Fortinet FortiGuard Labs tracked the 8220 Gang’s use of ScrubCrypt to obfuscate and encrypt payloads and deliver a Monero-mining operation via a WebLogic vulnerability. The operation combines PowerShell-based loading, in-memory execution, registry-based persistence, and several defense-evasion techniques to evade security tools. #ScrubCrypt #8220Gang #FortiGuardLabs #OracleWebLogic #Monero
Keypoints
- FortiGuard Labs detected a ScrubCrypt-based crypter used by the 8220 Gang to infiltrate Windows systems exposed via Oracle WebLogic Server in early 2023.
- Initial access originated from IPs 163.123.142.210 and 185.17.0.19 targeting the WebLogic URI wls-wsat/CoordinatorPortType.
- The dropper downloads bypass.ps1, which obfuscates and encodes code to load ScrubCrypt and evade AV/AMSI/ETW defenses.
- ScrubCrypt employs a BAT/PowerShell workflow, Base64 decoding, AES-CBC decryption, and .NET Reflective Injection to run the final payload in memory.
- Persistence and defense evasion include registry Run/RunOnce keys, a masquerading OracleUpdate.bat, and UAC bypass attempts with AMSI/ETW evasion.
- The final payload loads a miner in memory, connects to C2, and uses a Monero wallet address linked to prior 8220 Gang activity.
MITRE Techniques
- [T1190] Exploit Public-Facing Application – The attackers target an exploitable Oracle WebLogic Server via a URI: ‘wls-wsat/CoordinatorPortType’. Quote: ‘The attackers have targeted an HTTP URI, “wls-wsat/CoordinatorPortType,” which belongs to an Oracle Weblogic server.’
- [T1059.001] Command and Scripting Interpreter: PowerShell – The attack downloads a PowerShell script named “bypass.ps1.” Quote: ‘The attack attempts to download a PowerShell named “bypass.ps1”.’
- [T1140] Deobfuscate/Decode Files or Information – Reversing and Base64 decoding after constants are added to reveal clear text. Quote: ‘three rounds of adding constants, reversing, and Base64 decoding, we finally uncovered clear text.’
- [T1055] Process Injection (Reflective) – The final payload uses typical .NET Reflective Injection to execute in memory. Quote: ‘The organized code in Figure 6 is a typical .NET Reflective Injection.’
- [T1562.001] Impair Defenses: Disable or Modify Tools – AMSI/ETW evasion and Windows Defender bypass techniques are employed. Quote: ‘AMSI and ETW evasion, which is executed by “iex” at the end of the attack.’
- [T1547.001] Boot or Logon Autostart: Registry Run Keys / Startup Folder – Persistence via Run/RunOnce registry entries and a dropped VBS script. Quote: ‘For persistence, it grabs registry values from “Run” and “RunOnce” to determine if this .NET file is already set… adds a registry value to run a VBS file with the content shown in Figure 11.’
- [T1033] Account Discovery – The malware decodes a UAC-related artifact and retrieves username information from the compromised endpoint. Quote: ‘It is used to retrieve username information from the compromised endpoint.’
- [T1548.002] Abuse Elevation Control: Bypass User Account Control – UAC bypass behavior is indicated by checks against BUILTINAdministrators and decoding UAC data. Quote: ‘If the user is not in that specific group, it decodes the “UAC” data from the “Resources” section…’
- [T1059.005] Command and Scripting Interpreter: Visual Basic / VBScript (via VBS file) – The registry-based persistence uses a VBScript file;Quote: ‘adds a registry value to run a VBS file with the content shown in Figure 11.’
- [T1055] Process Injection (Memory-Resident) – The miner is loaded in memory and invoked from a decoded payload. Quote: ‘loads the decoded data named “miner” in memory and invokes the payload.’
- [T1071.001] Web Protocols – The final miner communicates with a C2 server over a network. Quote: ‘to start the miner process to server 45[.]142[.]122[.]11:8080.’
- [T1496] Resource Hijacking – The final payload engages in crypto-mining activity using a wallet address. Quote: ‘The crypto wallet address… and the server IP address used in Monero miner have all been used by the 8220 Gang in the past.’
Indicators of Compromise
- [URLs] Context – su-95[.]letmaker[.]top, work[.]letmaker[.]top
- [IP Addresses] Context – 163[.]123[.]142[.]210, 185[.]17[.]0[.]19
- [IP Addresses] Context – 79[.]137[.]203[.]156, 209[.]141[.]38[.]219
- [IP Addresses] Context – 45[.]142[.]122[.]11, 179[.]43[.]155[.]202
- [Files] Context – d9e7d3dbb299f76bb8a84e3b72cc8e78e86ea90e2dc777cdcfd51dbd10657f47, 179be54b3c2e29571fec9dcd16781eee3ce997c5352d9cce4834a10fc11d636b
- And 20+ additional hashes and indicators listed in the article.
Read more: https://www.fortinet.com/blog/threat-research/old-cyber-gang-uses-new-crypter-scrubcrypt