#BREAKING #Sandworm continues attacks in Ukraine
. #ESETresearch found an evolution of a malware loader used during the #Industroyer2 attacks. This updated piece of the puzzle is malware
calls #ArguePatch. ArguePatch was used to launch #CaddyWiper. #WarInUkraine 1/6
スレッド
会話
返信先: さん
The #Industroyer2 attacks used a patched version of IDA Pro’s remote debug server (win32_remote.exe). It was modified to include code to decrypt and run #CaddyWiper from an external file. 2/6
1
4
17
This time, #Sandworm chose an official executable to hide #ArguePatch. It was stripped of its digital signature and code was overwritten in a function called during the MSVC runtime initialization. 3/6
1
5
19
The added code is very similar in both cases, but it now includes a feature to launch the next stage at a particular time. This makes #ArguePatch a timed bomb when started. 4/6
1
2
15
This replaces the need to setup a Windows scheduled task for future detonation. This is perhaps a way to evade detections using known TTPs. 5/6
2
1
17
IoC:
eset_ssl_filtered_cert_importer.exe
SHA-1: 796362BD0304E305AD120576B6A8FB6721108752
ESET detection name: Win32/Agent.AEGY trojan #ESETresearch
6/6
8
18
Twitterを使ってみよう
今すぐ登録して、タイムラインをカスタマイズしましょう。