ASEC Weekly Malware Statistics (March 13th, 2023 – March 19th, 2023) – ASEC BLOG

MITRE Techniques

• [T1566.001] Phishing – Spearphishing attachments used to deliver malware. (‘Most are distributed through spam emails disguised as invoices, shipment documents, and purchase orders’)
• [T1105] Ingress Tool Transfer – The malware can download additional payloads by receiving commands from the C&C server. (‘It can also download additional malware by receiving commands from the C&C server.’)
• [T1056.003] Web Form Grabbing – Formbook can steal information via web browser form grabbing. (‘the malware can steal various information through keylogging, clipboard grabbing, and web browser form grabbing’)
• [T1056.001] Keylogging – Formbook performs keylogging to capture user input. (‘keylogging’)
• [T1115] Clipboard Data – Formbook grabs clipboard contents. (‘clipboard grabbing’)
• [T1055] Process Injection – Formbook is injected into normal processes (e.g., explorer.exe) to hide its operation. (‘Formbook is injected into normal processes (one is a running explorer.exe and the other is in system32)’)
• [T1555.003] Credentials in Web Browsers – AgentTesla leaks credentials saved in web browsers. (‘leaks user credentials saved in web browsers, emails, and FTP clients’)
• [T1071.003] Application Layer Protocol: Mail – AgentTesla uses SMTP to exfiltrate data. (‘SMTP Server : us2.smtp.mailhostbox[.]com…’)
• [T1071.001] Application Layer Protocol: Web Protocols – AgentTesla also uses Telegram API as a C2 channel. (‘Telegram : hxxps://api.telegram[.]org/bot…’)
• [T1203] Exploitation for Client Execution – Smokeloader is distributed via exploit kits. (‘SmokeLoader is an Infostealer/downloader malware that is distributed via exploit kits.’)
• [T1027] Obfuscated/Deobfuscated Files or Information – GuLoader is downloaded in memory, encoded, and decoded before execution. (‘downloaded on memory to avoid detection, and encoded, not PE. It is then executed after being decoded in the memory’)
• [T1036] Masquerading – Samples disguise file names and extensions (e.g., invoices, PDFs, or CAD files) to sneak into systems. (‘the file names contain such words shown above… Some samples have extensions disguised as document files such as pdf and xlsx or Auto CAD blueprint files such as dwg’)