Alchimist: A new attack framework in Chinese for Mac, Linux and Windows
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-4034 | Out-of-Bounds Read/Write Local Privilege Escalation in polkit pkexec (PwnKit) | 7.8 | 95% | KEVRansomwarePoC ×4 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | down.sct | f infections. One of these scripts was found with the name "down[.]sct." The script launches a WScript[.]shell object to run a P |
| domain | wscript.shell | was found with the name "down[.]sct." The script launches a WScript[.]shell object to run a PowerShell command and download the Insek |
| domain | www.apple.com | lhost 23 localhost 445 localhost 139 www[.]google[.]com 443 www[.]apple[.]com 443 github[.]com 443 Apart from these capabilities, the |
| domain | www.google.com | st 22 localhost 80 localhost 23 localhost 445 localhost 139 www[.]google[.]com 443 www[.]apple[.]com 443 github[.]com 443 Apart from t |
| ipv4 | 149.28.36.160 | e same certificate: 149[.]28[.]54[.]212 95[.]179[.]246[.]73 149[.]28[.]36[.]160 45[.]76[.]68[.]112 3[.]86[.]255[.]88 Our analysis rev |
| ipv4 | 149.28.54.212 | — we discovered five hosts containing the same certificate: 149[.]28[.]54[.]212 95[.]179[.]246[.]73 149[.]28[.]36[.]160 45[.]76[.]68[ |
| ipv4 | 18.167.90.252 | host and the port details for the shell code to connect to 18[.]167[.]90[.]252, providing Talos with one more piece of the operator' |
| ipv4 | 3.86.255.88 | 95[.]179[.]246[.]73 149[.]28[.]36[.]160 45[.]76[.]68[.]112 3[.]86[.]255[.]88 Our analysis revealed that the backdoors communicated |
| ipv4 | 45.32.132.166 | Shell command and download the Insekt implant from http[://]45[.]32[.]132[.]166/msconfig[.]zip. Shellcode A meterpreter shellcode was |
| ipv4 | 45.76.68.112 | 149[.]28[.]54[.]212 95[.]179[.]246[.]73 149[.]28[.]36[.]160 45[.]76[.]68[.]112 3[.]86[.]255[.]88 Our analysis revealed that the back |
| ipv4 | 95.179.246.73 | hosts containing the same certificate: 149[.]28[.]54[.]212 95[.]179[.]246[.]73 149[.]28[.]36[.]160 45[.]76[.]68[.]112 3[.]86[.]255[. |
| sha1 | 61b0feca645af9296aa422d2c289e1d13593dbb6 | mmand and control The certificate shows the serial number — 61b0feca645af9296aa422d2c289e1d13593dbb6 — and fingerprint — 134a3d105eef24fab27ed0fb3729e271306bde6 |
| sha256 | 134a3d105eef24fab27ed0fb3729e271306bde6dc4e9d2a4a5c5d1c82b0390fe | 1b0feca645af9296aa422d2c289e1d13593dbb6 — and fingerprint — 134a3d105eef24fab27ed0fb3729e271306bde6dc4e9d2a4a5c5d1c82b0390fe — we discovered five hosts containing the same certificate: |
From the original article
12 min read at blog.talosintelligence.com
Cisco Talos discovered a new attack framework including a command and control (C2) tool called "Alchimist" and a new malware "Insekt" with remote administration capabilities. The Alchimist has a web interface in Simplified Chinese with remote administration features. The attack framework is designed to target Windows, Linux and Mac machines.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.