Fenix Botnet Targeting LATAM Users

MITRE Techniques

• [T1189] Drive-by Compromise – Initial user interaction with a malicious webpage that delivers a ZIP archive (‘Victims are deceived into downloading a malicious zip archive under the guise of a legitimate tool from a website masquerading as the Government of Mexico.’)
• [T1204.002] User Execution: Malicious File – User is instructed to run an Internet Shortcut that retrieves remote content (‘Internet Shortcuts can be crafted to retrieve malicious files from the Internet network share.’)
• [T1105] Ingress Tool Transfer – Multiple staged files are downloaded from remote servers (‘.url shortcut file contains an embedded URL … the shortcut eventually retrieves the “rfc.jse” file’ and ‘shellcode retrieves either “narnia.xls” … or BotnetFenix payload’)
• [T1055.012] Process Injection: Thread Execution Hijacking – Loader injects shellcode into AuthHost.exe via QueueUserAPC (‘injects the shellcode into AuthHost.exe via QueueUserAPC process injection’)
• [T1620] Reflective Code Loading – Stealer payloads use reflective loading to execute modules in memory (‘steal.crypt … seems to contain only a reflective DLL loader component’ and ‘reflective code loading’)
• [T1027.006] Obfuscated Files or Information: XOR – BotnetFenix decrypts retrieved payloads using XOR with a hardcoded key (‘ability to decrypt the retrieved payloads from C2 servers using a simple XOR algorithm and the hardcoded key.’)
• [T1071.001] Application Layer Protocol: Web Protocols – C2 communication and host registration use HTTP POST requests to app.quantumservice.lat (example POST: ‘POST /2XpbhUdaA4/post.php … action=add_register&uuid={uuid_value}…’)
• [T1113] Screen Capture – NarniaRAT captures screenshots from the infected host (‘NarniaRAT contains the exfiltration, screen capture, keylogging, and banking stealing functionalities.’)
• [T1056.001] Input Capture: Keylogging – NarniaRAT records keystrokes to harvest credentials (‘NarniaRAT contains the exfiltration, screen capture, keylogging, and banking stealing functionalities.’)