ASEC Weekly Malware Statistics (January 30th, 2023 – February 5th, 2023) – ASEC BLOG

MITRE Techniques

• [T1055] Process Injection – SmokeLoader injects itself into explorer.exe; “When executed, it injects itself into explorer.exe, and the actual malicious behavior is executed by explorer.exe.”
• [T1105] Ingress Tool Transfer – SmokeLoader can download additional modules or other malware strains after connecting to the C&C server; “After connecting to the C&C server, it can download additional modules or other malware strains.”
• [T1105] Ingress Tool Transfer – BeamWinHTTP can download and install additional malware at the same time; “The malware is distributed via malware disguised as PUP installer. When it is executed, it installs PUP malware Garbage Cleaner and can download and install additional malware at the same time.”
• [T1036] Masquerading – Formbook and other loaders are distributed masquerading as legitimate software (e.g., “disguised as a cracked version of a normal program”).
• [T1056.001] Keylogging – Formbook and Quasar RAT capture keystrokes to steal credentials and sensitive data; “the malware can steal various information through keylogging, clipboard grabbing, and web browser form grabbing.”
• [T1056.003] Input Capture – Formbook engages in web browser form grabbing as part of its data theft.
• [T1555.003] Credentials in Web Browsers – Formbook/Quasar RAT collect browser credentials as part of data theft; “account credentials-collecting feature.”
• [T1021.001] Remote Desktop – Quasar RAT provides remote control capabilities including remote desktop access.
• [T1071.001] Web Protocols – Quasar RAT and other families communicate with C2 over web protocols; documented as C2 URLs/servers.
• [T1105] Ingress Tool Transfer – RedLine can download additional malware by receiving commands from the C&C server; “It can also download additional malware by receiving commands from the C&C server.”