HyperBro

MITRE ATT&CK Techniques list includes "T1583.003 Acquire Infrastructure: Virtual Private Server"

"The main command and control (C&C) server ... belongs to a Ukrainian ISP, specifically to a MikroTik router ... Researchers believe the Mikrotik router was explicitly hacked for the campaign"

“...redirected users to malicious sites hosting exploitation tools such as ScanBox and BEeF...” | “...used access to the data center to add JavaScript code to government sites, which redirected users to malicious sites...”

One of the Able update servers was likely compromised in order to deploy HyperBro and Tmanger.

"The initial attack vector ... is unclear, but researchers believe LuckyMouse possibly had conducted watering hole or phishing attacks to compromise accounts belonging to employees"

"ADVSTORESHELL is capable of starting a process using CreateProcess"; "build_downer has the ability to use the WinExec API"; "Aria-body has the ability to launch files using ShellExecute"

Able Desktop trojanized installer is executed by the user.

"Anchor can create and execute services to load its payload"; "APT32's backdoor has used Windows services as a way to execute its malicious payload"; "Ragnar Locker has used sc.exe to execute a service that it creates"; "Shamoon creates a new service named 'ntssrv' to execute the payload"

In the past, SysUpdate was loaded in memory by a known method involving three files: One legitimate executable, sometimes signed, and vulnerable to dynamic-link library (DLL) sideloading; One malicious DLL loaded by the legitimate file; One binary file usually containing obfuscated code, unpacked in memory by the malicious DLL.

The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.

MITRE ATT&CK Techniques list includes "T1055.003 ... Thread Execution Hijacking"

GuLoader has the ability to inject shellcode into donor processes that is started in a suspended state. Cardinal RAT injects into a newly spawned process created from a native Windows executable. Pandora can start and inject code into a new svchost process. ShadowPad has injected an install module into a newly created process.

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

"Sandworm Team used UPX to pack a copy of Mimikatz"; "APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium"; "Lazarus Group packed malicious .db files with Themida to evade detection."

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

The launcher starts by instantiating the CLoadInfo object... Directory to copy all files %PROGRAMDATA%\Test\ ... Name of the legitimate executable dlpumgr32.exe ... Lastly, the launcher starts a suspended process with the command line “C:\Windows\system32\svchost.exe -k LocalServices,”and injects the appropriate shellcode into it.

The content repeatedly describes malware and threat actors injecting shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, cmd.exe, lsass.exe, and browser processes.

MITRE ATT&CK Techniques list includes "T1055.003 ... Thread Execution Hijacking"

GuLoader has the ability to inject shellcode into donor processes that is started in a suspended state. Cardinal RAT injects into a newly spawned process created from a native Windows executable. Pandora can start and inject code into a new svchost process. ShadowPad has injected an install module into a newly created process.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

The content repeatedly describes malware and threat actors decoding, decrypting, or deobfuscating payloads, strings, configuration data, commands, and C2 traffic prior to execution or use, e.g., 'APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload' and 'Action RAT can use Base64 to decode actor-controlled C2 server communications.'

In the past, SysUpdate was loaded in memory by a known method involving three files: One legitimate executable, sometimes signed, and vulnerable to dynamic-link library (DLL) sideloading; One malicious DLL loaded by the legitimate file; One binary file usually containing obfuscated code, unpacked in memory by the malicious DLL.

“...HyperBro, a remote access trojan that operated via an ‘in-memory’ state, leaving minimal traces on disk...”

"HYPERBRO... capabilities such as screen capture and keylogging"

MITRE ATT&CK Techniques list includes "T1010 Application Window Discovery"

"HYPERBRO... capabilities such as screen capture and keylogging"

"Agent Tesla can capture screenshots of the victim’s desktop"; "AppleSeed can take screenshots on a compromised host"; "APT28 has used tools to take screenshots from victims"; "Cobalt Strike's Beacon payload is capable of capturing screenshots"; "PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals"; "Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop"

MITRE ATT&CK Techniques list includes "T1213 Data from Information Repositories"

The content repeatedly describes threat actors, malware, and campaigns using HTTP and/or HTTPS for command and control, including examples such as BlackEnergy communicating with C2 over HTTP POST requests and many other families using HTTP/S for C2.

“...hacked a MikroTik router to host the command and control server of the HyperBro RAT.”

MITRE ATT&CK Techniques list includes "T1095 Non-Application Layer Protocol"

MITRE ATT&CK Techniques list includes "T1105 Ingress Tool Transfer"; described delivery of tools and payloads post-access.