_re_fox

[_re_fox @_re_fox]

@StopMalvertisin @malwrhunterteam @1ZRR4H @luigi_martire94 Quick decode of AES encrypted shellcode: https://t.co/lnbiNNnffw

Resolves wininet and posts to updatebkav[.]cf via HttpSendRequestA

[_re_fox @_re_fox]

#malware #DOUBLEBACK
c41e2c2cc5843cedd79162c73787d4de

XOR key for config: 0x000001bf
C2:
https://greeklife242[.]com/admin8/client.php
https://cdnprojects[.]net/admin8/client.php

[_re_fox @_re_fox]

@Ledtech3 Looks like this one was already captured -> https://t.co/V5bxERQ3dm

[. @__0XYC__]

e793f991f7efc2dc49a1e43165bd64a01e0ce35f0f529171f7fefff3cf994f54

IDEAS 2022.doc

hxxp://log.bookservices.xyz

#APT

[_re_fox @_re_fox]

#malware rtf template injection
IDEAS 2022.doc - 35eadf808d958c01bd4b6b18a3ade34e

Template -> http://log[.]bookservices[.]xyz/Ods9Z6420zj7Y9H3/OsVoOaari3CP2x4i.php

[_re_fox @_re_fox]

Copy of template: a2b3599d36c2ab1317b4560931f689cb

https://t.co/BFAXbG80SK

[_re_fox @_re_fox]

#malware template injection
17efa6a9b3547aaad4588c07f9773e6a - (
ගුවන් හමුදා සේවා පුද්ගලයින් අනුයුක්ත කර ගැනීම.doc)

Template: http://records.hibiscus[.]live/NDnD7RdekyhSrhPE/KOighzucGWiCq6hR.php

146.70.29[.]251

[_re_fox @_re_fox]

client_socket C2: 178.18.249.42:8082
command execution and the following built in commands:
- pg - send "ok"
- cd - chdir
- ls - listdir
- lldf - sendFile
- llda - sendAllFiles
- lldd - sendDirectoryFiles

[_re_fox @_re_fox]

Linux .desktop entry #malware
09857e9e3676ee079de645e7dd4a65ec - Def_Coop_Mtg.odt.desktop

Decoy: http://www.mea[.]gov[.]in/Portal/CountryNews/11790_Press_Statement_EAM_visit_5_September.docx

DL and exec: http://178.18.249[.]42/mtg.sh ->
http://178.18.249[.]42/calendar

[_re_fox @_re_fox]

calendar - b87cd60214a804b29ab091b73e864884 (pyinstaller)

Entrypoint: client_socket.pyc

[_re_fox @_re_fox]

@RedDrip7 b1faaf95061f03b27c523b0fdf3b3d46

Observed at: https://www.incometaxdelhi[.]org/gallery/images/ssmx.rar

C2: 62.171.187.53

[_re_fox @_re_fox]

@James_inthe_box @InQuest @lazyactivist192 @VK_Intel Other related infra based on decoded data

https://195.123.211[.]5:443
ttps://194.15.113[.]116:443
https://52.91.135[.]7:443
https://54.144.144[.]42:443
restinaustraliaplace[.]bazar
sightsofsydney21[.]bazar
australiatourism[.]bazar

Notes: https://t.co/eu042YNPFv

[_re_fox @_re_fox]

And another c069fa3ee33e661dcb6a27c89548a487 (李彤彤简历-90sec.docx)

Template Injection -> http://167.179.70[.]183:8080/diaoyu.dotm

[_re_fox @_re_fox]

#malware #cobaltstrike
8bb1f74efaa8b736764b38e8f50706e8 (新建文件夹 (2).docx)
Template Injection -> http://rainy-autumn[.]top/Doc1.dotm (91b39d68a67bb067209faebf8bb25dee) containing macro with shellcode

C2: 81.70.203[.]138/onJ5

[_re_fox @_re_fox]

#malware #cobaltstrike
Same decoy 745eecaf3a17d34de29fbe990df899af (好东西.docx)
Template Injection -> http://121.196.184[.]210:8000/123.docm

[_re_fox @_re_fox]

@500mk500 @ShadowChasing1 Another one for you
Звіт.docx
bc37ae799db5bcdaedd51bdeccd5e01d

http://proteug[.]ru/BINGO/pry.dot

[_re_fox @_re_fox]

@ShadowChasing1 Good Catch, I missed your notification.

[_re_fox @_re_fox]

@500mk500 @ShadowChasing1 I was looking into this one as well.

Some referenced remote templates ->
http://mycodar[.]ru/BINGO/luncheon.dot
http://mycodar[.]ru/BINGO/presumably.dot
http://aerogenosa[.]ru/BINGO/luncheon.dot
http://aerogenosa[.]ru/BINGO/presumably.dot

[_re_fox @_re_fox]

#malware Call-for-Proposal-DGSP-COAS-Chair-Excellance[.]zip
Containing #lnk 261fa3263efc672ed853c7b327b64d70

mshta -> iiieyehealth[.]com

Drops winidr.exe (76f427732d65127b631822e84158fab3)
C2 http://161.97.142[.]96/htt_p

https://t.co/wDV3HcbE6v

[_re_fox @_re_fox]

#malware #lnk COVID_19_Test_Result.zip

Containing LNK (Password_Document.xml_;.lnk) that launches pass.vbs (b73cfb56875355db0cea8b3b0b251a2f)

C2: transfermychoice[.]com (129.146.45[.]144)

[_re_fox @_re_fox]

Similar decoy 380726ce279bf46bb942732b246272a1 (resume.docx)
Template Injection -> https://fort-communications[.]com/view/index.php (1c15a93806ee6bfa079cb5f92b61ff58)

Drops license.vbs (ad08b919f3f427e082128739cf72447e)

C2: adsclickboost[.]com/key/license/gate.php

[_re_fox @_re_fox]

#APT #Gamaredon
(b059248480fe52bb07296d0b67ffaf88) arhiv.rar containing Microsoft Word Document.docx.lnk (aefc6e9a78a78fcde75a1fd64e6c0c61)

mshta -> email-gov[.]site/puzzled/updates.html