TELEPUZ: a modular MaaS malware spreading via CLICKFIX-VIDAR chains

MITRE Techniques

• [T1204.002 ] User Execution: Malicious File – The attack begins when the user is tricked into copying and pasting a command from a malicious webpage, leading to code execution (‘the user visits a malicious web page and is prompted to copy and paste, then execute, a Windows shell command’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – PowerShell is used to download and run the second stage from the staging URL (‘PowerShell.exe -NoP -w h -ep bypass … DownloadFile’).
• [T1105 ] Ingress Tool Transfer – TELEPUZ and its stages download payloads, modules, and additional components from remote infrastructure (‘downloads the second stage’, ‘retrieved from the hurgadatour[.]shop domain’).
• [T1027 ] Obfuscated Files or Information – The malware uses garbage instructions, hashed imports, and encrypted strings to hinder analysis (‘interleaves its actual code with “garbage instructions”’, ‘decrypts strings using a custom RC4 implementation’).
• [T1027.001 ] Binary Padding – Garbage instructions are inserted to slow reverse engineering (‘interleaves its actual code with “garbage instructions”’).
• [T1027.009 ] Embedded Payloads – TELEPUZ stores and loads additional modules such as keylogger, stealer, and web injector components (‘downloads additional functional modules from its C2 server’).
• [T1106 ] Native API – The malware uses direct Windows NT APIs for syscalls, process inspection, and hiding from debuggers (’employs indirect syscalls’, ‘NtQueryInformationProcess’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – TELEPUZ patches AMSI and ETW functions to reduce visibility (‘patches the AmsiScanBuffer function’, ‘patches EtwEventWrite, NtTraceEvent’).
• [T1562.006 ] Impair Defenses: Indicator Blocking – It removes third-party DLL notification callbacks and unhooks NTDLL to interfere with monitoring (‘remove third party DllNotification callbacks’, ‘maps a fresh copy of ntdll.dll’).
• [T1480.001 ] Execution Guardrails: Environmental Keying – The malware terminates in virtualized or disallowed environments and checks locale and hardware constraints (‘fewer than two CPUs’, ‘locale identifier (LCID) is not among … CIS countries’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – It checks CPU, memory, disk space, usernames, computer names, and hypervisor indicators (‘common sandbox and malware research identifiers’).
• [T1055 ] Process Injection – TELEPUZ supports process hollowing and remote execution via downloads such as DownloadRunPE (‘creates a dllhost.exe process … and performs process hollowing’).
• [T1036 ] Masquerading – It disguises files, services, and exports to appear legitimate (‘systematically chosen to disguise the library as legitimate software’, ‘service name CipherAllocator’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – It migrates and installs persistence in user and application data locations and service-related registry locations (‘installs persistence’, ‘creates the necessary registry keys’).
• [T1543.003 ] Create or Modify System Process: Windows Service – TELEPUZ installs itself as a service via svchost.exe (‘registers itself as a service by creating the necessary registry keys’).
• [T1068 ] Exploitation for Privilege Escalation – The malware attempts to elevate privileges through COM elevation moniker and AppInfo/DebugObjects approaches (‘bypass UAC’).
• [T1057 ] Process Discovery – It inspects parent process names and running processes to avoid analysis and identify targets (‘verifies the parent process name against a list of known runners’).
• [T1082 ] System Information Discovery – TELEPUZ derives a victim/session identifier from hardware serial number, computer name, and OS install date (‘combining the hardware serial number, the computer name, and the operating system’s installation date’).
• [T1090 ] Proxy – The malware uses fallback infrastructure discovery via Telegram, Steam, DNS, and blockchain lookups to reach updated C2 locations (‘fallback C2 address using 4 different methods’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – TELEPUZ communicates with C2 using HTTP/WebSocket and optional TLS (‘establish communication using WebSockets with optional TLS’).
• [T1095 ] Non-Application Layer Protocol – It establishes a raw TCP socket manually before WebSocket communication (‘manually establishes the connection via a TCP socket’).
• [T1113 ] Screen Capture – The command list includes Screenshot capability (‘Screenshot’).
• [T1056.001 ] Input Capture: Keylogging – TELEPUZ can deploy a keylogger module (‘DownloadStartKeyLogger’).
• [T1555.003 ] Credentials from Web Browsers – It includes a module to extract Chrome cookies and browser data (‘ExtractChromeCookiesUsingDownloadedChromeElevator’).
• [T1003 ] OS Credential Dumping – The stealer module and token theft functionality indicate credential access (‘StealProcessToken’).
• [T1070.004 ] File Deletion – The malware deletes itself or downloaded files after migration (‘delete the current sample’).