Ransomwarehigh
Microsoft Exchange vulnerabilities exploited once again for ransomware, this time with Babuk
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-36942 | Unauthenticated LSA Spoofing (PetitPotam NTLM Relay) in Microsoft Windows | 7.5 | 66% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ctemplar.com | Et4AKCre9MeiqtiR51Lvg2X8dXv1tP7nxLaEHKKQ Email IDs mitnickd@ctemplar[.]com zar8b@tuta[.]io Hashes Stage - 1 Downloader 47033d071e1c7 |
| domain | fbi.fund | . The download server is hosted using the malicious domains fbi[.]fund and xxxs[.]info. The initial packed loader module contain |
| domain | pastebin.pl | xxp://185[.]219[.]52[.]229:8080/vefEPjwOdNF9qNw.hta hxxps://pastebin[.]pl/view/raw/a57be2ca Mutex DoYouWantToHaveSexWithCuongDong W |
| domain | tuta.io | 2X8dXv1tP7nxLaEHKKQ Email IDs mitnickd@ctemplar[.]com zar8b@tuta[.]io Hashes Stage - 1 Downloader 47033d071e1c79cc03f8b4081f5f6 |
| domain | xxxs.info | server is hosted using the malicious domains fbi[.]fund and xxxs[.]info. The initial packed loader module contains encrypted .NET |
| ipv4 | 168.119.93.163 | ns fbi[.]fund xxxs[.]info IP addresses 185[.]219[.]52[.]229 168[.]119[.]93[.]163 54[.]221[.]65[.]242 URLs hxxp://fbi.fund/tortillas/to |
| ipv4 | 185.219.52.229 | According to Shodan, the download server at the IP address 185[.]219[.]52[.]229 is located in Moscow, Russia and runs OpenSSH and Pyt |
| ipv4 | 54.221.65.242 | info IP addresses 185[.]219[.]52[.]229 168[.]119[.]93[.]163 54[.]221[.]65[.]242 URLs hxxp://fbi.fund/tortillas/tortilla.exe hxxp://fb |
| sha1 | 21d354a27519dd62b328416bab01767da94786cb | which we cannot verify. The thumbprint of the signature is:21D354A27519DD62B328416BAB01767DA94786CB. The same certificate is used by the actor to sign samples |
| sha256 | 07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235 | 1126e80ef078e29e10379722b49 Samples from previous campaigns 07fb7b42fe8d4a2125df459efd86de0f27b91b59d82b85b530c1e7c552c9e235 Most notable MITRE ATT&CK framework tactics and techniques |
| sha256 | 08d799cc27063bc7969ae935ca171b518d0b41b1feaa9775bae06bd319291b41 | t Stage -2 Swrort variant containing the ransomware payload 08d799cc27063bc7969ae935ca171b518d0b41b1feaa9775bae06bd319291b41 5f35dbf807c844c790b9cffc9f83eca05d32f58b737ba638c9567b8d221 |
| sha256 | 0994c1fc7f66f88eead2091f31a2137f69d08c3cf9ee0f4a15a842f54253c9d9 | 4c85e241efbbe326051999b9a8e1d8eeb9a3322da5cb9a93c31c65bbb49 0994c1fc7f66f88eead2091f31a2137f69d08c3cf9ee0f4a15a842f54253c9d9 Payload bd26b65807026a70909d38c48f2a9e0f8730b1126e80ef078e2 |
| sha256 | 1d28c4c85e241efbbe326051999b9a8e1d8eeb9a3322da5cb9a93c31c65bbb49 | bf807c844c790b9cffc9f83eca05d32f58b737ba638c9567b8d22119f96 1d28c4c85e241efbbe326051999b9a8e1d8eeb9a3322da5cb9a93c31c65bbb49 0994c1fc7f66f88eead2091f31a2137f69d08c3cf9ee0f4a15a842f5425 |
| sha256 | 47033d071e1c79cc03f8b4081f5f6d470d45e32a90b06ee96bfe6c3df2f47d40 | @ctemplar[.]com zar8b@tuta[.]io Hashes Stage - 1 Downloader 47033d071e1c79cc03f8b4081f5f6d470d45e32a90b06ee96bfe6c3df2f47d40 - DLL downloader 56b7e6dd46e38a30ead82790947a425661ad893f54 |
| sha256 | 56b7e6dd46e38a30ead82790947a425661ad893f54060381c9b76616c27d3b9f | 081f5f6d470d45e32a90b06ee96bfe6c3df2f47d40 - DLL downloader 56b7e6dd46e38a30ead82790947a425661ad893f54060381c9b76616c27d3b9f - DLL downloader 752d66990097c8be7760d8d6011b1e91daa1d55189 |
| sha256 | 5f35dbf807c844c790b9cffc9f83eca05d32f58b737ba638c9567b8d22119f96 | 9cc27063bc7969ae935ca171b518d0b41b1feaa9775bae06bd319291b41 5f35dbf807c844c790b9cffc9f83eca05d32f58b737ba638c9567b8d22119f96 1d28c4c85e241efbbe326051999b9a8e1d8eeb9a3322da5cb9a93c31c65 |
| sha256 | 752d66990097c8be7760d8d6011b1e91daa1d5518951d86f9fdf3d126d54872a | 90947a425661ad893f54060381c9b76616c27d3b9f - DLL downloader 752d66990097c8be7760d8d6011b1e91daa1d5518951d86f9fdf3d126d54872a - EfsPotato variant Stage -2 Swrort variant containing the |
| sha256 | bd26b65807026a70909d38c48f2a9e0f8730b1126e80ef078e29e10379722b49 | 88eead2091f31a2137f69d08c3cf9ee0f4a15a842f54253c9d9 Payload bd26b65807026a70909d38c48f2a9e0f8730b1126e80ef078e29e10379722b49 Samples from previous campaigns 07fb7b42fe8d4a2125df459efd8 |
| url | http://185.219.52.229:8080/vefEPjwOdNF9qNw.hta | tortillas/tore.exe hxxp://185[.]219[.]52[.]229/tortilla.exe hxxp://185[.]219[.]52[.]229:8080/vefEPjwOdNF9qNw.hta hxxps://pastebin[.]pl/view/raw/a57be2ca Mutex DoYouWa |
| url | http://185.219.52.229/tortilla.exe | tortilla.exe hxxp://185[.]219[.]52[.]229/tortillas/tore.exe hxxp://185[.]219[.]52[.]229/tortilla.exe hxxp://185[.]219[.]52[.]229:8080/vefEPjwOdNF9qNw.hta |
| url | http://185.219.52.229/tortillas/tore.exe | tore.exe hxxp://185[.]219[.]52[.]229/tortillas/tortilla.exe hxxp://185[.]219[.]52[.]229/tortillas/tore.exe hxxp://185[.]219[.]52[.]229/tortilla.exe hxxp://185[. |
| url | http://185.219.52.229/tortillas/tortilla.exe | ://fbi[.]fund/dark.exe hxxp://fbi[.]fund/tortillas/tore.exe hxxp://185[.]219[.]52[.]229/tortillas/tortilla.exe hxxp://185[.]219[.]52[.]229/tortillas/tore.exe hxxp:/ |
| url | http://fbi.fund/dark.exe | PowerShell command to download the next stage's loader from hxxp://fbi[.]fund/dark.exe, which is the main packed module containing the final pay |
| url | http://fbi.fund/tortillas/ | nvokes a web request to connect to the malicious repository hxxp://fbi[.]fund/tortillas/ using the Invoke-WebRequest commandlet and certutil.exe t |
| url | http://fbi.fund/tortillas/tore.exe | /fbi.fund/tortillas/tortilla.exe hxxp://fbi[.]fund/dark.exe hxxp://fbi[.]fund/tortillas/tore.exe hxxp://185[.]219[.]52[.]229/tortillas/tortilla.exe hxxp:/ |
| url | http://fbi.fund/tortillas/tortilla.exe | 19[.]52[.]229 168[.]119[.]93[.]163 54[.]221[.]65[.]242 URLs hxxp://fbi.fund/tortillas/tortilla.exe hxxp://fbi[.]fund/dark.exe hxxp://fbi[.]fund/tortillas/tore |
| url | https://pastebin.pl/view/raw/a57be2ca | la.exe hxxp://185[.]219[.]52[.]229:8080/vefEPjwOdNF9qNw.hta hxxps://pastebin[.]pl/view/raw/a57be2ca Mutex DoYouWantToHaveSexWithCuongDong Wallet 46zdZVRjm9XJ |
From the original article
12 min read at blog.talosintelligence.com
By Chetan Raghuprasad and Vanja Svajcer , with contributions from Caitlin Huey . Cisco Talos recently discovered a malicious campaign deploying variants of the Babuk ransomware predominantly affecting users in the U. S.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.