T1105kaspersky.com
kaspersky.com 时间:2021-03-23 阅读:()
AZORultMalwareOVERALLCLASSIFICATIONISTLP:WHITETLP:WHITE04/16/2020Report#:202004161000AgendaIntroductionAttackvectorsFunctionalityoverviewMappingagainsttheMITREATT&CKFrameworkInfectionandCompromiseOriginationofAttacksFakeCoronavirusmapTripleEncryptionPersistenceIntrusionDetectionRules/SignaturesMitigationpracticesIndicatorsofCompromiseReferencesQuestions4/16/20202Non-Technical:managerial,strategicandhigh-level(generalaudience)Technical:Tactical/IOCs;requiringin-depthknowledge(sysadmins,IRT)SlidesKey:TLP:WHITEImagesource:NJCCICIntroductionAZORult–WhatisitMalware–InformationstealerandcryptocurrencytheftInitiallydetectedin2016whendroppedbytheChthonicbankingtrojanLatestversion:3.
2;UsedtotargetWindowsAKAPuffStealer,RuzaltoEasytooperate(userfriendly)Verycommon;SoldonRussianhackerforumsfor~$100Canbothbedroppedorserveasadropper(firstorsecondstage)Constantlychanging/evolvinginfectionvectorsandattackstagesandcapabilitiesEspeciallyrelevantduringtheCoronaviruspandemicUsedinCoronavirus-themedattacks3TLP:WHITEImagesource:BleepingComputer4/16/2020AZORult–AttackVectorsHowisAZORultdeliveredCommon:ExploitKits(especiallyFalloutExploitKit)OthermalwarethatactsasadropperRamnitEmotetPhishingMalspamInfectedwebsitesMalvertisementsFakeinstallersOnoccasion:.
isofileRemoteDesktopProtocol(RDP)exploitation4TLP:WHITEImagesource:AdAstraGames4/16/2020AZORult–FunctionalityoverviewAZORultpossessesthefollowingcapabilities:Steals:SystemlogincredentialsSystemreconnaissanceinfo(GUID,systemarchitectureandlanguage,usernameandcomputername,operatingsystemversion,systemIPaddressCryptocurrencywalletsMonero,uCoin,andbitcoincryptocurrenciesElectrum,Electrum-LTC,Ethereum,Exodus,JaxxandMistwalletsSteamandTelegramcredentials;SkypechathistoryandcredentialsPaymentcardnumbersCookiesandothersensitivebrowser-baseddata(especiallyautofill)DataExfiltration/CommunicationPushestoacommand-and-controlserver.
ScreenshotsExecutesfilesviaremotebackdoorcommands5TLP:WHITEImagesource:LinkedIn4/16/2020MappingAZORultagainsttheMITREATT&CKFrameworkMITREATT&CKTechniquesusedbyAZORult:6TLP:WHITEDomainIDNameUseEnterpriseT1134AccessTokenManipulationAZORultcancallWTSQueryUserTokenandCreateProcessAsUsertostartanewprocesswithlocalsystemprivileges.
EnterpriseT1503CredentialsfromWebBrowsersAZORultcanstealcredentialsfromthevictim'sbrowser.
EnterpriseT1081CredentialsinFilesAZORultcanstealcredentialsinfilesbelongingtocommonsoftwaresuchasSkype,Telegram,andSteam.
EnterpriseT1140Deobfuscate/DecodeFilesorInformationAZORultusesanXORkeytodecryptcontentandusesBase64todecodetheC2address.
EnterpriseT1083FileandDirectoryDiscoveryAZORultcanrecursivelysearchforfilesinfoldersandcollectsfilesfromthedesktopwithcertainextensions.
EnterpriseT1107FileDeletionAZORultcandeletefilesfromvictimmachines.
EnterpriseT1057ProcessDiscoveryAZORultcancollectalistofrunningprocessesbycallingCreateToolhelp32Snapshot.
EnterpriseT1093ProcessHollowingAZORultcandecryptthepayloadintomemory,createanewsuspendedprocessofitself,theninjectadecryptedpayloadtothenewprocessandresumenewprocessexecution.
EnterpriseT1012QueryRegistryAZORultcancheckforinstalledsoftwareonthesystemundertheRegistrykeySoftware\Microsoft\Windows\CurrentVersion\Uninstall.
EnterpriseT1105RemoteFileCopyAZORultcandownloadandexecuteadditionalfiles.
AzorulthasalsodownloadedaransomwarepayloadcalledHermes.
EnterpriseT1113ScreenCaptureAZORultcancapturescreenshotsofthevictim'smachines.
EnterpriseT1032StandardCryptographicProtocolAZORultcanencryptC2trafficusingXOR.
EnterpriseT1082SystemInformationDiscoveryAZORultcancollectthemachineinformation,systemarchitecture,theOSversion,computername,Windowsproductname,thenumberofCPUcores,videocardinformation,andthesystemlanguage.
EnterpriseT1016SystemNetworkConfigurationDiscoveryAZORultcancollecthostIPinformationfromthevictim'smachine.
EnterpriseT1033SystemOwner/UserDiscoveryAZORultcancollecttheusernamefromthevictim'smachine.
EnterpriseT1124SystemTimeDiscoveryAZORultcancollectthetimezoneinformationfromthesystem.
Source:https://attack.
mitre.
org/software/S0344/4/16/2020AZORult–InfectionandcompromiseExampleattack:InfectionvectorExecutionPersistenceReconnaissanceExfiltration7TLP:WHITEImagesource:TrendMicro4/16/2020AZORult–OriginationofattacksGeographicaldistributionofAZORultattacks:December2017throughDecember20188TLP:WHITEDataandimagesource:Kaspersky4/16/2020RecentAZORultusage–FakeCoronavirusmapFakeCoronavirustrackingmapdropsAZORultonvictimsystems:9TLP:WHITE4/16/2020LegitimateJohnsHopkinsCoronavirusMapLegitimatemap:10TLP:WHITE4/16/2020RecentAZORulttechnique–tripleencryptionObservedinaFebruary2020phishingcampaign:11TLP:WHITEDataandimagesource:ThreatPost4/16/2020AZORult-PersistenceAZORultcanestablishpersistence:InstallstandardbackdoorsCreateshiddenadminaccounttosetregistrykeytoestablishRemoteDesktopProtocol(RDP)connectionCamouflagesaslegitimateapplication(registryandscheduledtasks)SeeexampleoffakeGoogleupdatebinarybelowwhichcontainedAZORulttrojan:12TLP:WHITEImagesource:BleepingComputer4/16/2020AZORultIntrusionDetectionRules/SignaturesYaraRules:https://malpedia.
caad.
fkie.
fraunhofer.
de/yara/win.
azorulthttps://github.
com/Yara-Rules/rules/blob/master/malware/MALW_AZORULT.
yarhttps://malware.
lu/articles/2018/05/04/azorult-stealer.
htmlhttps://yoroi.
company/research/gootkit-unveiling-the-hidden-link-with-azorult/https://neonprimetime.
blogspot.
com/2019/02/malware-yara-rules.
htmlhttps://tccontre.
blogspot.
com/2019/01/interesting-azorult-mutex-name-that.
htmlSnortrules:https://www.
snort.
org/rule_docs/1-47339https://www.
snort.
org/rule_docs/1-49548https://snort.
org/rule_docs/1-4760213TLP:WHITE4/16/2020MitigationPractices:AZORultTheHHS405(d)ProgrampublishedtheHealthIndustryCybersecurityPractices(HICP),whichisafreeresourcethatidentifiesthetopfivecyberthreatsandthetenbestpracticestomitigatethem.
BelowarethepracticesfromHICPthatcanbeusedtomitigateAZORult.
14TLP:WHITEBackgroundinformationcanbefoundhere:https://www.
phe.
gov/Preparedness/planning/405d/Documents/HICP-Main-508.
pdfDEFENSE/MITIGATION/COUNTERMEASURE405(d)HICPREFERENCEProvidesocialengineeringandphishingtrainingtoemployees.
[10.
S.
A],[1.
M.
D]Developandmaintainpolicyonsuspiciouse-mailsforendusers;Ensuresuspiciouse-mailsarereported.
[10.
S.
A],[10.
M.
A]Ensureemailsoriginatingfromoutsidetheorganizationareautomaticallymarkedbeforereceived.
[1.
S.
A],[1.
M.
A]Applypatches/updatesimmediatelyafterrelease/testing;Develop/maintainpatchingprogramifnecessary.
[7.
S.
A],[7.
M.
D]ImplementIntrusionDetectionSystem(IDS);Keepsignaturesandrulesupdated.
[6.
S.
C],[6.
M.
C],[6.
L.
C]Implementspamfiltersattheemailgateways;Keepsignaturesandrulesupdated.
[1.
S.
A],[1.
M.
A]BlocksuspiciousIPaddressesatthefirewall;Keepfirewallrulesareupdated.
[6.
S.
A],[6.
M.
A],[6.
L.
E]Implementwhitelistingtechnologytoensurethatonlyauthorizedsoftwareisallowedtoexecute.
[2.
S.
A],[2.
M.
A],[2.
L.
E]Implementaccesscontrolbasedontheprincipalofleastprivilege.
[3.
S.
A],[3.
M.
A],[3.
L.
C]Implementandmaintainanti-malwaresolution.
[2.
S.
A],[2.
M.
A],[2.
L.
D]Conductsystemhardeningtoensureproperconfigurations.
[7.
S.
A],[7.
M.
D]DisabletheuseofSMBv1(andallothervulnerableservicesandprotocols)andrequireatleastSMBv2.
[7.
S.
A],[7.
M.
D]4/16/202015IndicatorsofCompromise:ThereareinstancesofobsoleteIOCsbeingreused,soanyorganizationattemptingtodefendthemselvesshouldconsiderallpossibilities.
NewIOCsareconstantlybeingreleased,especiallywithatoolasprominentandfrequentlyusedasAZORult.
Itisthereforeincumbentuponanyorganizationattemptingtodefendthemselvestoremainvigilant,maintainsituationalawarenessandbeeveronthelookoutfornewIOCstooperationalizeintheircyberdefenseinfrastructure.
AZORult:IndicatorsofCompromiseTLP:WHITEINDICATORTYPEDESCRIPTIONhttp://daticho.
ac[.
]ugDomainCommandandcontrolserverhttp://ravor.
ac[.
]ugDomainCommandandcontrolserverssl[.
admin[.
itybuy[.
itDomainCommandandcontrolserverhairpd[.
]com/stat/stella.
exeDomainMalwarestoragehairpd[.
]com/stat/sputik.
exeDomainMalwarestorageivanzakharov91[.
]example.
comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestoragehost.
colocrossing[.
]comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestorage185.
154.
21[.
]208IPaddressMalwarestorage192.
3.
179[.
]203IPaddressMalwarestorage08EB8F2E441C26443EB9ABE5A93CD942MD5Executable5B26880F80A00397BC379CAF5CADC564MD5ExecutableB0EC3E594D20B9D38CC8591BAFF0148BMD5ExecutableFE8938F0BAAF90516A90610F6E210484MD5Executable2274174ed24425f41362aa207168b491e6fb55cab208116070f91c049946097aMD5Executable6f51bf05c9fa30f3c7b6b581d4bbf0194d1725120b242972ca95c6ecc7eb79bcMD5Executablea75b318eb2ae6678fd15f252d6b33919203262eb59e08ac32928f8bad54ca612MD5Executable12791e14ba82d36d434e7c7c0b81c7975ce802a430724f134b7e0cce5a7bb185MD5Executable97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19MD5Executablef291c822ee0c5655b2900f1c8881e415MD5Executable4/16/2020ReferencesAnalyzinganAZORultAttack–EvasioninaCloakofMultipleLayershttps://blog.
minerva-labs.
com/analyzing-an-azorult-attack-evasion-in-a-cloak-of-multiple-layersSeamlessCampaignDeliversRamnitviaRIGEKat188.
225.
82.
158.
Follow-upMalwareisAZORultStealer.
https://malwarebreakdown.
com/2017/11/12/seamless-campaign-delivers-ramnit-via-rig-ek-at-188-225-82-158-follow-up-malware-is-azorult-stealer/TheSeamlessCampaignDropsRamnit.
Follow-upMalware:AZORultStealer,SmokeLoader,etc.
https://malwarebreakdown.
com/2017/07/24/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc/Let'sLearn:ReversingCredentialandPaymentCardInformationStealer'AZORultV2'https://www.
vkremez.
com/2017/07/lets-learn-reversing-credential-and.
htmlThreatActorsUsingLegitimatePayPalAccountsToDistributeChthonicBankingTrojanhttps://www.
proofpoint.
com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojanKasperskyThreats:TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/campaignAZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAMNewversionofAZORultstealerimprovesloadingfeatures,spreadsalongsideransomwareinnewcampaignhttps://www.
proofpoint.
com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongsideMalpedia:Azorulthttps://malpedia.
caad.
fkie.
fraunhofer.
de/details/win.
azorultcampaignTrendMicro:AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAM16TLP:WHITE4/16/2020ReferencesMaliciouscoronavirusmaphidesAZORultinfo-stealingmalwarehttps://www.
scmagazine.
com/home/security-news/news-archive/coronavirus/malicious-coronavirus-map-hides-azorult-info-stealing-malware/Battlingonlinecoronavirusscamswithfactshttps://blog.
malwarebytes.
com/social-engineering/2020/02/battling-online-coronavirus-scams-with-facts/AZORultCampaignAdoptsNovelTriple-EncryptionTechniquehttps://threatpost.
com/azorult-campaign-encryption-technique/152508/AZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AzorultTrojanStealsPasswordsWhileHidingasGoogleUpdatehttps://www.
bleepingcomputer.
com/news/security/azorult-trojan-steals-passwords-while-hiding-as-google-update/CBTAUThreatIntelligenceNotification:CommontoRussianUndergroundForums,AZORultAimstoConnecttoC&CServer,StealSensitiveDatahttps://www.
carbonblack.
com/2019/09/24/cb-tau-threat-intelligence-notification-common-to-russian-underground-forums-azorult-aims-to-connect-to-cc-server-steal-sensitive-data/AZORultMalwareAbusingRDPProtocolToStealtheDatabyEstablishaRemoteDesktopConnectionhttps://gbhackers.
com/azorult-malware-abusing-rdp-protocol/ReverseEngineering,MalwareDeepInsighthttps://vk-intel.
org/2017/07/Azorultloaderstageshttps://maxkersten.
nl/binary-analysis-course/malware-analysis/azorult-loader-stages/MITRE:AZORulthttps://attack.
mitre.
org/software/S0344/AZORULTVERSION2:ATROCIOUSSPYWAREINFECTIONUSING3IN1RTFDOCUMENThttps://cysinfo.
com/azorult-version-2-atrocious-spyware-infection-using-3-1-rtf-document/AZORult++:Rewritinghistoryhttps://securelist.
com/azorult-analysis-history/89922/TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/17TLP:WHITE4/16/2020QuestionsUpcomingBriefsCOVID-19CyberThreatsThreatModellingforMobileHealthSystemsProductEvaluationsRecipientsofthisandotherHealthcareSectorCybersecurityCoordinationCenter(HC3)ThreatIntelligenceproductsarehighlyencouragedtoprovidefeedbacktoHC3@HHS.
GOV.
RequestsforInformationNeedinformationonaspecificcybersecuritytopicSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
18TLP:WHITE4/16/202019HealthSectorCybersecurityCoordinationCenter(HC3)BackgroundHC3workswithprivateandpublicsectorpartnerstoimprovecybersecuritythroughouttheHealthcareandPublicHealth(HPH)SectorSector&VictimNotificationsWhitePapersDirectedcommunicationstovictimsorpotentialvictimsofcompromises,vulnerableequipmentorPII/PHItheftandgeneralnotificationstotheHPHaboutcurrentlyimpactingthreatsviatheHHSOIGDocumentthatprovidesin-depthinformationonacybersecuritytopictoincreasecomprehensivesituationalawarenessandprovideriskrecommendationstoawideaudience.
ThreatBriefings&WebinarBriefingdocumentandpresentationthatprovidesactionableinformationonhealthsectorcybersecuritythreatsandmitigations.
Analystspresentcurrentcybersecuritytopics,engageindiscussionswithparticipantsoncurrentthreats,andhighlightbestpracticesandmitigationtactics.
NeedinformationonaspecificcybersecuritytopicorwanttojoinourlistservSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
Products4/21/2020
2;UsedtotargetWindowsAKAPuffStealer,RuzaltoEasytooperate(userfriendly)Verycommon;SoldonRussianhackerforumsfor~$100Canbothbedroppedorserveasadropper(firstorsecondstage)Constantlychanging/evolvinginfectionvectorsandattackstagesandcapabilitiesEspeciallyrelevantduringtheCoronaviruspandemicUsedinCoronavirus-themedattacks3TLP:WHITEImagesource:BleepingComputer4/16/2020AZORult–AttackVectorsHowisAZORultdeliveredCommon:ExploitKits(especiallyFalloutExploitKit)OthermalwarethatactsasadropperRamnitEmotetPhishingMalspamInfectedwebsitesMalvertisementsFakeinstallersOnoccasion:.
isofileRemoteDesktopProtocol(RDP)exploitation4TLP:WHITEImagesource:AdAstraGames4/16/2020AZORult–FunctionalityoverviewAZORultpossessesthefollowingcapabilities:Steals:SystemlogincredentialsSystemreconnaissanceinfo(GUID,systemarchitectureandlanguage,usernameandcomputername,operatingsystemversion,systemIPaddressCryptocurrencywalletsMonero,uCoin,andbitcoincryptocurrenciesElectrum,Electrum-LTC,Ethereum,Exodus,JaxxandMistwalletsSteamandTelegramcredentials;SkypechathistoryandcredentialsPaymentcardnumbersCookiesandothersensitivebrowser-baseddata(especiallyautofill)DataExfiltration/CommunicationPushestoacommand-and-controlserver.
ScreenshotsExecutesfilesviaremotebackdoorcommands5TLP:WHITEImagesource:LinkedIn4/16/2020MappingAZORultagainsttheMITREATT&CKFrameworkMITREATT&CKTechniquesusedbyAZORult:6TLP:WHITEDomainIDNameUseEnterpriseT1134AccessTokenManipulationAZORultcancallWTSQueryUserTokenandCreateProcessAsUsertostartanewprocesswithlocalsystemprivileges.
EnterpriseT1503CredentialsfromWebBrowsersAZORultcanstealcredentialsfromthevictim'sbrowser.
EnterpriseT1081CredentialsinFilesAZORultcanstealcredentialsinfilesbelongingtocommonsoftwaresuchasSkype,Telegram,andSteam.
EnterpriseT1140Deobfuscate/DecodeFilesorInformationAZORultusesanXORkeytodecryptcontentandusesBase64todecodetheC2address.
EnterpriseT1083FileandDirectoryDiscoveryAZORultcanrecursivelysearchforfilesinfoldersandcollectsfilesfromthedesktopwithcertainextensions.
EnterpriseT1107FileDeletionAZORultcandeletefilesfromvictimmachines.
EnterpriseT1057ProcessDiscoveryAZORultcancollectalistofrunningprocessesbycallingCreateToolhelp32Snapshot.
EnterpriseT1093ProcessHollowingAZORultcandecryptthepayloadintomemory,createanewsuspendedprocessofitself,theninjectadecryptedpayloadtothenewprocessandresumenewprocessexecution.
EnterpriseT1012QueryRegistryAZORultcancheckforinstalledsoftwareonthesystemundertheRegistrykeySoftware\Microsoft\Windows\CurrentVersion\Uninstall.
EnterpriseT1105RemoteFileCopyAZORultcandownloadandexecuteadditionalfiles.
AzorulthasalsodownloadedaransomwarepayloadcalledHermes.
EnterpriseT1113ScreenCaptureAZORultcancapturescreenshotsofthevictim'smachines.
EnterpriseT1032StandardCryptographicProtocolAZORultcanencryptC2trafficusingXOR.
EnterpriseT1082SystemInformationDiscoveryAZORultcancollectthemachineinformation,systemarchitecture,theOSversion,computername,Windowsproductname,thenumberofCPUcores,videocardinformation,andthesystemlanguage.
EnterpriseT1016SystemNetworkConfigurationDiscoveryAZORultcancollecthostIPinformationfromthevictim'smachine.
EnterpriseT1033SystemOwner/UserDiscoveryAZORultcancollecttheusernamefromthevictim'smachine.
EnterpriseT1124SystemTimeDiscoveryAZORultcancollectthetimezoneinformationfromthesystem.
Source:https://attack.
mitre.
org/software/S0344/4/16/2020AZORult–InfectionandcompromiseExampleattack:InfectionvectorExecutionPersistenceReconnaissanceExfiltration7TLP:WHITEImagesource:TrendMicro4/16/2020AZORult–OriginationofattacksGeographicaldistributionofAZORultattacks:December2017throughDecember20188TLP:WHITEDataandimagesource:Kaspersky4/16/2020RecentAZORultusage–FakeCoronavirusmapFakeCoronavirustrackingmapdropsAZORultonvictimsystems:9TLP:WHITE4/16/2020LegitimateJohnsHopkinsCoronavirusMapLegitimatemap:10TLP:WHITE4/16/2020RecentAZORulttechnique–tripleencryptionObservedinaFebruary2020phishingcampaign:11TLP:WHITEDataandimagesource:ThreatPost4/16/2020AZORult-PersistenceAZORultcanestablishpersistence:InstallstandardbackdoorsCreateshiddenadminaccounttosetregistrykeytoestablishRemoteDesktopProtocol(RDP)connectionCamouflagesaslegitimateapplication(registryandscheduledtasks)SeeexampleoffakeGoogleupdatebinarybelowwhichcontainedAZORulttrojan:12TLP:WHITEImagesource:BleepingComputer4/16/2020AZORultIntrusionDetectionRules/SignaturesYaraRules:https://malpedia.
caad.
fkie.
fraunhofer.
de/yara/win.
azorulthttps://github.
com/Yara-Rules/rules/blob/master/malware/MALW_AZORULT.
yarhttps://malware.
lu/articles/2018/05/04/azorult-stealer.
htmlhttps://yoroi.
company/research/gootkit-unveiling-the-hidden-link-with-azorult/https://neonprimetime.
blogspot.
com/2019/02/malware-yara-rules.
htmlhttps://tccontre.
blogspot.
com/2019/01/interesting-azorult-mutex-name-that.
htmlSnortrules:https://www.
snort.
org/rule_docs/1-47339https://www.
snort.
org/rule_docs/1-49548https://snort.
org/rule_docs/1-4760213TLP:WHITE4/16/2020MitigationPractices:AZORultTheHHS405(d)ProgrampublishedtheHealthIndustryCybersecurityPractices(HICP),whichisafreeresourcethatidentifiesthetopfivecyberthreatsandthetenbestpracticestomitigatethem.
BelowarethepracticesfromHICPthatcanbeusedtomitigateAZORult.
14TLP:WHITEBackgroundinformationcanbefoundhere:https://www.
phe.
gov/Preparedness/planning/405d/Documents/HICP-Main-508.
pdfDEFENSE/MITIGATION/COUNTERMEASURE405(d)HICPREFERENCEProvidesocialengineeringandphishingtrainingtoemployees.
[10.
S.
A],[1.
M.
D]Developandmaintainpolicyonsuspiciouse-mailsforendusers;Ensuresuspiciouse-mailsarereported.
[10.
S.
A],[10.
M.
A]Ensureemailsoriginatingfromoutsidetheorganizationareautomaticallymarkedbeforereceived.
[1.
S.
A],[1.
M.
A]Applypatches/updatesimmediatelyafterrelease/testing;Develop/maintainpatchingprogramifnecessary.
[7.
S.
A],[7.
M.
D]ImplementIntrusionDetectionSystem(IDS);Keepsignaturesandrulesupdated.
[6.
S.
C],[6.
M.
C],[6.
L.
C]Implementspamfiltersattheemailgateways;Keepsignaturesandrulesupdated.
[1.
S.
A],[1.
M.
A]BlocksuspiciousIPaddressesatthefirewall;Keepfirewallrulesareupdated.
[6.
S.
A],[6.
M.
A],[6.
L.
E]Implementwhitelistingtechnologytoensurethatonlyauthorizedsoftwareisallowedtoexecute.
[2.
S.
A],[2.
M.
A],[2.
L.
E]Implementaccesscontrolbasedontheprincipalofleastprivilege.
[3.
S.
A],[3.
M.
A],[3.
L.
C]Implementandmaintainanti-malwaresolution.
[2.
S.
A],[2.
M.
A],[2.
L.
D]Conductsystemhardeningtoensureproperconfigurations.
[7.
S.
A],[7.
M.
D]DisabletheuseofSMBv1(andallothervulnerableservicesandprotocols)andrequireatleastSMBv2.
[7.
S.
A],[7.
M.
D]4/16/202015IndicatorsofCompromise:ThereareinstancesofobsoleteIOCsbeingreused,soanyorganizationattemptingtodefendthemselvesshouldconsiderallpossibilities.
NewIOCsareconstantlybeingreleased,especiallywithatoolasprominentandfrequentlyusedasAZORult.
Itisthereforeincumbentuponanyorganizationattemptingtodefendthemselvestoremainvigilant,maintainsituationalawarenessandbeeveronthelookoutfornewIOCstooperationalizeintheircyberdefenseinfrastructure.
AZORult:IndicatorsofCompromiseTLP:WHITEINDICATORTYPEDESCRIPTIONhttp://daticho.
ac[.
]ugDomainCommandandcontrolserverhttp://ravor.
ac[.
]ugDomainCommandandcontrolserverssl[.
admin[.
itybuy[.
itDomainCommandandcontrolserverhairpd[.
]com/stat/stella.
exeDomainMalwarestoragehairpd[.
]com/stat/sputik.
exeDomainMalwarestorageivanzakharov91[.
]example.
comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestoragehost.
colocrossing[.
]comDomainMalwarestorageDriverconnectsearch[.
]infoDomainMalwarestorage185.
154.
21[.
]208IPaddressMalwarestorage192.
3.
179[.
]203IPaddressMalwarestorage08EB8F2E441C26443EB9ABE5A93CD942MD5Executable5B26880F80A00397BC379CAF5CADC564MD5ExecutableB0EC3E594D20B9D38CC8591BAFF0148BMD5ExecutableFE8938F0BAAF90516A90610F6E210484MD5Executable2274174ed24425f41362aa207168b491e6fb55cab208116070f91c049946097aMD5Executable6f51bf05c9fa30f3c7b6b581d4bbf0194d1725120b242972ca95c6ecc7eb79bcMD5Executablea75b318eb2ae6678fd15f252d6b33919203262eb59e08ac32928f8bad54ca612MD5Executable12791e14ba82d36d434e7c7c0b81c7975ce802a430724f134b7e0cce5a7bb185MD5Executable97c016bab36a85ca830376ec48c7e70ee25edbb55f626aee6219ade7468cee19MD5Executablef291c822ee0c5655b2900f1c8881e415MD5Executable4/16/2020ReferencesAnalyzinganAZORultAttack–EvasioninaCloakofMultipleLayershttps://blog.
minerva-labs.
com/analyzing-an-azorult-attack-evasion-in-a-cloak-of-multiple-layersSeamlessCampaignDeliversRamnitviaRIGEKat188.
225.
82.
158.
Follow-upMalwareisAZORultStealer.
https://malwarebreakdown.
com/2017/11/12/seamless-campaign-delivers-ramnit-via-rig-ek-at-188-225-82-158-follow-up-malware-is-azorult-stealer/TheSeamlessCampaignDropsRamnit.
Follow-upMalware:AZORultStealer,SmokeLoader,etc.
https://malwarebreakdown.
com/2017/07/24/the-seamless-campaign-drops-ramnit-follow-up-malware-azorult-stealer-smoke-loader-etc/Let'sLearn:ReversingCredentialandPaymentCardInformationStealer'AZORultV2'https://www.
vkremez.
com/2017/07/lets-learn-reversing-credential-and.
htmlThreatActorsUsingLegitimatePayPalAccountsToDistributeChthonicBankingTrojanhttps://www.
proofpoint.
com/us/threat-insight/post/threat-actors-using-legitimate-paypal-accounts-to-distribute-chthonic-banking-trojanKasperskyThreats:TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/campaignAZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAMNewversionofAZORultstealerimprovesloadingfeatures,spreadsalongsideransomwareinnewcampaignhttps://www.
proofpoint.
com/us/threat-insight/post/new-version-azorult-stealer-improves-loading-features-spreads-alongsideMalpedia:Azorulthttps://malpedia.
caad.
fkie.
fraunhofer.
de/details/win.
azorultcampaignTrendMicro:AZORULTMalwareInformationhttps://success.
trendmicro.
com/solution/000146108-azorult-malware-information-kAJ4P000000kEK2WAM16TLP:WHITE4/16/2020ReferencesMaliciouscoronavirusmaphidesAZORultinfo-stealingmalwarehttps://www.
scmagazine.
com/home/security-news/news-archive/coronavirus/malicious-coronavirus-map-hides-azorult-info-stealing-malware/Battlingonlinecoronavirusscamswithfactshttps://blog.
malwarebytes.
com/social-engineering/2020/02/battling-online-coronavirus-scams-with-facts/AZORultCampaignAdoptsNovelTriple-EncryptionTechniquehttps://threatpost.
com/azorult-campaign-encryption-technique/152508/AZORultTrojanUsesFakeProtonVPNInstallertoDisguiseAttackshttps://securityintelligence.
com/news/azorult-trojan-uses-fake-protonvpn-installer-to-disguise-attacks/AzorultTrojanStealsPasswordsWhileHidingasGoogleUpdatehttps://www.
bleepingcomputer.
com/news/security/azorult-trojan-steals-passwords-while-hiding-as-google-update/CBTAUThreatIntelligenceNotification:CommontoRussianUndergroundForums,AZORultAimstoConnecttoC&CServer,StealSensitiveDatahttps://www.
carbonblack.
com/2019/09/24/cb-tau-threat-intelligence-notification-common-to-russian-underground-forums-azorult-aims-to-connect-to-cc-server-steal-sensitive-data/AZORultMalwareAbusingRDPProtocolToStealtheDatabyEstablishaRemoteDesktopConnectionhttps://gbhackers.
com/azorult-malware-abusing-rdp-protocol/ReverseEngineering,MalwareDeepInsighthttps://vk-intel.
org/2017/07/Azorultloaderstageshttps://maxkersten.
nl/binary-analysis-course/malware-analysis/azorult-loader-stages/MITRE:AZORulthttps://attack.
mitre.
org/software/S0344/AZORULTVERSION2:ATROCIOUSSPYWAREINFECTIONUSING3IN1RTFDOCUMENThttps://cysinfo.
com/azorult-version-2-atrocious-spyware-infection-using-3-1-rtf-document/AZORult++:Rewritinghistoryhttps://securelist.
com/azorult-analysis-history/89922/TROJAN-PSW.
WIN32.
AZORULThttps://threats.
kaspersky.
com/en/threat/Trojan-PSW.
Win32.
Azorult/17TLP:WHITE4/16/2020QuestionsUpcomingBriefsCOVID-19CyberThreatsThreatModellingforMobileHealthSystemsProductEvaluationsRecipientsofthisandotherHealthcareSectorCybersecurityCoordinationCenter(HC3)ThreatIntelligenceproductsarehighlyencouragedtoprovidefeedbacktoHC3@HHS.
GOV.
RequestsforInformationNeedinformationonaspecificcybersecuritytopicSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
18TLP:WHITE4/16/202019HealthSectorCybersecurityCoordinationCenter(HC3)BackgroundHC3workswithprivateandpublicsectorpartnerstoimprovecybersecuritythroughouttheHealthcareandPublicHealth(HPH)SectorSector&VictimNotificationsWhitePapersDirectedcommunicationstovictimsorpotentialvictimsofcompromises,vulnerableequipmentorPII/PHItheftandgeneralnotificationstotheHPHaboutcurrentlyimpactingthreatsviatheHHSOIGDocumentthatprovidesin-depthinformationonacybersecuritytopictoincreasecomprehensivesituationalawarenessandprovideriskrecommendationstoawideaudience.
ThreatBriefings&WebinarBriefingdocumentandpresentationthatprovidesactionableinformationonhealthsectorcybersecuritythreatsandmitigations.
Analystspresentcurrentcybersecuritytopics,engageindiscussionswithparticipantsoncurrentthreats,andhighlightbestpracticesandmitigationtactics.
NeedinformationonaspecificcybersecuritytopicorwanttojoinourlistservSendyourrequestforinformation(RFI)toHC3@HHS.
GOVorcallusMonday-Friday,between9am-5pm(EST),at(202)691-2110.
Products4/21/2020
- T1105kaspersky.com相关文档
- unsecurekaspersky.com
- executingkaspersky.com
- Botnetzeskaspersky.com
- serviceskaspersky.com
- rulekaspersky.com
- lysiskaspersky.com
ftlcloud9元/月，美国云服务器，1G内存/1核/20g硬盘/10M带宽不限/10G防御
ftlcloud(超云)目前正在搞暑假促销，美国圣何塞数据中心的云服务器低至9元/月，系统盘与数据盘分离，支持Windows和Linux，免费防御CC攻击，自带10Gbps的DDoS防御。FTL-超云服务器的主要特色：稳定、安全、弹性、高性能的云端计算服务，快速部署，并且可根据业务需要扩展计算能力，按需付费，节约成本，提高资源的有效利用率。活动地址：https://www.ftlcloud.com...
JUSTG提供俄罗斯和南非CN2 GIA主机年$49.99美元JUSTGgia南非cn2南非CN2justG
JUSTG，这个主机商第二个接触到，之前是有介绍到有提供俄罗斯CN2 GIA VPS主机活动的，商家成立时间不久看信息是2020年，公司隶属于一家叫AFRICA CLOUD LIMITED的公司，提供的产品为基于KVM架构VPS主机，数据中心在非洲（南非）、俄罗斯（莫斯科），国内访问双向CN2，线路质量不错。有很多服务商实际上都是国人背景的，有的用英文、繁体搭建的冒充老外，这个服务商不清楚是不是真...
无忧云（25元/月），国内BGP高防云服务器 2核2G5M
无忧云官网无忧云怎么样 无忧云服务器好不好 无忧云值不值得购买 无忧云，无忧云是一家成立于2017年的老牌商家旗下的服务器销售品牌，现由深圳市云上无忧网络科技有限公司运营，是正规持证IDC/ISP/IRCS商家，主要销售国内、中国香港、国外服务器产品，线路有腾讯云国外线路、自营香港CN2线路等，都是中国大陆直连线路，非常适合免北岸建站业务需求和各种负载较高的项目，同时国内服务器也有多个BGP以及高...
kaspersky.com为你推荐
-
微信回应封杀钉钉微信发过来的钉钉链接打不开？xyq.163.cbg.com梦幻CBG的网站是什么。www.765.com下载小说地址789se.com莫非现在的789mmm珍的com不管了www.baitu.com谁有免费的动漫网站？se9999se.comexol.smtown.com机器蜘蛛挑战或是生存Boss是一只巨型机器蜘蛛的第一人称射击游戏叫什么www.cn12365.org全国公民身份证号码查询服务中心(http://www.nciic.com.cn/)这个网站怎么查不了啊?www.mfav.org手机登录WWW.brcbc.org 能注册么网页源代码网页源代码是什么，具体讲一下？