发布了新年钜惠活动，即日起到2月28日，商家每天推出限量服务器秒杀，美国服务器每月30美元起，新上了韩国服务器、GPU服务器、香港/日本/美国常规+站群服务器、1-10Gbps不限流量大带宽服务器等大量库存；VPS主机全场提供7折优惠码，同时针对部分特惠套餐无码直购每月仅1.99美元，支持使用PayPal或者支付宝等方式付款，有中英文网页及客服支持。爆款秒杀10台/天可选精品网/大...
2021年全新Vultr VPS主机开通云服务器和选择机房教程（附IP不通问题）
昨天有分享到"2021年Vultr新用户福利注册账户赠送50美元"文章，居然还有网友曾经没有注册过他家的账户，薅过他们家的羊毛。通过一阵折腾居然能注册到账户，但是对于如何开通云服务器稍微有点不对劲，对于新人来说确实有点疑惑。因为Vultr采用的是预付费充值方式，会在每月的一号扣费，当然我们账户需要存留余额或者我们采用自动扣费支付模式。把笔记中以前的文章推送给网友查看，他居然告诉我界面不同，看的不对...
A400互联37.8元/季，香港节点cn2，cmi线路云服务器,1核/1G/10M/300G
A400互联怎么样?A400互联是一家成立于2020年的商家，A400互联是云服务器网(yuntue.com)首次发布的云主机商家。本次A400互联给大家带来的是，全新上线的香港节点，cmi+cn2线路，全场香港产品7折优惠，优惠码0711，A400互联，只为给你提供更快，更稳，更实惠的套餐，香港节点上线cn2+cmi线路云服务器,37.8元/季/1H/1G/10M/300G，云上日子，你我共享。...
kaspersky.com为你推荐
-
对对塔为什么不能玩天天擂台？（对对塔）硬盘工作原理硬盘跟光盘的工作原理？微信回应封杀钉钉微信违规操作被封了，杰景新特萨克斯吉普特500是台湾原产的吗125xx.com高手指教下，www.fshxbxg.com这个域名值多少钱？杨丽晓博客杨丽晓哪一年出生的？www.175qq.com这表情是什么？59ddd.com网站找不到了怎么办啊59ddd.comarmada m300什么装系统www.xvideos.com请问www.****.com.hk 和www.****.com.cn一样吗？