Phish Stix

Just a phish

[Gen Threat Labs @GenThreatLabs]

A WMI subscription named "Realtek" started a 12 KB backdoor at 19:50, and it never exited. It read its C2 domain by counting spaces in a fake desktop.ini, then called a domain its operator stopped paying for in July 2021.

It kept trying for 11 months.

Read more -> https://t.co/z7SSDdpWAq

[Phish Stix @StixPhish]

@JasonAtwell14 An unappreciated field of endeavor...

[Phish Stix @StixPhish]

@dreamfallart Yep

[Phish Stix @StixPhish]

@500mk500 The logo seems to associate it to Yacht, an open source tool for managing Docker containers.

[James Northey @darkrym11]

Found some very common adware quietly killing antivirus products. Then we found an unregistered update domain, and anyone with $10 could have pushed any payload to 25,000+ endpoints, AV already disabled.

So we registered it first.

https://t.co/WMSaym7yOu

Big thanks to @_rdowd

[Phish Stix @StixPhish]

@JasonAtwell14 Nah these are just the new gut trucks at Benning...

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft Defender researchers observed attackers using yet another evasion approach to the ClickFix technique: Asking targets to run a command that executes a custom DNS lookup and parses the `Name:` response to receive the next-stage payload for execution.

[Phish Stix @StixPhish]

@curi0usJack Seems pretty decent to me. Requires active management tho. Muting all pol keywords and irrelevant mainstream garbage, etc. Engaging on quality sources to tune algo.

I get more actionable info from here than most of the 6 fig platforms out there.

[Phish Stix @StixPhish]

@luke92881 @s1dhy @SquiblydooBlog @andrewdanis @banthisguy9349 @struppigel Seeing several associated files under same signer:
Uninstall.exe
7zipinstall.exe
7z.exe
7zG.exe

Also observed same wild network traffic.
Connections to hero-sms and smshero domains.

Anybody nail down the sms piece yet?

[Phish Stix @StixPhish]

@luke92881 @SquiblydooBlog Seeing installs as App.exe and free-pdf-creator.exe as well

[Squiblydoo @SquiblydooBlog]

From 2020-2024, I tracked the SolarMarker malware, and in 2024, monitored a self-infection for months to learn their actions-on-objectives: on-device fraud.

I didn't publish the details of my months long investigation until now. Check the link the the attached comment.

[Phish Stix @StixPhish]

@HackingLZ @ex_raritas @Huntio +1 for huntio. Especially after Censys changed its business model to exclude us poors.

[Phish Stix @StixPhish]

@Osinttechnical And they just got popped by Kyber ransomware. That's weird...

[Phish Stix @StixPhish]

@SquiblydooBlog @malwaremarcus @struppigel @InvokeReversing My samples are gone but looks there's a handful on VT searching by name. Signer seen in VT samples, Pixel Catalyst Media LLC, also associated with AllManualsReader

[Phish Stix @StixPhish]

@malwaremarcus @SquiblydooBlog @struppigel @InvokeReversing These references should help. App names can vary but from what I've seen they're all mostly the same under the hood.
https://t.co/Oe5as4Wenm
https://t.co/o06KKjmViy

[Phish Stix @StixPhish]

@DoingFedTime https://t.co/OeKrfTDm44

[Phish Stix @StixPhish]

@SquiblydooBlog @struppigel @InvokeReversing Similar activity from PDF themed apps turbofixpdf, effortlesspdf, and Manual Reader themed apps usermanualsonline, allmanualsreader, manualreaderpro, getmanualviewer, openmymanual. Node.exe launches malicious js files

Many using same api.(RandomNumCharString).com format C2 URLs

[Phish Stix @StixPhish]

@Cyberknow20 @solostalking is correct. They advertised the new alphv imposter channel on the Babuk 2.0 channel.

[Phish Stix @StixPhish]

@DanLinnaeus I fail to see how this is indicative of any desire by the subject to associate with potentially questionable entities rather than simply evidence of PRC's widespread infiltration and influence across US society in general.

[Phish Stix @StixPhish]

@Malware_Brandon Great thread. Outstanding work. Thanks for sharing!