AZORult Malware - HHS.gov
TLP:WHITEAZORult MalwareOVERALL CLASSIFICATION ISTLP:WHITE04/16/2020Report #: 202004161000
TLP:WHITEAgendaImage source: NJCCIC IntroductionAttack vectorsFunctionality overviewMapping against the MITRE ATT&CK FrameworkInfection and CompromiseOrigination of AttacksFake Coronavirus mapTriple EncryptionPersistenceIntrusion Detection Rules/SignaturesSlides Key:Mitigation practicesNon-Technical: managerial, strategicIndicators of Compromiseand high-level (general audience)ReferencesTechnical: Tactical / IOCs; requiringQuestionsin-depth knowledge (sysadmins, IRT)4/16/20202
TLP:WHITEIntroductionAZORult – What is it? Malware – Information stealer and cryptocurrency theft Initially detected in 2016 when dropped by the Chthonic banking trojanLatest version: 3.2; Used to target WindowsAKA PuffStealer, RuzaltoEasy to operate (user friendly)Very common; Sold on Russian hacker forums for 100Can both be dropped or serve as a dropper (first or second stage)Constantly changing/evolving infection vectors and attack stages and capabilities Especially relevant during the Coronavirus pandemic Used in Coronavirus-themed attacksImage source: Bleeping Computer4/16/20203
AZORult – Attack VectorsTLP:WHITEImage source: Ad Astra GamesHow is AZORult delivered? Common: Exploit Kits (especially Fallout Exploit Kit) Other malware that acts as a dropper RamnitEmotetPhishingMalspamInfected websitesMalvertisementsFake installers On occasion: .iso file Remote Desktop Protocol (RDP) exploitation4/16/20204
AZORult – Functionality overviewTLP:WHITEAZORult possesses the following capabilities: Steals: System login credentials System reconnaissance info (GUID, system architecture and language, username and computer name,operating system version, system IP address Cryptocurrency wallets Monero, uCoin, and bitcoin cryptocurrencies Electrum, Electrum-LTC, Ethereum, Exodus, Jaxx and Mist wallets Steam and Telegram credentials; Skype chat history and credentials Payment card numbers Cookies and other sensitive browser-based data (especially autofill) Data Exfiltration/Communication Pushes to a command-and-control server. Screenshots Executes files via remote backdoor commandsImage source: LinkedIn4/16/20205
TLP:WHITEMapping AZORult against the MITRE ATT&CK FrameworkMITRE ATT&CK Techniques used by AZORult:DomainIDNameUseEnterprise T1134 Access Token ManipulationAZORult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.Enterprise T1503 Credentials from Web BrowsersAZORult can steal credentials from the victim's browser.Enterprise T1081 Credentials in FilesAZORult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.Enterprise T1140 Deobfuscate/Decode Files or Information AZORult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.Enterprise T1083 File and Directory DiscoveryAZORult can recursively search for files in folders and collects files from the desktop with certain extensions.Enterprise T1107 File DeletionAZORult can delete files from victim machines.Enterprise T1057 Process DiscoveryAZORult can collect a list of running processes by calling CreateToolhelp32Snapshot.Enterprise T1093 Process HollowingAZORult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the newprocess and resume new process execution.Enterprise T1012 Query RegistryAZORult can check for installed software on the system under the Registry tall.Enterprise T1105 Remote File CopyAZORult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.Enterprise T1113 Screen CaptureAZORult can capture screenshots of the victim’s machines.Enterprise T1032 Standard Cryptographic ProtocolAZORult can encrypt C2 traffic using XOR.Enterprise T1082 System Information DiscoveryAZORult can collect the machine information, system architecture, the OS version, computer name, Windows product name, thenumber of CPU cores, video card information, and the system language.Enterprise T1016 System Network Configuration Discovery AZORult can collect host IP information from the victim’s machine.Enterprise T1033 System Owner/User DiscoveryAZORult can collect the username from the victim’s machine.Enterprise T1124 System Time DiscoveryAZORult can collect the time zone information from the system.Source: https://attack.mitre.org/software/S0344/4/16/20206
AZORult – Infection and compromiseTLP:WHITE Example attack: Infection onImage source: Trend Micro4/16/20207
AZORult – Origination of attacksTLP:WHITEGeographical distribution of AZORult attacks: December 2017 through December 2018Data and image source: Kaspersky4/16/20208
Recent AZORult usage – Fake Coronavirus mapTLP:WHITEFake Coronavirus tracking map drops AZORult on victim systems:4/16/20209
TLP:WHITELegitimate Johns Hopkins Coronavirus MapLegitimate map:4/16/202010
Recent AZORult technique – triple encryptionTLP:WHITE Observed in a February 2020 phishing campaign:Data and image source: ThreatPost4/16/202011
TLP:WHITEAZORult - PersistenceAZORult can establish persistence: Install standard backdoors Creates hidden admin account to set registry key to establish RemoteDesktop Protocol (RDP) connection Camouflages as legitimate application (registry and scheduled tasks) See example of fake Google update binary below which contained AZORulttrojan:Image source: Bleeping Computer4/16/202012
TLP:WHITEAZORult Intrusion Detection Rules/Signatures Yara Rules: azorult ware/MALW AZORULT.yar aler.html he-hidden-link-with-azorult/ -yara-rules.html azorult-mutex-name-that.html Snort rules: https://www.snort.org/rule docs/1-47339 https://www.snort.org/rule docs/1-49548 https://snort.org/rule docs/1-476024/16/202013
TLP:WHITEMitigation Practices: AZORultThe HHS 405(d) Program published the Health Industry Cybersecurity Practices(HICP), which is a free resource that identifies the top five cyber threats and the tenbest practices to mitigate them. Below are the practices from HICP that can be usedto mitigate AZORult.DEFENSE/MITIGATION/COUNTERMEASURE405(d) HICPREFERENCEProvide social engineering and phishing training to employees.[10.S.A], [1.M.D]Develop and maintain policy on suspicious e-mails for end users; Ensure suspicious e-mails are reported.[10.S.A], [10.M.A]Ensure emails originating from outside the organization are automatically marked before received.[1.S.A], [1.M.A]Apply patches/updates immediately after release/testing; Develop/maintain patching program if necessary.[7.S.A], [7.M.D]Implement Intrusion Detection System (IDS); Keep signatures and rules updated.[6.S.C], [6.M.C], [6.L.C]Implement spam filters at the email gateways; Keep signatures and rules updated.[1.S.A], [1.M.A]Block suspicious IP addresses at the firewall; Keep firewall rules are updated.[6.S.A], [6.M.A], [6.L.E]Implement whitelisting technology to ensure that only authorized software is allowed to execute.[2.S.A], [2.M.A], [2.L.E]Implement access control based on the principal of least privilege.[3.S.A], [3.M.A], [3.L.C]Implement and maintain anti-malware solution.[2.S.A], [2.M.A], [2.L.D]Conduct system hardening to ensure proper configurations.[7.S.A], [7.M.D]Disable the use of SMBv1 (and all other vulnerable services and protocols) and require at least SMBv2.[7.S.A], [7.M.D]Background information can be found d/Documents/HICP-Main-508.pdf4/16/202014
TLP:WHITEAZORult: Indicators of CompromiseIndicators of Compromise: There are instances of obsolete IOCs being reused, so any organizationattempting to defend themselves should consider all possibilities. New IOCs are constantly being released, especially with a tool as prominentand frequently used as AZORult. It is therefore incumbent upon anyorganization attempting to defend themselves to remain vigilant, maintainsituational awareness and be ever on the lookout for new IOCs tooperationalize in their cyberdefense mainDomainDomainIP addressIP mmand and control serverCommand and control serverCommand and control serverMalware storageMalware storageMalware storageMalware storageMalware storageMalware storageMalware storageMalware cutable4/16/202015
TLP:WHITEReferences Analyzing an AZORult Attack – Evasion in a Cloak of Multiple Layers Seamless Campaign Delivers Ramnit via RIG EK at 188.225.82.158. Follow-up Malware is AZORult Stealer. res-spreads-alongsideMalpedia: Azorult azorult-malware-information-kAJ4P000000kEK2WAMNew version of AZORult stealer improves loading features, spreads alongside ransomware in new campaign ks/AZORULT Malware Information .Win32.Azorult/campaignAZORult Trojan Uses Fake ProtonVPN Installer to Disguise Attacks distribute-chthonic-bankingtrojanKaspersky Threats: TROJAN-PSW.WIN32.AZORULT ng-credential-and.htmlThreat Actors Using Legitimate PayPal Accounts To Distribute Chthonic Banking Trojan -stealer-smokeloader-etc/Let's Learn: Reversing Credential and Payment Card Information Stealer 'AZORult V2' 58-follow-up-malwareis-azorult-stealer/The Seamless Campaign Drops Ramnit. Follow-up Malware: AZORult Stealer, Smoke Loader, etc. orultcampaignTrend Micro: AZORULT Malware Information /202016
TLP:WHITEReferences Malicious coronavirus map hides AZORult info-stealing malware Battling online coronavirus scams with facts https://attack.mitre.org/software/S0344/AZORULT VERSION 2: ATROCIOUS SPYWARE INFECTION USING 3 IN 1 RTF DOCUMENT re-analysis/azorult-loader-stages/MITRE: AZORult https://vk-intel.org/2017/07/Azorult loader stages protocol/Reverse Engineering, Malware Deep Insight ersteal-sensitive-data/AZORult Malware Abusing RDP Protocol To Steal the Data by Establish a Remote Desktop Connection e-update/CB TAU Threat Intelligence Notification: Common to Russian Underground Forums, AZORult Aims to Connect to C&C Server, Steal Sensitive Data ks/Azorult Trojan Steals Passwords While Hiding as Google Update -technique/152508/AZORult Trojan Uses Fake ProtonVPN Installer to Disguise Attacks s/AZORult Campaign Adopts Novel Triple-Encryption Technique sing-3-1-rtf-document/AZORult : Rewriting history 922/ TROJAN-PSW.WIN32.AZORULT .Win32.Azorult/4/16/202017
TLP:WHITEQuestionsUpcoming Briefs COVID-19 Cyber Threats Threat Modelling for Mobile Health SystemsProduct EvaluationsRecipients of this and other Healthcare Sector Cybersecurity Coordination Center (HC3) Threat Intelligence productsare highly encouraged to provide feedback to HC3@HHS.GOV.Requests for InformationNeed information on a specific cybersecurity topic? Send your request for information (RFI) to HC3@HHS.GOV or callus Monday-Friday, between 9am-5pm (EST), at (202) 691-2110.4/16/202018
Health Sector Cybersecurity Coordination Center (HC3)BackgroundHC3 works with private and public sectorpartners to improve cybersecurity throughoutthe Healthcare and Public Health (HPH) SectorProductsSector & Victim NotificationsDirected communications to victims orpotential victims of compromises, vulnerableequipment or PII/PHI theft and generalnotifications to the HPH about currentlyimpacting threats via the HHS OIGWhite PapersThreat Briefings & WebinarDocument that provides in-depth informationon a cybersecurity topic to increasecomprehensive situational awareness andprovide risk recommendations to a wideaudience.Briefing document and presentation thatprovides actionable information on healthsector cybersecurity threats and mitigations.Analysts present current cybersecurity topics,engage in discussions with participants oncurrent threats, and highlight best practicesand mitigation tactics.Need information on a specific cybersecurity topic or want to join our listserv? Send your request forinformation (RFI) to HC3@HHS.GOV or call us Monday-Friday, between 9am-5pm (EST), at (202) 691-2110.4/21/202019
Very common; Sold on Russian hacker forums for 100 Can both be dropped or serve as a dropper (first or second stage) Constantly changing/evolving infection vectors and attack stages and capabilities Especially relevant during the Coronavirus pandemic Used in Coronavirus-theme
Trojan / Backdoor. Rootkit Malware 101. Malware 101 The famous “Love Bug” aka ”I love you” worm. Not a virus but a worm. (Filipino-made) Worms. Malware 101 Theories for self- . Rustock Rootkits Mobile Brief History of Malware. Malware 101 A malware installs itself
Kernel Malware vs. User Malware Kernel malware is more destructive Can control the whole system including both hardware and software Kernel malware is more difficult to detect or remove Many antivirus software runs in user mode lower privilege than malware cannot scan or modify malware in kernel mode
HTC Clients SBIR/STTR - 30M Company Client Status Total Funds ( )* Loan SBIR I SBIR II STTR I STTR II Agencies Archimage Former 5,019,915 1 3 HHS Aros, Inc. Graduate 423,885 3 DOD; HHS CorInnova, Inc. Graduate 248,233 2 NSF; HHS DNAtrix Former 160,632 1 HHS Endothelix Graduate 94,375 1 HHS Ensysce Biosciences, Inc. Former 298,072 1 HHS
The Health and Human Services (HHS) Enterprise Architecture (EA) Governance Plan describes the major activities of the HHS EA Prog ram and, especially, the interaction of HHS EA Program activities with related functions, processes, and initiatives within and outside HHS. The Governance Plan defines . 3.2.5 HHS Data Architecture Work Group .
Today, machine learning boosts malware detection using various kinds of data on host, network and cloud-based anti-malware components. An efficient, robust and scalable malware recognition module is the key component of every cybersecurity product. Malware recognition modules decide if an
2.the malware download ratio (percentage of all downloads of the collected apps belonging to apps that are detected as malware); 3.the survival period of malware (how long apps de-tected as malicious remain in the app store). 3.1 Data Collection F-Secure’s 2014 Theat Report covers the trends in An-droid malware over the second half of 2013 .
Anti-Malware for Mac User Guide 1 About Malwarebytes Anti-Malware for Mac Malwarebytes Anti-Malware for Mac is an application for Mac OS X designed to remove malware and adware from your computer. It is very simple to use, and for most problems, should clean up your system in less than a minute, from start to finish.Just open
The anatomy and physiology Topic text is clearly and concisely written, and is presented in easily digestible units of information to help facilitate learning. SE GIDE: PIMAL’S 3D HMA AATOM AD PHSIOLOG Page 10 of 31. SLIDE USER GUIDE: PRIMALS 3D HUMAN ANATOMY AND PHYSIOLOGY Page 11 of 31 MOVIE SLIDE – DIAGRAM SLIDE – ILLUSTRATION SLIDE – PHOTOGRAPH SLIDE – STATIC 3D IMAGE The View .
