Sapphire Werewolf evolves into Amethyst, a data-stealing malware that leverages legitimate Windows tools and Telegram-based C2 to exfiltrate from over 300 companies. It drops and runs Amethyst, collects browser, Telegram, and SSH-related data, archives it (password-protected), and retrieves C2 addresses via Telegram posts. #SapphireWerewolf #AmethystStealer #SapphireStealer
Keypoints
- The campaign uses a malicious dropper that copies to the folder %AppData%MicrosoftEdgeUpdate and deploys MicrosoftEdgeUpdate.exe from Resources.MicrosoftEdgeUpdate.
- Persistence is established by creating a Windows Task Scheduler task via the embedded FunnyCat.Microsoft.Win32.TaskScheduler.dll, masquerading as MicrosoftEdgeUpdateTaskMachineCore and running every 60 minutes.
- A decoy document is written to the current folder and opened to lure user execution.
- Amethyst stealer is written to VPN.exe in a temporary data folder and executed, followed by self-deletion via a command line.
- The stealer collects a wide range of data (browsers, Telegram data, PowerShell logs, and SSH/FileZilla configs) and stores it in a UUID-named folder before exfiltrating to C2.
- Exfiltration occurs through a Telegram bot C2, with the archive password-protected and notes detailing device IPs, host name, and processorID included in the archive.
MITRE Techniques
- [T1053] Scheduled Task – The attackers create a Windows Task Scheduler task using the embedded library to run the malware every 60 minutes, disguising the task as MicrosoftEdgeUpdateTaskMachineCore. “To get a foothold in the compromised system, the adversaries create a task in Windows Task Scheduler. For this purpose, they use the library embedded in the executable file, FunnyCat.Microsoft.Win32.TaskScheduler.dll. This legitimate library makes it possible to create a scheduled task without actually running schtasks. The name, description, and path to the executable file in the task are disguised as a legitimate task MicrosoftEdgeUpdateTaskMachineCore. The newly created task is executed every 60 minutes after the initial launch.”
- [T1204.002] User Execution: Malicious File – A decoy document is written into the current folder and then opened. “a decoy document is written into the current folder and then opened.”
- [T1105] Ingress Tool Transfer – The MicrosoftEdgeUpdate.exe enables the download and execution of additional files in the compromised system, including obtaining the C2 server address via a Telegram channel post. “The MicrosoftEdgeUpdate.exe file enables the download and execution of additional files in the compromised system. Same as Amethyst, the file gets the C2 server address for downloading extra files through a post in the Telegram channel.”
- [T1059.003] Windows Command Shell – The malware uses cmd.exe to perform operations, including deletion commands. “cmd.exe /C choice /C Y /N /D Y /T 3 & Del ‘[path to the current executable file]’”
- [T1070.004] File Deletion – After execution, the program deletes itself using a command line. “the following command: cmd.exe /C … Del ‘[path to the current executable file]’”
- [T1041] Exfiltration Over C2 Channel – Collected data is archived and sent to the C2 server (Telegram bot). “All these files get compressed into an archive and transmitted to the C2 server.”
- [T1119] Automated Collection – The malware automates data collection (broad set of files from multiple sources) and then exfiltrates. “The above mentioned files get archived and sent to the C2 server.”
Indicators of Compromise
- [File] MicrosoftEdgeUpdate.exe, VPN.exe – Dropper/executable files involved in the campaign
- [Directory] %AppData%MicrosoftEdgeUpdate – Drop location for the initial payload
- [Directory] %UserProfile%/Downloads/Telegram Desktop – Source of collected Telegram-related files
- [URL] http://checkip.dyndns.org, https://t.me/s/[channel ID] – Used to reveal public IP and obtain C2 server addresses
- [Library] FunnyCat.Microsoft.Win32.TaskScheduler.dll – Used to create scheduled tasks for persistence
Read more: https://bi.zone/eng/expertise/blog/sapphire-werewolf-ottachivaet-izvestnyy-stiler-dlya-novykh-atak/