Malware Research

23 Dec 2024 11:29

https://charlie.fish/posts/2023/10/creating-dark-web-tor-onion-service-website/

I think this should give some ideas for detection

I'm just curious how it would port over to Windows... since most infostealers are Windows malware 😬

you might see BYOS - Bring Your Own Servers 🫣

Malware Research

23 Dec 2024 11:14

That's always the case 😄

Malware Research

23 Dec 2024 11:14

App bound encryption is already being targeted. A lot of stealers have updated their code. Some got forced by their customers to update it.

Malware Research

23 Dec 2024 11:08

but whether there's undisclosed vulnerabilities around device based session credentials is unknown to me, since it's an open source project and everyone can study its codes for vulnerabilities

Malware Research

23 Dec 2024 11:05

Some of the channel here in telegram claim that they have bypassed device bound session credentials. I am not sure how they have done it.

Malware Research

23 Dec 2024 10:18

At some point they will catch it, even if not 100%

But whether you can answer questions your government throws at you is a different matter, especially for regulated or critical information operators, or in the case of data breaches, which would likely apply to all companies where there's relevant laws

Malware Research

23 Dec 2024 09:57

And realistically speaking, attackers seldom just exfiltrate from one system

There's usually multiple systems that they exfiltrate from. So will there be multiple Tor servers created or just one?

If there's multiple Tor servers because every infected system will be installed with one server, then the TA needs a system to manage all the servers. It could present interesting incoming and outgoing paths

Malware Research

23 Dec 2024 09:50

From network management view, if both incoming and outgoing Tor traffic, then this method might not work

But if only outgoing Tor traffic is blocked, it could make things interesting for detection and data analysis, e.g. why is there so much incoming traffic to this system?

Malware Research

23 Dec 2024 06:47

From the interview, the impression i get is that they would start tor service on the system and make it available as an open directory. The attacker can browse all the files in the system and download them by making get request.

Malware Research

23 Dec 2024 00:18

please read the quoted message for the context

Malware Research

22 Dec 2024 20:02

In the interview, 2 methods are mentioned tor and using preconfiged vpn.

As far as i know, one can detect and block tor network traffic in their environment.

Maybe one can check if a vpn is connection is being made. If they can then easily allow the ones that are used in the environment. I am not sure about this though.


Also, stealers these days need to bypass chromium's app bound encryption. To do that, you need to execute the code on the system. Some try to start chrome in headless mode and try to steal it.

So, I don't think you can get cookies using it. Passwords and files maybe. Although it needs to be decrypted using dpapi which is not possible to do so on server side.

It would be good if any vendor has caught this in action and can confirm. Otherwise it seems like a misdirection.

Malware Research

22 Dec 2024 16:29

Have you guys read the latest interview of pryx by hudsonRock ? He talks about server side stealers where the victim's system is turned into an onion server. The attacker gets the onion addresses and then performs get request in order to exfiltrate files from it.

I wonder why would anyone openly talk about their new technique?

Malware Research

22 Dec 2024 11:02

May I ask to download this file from VT? Big thanks

https://www.virustotal.com/gui/file/58ba4b98bb43ee953ef9fdb02bcc9594b368fe83963b1975130ba58a5112317e/detection

Malware Research

21 Dec 2024 09:35

Hello Cho, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

21 Dec 2024 03:02

🚀 Unlock the Ultimate Capital Raising Resource! 🚀

Don’t miss this one-time deal:
Master List 360 + Capital Raising Blueprint
🔥 357,300+ Investors & LPs for just $885 (down from $1,885!) 🔥

🎯 Features include:
✅ 16,000+ Family Office records (US, Europe, Asia)
✅ 109,000+ Venture Capital records
✅ 8,000+ Private Equity records
✅ Tools for efficient fundraising: term sheets, pitch decks, and more!

📂 Explore the Sample Database here: [SAMPLE LINK]
💳 Secure Your Access Now: [PAYMENT LINK]

⏰ Offer valid until midnight tonight (Eastern U.S. Time, 12.24.2024).

📅 Prepare for 2025 with the most comprehensive and powerful investor database! Whether you're a founder, startup, or entrepreneur, this is your opportunity to start the new year with the tools to achieve your funding goals.

Start your journey to strategic and efficient fundraising today! 💼

Malware Research

23 Dec 2024 11:16

yeah. when it was initially implemented by Chrome, I think I saw chatter about it

it's also where the confusion of device bound session credentials and app bound encryption came about

Malware Research

23 Dec 2024 11:14

in short, your detection must account for various types of scenarios and users must still avoid falling for phishing

+ defense in depth

Malware Research

23 Dec 2024 11:12

by the way, if session thefts are made impossible, then I suspect app bound encryption will be very heavily targeted, so attackers will create their own sessions instead, especially if MFA can't be enforced for legacy apps/protocols

this will totally eliminate the need for device bound session credentials, and you will need other detection rules, such as multiple logins from the same user from the different IPs

Malware Research

23 Dec 2024 11:07

no idea. I have seen some confused between device bound session credentials and app bound encryption

I too initially was confused until I re-read all the relevant documentation and codes, only to find that they have bypassed app bound encryption, haha

Malware Research

23 Dec 2024 11:02

on the Chromium part - https://redcanary.com/blog/threat-intelligence/google-chrome-app-bound-encryption/

I think there would likely be some detections around this area, since vendors have seen them, though I personally have not encountered any

in the worst case scenario where cookies are stolen, assuming that the browser has device bound session credentials enabled, it could likely limit the impact if it's successful

but I suspect your processes to contain and mitigate the threat of session thefts and hijacking will be more important, because if it's successfully decrypted and there's no device bound session credentials, anything could really happen, so speed is essential, especially for critical accounts

Malware Research

23 Dec 2024 10:01

There are many questions that needs to be answered however i feel if an org has decent EDR and networking monitoring tool, then they might be able to catch it in action.

Malware Research

23 Dec 2024 09:51

Forensically, assuming that it's an active data staging server, that means they can't delete away or hide artifacts effectively. So if IR or SOC contains the threat fast enough, impact could be limited

Malware Research

23 Dec 2024 09:46

I thought they are making use of the infected system as a Tor server

So if it's a server, it becomes interesting because options are now available. But whether those options are quiet enough in an environment I don't know for sure. I'm not too sure how a Tor server works or how the TA intends for it to work to exfiltrate data

Malware Research

23 Dec 2024 00:40

Depends on how the environment uses VPN I think

But I think this is where EDR could possibly help - detection of new processes and services. Where possible, they can block unauthorized VPN executables and flag them

In Windows, it's possible that you can block such executables and only allow specific VPN executables to run

The Tor exfiltration part is unclear and it seems like there's missing info as to how it will work. But for it to completely evade detection, perhaps it's more than just creating a Tor server

Malware Research

22 Dec 2024 20:09

🤔 what's this and password

Malware Research

22 Dec 2024 17:59

Could be a psychological tactic, especially if vendors are going to talk about it, so might as well

Two, from reading the interviews, it was mentioned that the aim is to dominate the market and change how it operates, so there's probably more to come and he/she is satisfied enough that revealing it wouldn't derail it from achieving its aim, even if other threat actors start copying

Malware Research

22 Dec 2024 13:29

Hello @mahdi13968573, welcome to the Malware Research group! Please read the pinned message before you post!

Malware Research

22 Dec 2024 08:07

https://x.com/TrendMicroRSRCH/status/1870725964285571250
Discover how ANEL, a backdoor malware from APT10, has resurfaced in a spear-phishing campaign by Earth Kasha.

Malware Research

21 Dec 2024 05:56

New FedBan
Fed: Libra's Empire
FedAdmin: ❤🦦
User: 1 1
User ID: 510858141
Reason: spam

Malware Research

20 Dec 2024 22:22

github.com