MAR-10386789-1.v1 – Log4Shell

This report is provided "as is" for informational purposes only. The Departcenment of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Description

Since December 2021, multiple threat actor groups have exploited Log4Shell on unpatched, public-facing VMware Horizon and Unified Access Gateway (UAG) servers. From May through June 2022, CISA provided remote incident support at an organization where CISA observed suspected Log4Shell PowerShell downloads. During remote support, CISA confirmed the organization was compromised by malicious cyber actors who exploited Log4Shell in a VMware Horizon server that did not have patches or workarounds applied. CISA analyzed five malware samples obtained from the organization’s network: two malicious PowerShell files, two Extensible Markup Language (XML) files, and a 64-bit compiled Python Portable Executable (PE) file.



The two PowerShell files are Trojan downloaders designed to download malicious files from a command and control (C2) server and install them on the compromised system. One of the scripts also checks for and installs Nmap if it is not installed on the compromised system. The two XML files are for scheduling tasks for persistence. The 64-bit compiled Python PE file is designed to perform scans for IP addresses of live hosts, open ports, and services running on those hosts.

For more information on Log4Shell, see: 

• Joint CSA Malicious Cyber Actors Continue to Exploit Log4Shell in VMware Horizon Systems,
• CISA’s Apache Log4j Vulnerability Guidance webpage,
• Joint CSA Mitigating Log4Shell and Other Log4j-Related Vulnerabilities, and
• CISA’s database of known vulnerable services on the CISA GitHub page.

For a downloadable copy of IOCs, see: MAR-10386789-1.v1.stix.

Submitted Files (5)

1d459b9909adf98690635c62ea005009ede8eb9a665b8703fe2ad0b0c414816b (this.ps1)

4cdd06a36858ac32a09606bfecb54b517ad41a6aac1e37ca56bb1c193f8174cf (RuntimeService.exe)

76a2979d965d42f99558ca6ecd97734697249667291a3013d611e310a03f550e (ps.ps1)

c357879e2c1013dcf999bcdc65372eacf0895af4a4b4bad2b7d28108d3e7c46a (this.xml)

e3d2e6b5cd422de1be7e6aa830b91115d204ba5e87c77b6431f3313e0930a697 (that.xml)

Additional Files (8)

3b4d726bd366e7439367fa78a186dfa9b641d3b2ad354fd915581b6567480f94 (nmap.exe)

407d60626707baee29fb9f2597dd32cfd544ff46df7f76e51ff0b79b3ffce3f2 (this.xml)

42c844c62ad1b7ae1925973a9b6845b40d4f626a4895cba9ae9e3e3de3f7973a (n.zip)

6408217e10fac9f6549ffaaab328bcfeed4a7ebea71f3dcf60f6186e1b21b501 (that.xml)

817046c4fe89cd44dbb613cdac2f0c165e2b47d2b5245911ca6fabdda89d1691 (this.ps1)

b050749c87399f9978cc6eaea7d25405fc0d099a14c169f5c5f63b8b6ec98b0f (RuntimeService.exe)

e6bc8aa44233312058704b4d5954c45b4160841f470dd7f6d13c08940e61a7bb (ps.ps1)

fb833ecd1b1050304f364f879b8b1f7b7136e9c4a21aaf0a6c6b3f419e892d6d (elasticsearch.nse)

IPs (1)

66.70.238.65

1d459b9909adf98690635c62ea005009ede8eb9a665b8703fe2ad0b0c414816b

Tags

downloaderloadertrojan

Details

Antivirus

YARA Rules

• rule CISA_10386789_01 : downloader
  
  {
  
     meta:
  
         Author = "CISA Code & Media Analysis"
  
         Incident = "10386789"
  
         Date = "2022-06-08"
  
         Last_Modfied = "20220613_1130"
  
         Actor = "n/a"
  
         Category = "Downloader"
  
         Family = "n/a"
  
         Description = "Detects PowerShell downloader samples"
  
         MD5_1 = "8aedb094121903a3bfc3dade34f48126"
  
         SHA256_1 = "1d459b9909adf98690635c62ea005009ede8eb9a665b8703fe2ad0b0c414816b"
  
         MD5_2 = "1940ddb77882162f898bc3aae9c67d94"
  
         SHA256_2 = "817046c4fe89cd44dbb613cdac2f0c165e2b47d2b5245911ca6fabdda89d1691"
  
         MD5_3 = "84aadb11699f0c3ed062f484aa0a622e"
  
         SHA256_3 = "e6bc8aa44233312058704b4d5954c45b4160841f470dd7f6d13c08940e61a7bb"
  
         MD5_4 = "a439e7a030d52c8d31bf2c140ccf216b"
  
         SHA256_4 = "76a2979d965d42f99558ca6ecd97734697249667291a3013d611e310a03f550e"
  
     strings:
  
         $s0 = { 44 6F 63 75 6D 65 6E 74 73 5C 70 73 2E 70 73 31 }
  
         $s1 = { 44 6F 77 6E 6C 6F 61 64 73 5C 65 6C 61 73 74 69 63 73 65 61 72 63 68 2E 6E 73 65 }
  
         $s2 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 70 63 61 70 49 6E 73 74 }
  
         $s3 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 6D 61 70 }
  
         $s4 = { 2F 44 65 6C 65 74 65 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 22 }
  
         $s5 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 2E 7A 69 70 22 }
  
         $s6 = { 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 5C 52 75 6E 74 69 6D 65 20 55 70 64 61 74 65 20 53 65 72 76 69 63 65 }
  
         $s7 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 6D 61 70 2E 65 78 65 22 }
  
         $t8 = { 6D 61 74 63 68 20 22 73 79 73 74 65 6D 70 72 6F 66 69 6C 65 }
  
         $t9 = { 2D 6E 6F 74 6D 61 74 63 68 20 22 41 70 70 44 61 74 61 }
  
         $t10 = { 20 6B 69 6C 6C 20 2D 49 64 20 }
  
         $t11 = { 2F 52 75 6E 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 }
  
         $t12 = { 44 6F 77 6E 6C 6F 61 64 73 5C 74 68 69 73 2E 70 73 31 }
  
     condition:
  
         all of ($s*) or all of ($t*)
  
  }

ssdeep Matches

No matches found.

Relationships

Description

This artifact is a malicious PowerShell script file downloaded and installed by "ps.ps1" (a439e7a030d52c8d31bf2c140ccf216b) . When executed, it stops and deletes the running scheduled tasks below if they exist on the compromised system:



--Begin task name--

"Runtime Service"

"\Microsoft\Windows\Runtime Update Service"

--End task name--



It downloads and installs a scheduled task XML file and a PowerShell file below if the file "C:\Program Files (x86)\Nmap\RuntimeService.exe" is installed on the compromised system:



--Begin files--

C:\Users\Public\Downloads\that.xml ==> "9bf865e73bb0bf021af2d4a2ce1abdfe"

C:\Users\Public\Documents\ps.ps1 ==> "a439e7a030d52c8d31bf2c140ccf216b"

--End files--



It creates a scheduled task named "\Microsoft\Windows\Runtime Update Service" from the task specified in the above XML file to execute the file "C:\Users\Public\Documents\ps.ps1" at a specified time of each day for persistence, and then exits it code execution.



Displayed below is the command used to install the scheduled task named "\Microsoft\Windows\Runtime Update Service":



--Begin scheduled task--

"schtasks.exe /Create /XML "C:\Users\Public\Downloads\that.xml" /tn "\Microsoft\Windows\Runtime Update Service"

--End scheduled task--



If not, it checks if the Nmap file path "C:\Program Files (x86)\Nmap" is installed on the victim's system. If the file path exists, it will search for the running process named "RuntimeService", which is the 64-bit Python compiled PE file. It will attempt to terminate and delete it from "C:\Program Files (x86)\Nmap\RuntimeService.exe" if the file is running. It downloads and installs a scheduled task XML file and the Python compiled PE file. It copies the PE file from "C:\Users\Public\Downloads\RuntimeService.exe" to the Nmap installed folder "C:\Program Files (x86)\Nmap\RuntimeService.exe".



Displayed below are the scheduled task XML file and PE file installed at runtime:



--Begin files--

C:\Users\Public\Downloads\this.xml ==> "e4ea99b9a35807bae6bc2885b220c498"

C:\Users\Public\Downloads\RuntimeService.exe ==> copied to C:\Program Files (x86)\Nmap\RuntimeService.exe. ==> "eda057d006561e28563813b2e81b9fd0"

--End files--



It creates a scheduled task named "Runtime Service" from the task specified in the above "this.xml" file on the victim's system to execute the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe" with predefined arguments in every system reboot for persistence.



Displayed below is the command used to install the scheduled task named "Runtime Service":



--Begin scheduled task--

"schtasks.exe /Create /XML "C:\Users\Public\Downloads\this.xml" /tn "Runtime Service"

--End scheduled task--



If the Nmap file path "C:\Program Files (x86)\Nmap" is not installed on the victim's system, it will download a zip file from its C2 server to "C:\Users\Public\Downloads\n.zip". The zip file contains the Nmap installer and the NSE file. It installs the Nmap installer on the compromised system with the command below:



--Begin command--

start "C:\Users\Public\Downloads\Nmap.exe" "/S"

--End command--



It will download the these files RuntimeService.exe, this.xml, that.xml, and ps.ps1 files from its C2 server into "C:\Users\Public\Downloads\".



It copies the NSE file from the current directory "C:\Users\Public\Downloads\elasticsearch.nse" to "C:\Program Files (x86)\Nmap\scripts\elasticsearch.nse", and the Python PE file "C:\Users\Public\Downloads\RuntimeService.exe" to "C:\Program Files (x86)\Nmap\RuntimeService.exe". It creates scheduled tasks named "Runtime Service" and "Runtime Update Service" from the task specified in the above XML files on the victim's system for persistence.



It deletes the command line for removing the Nmap application and the Nmap project's packet capture (Npcap) installed from the registry by changing the "UninstallString" registry value to a null string under the following registry keys:



--Begin registry entries--

"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst"

"UninstallString"="C:\Program Files\Npcap\uninstall.exe"



"HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Nmap"

"UninstallString" = "C:\Program Files (x86)\Nmap\uninstall.exe"

--End registry entries--



It deletes the files below from the victim's system:



--Begin files--

C:\Users\Public\Downloads\nmap.exe

C:\Users\Public\Downloads\elasticsearch.nse

C:\Users\Public\Downloads\n.zip

C:\Users\Public\Downloads\RuntimeService.exe

C:\Users\Public\Downloads\this.xml

C:\Users\Public\Downloads\that.xml"

--End files--



Displayed below are the list of Uniform Resource Identifiers (URIs) used to download the files above:



--Begin URIs--

http[:]//66[.]70[.]238[.]65/RuntimeService.exe

http[:]//66[.]70[.]238[.]65/this.xml

http[:]//66[.]70[.]238[.]65/that.xml

http[:]//66[.]70[.]238[.]65/ps.ps1

http[:]//66[.]70[.]238[.]65/n.zip

--End URIs--

Screenshots

76a2979d965d42f99558ca6ecd97734697249667291a3013d611e310a03f550e

Tags

downloaderloadertrojan

Details

Antivirus

YARA Rules

• rule CISA_10386789_01 : downloader
  
  {
  
     meta:
  
         Author = "CISA Code & Media Analysis"
  
         Incident = "10386789"
  
         Date = "2022-06-08"
  
         Last_Modfied = "20220613_1130"
  
         Actor = "n/a"
  
         Category = "Downloader"
  
         Family = "n/a"
  
         Description = "Detects PowerShell downloader samples"
  
         MD5_1 = "8aedb094121903a3bfc3dade34f48126"
  
         SHA256_1 = "1d459b9909adf98690635c62ea005009ede8eb9a665b8703fe2ad0b0c414816b"
  
         MD5_2 = "1940ddb77882162f898bc3aae9c67d94"
  
         SHA256_2 = "817046c4fe89cd44dbb613cdac2f0c165e2b47d2b5245911ca6fabdda89d1691"
  
         MD5_3 = "84aadb11699f0c3ed062f484aa0a622e"
  
         SHA256_3 = "e6bc8aa44233312058704b4d5954c45b4160841f470dd7f6d13c08940e61a7bb"
  
         MD5_4 = "a439e7a030d52c8d31bf2c140ccf216b"
  
         SHA256_4 = "76a2979d965d42f99558ca6ecd97734697249667291a3013d611e310a03f550e"
  
     strings:
  
         $s0 = { 44 6F 63 75 6D 65 6E 74 73 5C 70 73 2E 70 73 31 }
  
         $s1 = { 44 6F 77 6E 6C 6F 61 64 73 5C 65 6C 61 73 74 69 63 73 65 61 72 63 68 2E 6E 73 65 }
  
         $s2 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 70 63 61 70 49 6E 73 74 }
  
         $s3 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 6D 61 70 }
  
         $s4 = { 2F 44 65 6C 65 74 65 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 22 }
  
         $s5 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 2E 7A 69 70 22 }
  
         $s6 = { 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 5C 52 75 6E 74 69 6D 65 20 55 70 64 61 74 65 20 53 65 72 76 69 63 65 }
  
         $s7 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 6D 61 70 2E 65 78 65 22 }
  
         $t8 = { 6D 61 74 63 68 20 22 73 79 73 74 65 6D 70 72 6F 66 69 6C 65 }
  
         $t9 = { 2D 6E 6F 74 6D 61 74 63 68 20 22 41 70 70 44 61 74 61 }
  
         $t10 = { 20 6B 69 6C 6C 20 2D 49 64 20 }
  
         $t11 = { 2F 52 75 6E 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 }
  
         $t12 = { 44 6F 77 6E 6C 6F 61 64 73 5C 74 68 69 73 2E 70 73 31 }
  
     condition:
  
         all of ($s*) or all of ($t*)
  
  }

ssdeep Matches

No matches found.

Relationships

Description

This artifact is a malicious PowerShell script file downloaded and installed by "this.ps1" (8aedb094121903a3bfc3dade34f48126) and "ps.ps1" (a439e7a030d52c8d31bf2c140ccf216b). This file and "84aadb11699f0c3ed062f484aa0a622e" have similar code functions. When executed, it checks and stops any process running from the specified paths:



--Begin file paths--

C:\Windows\Temp

C:\Windows\System32\config\systemprofile

--End file paths--



If not, it checks if the scheduled task named "Runtime Service" is installed on the victim's system. If not, it downloads and installs the XML scheduled task file "C:\Users\Public\Downloads\this.xml" (e4ea99b9a35807bae6bc2885b220c498) and creates a scheduled task named "Runtime Service" from the task specified in the XML file on the victim's system. This task is designed to run the file "C:\Program Files (x86)\Nmap\RuntimeService.exe" with predefined arguments in every system reboot.



It checks if the scheduled task named "\Microsoft\Windows\Runtime Update Service" is installed on the victim's system. If not, it downloads and installs the XML scheduled task file "C:\Users\Public\Downloads\that.xml" (9bf865e73bb0bf021af2d4a2ce1abdfe) and creates a scheduled task named "\Microsoft\Windows\Runtime Update Service" from the task specified in the XML file on the victim's system. This task is designed to run the PowerShell script file from "C:\Users\Public\Documents\ps.ps1" in a specified date and time.



It checks if the Nmap file path "C:\Program Files (x86)\Nmap" is installed on the victim's system. If the file path is not installed, it downloads a PowerShell file from its C2 server to "C:\Users\Public\Downloads\this.ps1" (8aedb094121903a3bfc3dade34f48126) before executing it using the command below:



--Begin command--

"Powershell.exe -ExecutionPolicy UnRestricted -File "C:\Users\Public\Downloads\this.ps1"

--End command--



If the Nmap file path is installed, it checks if the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe" (eda057d006561e28563813b2e81b9fd0) is also installed on the victim's system. If the PE file is not installed, it downloads and installs the PE file into "C:\Users\Public\Downloads\RuntimeService.exe" (eda057d006561e28563813b2e81b9fd0) if the PE file is not installed on the victim's system. It copies the PE file from "C:\Users\Public\Downloads\RuntimeService.exe" to the Nmap file path "C:\Program Files (x86)\Nmap\RuntimeService.exe". It enables and runs the scheduled task named "Runtime Service" to execute the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe".



If the PE file is installed, it will attempt to retrieve and verify the last write time of the file with the date and time: "Sunday, April 24, 2022 11:31:45 AM" retrieved from the C2 server using the hard-coded URI:"http[:]//66[.]70[.]238[.]65/txt.txt".



Analysis indicates that if the last write time of the file is less than the date and time retrieved from the C2 server, it will search for the running process named "RuntimeService" and attempt to terminate and delete it from "C:\Program Files (x86)\Nmap\RuntimeService.exe" if the file is running on the victim's system. It downloads and installs the PE file into "C:\Users\Public\Downloads\RuntimeService.exe". It copies the PE file from "C:\Users\Public\Downloads\RuntimeService.exe" to the Nmap file path "C:\Program Files (x86)\Nmap\RuntimeService.exe". It enables and runs the scheduled task named "Runtime Service" to execute the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe".



It is designed to delete the other files below before existing its code execution:



--Begin deleted files--

"C:\Users\Public\Downloads\RuntimeService.exe"

"C:\Users\Public\Downloads\this.xml"

"C:\Users\Public\Downloads\that.xml"

"C:\Users\Public\Downloads\this.ps1"

--End deleted files--



Displayed below are the URIs used to download the files above:



--Begin URIs--

http[:]//66[.]70[.]238[.]65/RuntimeService.exe

http[:]//66[.]70[.]238[.]65/this.xml

http[:]//66[.]70[.]238[.]65/that.xml

http[:]//66[.]70[.]238[.]65/this.ps1

--End URIs--

Screenshots

e3d2e6b5cd422de1be7e6aa830b91115d204ba5e87c77b6431f3313e0930a697

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

This artifact is the scheduled task XML file downloaded and installed by "8aedb094121903a3bfc3dade34f48126" and "a439e7a030d52c8d31bf2c140ccf216b". It contains the task's properties, triggers, actions, conditions, and settings used to create a scheduled task named "\Microsoft\Windows\Runtime Update Service" for persistence. It is designed to execute the PowerShell script file from "C:\Users\Public\Documents\ps.ps1" in everyday from January 01, 2022. This file and "80343fb39fe8657f3f3904509b59d1d2" have similar code functions.

Screenshots

c357879e2c1013dcf999bcdc65372eacf0895af4a4b4bad2b7d28108d3e7c46a

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

This artifact is the scheduled task XML file downloaded and installed by "8aedb094121903a3bfc3dade34f48126" and "a439e7a030d52c8d31bf2c140ccf216b". This file and "d5e111c8cea4d2c8e8ae15a570ff8d3d" have similar code functions. It contains the task's properties, triggers, actions, conditions, and settings used to create a scheduled task named "Runtime Service" for persistence. It is designed to execute the Python compiled PE file from "C:\Program Files (x86)\Nmap\RuntimeService.exe" with the arguments below in every system reboot.



--Begin arguments--

[C2 server IP address] [Port number] [threads]

66[.]70[.]238[.]65 50106 250

--End arguments--

Screenshots

4cdd06a36858ac32a09606bfecb54b517ad41a6aac1e37ca56bb1c193f8174cf

Tags

remote-access-trojantrojan

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This artifact is a 64-bit Python 3.9 compiled executable downloaded and installed by "this.ps1" (8aedb094121903a3bfc3dade34f48126). The file is executed by scheduled task named "Runtime Service" from the task specified in the XML file "C:\Users\Public\Downloads\this.xml" on the victim's system. It executes the file with the arguments below in every system reboot.



--Begin arguments--

[C2 server IP address] [Port number] [threads]

66[.]70[.]238[.]65 50106 250

--End arguments--



When executed, it attempts to connect to the specified C2 IP address and port and waits for a response. The response payload was not available for analysis. Analysis indicates that once the response is received, it is designed to perform the functions below:



--Begin functions--

It is capable of using FreeProxy class to scrape proxies from proxy sources: https[:]//free-proxy-list[.]net and https[:]//www[.]sslproxies[.]org and checks if proxy is working. It can filter proxies by acceptable timeout and randomize the list of proxies from where the script would get the first working proxy.

It is capable of scanning multiple endpoints using Nmap NSE scripts. It is capable of running specified Nmap NSE scripts to perform a variety of tasks and store the output in JSON format.

It is capable of performing scans to find out all IP addresses of live hosts, open ports and services running on those hosts.

It is capable of performing banner grabbing: find open ports of a host and grab different banners of services available on different ports.

It is capable of collecting public key certificates information from the compromised system.

It is capable of starting and closing socks connection.

The scanned results and the collected information can be sent in JSON format through a specified socket to the attacker's C2 server.

--End functions--



Displayed below are the hard-coded ports scanned at runtime:



--Begin ports--

22

80

8080

8888

8060

8081

443

1443

2443

3443

4443

5443

6443

7443

8443

9443

10443

11443

12443

3389

9200

27017

3306

1433

5432

--End ports



Displayed below are the hard-coded services scanned at runtime:



--Begin services--

22: 'ssh'

80: 'http'

443: 'https'

1433: 'ms-sql-s'

3389: 'ms-wbt-server'

5432: 'postgresql'

3306: 'mysql'

9200: 'wap-wsp'

8080: 'http-proxy'

8081: 'blackice-icecap'

8888: 'sun-answerbook'

8060: 'aero'

1443: 'ies-lm'

2443: 'powerclientcsf'

3443: 'ov-nnm-websrv'

4443: 'pharos'

5443: 'spss'

6443: 'm2ap'

7443: 'oracleas-https'

8443: 'https-alt'

9443: 'tungsten-https'

27017: 'mongodb'

10443: 'cirrossp'

11443: 'unknown'

12443: 'unknown

--End services--



Displayed below is the format of the public key certificates data collected at runtime:



--Begin certificate information--

Subject: The certificate's subject

Issuer: The certificate's issuer

Has-expired: x509 cert has expired

Not-after: The not after portion of the certificate's validity period

Not-before: The not before portion of the certificate's validity period

Serial-number: The certificate's serial number

Serial-number(hex): The certificate's serial number in hexadecimal

Signature-algorithm: The certificate's signature algorithm

Version: The X.509 version number

Pulic-key-length: The certificate public key length

Extensions': The X.509 extensions

--End certificate information--

Screenshots

817046c4fe89cd44dbb613cdac2f0c165e2b47d2b5245911ca6fabdda89d1691

Tags

downloaderloadertrojan

Details

Antivirus

YARA Rules

• rule CISA_10386789_01 : downloader
  
  {
  
     meta:
  
         Author = "CISA Code & Media Analysis"
  
         Incident = "10386789"
  
         Date = "2022-06-08"
  
         Last_Modfied = "20220613_1130"
  
         Actor = "n/a"
  
         Category = "Downloader"
  
         Family = "n/a"
  
         Description = "Detects PowerShell downloader samples"
  
         MD5_1 = "8aedb094121903a3bfc3dade34f48126"
  
         SHA256_1 = "1d459b9909adf98690635c62ea005009ede8eb9a665b8703fe2ad0b0c414816b"
  
         MD5_2 = "1940ddb77882162f898bc3aae9c67d94"
  
         SHA256_2 = "817046c4fe89cd44dbb613cdac2f0c165e2b47d2b5245911ca6fabdda89d1691"
  
         MD5_3 = "84aadb11699f0c3ed062f484aa0a622e"
  
         SHA256_3 = "e6bc8aa44233312058704b4d5954c45b4160841f470dd7f6d13c08940e61a7bb"
  
         MD5_4 = "a439e7a030d52c8d31bf2c140ccf216b"
  
         SHA256_4 = "76a2979d965d42f99558ca6ecd97734697249667291a3013d611e310a03f550e"
  
     strings:
  
         $s0 = { 44 6F 63 75 6D 65 6E 74 73 5C 70 73 2E 70 73 31 }
  
         $s1 = { 44 6F 77 6E 6C 6F 61 64 73 5C 65 6C 61 73 74 69 63 73 65 61 72 63 68 2E 6E 73 65 }
  
         $s2 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 70 63 61 70 49 6E 73 74 }
  
         $s3 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 6D 61 70 }
  
         $s4 = { 2F 44 65 6C 65 74 65 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 22 }
  
         $s5 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 2E 7A 69 70 22 }
  
         $s6 = { 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 5C 52 75 6E 74 69 6D 65 20 55 70 64 61 74 65 20 53 65 72 76 69 63 65 }
  
         $s7 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 6D 61 70 2E 65 78 65 22 }
  
         $t8 = { 6D 61 74 63 68 20 22 73 79 73 74 65 6D 70 72 6F 66 69 6C 65 }
  
         $t9 = { 2D 6E 6F 74 6D 61 74 63 68 20 22 41 70 70 44 61 74 61 }
  
         $t10 = { 20 6B 69 6C 6C 20 2D 49 64 20 }
  
         $t11 = { 2F 52 75 6E 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 }
  
         $t12 = { 44 6F 77 6E 6C 6F 61 64 73 5C 74 68 69 73 2E 70 73 31 }
  
     condition:
  
         all of ($s*) or all of ($t*)
  
  }

ssdeep Matches

No matches found.

Relationships

Description

This artifact is a malicious PowerShell script file downloaded and installed by "ps.ps1" (84aadb11699f0c3ed062f484aa0a622e). This file and "8aedb094121903a3bfc3dade34f48126" have similar code functions. When executed, it stops and deletes the running scheduled tasks below if they exist on the compromised system:



--Begin task name--

"Runtime Service"

"\Microsoft\Windows\Runtime Update Service"

--End task name--



It downloads and installs a scheduled task XML file and a PowerShell file below if the file "C:\Program Files (x86)\Nmap\RuntimeService.exe" is installed on the compromised system:



--Begin files--

C:\Users\Public\Downloads\that.xml ==> "80343fb39fe8657f3f3904509b59d1d2"

C:\Users\Public\Documents\ps.ps1

--End files--



It creates a scheduled task named "Runtime Update Service" from the task specified in the above XML file to execute the file "C:\Users\Public\Documents\ps.ps1" at a specified time of each day for persistence, and then exits it code execution.



Displayed below is the command used to install the scheduled task named "\Microsoft\Windows\Runtime Update Service":



--Begin scheduled task--

"schtasks.exe /Create /XML "C:\Users\Public\Downloads\that.xml" /tn "\Microsoft\Windows\Runtime Update Service"

--End scheduled task--



If not, it checks if the Nmap file path "C:\Program Files (x86)\Nmap" is installed on the victim's system. If the file path exists, it will search for the running process named "RuntimeService", which is the 64-bit Python compiled PE file. It will attempt to terminate and delete it from "C:\Program Files (x86)\Nmap\RuntimeService.exe" if the file is running. It downloads and installs a scheduled task XML file and the Python compiled PE file. It copies the PE file from "C:\Users\Public\Downloads\RuntimeService.exe" to the Nmap installed folder "C:\Program Files (x86)\Nmap\RuntimeService.exe".



Displayed below are the scheduled task XML file and PE file installed at runtime:



--Begin files--

C:\Users\Public\Downloads\this.xml ==> "d5e111c8cea4d2c8e8ae15a570ff8d3d"

C:\Users\Public\Downloads\RuntimeService.exe ==> copied to C:\Program Files (x86)\Nmap\RuntimeService.exe. ==> "172fbaf8328f5622a0f69f6cb3b346ac"

--End files--



It creates a scheduled task named "Runtime Service" from the task specified in the above "this.xml" file on the victim's system to execute the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe" with predefined arguments in every system reboot for persistence.



Displayed below is the command used to install the scheduled task named "Runtime Service":



--Begin scheduled task--

"schtasks.exe /Create /XML "C:\Users\Public\Downloads\this.xml" /tn "Runtime Service"

--End scheduled task--



If the Nmap file path "C:\Program Files (x86)\Nmap" is not installed on the victim's system, it will download a zip file from its C2 server to "C:\Users\Public\Downloads\n.zip". The zip file contains the Nmap installer and the NSE file. It installs the Nmap installer on the compromised system with the command below:



--Begin command--

start "C:\Users\Public\Downloads\Nmap.exe" "/S"

--End command--



It will download the files RuntimeService.exe, this.xml, that.xml, and ps.ps1 files from its C2 server into "C:\Users\Public\Downloads\".



It copies the NSE file from the current directory "C:\Users\Public\Downloads\elasticsearch.nse" to "C:\Program Files (x86)\Nmap\scripts\elasticsearch.nse", and the Python PE file "C:\Users\Public\Downloads\RuntimeService.exe" to "C:\Program Files (x86)\Nmap\RuntimeService.exe". It creates scheduled tasks named "Runtime Service" and "Runtime Update Service" from the task specified in the above XML files on the victim's system for persistence.



It deletes the command line for removing the Nmap application and the Nmap project's packet capture (Npcap) installed from the registry by changing the "UninstallString" registry value to a null string under the following registry keys:



--Begin registry entries--

"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\NpcapInst"

"UninstallString"="C:\Program Files\Npcap\uninstall.exe"



"HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Nmap"

"UninstallString" = "C:\Program Files (x86)\Nmap\uninstall.exe"

--End registry entries--



It deletes the files below from the victim's system:



--Begin files--

C:\Users\Public\Downloads\nmap.exe

C:\Users\Public\Downloads\elasticsearch.nse

C:\Users\Public\Downloads\n.zip

C:\Users\Public\Downloads\RuntimeService.exe

C:\Users\Public\Downloads\this.xml

C:\Users\Public\Downloads\that.xml"

--End files--



Displayed below are the list of Uniform Resource Identifiers (URIs) used to download the files above:



--Begin URIs--

http[:]//66[.]70[.]238[.]65/RuntimeService.exe

http[:]//66[.]70[.]238[.]65/this.xml

http[:]//66[.]70[.]238[.]65/that.xml

http[:]//66[.]70[.]238[.]65/ps.ps1

http[:]//66[.]70[.]238[.]65/n.zip

--End URIs--

Screenshots

e6bc8aa44233312058704b4d5954c45b4160841f470dd7f6d13c08940e61a7bb

Tags

downloaderloadertrojan

Details

Antivirus

YARA Rules

• rule CISA_10386789_01 : downloader
  
  {
  
     meta:
  
         Author = "CISA Code & Media Analysis"
  
         Incident = "10386789"
  
         Date = "2022-06-08"
  
         Last_Modfied = "20220613_1130"
  
         Actor = "n/a"
  
         Category = "Downloader"
  
         Family = "n/a"
  
         Description = "Detects PowerShell downloader samples"
  
         MD5_1 = "8aedb094121903a3bfc3dade34f48126"
  
         SHA256_1 = "1d459b9909adf98690635c62ea005009ede8eb9a665b8703fe2ad0b0c414816b"
  
         MD5_2 = "1940ddb77882162f898bc3aae9c67d94"
  
         SHA256_2 = "817046c4fe89cd44dbb613cdac2f0c165e2b47d2b5245911ca6fabdda89d1691"
  
         MD5_3 = "84aadb11699f0c3ed062f484aa0a622e"
  
         SHA256_3 = "e6bc8aa44233312058704b4d5954c45b4160841f470dd7f6d13c08940e61a7bb"
  
         MD5_4 = "a439e7a030d52c8d31bf2c140ccf216b"
  
         SHA256_4 = "76a2979d965d42f99558ca6ecd97734697249667291a3013d611e310a03f550e"
  
     strings:
  
         $s0 = { 44 6F 63 75 6D 65 6E 74 73 5C 70 73 2E 70 73 31 }
  
         $s1 = { 44 6F 77 6E 6C 6F 61 64 73 5C 65 6C 61 73 74 69 63 73 65 61 72 63 68 2E 6E 73 65 }
  
         $s2 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 70 63 61 70 49 6E 73 74 }
  
         $s3 = { 5C 55 6E 69 6E 73 74 61 6C 6C 5C 4E 6D 61 70 }
  
         $s4 = { 2F 44 65 6C 65 74 65 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 22 }
  
         $s5 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 2E 7A 69 70 22 }
  
         $s6 = { 5C 4D 69 63 72 6F 73 6F 66 74 5C 57 69 6E 64 6F 77 73 5C 52 75 6E 74 69 6D 65 20 55 70 64 61 74 65 20 53 65 72 76 69 63 65 }
  
         $s7 = { 44 6F 77 6E 6C 6F 61 64 73 5C 6E 6D 61 70 2E 65 78 65 22 }
  
         $t8 = { 6D 61 74 63 68 20 22 73 79 73 74 65 6D 70 72 6F 66 69 6C 65 }
  
         $t9 = { 2D 6E 6F 74 6D 61 74 63 68 20 22 41 70 70 44 61 74 61 }
  
         $t10 = { 20 6B 69 6C 6C 20 2D 49 64 20 }
  
         $t11 = { 2F 52 75 6E 20 2F 74 6E 20 22 52 75 6E 74 69 6D 65 20 53 65 72 76 69 63 65 }
  
         $t12 = { 44 6F 77 6E 6C 6F 61 64 73 5C 74 68 69 73 2E 70 73 31 }
  
     condition:
  
         all of ($s*) or all of ($t*)
  
  }

ssdeep Matches

No matches found.

Relationships

Description

This artifact is a malicious PowerShell script file downloaded and installed by "this.ps1" (1940ddb77882162f898bc3aae9c67d94). This file and "a439e7a030d52c8d31bf2c140ccf216b" have similar code functions. When executed, it checks and stops any process running from the specified paths:



--Begin file paths--

C:\Windows\Temp

C:\Windows\System32\config\systemprofile

--End file paths--



If not, it checks if the scheduled task named "Runtime Service" is installed on the victim's system. If not, it downloads and installs the XML scheduled task file "C:\Users\Public\Downloads\this.xml" (d5e111c8cea4d2c8e8ae15a570ff8d3d) and creates scheduled task named "Runtime Service" from the task specified in the XML file on the victim's system. This task is designed to execute the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe" with predefined arguments in every system reboot for persistence.



It checks if the schedule task named "\Microsoft\Windows\Runtime Update Service" is installed on the victim's system. If not, it downloads and installs the XML scheduled task file "C:\Users\Public\Downloads\that.xml" (80343fb39fe8657f3f3904509b59d1d2) and creates a scheduled task named "\Microsoft\Windows\Runtime Update Service" from the task specified in the XML file on the victim's system. This task is designed to run the PowerShell script file C:\Users\Public\Documents\ps.ps1" in a specified date and time.



It checks if the Nmap file path "C:\Program Files (x86)\Nmap" is installed on the victim's system. If the file path is not installed, it downloads a PowerShell file from its C2 server to "C:\Users\Public\Downloads\this.ps1" (1940ddb77882162f898bc3aae9c67d94) before executing it using the command below:



--Begin command--

"Powershell.exe -ExecutionPolicy UnRestricted -File "C:\Users\Public\Downloads\this.ps1"

--End command--



If the Nmap file path is installed, it checks if the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe" (172fbaf8328f5622a0f69f6cb3b346ac) is also installed on the victim's system. If the PE file is not installed, it downloads and installs the PE file into "C:\Users\Public\Downloads\RuntimeService.exe" (172fbaf8328f5622a0f69f6cb3b346ac) if the PE file is not installed on the victim's system. It copies the PE file from "C:\Users\Public\Downloads\RuntimeService.exe" to the Nmap file path "C:\Program Files (x86)\Nmap\RuntimeService.exe". It enables and runs the scheduled task named "Runtime Service" to execute the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe".



If the PE file is installed, it will attempt to retrieve and verify the last write time of the file with the date and time: "Sunday, April 24, 2022 11:31:45 AM" retrieved from the C2 server using the hard-coded URI:"http[:]//66[.]70[.]238[.]65/txt.txt".



Analysis indicates that if the last write time of the file is less than the date and time retrieved from the C2 server, it will search for the running process named "RuntimeService" and attempt to stop and delete it from "C:\Program Files (x86)\Nmap\RuntimeService.exe" if the file is running on the victim's system. It downloads and installs the PE file into "C:\Users\Public\Downloads\RuntimeService.exe". It copies the PE file from "C:\Users\Public\Downloads\RuntimeService.exe" to "C:\Program Files (x86)\Nmap\RuntimeService.exe". It enables and runs the scheduled task named "Runtime Service" to execute the PE file "C:\Program Files (x86)\Nmap\RuntimeService.exe".



It is designed to delete the other files below before existing its code execution:



--Begin deleted files--

"C:\Users\Public\Downloads\RuntimeService.exe"

"C:\Users\Public\Downloads\this.xml"

"C:\Users\Public\Downloads\that.xml"

"C:\Users\Public\Downloads\this.ps1"

--End deleted files--



Displayed below are the URIs used to download the files above:



--Begin URIs--

http[:]//66[.]70[.]238[.]65/RuntimeService.exe

http[:]//66[.]70[.]238[.]65/this.xml

http[:]//66[.]70[.]238[.]65/that.xml

http[:]//66[.]70[.]238[.]65/this.ps1

--End URIs--

Screenshots

6408217e10fac9f6549ffaaab328bcfeed4a7ebea71f3dcf60f6186e1b21b501

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

This artifact is the scheduled task XML file downloaded and installed by "1940ddb77882162f898bc3aae9c67d94" and "84aadb11699f0c3ed062f484aa0a622e". It contains the task's properties, triggers, actions, conditions, and settings used to create a scheduled task named "\Microsoft\Windows\Runtime Update Service" for persistence. It is designed to execute the PowerShell script file from "C:\Users\Public\Documents\ps.ps1" in everyday from January 01, 2022.

Screenshots

407d60626707baee29fb9f2597dd32cfd544ff46df7f76e51ff0b79b3ffce3f2

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

This artifact is the scheduled task XML file downloaded and installed by "1940ddb77882162f898bc3aae9c67d94" and "84aadb11699f0c3ed062f484aa0a622e". It contains the task's properties, triggers, actions, conditions, and settings used to create a scheduled task named "Runtime Service" for persistence. It is designed to execute the Python PE compiled file from "C:\Program Files (x86)\Nmap\RuntimeService.exe" with the arguments below in every system reboot.



--Begin arguments--

[C2 server IP address] [Port number] [threads]

66[.]70[.]238[.]65 50106 250

--End arguments--

Screenshots

b050749c87399f9978cc6eaea7d25405fc0d099a14c169f5c5f63b8b6ec98b0f

Tags

remote-access-trojantrojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This artifact is a 64-bit Python 3.9 compiled executable downloaded and installed by "this.ps1" (1940ddb77882162f898bc3aae9c67d94) and "ps.ps1" (84aadb11699f0c3ed062f484aa0a622e). This file and "eda057d006561e28563813b2e81b9fd0" have similar code function. The file is executed by scheduled task named "Runtime Service" from the task specified in the XML file "C:\Users\Public\Downloads\this.xml" on the victim's system. It executes the file with the arguments below in every system reboot.



--Begin arguments--

[C2 server IP address] [Port number] [threads]

66[.]70[.]238[.]65 50106 250

--End arguments--



When executed, it attempts to connect to the specified C2 IP address and port and waits for a response. The response payload was not available for analysis. Analysis indicates that once the response is received, it is designed to perform the functions below:



--Begin functions--

It is capable of scanning multiple endpoints using Nmap NSE scripts. It is capable of running specified Nmap NSE scripts to perform a variety of tasks and store the output in JSON format.

It is capable of performing scans to find out all IP addresses of live hosts, open ports and services running on those hosts.

It is capable of performing banner grabbing: find open ports of a host and grab different banners of services available on different ports.

It is capable of collecting public key certificates information from the compromised system.

It is capable of starting and closing socks connection.

The scanned results and the collected information can be sent in JSON format through a specified socket to the attacker's C2 server.

--End functions--



Displayed below are the hard-coded ports scanned at runtime:



--Begin ports--

22

80

8080

8888

8060

8081

443

1443

2443

3443

4443

5443

6443

7443

8443

9443

10443

11443

12443

3389

9200

27017

3306

1433

5432

--End ports



Displayed below are the hard-coded services scanned at runtime:



--Begin services--

22: 'ssh'

80: 'http'

443: 'https'

1433: 'ms-sql-s'

3389: 'ms-wbt-server'

5432: 'postgresql'

3306: 'mysql'

9200: 'wap-wsp'

8080: 'http-proxy'

8081: 'blackice-icecap'

8888: 'sun-answerbook'

8060: 'aero'

1443: 'ies-lm'

2443: 'powerclientcsf'

3443: 'ov-nnm-websrv'

4443: 'pharos'

5443: 'spss'

6443: 'm2ap'

7443: 'oracleas-https'

8443: 'https-alt'

9443: 'tungsten-https'

27017: 'mongodb'

10443: 'cirrossp'

11443: 'unknown'

12443: 'unknown

--End services--



Displayed below is the format of the public key certificates data collected at runtime:



--Begin certificate information--

Subject: The certificate's subject

Issuer: The certificate's issuer

Has-expired: x509 cert has expired

Not-after: The not after portion of the certificate's validity period

Not-before: The not before portion of the certificate's validity period

Serial-number: The certificate's serial number

Serial-number(hex): The certificate's serial number in hexadecimal

Signature-algorithm: The certificate's signature algorithm

Version: The X.509 version number

Pulic-key-length: The certificate public key length

Extensions': The X.509 extensions

--End certificate information--

Screenshots

42c844c62ad1b7ae1925973a9b6845b40d4f626a4895cba9ae9e3e3de3f7973a

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

This artifact is a zip compressed file downloaded and installed by "this.ps1" (8aedb094121903a3bfc3dade34f48126) and "this.ps1"(1940ddb77882162f898bc3aae9c67d94). It contains the Nmap installer and elasticsearch NSE file. The files within the zip file are extracted into the directory below:



--Begin files--

"C:\Users\Public\Downloads\nmap.exe"

"C:\Users\Public\Downloads\elasticsearch.nse" ==> It copies the NSE file from the current directory "C:\Users\Public\Downloads\elasticsearch.nse" to "C:\Program Files (x86)\Nmap\scripts\elasticsearch.nse".

--End files--

3b4d726bd366e7439367fa78a186dfa9b641d3b2ad354fd915581b6567480f94

Tags

trojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This artifact is a 64-bit self-extracting archive executable file contained within the "n.zip" file (44a34e9bbaee0c0d85f21eb60b723b4e). This file has been identified as a variant of Nmap installer version 7.80. This file is installed by "this.ps1" with the command below:



--Begin command--

start "C:\Users\Public\Downloads\Nmap.exe" "/S"

--End command--

fb833ecd1b1050304f364f879b8b1f7b7136e9c4a21aaf0a6c6b3f419e892d6d

Details

Antivirus

No matches found.

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

Description

This artifact is the NSE file contained within the "n.zip" (44a34e9bbaee0c0d85f21eb60b723b4e). This file is extracted and copied from "C:\Users\Public\Downloads\elasticsearch.nse" to "C:\Program Files (x86)\Nmap\scripts\elasticsearch.nse" by "this.ps1". This file has been identified as

Nmap Elasticsearch NSE for enumerating indices, plugins and cluster nodes on an elasticsearch target.

Screenshots

66.70.238.65

URLs

• http[:]//66.70.238.65/RuntimeService.exe
• http[:]//66.70.238.65/n.zip
• http[:]//66.70.238.65/ps.ps1
• http[:]//66.70.238.65/that.xml
• http[:]//66.70.238.65/this.xml

Ports

• 80 TCP
• 50106 TCP

HTTP Sessions

• GET /ps.ps1 HTTP/1.1
  
  Host    66.70.238.65
  
  User-Agent    Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
  
  Accept    text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  
  Accept-Language    en-US,en;q=0.5
  
  Accept-Encoding    gzip, deflate
  
  
  
  GET /that.xml HTTP/1.1
  
  Host    66.70.238.65
  
  User-Agent    Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
  
  Accept    text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  
  Accept-Language    en-US;q=0.5,en;q=0.3
  
  Accept-Encoding    gzip, deflate
  
  Connection    keep-alive
  
  Upgrade-Insecure-Requests    1
  
  
  
  GET /RuntimeService.exe HTTP/1.1
  
  Host    66.70.238.65
  
  User-Agent    Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
  
  Accept    text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  
  Accept-Language    en-US;q=0.5,en;q=0.3
  
  Accept-Encoding    gzip, deflate
  
  Connection    keep-alive
  
  Upgrade-Insecure-Requests    1
  
  
  
  GET /this.xml HTTP/1.1
  
  Host    66.70.238.65
  
  User-Agent    Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
  
  Accept    text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  
  Accept-Language    en-US;q=0.5,en;q=0.3
  
  Accept-Encoding    gzip, deflate
  
  Connection    keep-alive
  
  Upgrade-Insecure-Requests    1
  
  
  
  GET /n.zip HTTP/1.1
  
  Host    66.70.238.65
  
  User-Agent    Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
  
  Accept    text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  
  Accept-Language    en-US;q=0.5,en;q=0.3
  
  Accept-Encoding    gzip, deflate
  
  Connection    keep-alive
  
  Upgrade-Insecure-Requests    1
  
   

Whois

IP Location    Canada Canada Montreal Ovh Hosting Inc.

ASN    Canada AS16276 OVH, FR (registered Feb 15, 2001)

Resolve Host    ip65.ip-66-70-238.net

Whois Server    whois.arin.net

IP Address    66.70.238.65

NetRange:     66.70.128.0 - 66.70.255.255

CIDR:         66.70.128.0/17

NetName:        HO-2

NetHandle:     NET-66-70-128-0-1

Parent:         NET66 (NET-66-0-0-0-0)

NetType:        Direct Allocation

OriginAS:    

Organization: OVH Hosting, Inc. (HO-2)

RegDate:        2017-02-13

Updated:        2017-02-13

Ref:            https://rdap.arin.net/registry/ip/66.70.128.0



OrgName:        OVH Hosting, Inc.

OrgId:         HO-2

Address:        800-1801 McGill College

City:         Montreal

StateProv:     QC

PostalCode:     H3A 2N4

Country:        CA

RegDate:        2011-06-22

Updated:        2017-01-28

Ref:            https://rdap.arin.net/registry/entity/HO-2



OrgAbuseHandle: ABUSE3956-ARIN

OrgAbuseName: Abuse

OrgAbusePhone: +1-855-684-5463

OrgAbuseEmail: abuse@ovh.ca

OrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE3956-ARIN



OrgTechHandle: NOC11876-ARIN

OrgTechName: NOC

OrgTechPhone: +1-855-684-5463

OrgTechEmail: noc@ovh.net

OrgTechRef:    https://rdap.arin.net/registry/entity/NOC11876-ARIN



NetRange:     66.70.238.0 - 66.70.238.255

CIDR:         66.70.238.0/24

NetName:        OVH-DEDICATED-FO

NetHandle:     NET-66-70-238-0-1

Parent:         HO-2 (NET-66-70-128-0-1)

NetType:        Reassigned

OriginAS:     AS16276

Organization: OVH Hosting, Inc. (HO-2)

RegDate:        2017-06-24

Updated:        2017-06-24

Comment:        Failover IPs

Ref:            https://rdap.arin.net/registry/ip/66.70.238.0



OrgName:        OVH Hosting, Inc.

OrgId:         HO-2

Address:        800-1801 McGill College

City:         Montreal

StateProv:     QC

PostalCode:     H3A 2N4

Country:        CA

RegDate:        2011-06-22

Updated:        2017-01-28

Ref:            https://rdap.arin.net/registry/entity/HO-2



OrgAbuseHandle: ABUSE3956-ARIN

OrgAbuseName: Abuse

OrgAbusePhone: +1-855-684-5463

OrgAbuseEmail: abuse@ovh.ca

OrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE3956-ARIN



OrgTechHandle: NOC11876-ARIN

OrgTechName: NOC

OrgTechPhone: +1-855-684-5463

OrgTechEmail: noc@ovh.net

OrgTechRef:    https://rdap.arin.net/registry/entity/NOC11876-ARIN

Relationships

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines.
• Keep operating system patches up-to-date.
• Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
• Enforce a strong password policy and implement regular password changes.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
• Scan all software downloaded from the Internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, "Guide to Malware Incident Prevention & Handling for Desktops and Laptops".

• 1-888-282-0870
• CISA Central (UNCLASS)
• CISA SIPR (SIPRNET)
• CISA IC (JWICS)

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Central.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

• Web: https://malware.us-cert.gov
• E-Mail: submit@malware.us-cert.gov
• FTP: ftp.malware.us-cert.gov (anonymous)

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.cisa.gov.