The ASEC analysis team is using the ASEC automatic analysis system RAPIT to categorize and respond to major malware. This post will list weekly statistics collected from July 19th, 2021 (Monday) to July 25th, 2021 (Sunday).
For the main category, info-stealer ranked top with 54.7%, followed by RAT (Remote Administration Tool) malware with 23.6%, CoinMiner with 9.2%, downloader with 8.0%, ransomware with 2.4%, and backdoor with 1.7%.
Top 1 – RedLine
RedLine malware was ranked first place with 9.2%. The number of collected samples was the same as Glupteba, a malware that ranked second place. However, when samples collected overseas are also counted, RedLine was first place. The malware steals various information such as web browser, FTP client, cryptocurrency wallet, and PC settings. It can also download additional malware by receiving commands from the C&C server.
The following are the confirmed C&C server domains for RedLine:
- hxxp://yarinefatt[.]xyz
- hxxp://vahodedian[.]xyz
- hxxp://periatilll[.]xyz
- hxxp://kalamaivig[.]xyz
- hxxp://ivaloribar[.]xyz
- hxxp://ieynanerin[.]xyz
- hxxp://eraynabrha[.]xyz
Top 2 – Glupteba
Glupteba is a malware developed with Golang, taking second place with 9.2%. It downloads various additional modules and has various features, but it is actually a CoinMiner malware that installs XMR (Monero) CoinMiner.
When Glupteba is executed, it acquires the system permission by going through UAC Bypass and using TrustedInstaller’s permission. It then disguises as a normal process named C:Windowsrsscsrss.exe and remains in the system. Afterward, Glupteba downloads additional modules such as rootkit drivers for a purpose of concealing processes and files, and ultimately installs Eternal Blue package to spread through XMR CoinMiner and SMB vulnerabilities.
So far, most of the confirmed Glupteba samples are being downloaded and distributed via PUPs. Even though Glupteba is being distributed via PUP, it takes the appearance of a MalPe packer (it is mentioned in the previous blog post).
[Additional Module Download URL]
- hxxps://spolaect[.]info
[C&C Server URL]
- hxxps://ninhaine[.]com
- hxxps://2makestorage[.]com
- hxxps://nisdably[.]com
Top 3 – AgentTesla
AgentTesla was ranked third place with 8.6%. It is an info-stealer malware that leaks user information saved in web browsers, e-mails, and FTP clients.
Recently collected samples use the following mail servers and user accounts when leaking the collected information.
- mail.kenmascs[.]com
sender: info@kenmascs[.]com
receiver: info@kenmascs[.]com
user: emails2021emails@yandex[.]com
pw: Ken****4! - smtp.vivaldi[.]net
sender: billions101@vivaldi[.]net
receiver: billions101@vivaldi[.]net
user: billions101@vivaldi[.]net
pw: Great#@****909()*&^ - mail.enerzi[.]co
sender: abudhabioffice@upgeng[.]com
receiver: abudhabioffice@upgeng[.]com
user: abudhabioffice@upgeng[.]com
pw: U****45+
As most are distributed through spam mails disguised as invoices, shipment documents, and purchase orders, the file names contain such words shown above (Invoice, Shipment, P.O. – Purchase Order). Some samples have extensions disguised as document files such as pdf and xlsx or Auto CAD blueprint files such as dwg.
- SWIFT_987867T8E.exe
- SJ-21-0512-01(POM-213620) R1.exe
- RFQ__JICPRHR10633.exe
- REMITANCE 103_03435_210408_BSA_.exe
- Released_Order.exe
- PAYMENT_PROOF.exe
- payment $67,830.00.exe
- PAGO FACTURA 3802.exe
- Order_4110043899.exe
- ORDER.exe
- order 001.exe
- NEW_ORDER.exe
- MRKU8781602_DOCS.exe
- Jose_Luis_Ezeiza.cv7-19-2021.exe
- DHL_Shipment_Confirmation_CBJ190517000131.exe
- DHL SHIPPING INVOICE COPYS.exe
- Deposit_slip.exe
- Commercial_Invoice.exe
- bl-invoice-shipping documents.exe
Top 4 – CryptBot
This week, CryptBot malware ranked fourth with 8.5%. CryptBot is mainly distributed through fake sites disguised as software download sites. Upon entering a certain keyword in the search engine, these malicious websites appear on the top page. When the PC is infected, it attempts to steal various user info and download additional malware.
The following are the C&C server URLs and additional malware download URLs of CryptBot.
- C&C1: wymocd61[.]top/index.php
C&C2: morxek06[.]top/index.php
Download URL: hofvit08[.]top/download.php?file=lv.exe - C&C1: smaqjz21[.]top/index.php
C&C2: moryuf02[.]top/index.php
Download URL: guremd03[.]top/download.php?file=lv.exe - C&C1: smaxgr31[.]top/index.php
C&C2: morers03[.]top/index.php
Download URL: gurswj04[.]top/download.php?file=lv.exe - C&C1: smakpy41[.]top/index.php
C&C2: morbea04[.]top/index.php
Download URL: gurdgo06[.]top/download.php?file=lv.exe - C&C1: smapet51[.]top/index.php
C&C2: morzie05[.]top/index.php
Download URL: gurqfo07[.]top/download.php?file=lv.exe - C&C1: smasuq55[.]top/index.php
C&C2: morzie05[.]top/index.php
Download URL: gurqfo07[.]top/download.php?file=lv.exe
The distributed filenames are as follows.
- main_setup_x86x64.exe
- mypleasure.exe
- setup_x86_x64_install.exe
- setup.exe
- 32_64_ver_2_bit.exe
- setup_launcher_n2.exe
- p3.exe
- p6.exe
- p6-2.exe
Top 5 – Formbook
Formbook is an info-stealer malware ranked fifth place with 8.2%.
Like other info-stealer malware, it is mainly distributed through spam mails. The distributed file names are close to each other.
- Estimate Item List.exe
- Swift_Fattura_0093320128_.exe
- SA#2107197743.exe
- quotation.exe
- Proforma_Invoice_signed_copy_july19_doc.exe
- Product_Specifications_Details_331011_RFQ.exe
- Potvrda_narudzbe_predracuna.exe
- PO_9756-NMNBVC.exe
- PO#635900622.exe
- PO#4500046416.PDF.exe
- PI-0387991.exe
- Payment_invoice.exe
- P.O #78574.exe
- NewOrder.exe
- NEW_ORDER.exe
- Invoice 256371kn.exe
- Finance_Quote_Carolina_Construction_Inc._7-9-2021_AA.PDF.exe
- DONG SUNG PO.exe
- Atlantic_spare_parts_Request_for_Quotation.PDF.exe
- #6495PI-29458-2020.exe
As Formbook is injected in a normal process that is in the directory of explorer.exe and system32, the malicious behaviors are performed by the normal process. Besides user account information in the web browser, the malware can steal various information through keylogging, clipboard grabbing, and web browser form grabbing. Below is the list of confirmed C&C server URLs of Formbook.
- hxxp://www.abrosnm3[.]com/a3ea/
- hxxp://www.nieght[.]com/wt5i/
- hxxp://www.valengz[.]com/lt0h/
- hxxp://www.cenfoxy[.]com/bgr7/
- hxxp://www.solisdq[.]info/qmf6/
- hxxp://www.blinbins[.]com/q4kr/
- hxxp://www.cunix88[.]com/synv/
- hxxp://www.brateix[.]info/qcir/
- hxxp://www.rugpat[.]com/vd9n/
- hxxp://www.chaytel[.]com/dxe/
Subscribe to AhnLab’s next-generation threat intelligence platform ‘AhnLab TIP’ to check related IOC and detailed analysis information.
Categories:Statistics