Cinoshi Project And The Dark Side Of Free MaaS – Cyble

MITRE Techniques

• [T1204] User Execution – The stealer payload is generated and executed via the web panel build process. Quote: “The stealer build can be configured on the web panel, which enables features that”
• [T1547] Boot or Logon Autostart Execution – The malware creates a ChromeUpdater folder in AppDataRoaming, executes as chrome.exe, and adds itself to startup for persistence. Quote: “The malware generates a new directory named “ChromeUpdater” within the “AppDataRoaming” directory and executes in this location under the name “chrome.exe”. It then adds itself to the startup location to maintain persistence.”
• [T1053] Scheduled Task/Job – A task scheduler entry is created to run the miner on startup. Quote: “creates a task scheduler entry to make the miner execute during startup.”
• [T1497.001] Virtualization/Sandbox Evasion – The malware uses heavy obfuscation and empty methods to hinder analysis. Quote: “anti-tampering techniques, including heavy obfuscation and the use of empty methods. It modifies its code during runtime and generates error messages when automatic de-obfuscation tools are used.”
• [T1027] Obfuscated Files or Information – Same obfuscation/anti-tampering approach described. Quote: “heavy obfuscation and the use of empty methods.”
• [T1113] Screen Capture – The stealer captures screenshots from the victim’s computer. Quote: “Screenshot from the victim’s computer.”
• [T1087] Account Discovery – The stealer verifies directory presence on the victim’s system via Directory.Exists(). Quote: “verifies their presence on the victim’s system using the Directory.Exists() method.”
• [T1057] Process Discovery – The stealer initializes and operates across multiple processes/threads to locate sensitive data. Quote: “The stealer now initiates multiple threads to carry out malicious actions.”
• [T1614] System Location Discovery – Geoinformation is fetched from the victim. Quote: “Geoinformation fetched by the stealer.”
• [T1071] Application Layer Protocol – The stealer uses HTTP-based C2 communications and decodes C2 URLs. Quote: “The stealer payload makes a request to hxxps[:]//tryno[.]ru/robots… decodes the content, which is Command and Control (C&C) URL (hxxps[:]//anaida.evisyn[.]lol/).”
• [T1041] Exfiltration Over C&C Channel – The stealer exfiltrates data via POST requests to the C2. Quote: “POST requests to exfiltrate the stolen data.”
• [T1567] Exfiltration Over Web Service – Data exfiltration patterns extend beyond a single C2 channel (web-based exfiltration). Quote: “and sends POST requests to exfiltrate the stolen data.”
• [T1489] Service Stop – The miner/loader stops security services to facilitate mining. Quote: “sc stop UsoSvc: This command stops the Windows Update service.”