T1105kaspersky.com
kaspersky.com 时间:2021-03-23 阅读:()
AZORultMalwareOVERALLCLASSIFICATIONISTLP:WHITETLP:WHITE04/16/2020Report#:202004161000AgendaIntroductionAttackvectorsFunctionalityoverviewMappingagainsttheMITREATT&CKFrameworkInfectionandCompromiseOriginationofAttacksFakeCoronavirusmapTripleEncryptionPersistenceIntrusionDetectionRules/SignaturesMitigationpracticesIndicatorsofCompromiseReferencesQuestions4/16/20202Non-Technical:managerial,strategicandhigh-level(generalaudience)Technical:Tactical/IOCs;requiringin-depthknowledge(sysadmins,IRT)SlidesKey:TLP:WHITEImagesource:NJCCICIntroductionAZORult–WhatisitMalware–InformationstealerandcryptocurrencytheftInitiallydetectedin2016whendroppedbytheChthonicbankingtrojanLatestversion:3.
2;UsedtotargetWindowsAKAPuffStealer,RuzaltoEasytooperate(userfriendly)Verycommon;SoldonRussianhackerforumsfor~$100Canbothbedroppedorserveasadropper(firstorsecondstage)Constantlychanging/evolvinginfectionvectorsandattackstagesandcapabilitiesEspeciallyrelevantduringtheCoronaviruspandemicUsedinCoronavirus-themedattacks3TLP:WHITEImagesource:BleepingComputer4/16/2020AZORult–AttackVectorsHowisAZORultdeliveredCommon:ExploitKits(especiallyFalloutExploitKit)OthermalwarethatactsasadropperRamnitEmotetPhishingMalspamInfectedwebsitesMalvertisementsFakeinstallersOnoccasion:.
isofileRemoteDesktopProtocol(RDP)exploitation4TLP:WHITEImagesource:AdAstraGames4/16/2020AZORult–FunctionalityoverviewAZORultpossessesthefollowingcapabilities:Steals:SystemlogincredentialsSystemreconnaissanceinfo(GUID,systemarchitectureandlanguage,usernameandcomputername,operatingsystemversion,systemIPaddressCryptocurrencywalletsMonero,uCoin,andbitcoincryptocurrenciesElectrum,Electrum-LTC,Ethereum,Exodus,JaxxandMistwalletsSteamandTelegramcredentials;SkypechathistoryandcredentialsPaymentcardnumbersCookiesandothersensitivebrowser-baseddata(especiallyautofill)DataExfiltration/CommunicationPushestoacommand-and-controlserver.
ScreenshotsExecutesfilesviaremotebackdoorcommands5TLP:WHITEImagesource:LinkedIn4/16/2020MappingAZORultagainsttheMITREATT&CKFrameworkMITREATT&CKTechniquesusedbyAZORult:6TLP:WHITEDomainIDNameUseEnterpriseT1134AccessTokenManipulationAZORultcancallWTSQueryUserTokenandCreateProcessAsUsertostartanewprocesswithlocalsystemprivileges.
EnterpriseT1503CredentialsfromWebBrowsersAZORultcanstealcredentialsfromthevictim'sbrowser.
EnterpriseT1081CredentialsinFilesAZORultcanstealcredentialsinfilesbelongingtocommonsoftwaresuchasSkype,Telegram,andSteam.
EnterpriseT1140Deobfuscate/DecodeFilesorInformationAZORultusesanXORkeytodecryptcontentandusesBase64todecodetheC2address.
EnterpriseT1083FileandDirectoryDiscoveryAZORultcanrecursivelysearchforfilesinfoldersandcollectsfilesfromthedesktopwithcertainextensions.
EnterpriseT1107FileDeletionAZORultcandeletefilesfromvictimmachines.
EnterpriseT1057ProcessDiscoveryAZORultcancollectalistofrunningprocessesbycallingCreateToolhelp32Snapshot.
EnterpriseT1093ProcessHollowingAZORultcandecryptthepayloadintomemory,createanewsuspendedprocessofitself,theninjectadecryptedpayloadtothenewprocessandresumenewprocessexecution.
EnterpriseT1012QueryRegistryAZORultcancheckforinstalledsoftwareonthesystemundertheRegistrykeySoftware\Microsoft\Windows\CurrentVersion\Uninstall.
EnterpriseT1105RemoteFileCopyAZORultcandownloadandexecuteadditionalfiles.
AzorulthasalsodownloadedaransomwarepayloadcalledHermes.
EnterpriseT1113ScreenCaptureAZORultcancapturescreenshotsofthevictim'smachines.
EnterpriseT1032StandardCryptographicProtocolAZORultcanencryptC2trafficusingXOR.
EnterpriseT1082SystemInformationDiscoveryAZORultcancollectthemachineinformation,systemarchitecture,theOSversion,computername,Windowsproductname,thenumberofCPUcores,videocardinformation,andthesystemlanguage.
EnterpriseT1016SystemNetworkConfigurationDiscoveryAZORultcancollecthostIPinformationfromthevictim'smachine.
EnterpriseT1033SystemOwner/UserDiscoveryAZORultcancollecttheusernamefromthevictim'smachine.
EnterpriseT1124SystemTimeDiscoveryAZORultcancollectthetimezoneinformationfromthesystem.
Source:https://attack.
mitre.
org/software/S0344/4/16/2020AZORult–InfectionandcompromiseExampleattack:InfectionvectorExecutionPersistenceReconnaissanceExfiltration7TLP:WHITEImagesource:TrendMicro4/16/2020AZORult–OriginationofattacksGeographicaldistributionofAZORultattacks:December2017throughDecember20188TLP:WHITEDataandimagesource:Kaspersky4/16/2020RecentAZORultusage–FakeCoronavirusmapFakeCoronavirustrackingmapdropsAZORultonvictimsystems:9TLP:WHITE4/16/2020LegitimateJohnsHopkinsCoronavirusMapLegitimatemap:10TLP:WHITE4/16/2020RecentAZORulttechnique–tripleencryptionObservedinaFebruary2020phishingcampaign:11TLP:WHITEDataandimagesource:ThreatPost4/16/2020AZORult-PersistenceAZORultcanestablishpersistence:InstallstandardbackdoorsCreateshiddenadminaccounttosetregistrykeytoestablishRemoteDesktopProtocol(RDP)connectionCamouflagesaslegitimateapplication(registryandscheduledtasks)SeeexampleoffakeGoogleupdatebinarybelowwhichcontainedAZORulttrojan:12TLP:WHITEImagesource:BleepingComputer4/16/2020AZORultIntrusionDetectionRules/SignaturesYaraRules:https://malpedia.
caad.
fkie.
fraunhofer.
de/yara/win.
azorulthttps://github.
com/Yara-Rules/rules/blob/master/malware/MALW_AZORULT.
yarhttps://malware.
lu/articles/2018/05/04/azorult-stealer.
htmlhttps://yoroi.
company/research/gootkit-unveiling-the-hidden-link-with-azorult/https://neonprimetime.
blogspot.
com/2019/02/malware-yara-rules.
htmlhttps://tccontre.
blogspot.
com/2019/01/interesting-azorult-mutex-name-that.
htmlSnortrules:https://www.
snort.
org/rule_docs/1-47339https://www.
snort.
org/rule_docs/1-49548https://snort.
org/rule_docs/1-4760213TLP:WHITE4/16/2020MitigationPractices:AZORultTheHHS405(d)ProgrampublishedtheHealthIndustryCybersecurityPractices(HICP),whichisafreeresourcethatidentifiesthetopfivecyberthreatsandthetenbestpracticestomitigatethem.
BelowarethepracticesfromHICPthatcanbeusedtomitigateAZORult.
14TLP:WHITEBackgroundinformationcanbefoundhere:https://www.
phe.
gov/Preparedness/planning/405d/Documents/HICP-Main-508.
pdfDEFENSE/MITIGATION/COUNTERMEASURE405(d)HICPREFERENCEProvidesocialengineeringandphishingtrainingtoemployees.
[10.
S.
A],[1.
M.
D]Developandmaintainpolicyonsuspiciouse-mailsforendusers;Ensuresuspiciouse-mailsarereported.
[10.
S.
A],[10.
M.
A]Ensureemailsoriginatingfromoutsidetheorganizationareautomaticallymarkedbeforereceived.
[1.
S.
A],[1.
M.
A]Applypatches/updatesimmediatelyafterrelease/testing;Develop/maintainpatchingprogramifnecessary.
[7.
S.
A],[7.
M.
D]ImplementIntrusionDetectionSystem(IDS);Keepsignaturesandrulesupdated.
[6.
S.
C],[6.
M.
C],[6.
L.
C]Implementspamfiltersattheemailgateways;Keepsignaturesandrulesupdated.
[1.
S.
A],[1.
M.
A]BlocksuspiciousIPaddressesatthefirewall;Keepfirewallrulesareupdated.
[6.
S.
A],[6.
M.
A],[6.
L.
E]Implementwhitelistingtechnologytoensurethatonlyauthorizedsoftwareisallowedtoexecute.
[2.
S.
A],[2.
M.
A],[2.
L.
E]Implementaccesscontrolbasedontheprincipalofleastprivilege.
[3.
S.
A],[3.
M.
A],[3.
L.
C]Implementandmaintainanti-malwaresolution.
[2.
S.
A],[2.
M.
A],[2.
L.
D]Conductsystemhardeningtoensureproperconfigurations.
[7.
S.
A],[7.
M.
D]DisabletheuseofSMBv1(andallothervulnerableservicesandprotocols)andrequireatleastSMBv2.
[7.
S.
A],[7.
M.
D]4/16/202015IndicatorsofCompromise:ThereareinstancesofobsoleteIOCsbeingreused,soanyorganizationattemptingtodefendthemselvesshouldconsiderallpossibilities.
NewIOCsareconstantlybeingreleased,especiallywithatoolasprominentandfrequentlyusedasAZORult.
Itisthereforeincumbentuponanyorganizationattemptingtodefendthemselvestoremainvigilant,maintainsituationalawarenessandbeeveronthelookoutfornewIOCstooperationalizeintheircyberdefenseinfrastructure.
AZORult:IndicatorsofCompromiseTLP:WHITEINDICATORTYPEDESCRIPTIONhttp://daticho.
ac[.
]ugDomainCommandandcontrolserverhttp://ravor.
ac[.
]ugDomainCommandandcontrolserverssl[.
admin[.
itybuy[.
itDomainCommandandcontrolserverhairpd[.
]com/stat/stella.
exeDomainMalwarestoragehairpd[.
]com/stat/sputik.
exeDomainMalwarestorageivanzakharov91[.
]example.
comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestoragehost.
colocrossing[.
]comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestorage185.
154.
21[.
]208IPaddressMalwarestorage192.
3.
179[.
]203IPaddressMalwarestorage08EB8F2E441C26443EB9ABE5A93CD942MD5Executable5B26880F80A00397BC379CAF5CADC564MD5ExecutableB0EC3E594D20B9D38CC8591BAFF0148BMD5ExecutableFE8938F0BAAF90516A90610F6E210484MD5Executable2274174ed24425f41362aa207168b491e6fb55cab208116070f91c049946097aMD5Executable6f51bf05c9fa30f3c7b6b581d4bbf0194d1725120b242972ca95c6ecc7eb79bcMD5Executablea75b318eb2ae6678fd15f252d6b33919203262eb59e08ac32928f8bad54ca612MD5Executable12791e14ba82d36d434e7c7c0b81c7975ce802a430724f134b7e0cce5a7bb185MD5Executable97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19MD5Executablef291c822ee0c5655b2900f1c8881e415MD5Executable4/16/2020ReferencesAnalyzinganAZORultAttack–EvasioninaCloakofMultipleLayershttps://blog.
minerva-labs.
com/analyzing-an-azorult-attack-evasion-in-a-cloak-of-multiple-layersSeamlessCampaignDeliversRamnitviaRIGEKat188.
225.
82.
158.
Follow-upMalwareisAZORultStealer.
https://malwarebreakdown.
com/2017/11/12/seamless-campaign-delivers-ramnit-via-rig-ek-at-188-225-82-158-follow-up-malware-is-azorult-stealer/TheSeamlessCampaignDropsRamnit.
Follow-upMalware:AZORultStealer,SmokeLoader,etc.
https://malwarebreakdown.
com/2017/07/24/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc/Let'sLearn:ReversingCredentialandPaymentCardInformationStealer'AZORultV2'https://www.
vkremez.
com/2017/07/lets-learn-reversing-credential-and.
htmlThreatActorsUsingLegitimatePayPalAccountsToDistributeChthonicBankingTrojanhttps://www.
proofpoint.
com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojanKasperskyThreats:TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/campaignAZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAMNewversionofAZORultstealerimprovesloadingfeatures,spreadsalongsideransomwareinnewcampaignhttps://www.
proofpoint.
com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongsideMalpedia:Azorulthttps://malpedia.
caad.
fkie.
fraunhofer.
de/details/win.
azorultcampaignTrendMicro:AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAM16TLP:WHITE4/16/2020ReferencesMaliciouscoronavirusmaphidesAZORultinfo-stealingmalwarehttps://www.
scmagazine.
com/home/security-news/news-archive/coronavirus/malicious-coronavirus-map-hides-azorult-info-stealing-malware/Battlingonlinecoronavirusscamswithfactshttps://blog.
malwarebytes.
com/social-engineering/2020/02/battling-online-coronavirus-scams-with-facts/AZORultCampaignAdoptsNovelTriple-EncryptionTechniquehttps://threatpost.
com/azorult-campaign-encryption-technique/152508/AZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AzorultTrojanStealsPasswordsWhileHidingasGoogleUpdatehttps://www.
bleepingcomputer.
com/news/security/azorult-trojan-steals-passwords-while-hiding-as-google-update/CBTAUThreatIntelligenceNotification:CommontoRussianUndergroundForums,AZORultAimstoConnecttoC&CServer,StealSensitiveDatahttps://www.
carbonblack.
com/2019/09/24/cb-tau-threat-intelligence-notification-common-to-russian-underground-forums-azorult-aims-to-connect-to-cc-server-steal-sensitive-data/AZORultMalwareAbusingRDPProtocolToStealtheDatabyEstablishaRemoteDesktopConnectionhttps://gbhackers.
com/azorult-malware-abusing-rdp-protocol/ReverseEngineering,MalwareDeepInsighthttps://vk-intel.
org/2017/07/Azorultloaderstageshttps://maxkersten.
nl/binary-analysis-course/malware-analysis/azorult-loader-stages/MITRE:AZORulthttps://attack.
mitre.
org/software/S0344/AZORULTVERSION2:ATROCIOUSSPYWAREINFECTIONUSING3IN1RTFDOCUMENThttps://cysinfo.
com/azorult-version-2-atrocious-spyware-infection-using-3-1-rtf-document/AZORult++:Rewritinghistoryhttps://securelist.
com/azorult-analysis-history/89922/TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/17TLP:WHITE4/16/2020QuestionsUpcomingBriefsCOVID-19CyberThreatsThreatModellingforMobileHealthSystemsProductEvaluationsRecipientsofthisandotherHealthcareSectorCybersecurityCoordinationCenter(HC3)ThreatIntelligenceproductsarehighlyencouragedtoprovidefeedbacktoHC3@HHS.
GOV.
RequestsforInformationNeedinformationonaspecificcybersecuritytopicSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
18TLP:WHITE4/16/202019HealthSectorCybersecurityCoordinationCenter(HC3)BackgroundHC3workswithprivateandpublicsectorpartnerstoimprovecybersecuritythroughouttheHealthcareandPublicHealth(HPH)SectorSector&VictimNotificationsWhitePapersDirectedcommunicationstovictimsorpotentialvictimsofcompromises,vulnerableequipmentorPII/PHItheftandgeneralnotificationstotheHPHaboutcurrentlyimpactingthreatsviatheHHSOIGDocumentthatprovidesin-depthinformationonacybersecuritytopictoincreasecomprehensivesituationalawarenessandprovideriskrecommendationstoawideaudience.
ThreatBriefings&WebinarBriefingdocumentandpresentationthatprovidesactionableinformationonhealthsectorcybersecuritythreatsandmitigations.
Analystspresentcurrentcybersecuritytopics,engageindiscussionswithparticipantsoncurrentthreats,andhighlightbestpracticesandmitigationtactics.
NeedinformationonaspecificcybersecuritytopicorwanttojoinourlistservSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
Products4/21/2020
2;UsedtotargetWindowsAKAPuffStealer,RuzaltoEasytooperate(userfriendly)Verycommon;SoldonRussianhackerforumsfor~$100Canbothbedroppedorserveasadropper(firstorsecondstage)Constantlychanging/evolvinginfectionvectorsandattackstagesandcapabilitiesEspeciallyrelevantduringtheCoronaviruspandemicUsedinCoronavirus-themedattacks3TLP:WHITEImagesource:BleepingComputer4/16/2020AZORult–AttackVectorsHowisAZORultdeliveredCommon:ExploitKits(especiallyFalloutExploitKit)OthermalwarethatactsasadropperRamnitEmotetPhishingMalspamInfectedwebsitesMalvertisementsFakeinstallersOnoccasion:.
isofileRemoteDesktopProtocol(RDP)exploitation4TLP:WHITEImagesource:AdAstraGames4/16/2020AZORult–FunctionalityoverviewAZORultpossessesthefollowingcapabilities:Steals:SystemlogincredentialsSystemreconnaissanceinfo(GUID,systemarchitectureandlanguage,usernameandcomputername,operatingsystemversion,systemIPaddressCryptocurrencywalletsMonero,uCoin,andbitcoincryptocurrenciesElectrum,Electrum-LTC,Ethereum,Exodus,JaxxandMistwalletsSteamandTelegramcredentials;SkypechathistoryandcredentialsPaymentcardnumbersCookiesandothersensitivebrowser-baseddata(especiallyautofill)DataExfiltration/CommunicationPushestoacommand-and-controlserver.
ScreenshotsExecutesfilesviaremotebackdoorcommands5TLP:WHITEImagesource:LinkedIn4/16/2020MappingAZORultagainsttheMITREATT&CKFrameworkMITREATT&CKTechniquesusedbyAZORult:6TLP:WHITEDomainIDNameUseEnterpriseT1134AccessTokenManipulationAZORultcancallWTSQueryUserTokenandCreateProcessAsUsertostartanewprocesswithlocalsystemprivileges.
EnterpriseT1503CredentialsfromWebBrowsersAZORultcanstealcredentialsfromthevictim'sbrowser.
EnterpriseT1081CredentialsinFilesAZORultcanstealcredentialsinfilesbelongingtocommonsoftwaresuchasSkype,Telegram,andSteam.
EnterpriseT1140Deobfuscate/DecodeFilesorInformationAZORultusesanXORkeytodecryptcontentandusesBase64todecodetheC2address.
EnterpriseT1083FileandDirectoryDiscoveryAZORultcanrecursivelysearchforfilesinfoldersandcollectsfilesfromthedesktopwithcertainextensions.
EnterpriseT1107FileDeletionAZORultcandeletefilesfromvictimmachines.
EnterpriseT1057ProcessDiscoveryAZORultcancollectalistofrunningprocessesbycallingCreateToolhelp32Snapshot.
EnterpriseT1093ProcessHollowingAZORultcandecryptthepayloadintomemory,createanewsuspendedprocessofitself,theninjectadecryptedpayloadtothenewprocessandresumenewprocessexecution.
EnterpriseT1012QueryRegistryAZORultcancheckforinstalledsoftwareonthesystemundertheRegistrykeySoftware\Microsoft\Windows\CurrentVersion\Uninstall.
EnterpriseT1105RemoteFileCopyAZORultcandownloadandexecuteadditionalfiles.
AzorulthasalsodownloadedaransomwarepayloadcalledHermes.
EnterpriseT1113ScreenCaptureAZORultcancapturescreenshotsofthevictim'smachines.
EnterpriseT1032StandardCryptographicProtocolAZORultcanencryptC2trafficusingXOR.
EnterpriseT1082SystemInformationDiscoveryAZORultcancollectthemachineinformation,systemarchitecture,theOSversion,computername,Windowsproductname,thenumberofCPUcores,videocardinformation,andthesystemlanguage.
EnterpriseT1016SystemNetworkConfigurationDiscoveryAZORultcancollecthostIPinformationfromthevictim'smachine.
EnterpriseT1033SystemOwner/UserDiscoveryAZORultcancollecttheusernamefromthevictim'smachine.
EnterpriseT1124SystemTimeDiscoveryAZORultcancollectthetimezoneinformationfromthesystem.
Source:https://attack.
mitre.
org/software/S0344/4/16/2020AZORult–InfectionandcompromiseExampleattack:InfectionvectorExecutionPersistenceReconnaissanceExfiltration7TLP:WHITEImagesource:TrendMicro4/16/2020AZORult–OriginationofattacksGeographicaldistributionofAZORultattacks:December2017throughDecember20188TLP:WHITEDataandimagesource:Kaspersky4/16/2020RecentAZORultusage–FakeCoronavirusmapFakeCoronavirustrackingmapdropsAZORultonvictimsystems:9TLP:WHITE4/16/2020LegitimateJohnsHopkinsCoronavirusMapLegitimatemap:10TLP:WHITE4/16/2020RecentAZORulttechnique–tripleencryptionObservedinaFebruary2020phishingcampaign:11TLP:WHITEDataandimagesource:ThreatPost4/16/2020AZORult-PersistenceAZORultcanestablishpersistence:InstallstandardbackdoorsCreateshiddenadminaccounttosetregistrykeytoestablishRemoteDesktopProtocol(RDP)connectionCamouflagesaslegitimateapplication(registryandscheduledtasks)SeeexampleoffakeGoogleupdatebinarybelowwhichcontainedAZORulttrojan:12TLP:WHITEImagesource:BleepingComputer4/16/2020AZORultIntrusionDetectionRules/SignaturesYaraRules:https://malpedia.
caad.
fkie.
fraunhofer.
de/yara/win.
azorulthttps://github.
com/Yara-Rules/rules/blob/master/malware/MALW_AZORULT.
yarhttps://malware.
lu/articles/2018/05/04/azorult-stealer.
htmlhttps://yoroi.
company/research/gootkit-unveiling-the-hidden-link-with-azorult/https://neonprimetime.
blogspot.
com/2019/02/malware-yara-rules.
htmlhttps://tccontre.
blogspot.
com/2019/01/interesting-azorult-mutex-name-that.
htmlSnortrules:https://www.
snort.
org/rule_docs/1-47339https://www.
snort.
org/rule_docs/1-49548https://snort.
org/rule_docs/1-4760213TLP:WHITE4/16/2020MitigationPractices:AZORultTheHHS405(d)ProgrampublishedtheHealthIndustryCybersecurityPractices(HICP),whichisafreeresourcethatidentifiesthetopfivecyberthreatsandthetenbestpracticestomitigatethem.
BelowarethepracticesfromHICPthatcanbeusedtomitigateAZORult.
14TLP:WHITEBackgroundinformationcanbefoundhere:https://www.
phe.
gov/Preparedness/planning/405d/Documents/HICP-Main-508.
pdfDEFENSE/MITIGATION/COUNTERMEASURE405(d)HICPREFERENCEProvidesocialengineeringandphishingtrainingtoemployees.
[10.
S.
A],[1.
M.
D]Developandmaintainpolicyonsuspiciouse-mailsforendusers;Ensuresuspiciouse-mailsarereported.
[10.
S.
A],[10.
M.
A]Ensureemailsoriginatingfromoutsidetheorganizationareautomaticallymarkedbeforereceived.
[1.
S.
A],[1.
M.
A]Applypatches/updatesimmediatelyafterrelease/testing;Develop/maintainpatchingprogramifnecessary.
[7.
S.
A],[7.
M.
D]ImplementIntrusionDetectionSystem(IDS);Keepsignaturesandrulesupdated.
[6.
S.
C],[6.
M.
C],[6.
L.
C]Implementspamfiltersattheemailgateways;Keepsignaturesandrulesupdated.
[1.
S.
A],[1.
M.
A]BlocksuspiciousIPaddressesatthefirewall;Keepfirewallrulesareupdated.
[6.
S.
A],[6.
M.
A],[6.
L.
E]Implementwhitelistingtechnologytoensurethatonlyauthorizedsoftwareisallowedtoexecute.
[2.
S.
A],[2.
M.
A],[2.
L.
E]Implementaccesscontrolbasedontheprincipalofleastprivilege.
[3.
S.
A],[3.
M.
A],[3.
L.
C]Implementandmaintainanti-malwaresolution.
[2.
S.
A],[2.
M.
A],[2.
L.
D]Conductsystemhardeningtoensureproperconfigurations.
[7.
S.
A],[7.
M.
D]DisabletheuseofSMBv1(andallothervulnerableservicesandprotocols)andrequireatleastSMBv2.
[7.
S.
A],[7.
M.
D]4/16/202015IndicatorsofCompromise:ThereareinstancesofobsoleteIOCsbeingreused,soanyorganizationattemptingtodefendthemselvesshouldconsiderallpossibilities.
NewIOCsareconstantlybeingreleased,especiallywithatoolasprominentandfrequentlyusedasAZORult.
Itisthereforeincumbentuponanyorganizationattemptingtodefendthemselvestoremainvigilant,maintainsituationalawarenessandbeeveronthelookoutfornewIOCstooperationalizeintheircyberdefenseinfrastructure.
AZORult:IndicatorsofCompromiseTLP:WHITEINDICATORTYPEDESCRIPTIONhttp://daticho.
ac[.
]ugDomainCommandandcontrolserverhttp://ravor.
ac[.
]ugDomainCommandandcontrolserverssl[.
admin[.
itybuy[.
itDomainCommandandcontrolserverhairpd[.
]com/stat/stella.
exeDomainMalwarestoragehairpd[.
]com/stat/sputik.
exeDomainMalwarestorageivanzakharov91[.
]example.
comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestoragehost.
colocrossing[.
]comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestorage185.
154.
21[.
]208IPaddressMalwarestorage192.
3.
179[.
]203IPaddressMalwarestorage08EB8F2E441C26443EB9ABE5A93CD942MD5Executable5B26880F80A00397BC379CAF5CADC564MD5ExecutableB0EC3E594D20B9D38CC8591BAFF0148BMD5ExecutableFE8938F0BAAF90516A90610F6E210484MD5Executable2274174ed24425f41362aa207168b491e6fb55cab208116070f91c049946097aMD5Executable6f51bf05c9fa30f3c7b6b581d4bbf0194d1725120b242972ca95c6ecc7eb79bcMD5Executablea75b318eb2ae6678fd15f252d6b33919203262eb59e08ac32928f8bad54ca612MD5Executable12791e14ba82d36d434e7c7c0b81c7975ce802a430724f134b7e0cce5a7bb185MD5Executable97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19MD5Executablef291c822ee0c5655b2900f1c8881e415MD5Executable4/16/2020ReferencesAnalyzinganAZORultAttack–EvasioninaCloakofMultipleLayershttps://blog.
minerva-labs.
com/analyzing-an-azorult-attack-evasion-in-a-cloak-of-multiple-layersSeamlessCampaignDeliversRamnitviaRIGEKat188.
225.
82.
158.
Follow-upMalwareisAZORultStealer.
https://malwarebreakdown.
com/2017/11/12/seamless-campaign-delivers-ramnit-via-rig-ek-at-188-225-82-158-follow-up-malware-is-azorult-stealer/TheSeamlessCampaignDropsRamnit.
Follow-upMalware:AZORultStealer,SmokeLoader,etc.
https://malwarebreakdown.
com/2017/07/24/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc/Let'sLearn:ReversingCredentialandPaymentCardInformationStealer'AZORultV2'https://www.
vkremez.
com/2017/07/lets-learn-reversing-credential-and.
htmlThreatActorsUsingLegitimatePayPalAccountsToDistributeChthonicBankingTrojanhttps://www.
proofpoint.
com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojanKasperskyThreats:TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/campaignAZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAMNewversionofAZORultstealerimprovesloadingfeatures,spreadsalongsideransomwareinnewcampaignhttps://www.
proofpoint.
com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongsideMalpedia:Azorulthttps://malpedia.
caad.
fkie.
fraunhofer.
de/details/win.
azorultcampaignTrendMicro:AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAM16TLP:WHITE4/16/2020ReferencesMaliciouscoronavirusmaphidesAZORultinfo-stealingmalwarehttps://www.
scmagazine.
com/home/security-news/news-archive/coronavirus/malicious-coronavirus-map-hides-azorult-info-stealing-malware/Battlingonlinecoronavirusscamswithfactshttps://blog.
malwarebytes.
com/social-engineering/2020/02/battling-online-coronavirus-scams-with-facts/AZORultCampaignAdoptsNovelTriple-EncryptionTechniquehttps://threatpost.
com/azorult-campaign-encryption-technique/152508/AZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AzorultTrojanStealsPasswordsWhileHidingasGoogleUpdatehttps://www.
bleepingcomputer.
com/news/security/azorult-trojan-steals-passwords-while-hiding-as-google-update/CBTAUThreatIntelligenceNotification:CommontoRussianUndergroundForums,AZORultAimstoConnecttoC&CServer,StealSensitiveDatahttps://www.
carbonblack.
com/2019/09/24/cb-tau-threat-intelligence-notification-common-to-russian-underground-forums-azorult-aims-to-connect-to-cc-server-steal-sensitive-data/AZORultMalwareAbusingRDPProtocolToStealtheDatabyEstablishaRemoteDesktopConnectionhttps://gbhackers.
com/azorult-malware-abusing-rdp-protocol/ReverseEngineering,MalwareDeepInsighthttps://vk-intel.
org/2017/07/Azorultloaderstageshttps://maxkersten.
nl/binary-analysis-course/malware-analysis/azorult-loader-stages/MITRE:AZORulthttps://attack.
mitre.
org/software/S0344/AZORULTVERSION2:ATROCIOUSSPYWAREINFECTIONUSING3IN1RTFDOCUMENThttps://cysinfo.
com/azorult-version-2-atrocious-spyware-infection-using-3-1-rtf-document/AZORult++:Rewritinghistoryhttps://securelist.
com/azorult-analysis-history/89922/TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/17TLP:WHITE4/16/2020QuestionsUpcomingBriefsCOVID-19CyberThreatsThreatModellingforMobileHealthSystemsProductEvaluationsRecipientsofthisandotherHealthcareSectorCybersecurityCoordinationCenter(HC3)ThreatIntelligenceproductsarehighlyencouragedtoprovidefeedbacktoHC3@HHS.
GOV.
RequestsforInformationNeedinformationonaspecificcybersecuritytopicSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
18TLP:WHITE4/16/202019HealthSectorCybersecurityCoordinationCenter(HC3)BackgroundHC3workswithprivateandpublicsectorpartnerstoimprovecybersecuritythroughouttheHealthcareandPublicHealth(HPH)SectorSector&VictimNotificationsWhitePapersDirectedcommunicationstovictimsorpotentialvictimsofcompromises,vulnerableequipmentorPII/PHItheftandgeneralnotificationstotheHPHaboutcurrentlyimpactingthreatsviatheHHSOIGDocumentthatprovidesin-depthinformationonacybersecuritytopictoincreasecomprehensivesituationalawarenessandprovideriskrecommendationstoawideaudience.
ThreatBriefings&WebinarBriefingdocumentandpresentationthatprovidesactionableinformationonhealthsectorcybersecuritythreatsandmitigations.
Analystspresentcurrentcybersecuritytopics,engageindiscussionswithparticipantsoncurrentthreats,andhighlightbestpracticesandmitigationtactics.
NeedinformationonaspecificcybersecuritytopicorwanttojoinourlistservSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
Products4/21/2020
- T1105kaspersky.com相关文档
- unsecurekaspersky.com
- executingkaspersky.com
- Botnetzeskaspersky.com
- serviceskaspersky.com
- rulekaspersky.com
- lysiskaspersky.com
TTcloud：日本独立服务器促销活动,价格$70/月起,季付送10Mbps带宽
ttcloud怎么样?ttcloud是一家海外服务器厂商，运营服务器已经有10年时间，公司注册地址在香港地区，业务范围包括服务器托管，机柜托管，独立服务器等在内的多种服务。我们后台工单支持英文和中文服务。TTcloud最近推出了新上架的日本独立服务器促销活动，价格 $70/月起，季付送10Mbps带宽。也可以跟进客户的需求进行各种DIY定制。点击进入：ttcloud官方网站地址TTcloud拥有自...
月神科技：香港CN2/洛杉矶CN2/华中电信高防vps，月付20元起
月神科技怎么样?月神科技是由江西月神科技有限公司运营的一家自营云产品的IDC服务商，提供香港安畅、香港沙田、美国CERA、华中电信等机房资源，月神科技有自己的用户群和拥有创宇认证，并且也有电商企业将业务架设在月神科技的平台上。目前，香港CN2云服务器、洛杉矶CN2云主机、华中电信高防vps，月付20元起。点击进入：月神科技官方网站地址月神科技vps优惠信息：香港安畅CN2-GIA低至20元核心：2...
41云，服务器8折优惠券，200G TCP防御
41云怎么样?41云是国人主机品牌，目前经营产品有国内外云服务器、CDN(高防CDN)和物理机，其中国内外云服务器又细分小类有香港限流量VPS、香港大带宽VPS、香港弹性自选VPS、香港不限流VPS、香港BGP线路VPS、香港Cera+大带宽机器、美国超防VPS、韩国原生VPS、仁川原生VPS、日本CN2 VPS、枣庄高防VPS和金华高防VPS;物理机有美国Cera服务器、香港单程CN2服务器、香...
kaspersky.com为你推荐
-
摩根币JPM摩根币是什么？怎么赚钱是骗人的吗？微信回应封杀钉钉微信永久封号了！求大神们指点下怎么解封啊！老虎数码86年属虎的吉祥数字和求财方向关键字编程中，什么是关键字关键字关键词编故事关键字什么叫关键词刘祚天DJ是什么职业？刘祚天DJ这个职业怎么样？比肩工场比肩之意是什么意思www.jjwxc.net有那个网站可以看书？