Analisi di KrustyLoader

Questo repository contiene risorse relative all'analisi effettuata su KrustyLoader e disponibili in questo post del blog: https://www.synacktiv.com/publications/krustyloader-rust-malware-linked-to-ivanti-connectsecure-compromises.

uno script Python per estrarre e decrittare l'URL utilizzato dal downloader per ottenere payload aggiuntivi
e una regola YARA per rilevare altri campioni di KrustyLoader

IOC

IOC da Volexity: https://github.com/volexity/threat-intel/blob/main/2024/2024-01-18%20Ivanti%20Connect%20Secure%20pt3/indicators/iocs.csv
Per ogni riga:
- Lo sha256sum del campione
- L'URL contattato dal campione per recuperare la backdoor Sliver
- Il nome di dominio C2 di Sliver

sha256	Stage URL	Sliver C2
47ff0ae9220a09bfad2a2fb1e2fa2c8ffe5e9cb0466646e2a940ac2e0cf55d04	`hxxp://blog-app-system2.s3.amazonaws[.]com/CGK63gVfWs52h`	`hxxps://update.sysupdates[.]org`
816754f6eaf72d2e9c69fe09dcbe50576f7a052a1a450c2a19f01f57a6e13c17	`hxxp://beansdeals-static.s3.amazonaws[.]com/1vzo0KenG4IKN`	`hxxps://api.farstream[.]org`
c26da19e17423ce4cb4c8c47ebc61d009e77fc1ac4e87ce548cf25b8e4f4dc28	`hxxp://breaknlinks.s3.amazonaws[.]com/Bx8DH5OhdG3hY`	`hxxps://ntp.sysupdates[.]org`
c7ddd58dcb7d9e752157302d516de5492a70be30099c2f806cb15db49d466026	`hxxp://be-at-home.s3.ap-northeast-2.amazonaws[.]com/2ekjMjslSG9uI`	`hxxps://music.farstream[.]org`
d14122fa7883b89747f273c44b1f71b81669a088764e97256f97b4b20d945ed0	`hxxp://acapros-app.s3-us-west-2.amazonaws[.]com/Z0RM2DsTiBrmb`	Forbidden 403 on Stage Host
6f684f3a8841d5665d083dcf62e67b19e141d845f6c13ee8ba0b6ccdec591a01	`hxxp://acapros-app.s3-us-west-2.amazonaws[.]com/Lf6ceJhYiO7w4`	Forbidden 403 on Stage Host
a4e1b07bb8d6685755feca89899d9ead490efa9a6b6ccc00af6aaea071549960	`hxxp://bbr-promo.s3.amazonaws[.]com/NWEUW983Ve4g1`	`hxxps://update.sysupdates[.]org`
ef792687b8bcd3c03bed4b09c4722bba921536802afe01f7cdb01cc7c3c60815	`hxxp://bigtimeassets.s3.amazonaws[.]com/sTj9glpy3JMw5`	`hxxps://music.farstream[.]org`
76902d101997df43cd6d3ac10470314a82cb73fa91d212b97c8f210d1fa8271f	`hxxp://ahha-asset.s3.ap-northeast-2.amazonaws[.]com/7J0WhInu49Teg`	`hxxps://ntp.sysupdates[.]org`
e47b86b8df43c8c1898abef15b8b7feffe533ae4e1a09e7294dd95f752b0fbb2	`hxxp://bringthenoiseappnew.s3.amazonaws[.]com/mi1FLmycM4of4`	`hxxps://check.sysupdates[.]org`
73657c062a7cc50a3d51853ec4df904bcb291fdc9cdd08eecaecb78826eb49b6	`hxxp://2261992.s3.amazonaws[.]com/kvdoEAH0y495p`	`hxxps://video.farstream[.]org`

Elenco degli IOC formattato per un facile copia/incolla (grazie Ivan!):

hxxp://blog-app-system2.s3.amazonaws[.]com/CGK63gVfWs52h
hxxp://beansdeals-static.s3.amazonaws[.]com/1vzo0KenG4IKN
hxxp://breaknlinks.s3.amazonaws[.]com/Bx8DH5OhdG3hY
hxxp://be-at-home.s3.ap-northeast-2.amazonaws[.]com/2ekjMjslSG9uI
hxxp://acapros-app.s3-us-west-2.amazonaws[.]com/Z0RM2DsTiBrmb
hxxp://acapros-app.s3-us-west-2.amazonaws[.]com/Lf6ceJhYiO7w4
hxxp://bbr-promo.s3.amazonaws[.]com/NWEUW983Ve4g1
hxxp://bigtimeassets.s3.amazonaws[.]com/sTj9glpy3JMw5
hxxp://ahha-asset.s3.ap-northeast-2.amazonaws[.]com/7J0WhInu49Teg
hxxp://bringthenoiseappnew.s3.amazonaws[.]com/mi1FLmycM4of4
hxxp://2261992.s3.amazonaws[.]com/kvdoEAH0y495p
hxxp://bringthenoiseappnew.s3.amazonaws[.]com/iEgJ4J7Uc9YgC
hxxps://update.sysupdates[.]org
hxxps://api.farstream[.]org
hxxps://ntp.sysupdates[.]org
hxxps://music.farstream[.]org
hxxps://update.sysupdates[.]org
hxxps://music.farstream[.]org
hxxps://ntp.sysupdates[.]org
hxxps://check.sysupdates[.]org
hxxps://video.farstream[.]org

Copyright

2024 - Théo Letailleur, Synacktiv

Licenza

I contenuti di questo repository sono disponibili sotto licenza AGPL

Contatti

Théo Letailleur: [email protected]
CSIRT Synacktiv: [email protected]

krustyloader-analysis

Più Popolari