Malwaremedium
SteelFox Trojan imitates popular products to drop stealer and miner malware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-14979 | The WinRing0.sys and WinRing0x64.sys drivers 1.2.0 in EVGA Precision X1 through 1.0.6 allow local users, including low integrity processes, to read and write… | 7.8 | <1% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ankjdans.xyz | urce\dll\sys\lib\amd64\WinRing0.pdb Domains and IPs hxxps://ankjdans[.]xyz 205.185.115[.]5 Malicious URLs hxxps://github[.]com/David |
| domain | cloudstaymoon.com | n67/CrackJetbrains/main/jetbrains-activator.exe hxxps://www.cloudstaymoon[.]com/2024/05/06/tools-1 hxxps://squarecircle[.]ru/Intelij/jetb |
| domain | squarecircle.ru | hxxps://www.cloudstaymoon[.]com/2024/05/06/tools-1 hxxps://squarecircle[.]ru/Intelij/jetbrains-activator.exe hxxps://drive.google[.]co |
| ipv4 | 205.185.115.5 | b\amd64\WinRing0.pdb Domains and IPs hxxps://ankjdans[.]xyz 205.185.115[.]5 Malicious URLs hxxps://github[.]com/DavidNguyen67/CrackJe |
| md5 | 015595d7f868e249bbc1914be26ae81f | b171541c8251651cabe1364b7b6 FoxitPDFEditorUpdateService.exe 015595d7f868e249bbc1914be26ae81f 0947cca1b5509f1363da20a0a3640700 040dede78bc1999ea62d1d044e |
| md5 | 040dede78bc1999ea62d1d044ea5e763 | d7f868e249bbc1914be26ae81f 0947cca1b5509f1363da20a0a3640700 040dede78bc1999ea62d1d044ea5e763 0ce3775fbfbe8f96e769822538c9804c 051269b1573f72a2355867a659 |
| md5 | 051269b1573f72a2355867a65979b485 | e78bc1999ea62d1d044ea5e763 0ce3775fbfbe8f96e769822538c9804c 051269b1573f72a2355867a65979b485 0f2f104dcc4a6c7e3c258857745d70fb 08fa6ebc263001658473f6a968 |
| md5 | 08fa6ebc263001658473f6a968d8785b | b1573f72a2355867a65979b485 0f2f104dcc4a6c7e3c258857745d70fb 08fa6ebc263001658473f6a968d8785b 11caf769c0fb642bbb3daa63e516ca54 d5290ba0cd8529032849ae567f |
| md5 | 0947cca1b5509f1363da20a0a3640700 | PDFEditorUpdateService.exe 015595d7f868e249bbc1914be26ae81f 0947cca1b5509f1363da20a0a3640700 040dede78bc1999ea62d1d044ea5e763 0ce3775fbfbe8f96e769822538 |
| md5 | 0ce3775fbfbe8f96e769822538c9804c | a1b5509f1363da20a0a3640700 040dede78bc1999ea62d1d044ea5e763 0ce3775fbfbe8f96e769822538c9804c 051269b1573f72a2355867a65979b485 0f2f104dcc4a6c7e3c25885774 |
| md5 | 0f2f104dcc4a6c7e3c258857745d70fb | 5fbfbe8f96e769822538c9804c 051269b1573f72a2355867a65979b485 0f2f104dcc4a6c7e3c258857745d70fb 08fa6ebc263001658473f6a968d8785b 11caf769c0fb642bbb3daa63e5 |
| md5 | 11caf769c0fb642bbb3daa63e516ca54 | 4dcc4a6c7e3c258857745d70fb 08fa6ebc263001658473f6a968d8785b 11caf769c0fb642bbb3daa63e516ca54 d5290ba0cd8529032849ae567faba1ce e7c4e02e1da5afb56a2df09967 |
| md5 | 5029b1db994cd17f2669e73ce0a0b71a | File Hashes Payload fb94950342360aa1656805f6dc23a1a0 Loader 5029b1db994cd17f2669e73ce0a0b71a lpsad.exe 69a74c90d0298d2db34b48fa6c51e77d AGSService.exe 8 |
| md5 | 69a74c90d0298d2db34b48fa6c51e77d | 6dc23a1a0 Loader 5029b1db994cd17f2669e73ce0a0b71a lpsad.exe 69a74c90d0298d2db34b48fa6c51e77d AGSService.exe 84b29b171541c8251651cabe1364b7b6 FoxitPDFEdi |
| md5 | 84b29b171541c8251651cabe1364b7b6 | a lpsad.exe 69a74c90d0298d2db34b48fa6c51e77d AGSService.exe 84b29b171541c8251651cabe1364b7b6 FoxitPDFEditorUpdateService.exe 015595d7f868e249bbc1914be26 |
| md5 | d5290ba0cd8529032849ae567faba1ce | bc263001658473f6a968d8785b 11caf769c0fb642bbb3daa63e516ca54 d5290ba0cd8529032849ae567faba1ce e7c4e02e1da5afb56a2df0996784a9d5 d715507131bbf4ca1fe7bc4a5d |
| md5 | d715507131bbf4ca1fe7bc4a5ddfeb19 | a0cd8529032849ae567faba1ce e7c4e02e1da5afb56a2df0996784a9d5 d715507131bbf4ca1fe7bc4a5ddfeb19 e9a14ae0f7eb81346eac9d039138a7d8 dc8c18e4b729fdbf746252b2fc |
| md5 | dc8c18e4b729fdbf746252b2fc1decc5 | 7131bbf4ca1fe7bc4a5ddfeb19 e9a14ae0f7eb81346eac9d039138a7d8 dc8c18e4b729fdbf746252b2fc1decc5 f3690f597c725553b8ced0179f4f032e dc9d42902bda8d63e5858b2a06 |
| md5 | dc9d42902bda8d63e5858b2a062aecc1 | e4b729fdbf746252b2fc1decc5 f3690f597c725553b8ced0179f4f032e dc9d42902bda8d63e5858b2a062aecc1 f8f6c7d65b28b978e4f2a40158973a0c Dropper File paths C:\Prog |
| md5 | e7c4e02e1da5afb56a2df0996784a9d5 | 69c0fb642bbb3daa63e516ca54 d5290ba0cd8529032849ae567faba1ce e7c4e02e1da5afb56a2df0996784a9d5 d715507131bbf4ca1fe7bc4a5ddfeb19 e9a14ae0f7eb81346eac9d0391 |
| md5 | e9a14ae0f7eb81346eac9d039138a7d8 | 2e1da5afb56a2df0996784a9d5 d715507131bbf4ca1fe7bc4a5ddfeb19 e9a14ae0f7eb81346eac9d039138a7d8 dc8c18e4b729fdbf746252b2fc1decc5 f3690f597c725553b8ced0179f |
| md5 | f3690f597c725553b8ced0179f4f032e | e0f7eb81346eac9d039138a7d8 dc8c18e4b729fdbf746252b2fc1decc5 f3690f597c725553b8ced0179f4f032e dc9d42902bda8d63e5858b2a062aecc1 f8f6c7d65b28b978e4f2a40158 |
| md5 | f8f6c7d65b28b978e4f2a40158973a0c | 597c725553b8ced0179f4f032e dc9d42902bda8d63e5858b2a062aecc1 f8f6c7d65b28b978e4f2a40158973a0c Dropper File paths C:\Program Files (x86)\Foxit Software\Fo |
| md5 | fb94950342360aa1656805f6dc23a1a0 | re valid as at the time of publication. File Hashes Payload fb94950342360aa1656805f6dc23a1a0 Loader 5029b1db994cd17f2669e73ce0a0b71a lpsad.exe 69a74c90d |
| url | https://ankjdans.xyz | ring0\source\dll\sys\lib\amd64\WinRing0.pdb Domains and IPs hxxps://ankjdans[.]xyz 205.185.115[.]5 Malicious URLs hxxps://github[.]com/David |
| url | https://drive.google.com/file/d/1bhDBVMywFg2551oMmPO3_5VaeYnj7pe5/view?usp=sharing | 1 hxxps://squarecircle[.]ru/Intelij/jetbrains-activator.exe hxxps://drive.google[.]com/file/d/1bhDBVMywFg2551oMmPO3_5VaeYnj7pe5/view?usp=sharing hxxps://github[.]com/cppdev-123 Windows commands used by |
| url | https://github.com/cppdev-123 | m/file/d/1bhDBVMywFg2551oMmPO3_5VaeYnj7pe5/view?usp=sharing hxxps://github[.]com/cppdev-123 Windows commands used by attacker |
| url | https://github.com/DavidNguyen67/CrackJetbrains | d IPs hxxps://ankjdans[.]xyz 205.185.115[.]5 Malicious URLs hxxps://github[.]com/DavidNguyen67/CrackJetbrains hxxps://github[.]com/TrungGa123/Active-all-app-Jetbrains/ |
| url | https://github.com/TaronSargsyan123/ScaraSimulation | thub[.]com/tranquanghuy-09/activate-intellij-idea-ultimate/ hxxps://github[.]com/TaronSargsyan123/ScaraSimulation hxxps://raw.githubusercontent[.]com/tranquanghuy-09/activ |
| url | https://github.com/tranquanghuy-09/activate-intellij-idea-ultimate/ | s hxxps://github[.]com/TrungGa123/Active-all-app-Jetbrains/ hxxps://github[.]com/tranquanghuy-09/activate-intellij-idea-ultimate/ hxxps://github[.]com/TaronSargsyan123/ScaraSimulation hxx |
| url | https://github.com/TrungGa123/Active-all-app-Jetbrains/ | ious URLs hxxps://github[.]com/DavidNguyen67/CrackJetbrains hxxps://github[.]com/TrungGa123/Active-all-app-Jetbrains/ hxxps://github[.]com/tranquanghuy-09/activate-intellij-id |
| url | https://raw.githubusercontent.com/DavidNguyen67/CrackJetbrains/main/jetbrains-activator.exe | Ga123/Active-all-app-Jetbrains/main/jetbrains-activator.exe hxxps://raw.githubusercontent[.]com/DavidNguyen67/CrackJetbrains/main/jetbrains-activator.exe hxxps://www.cloudstaymoon[.]com/2024/05/06/tools-1 hxxps: |
| url | https://raw.githubusercontent.com/TaronSargsyan123/ScaraSimulation/main/jetbrains-activator.exe | ctivate-intellij-idea-ultimate/main/jetbrains-activator.exe hxxps://raw.githubusercontent[.]com/TaronSargsyan123/ScaraSimulation/main/jetbrains-activator.exe hxxps://raw.githubusercontent[.]com/TrungGa123/Active-all |
| url | https://raw.githubusercontent.com/tranquanghuy-09/activate-intellij-idea-ultimate/main/jetbrains-activator.exe | mate/ hxxps://github[.]com/TaronSargsyan123/ScaraSimulation hxxps://raw.githubusercontent[.]com/tranquanghuy-09/activate-intellij-idea-ultimate/main/jetbrains-activator.exe hxxps://raw.githubusercontent[.]com/TaronSargsyan123/Scar |
| url | https://raw.githubusercontent.com/TrungGa123/Active-all-app-Jetbrains/main/jetbrains-activator.exe | ronSargsyan123/ScaraSimulation/main/jetbrains-activator.exe hxxps://raw.githubusercontent[.]com/TrungGa123/Active-all-app-Jetbrains/main/jetbrains-activator.exe hxxps://raw.githubusercontent[.]com/DavidNguyen67/CrackJe |
| url | https://squarecircle.ru/Intelij/jetbrains-activator.exe | ator.exe hxxps://www.cloudstaymoon[.]com/2024/05/06/tools-1 hxxps://squarecircle[.]ru/Intelij/jetbrains-activator.exe hxxps://drive.google[.]com/file/d/1bhDBVMywFg2551oMmPO3_5 |
| url | https://www.cloudstaymoon.com/2024/05/06/tools-1 | m/DavidNguyen67/CrackJetbrains/main/jetbrains-activator.exe hxxps://www.cloudstaymoon[.]com/2024/05/06/tools-1 hxxps://squarecircle[.]ru/Intelij/jetbrains-activator.exe |
From the original article
10 min read at securelist.com
In August 2024, our team identified a new crimeware bundle, which we named “SteelFox”. Delivered via sophisticated execution chains including shellcoding, this threat abuses Windows services and drivers. It spreads via forums posts, torrent trackers and blogs, imitating popular software like Foxit PDF Editor and AutoCAD.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.