Security Affairs

JUNE 26, 2021

IT back-office and communications systems, such as email have been taken offline at the time. The provided sample of exfiltrated files includes business data and documents, as well as Argus certificates and development files. The sample archive is password protected – but the file names and types are clearly visible.

Ransomware 343

Ransomware File names Archiving Encryption 343

Security Affairs

FEBRUARY 26, 2020

Figure 4: Piece of the encrypted file downloaded from “share.]dmca.]gripe”. Inside it, two files named “filename1.vbs” Figure 5: Installed files. The content of the VBScript is straightforward: it simply is the launching point to run executable file. Figure 10: Piece of network communication intercepted.

File names 357

File names Communications Encryption IT 357

Security Affairs

JUNE 24, 2024

While investigating a security incident from March 2024 on a client’s Linux host, Positive Technologies researchers discovered a file named “scrond.” The communication between GoRed and its C2 server relies on the RPC protocol.

File names 295

File names Communications Mining Archiving 295

Security Affairs

JULY 20, 2024

The attackers attempted to trick the company’s customers into opening a ZIP archive file named “ crowdstrike-hotfix.zip.” ” The archive includes a loader named Hijack Loader used to execute the Remcos RAT. ” reads the report published by Kaspersky.

File names 251

File names Archiving Cybersecurity Communications 251

Security Affairs

APRIL 18, 2021

“The attack begins with a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth).” ” The attack used a PowerShell command to retrieve a file named win_r.zip from another compromised server’s Outlook Web Access logon path (/owa/auth). .

File names 302

File names Archiving Passwords Communications 302

Security Affairs

JUNE 22, 2024

RansomHub claimed responsibility for attacks against multiple organizations, including Change Healthcare, Christie’s , and Frontier Communications. The experts at Insikt Group noticed that the ESXi version of RansomHub creates a file named /tmp/app.pid to ensure the exclusive execution of RansomHub processes.

Ransomware 353

Ransomware Encryption File names Communications 353

Security Affairs

SEPTEMBER 23, 2024

The phishing emails in this campaign have carefully tailored subject lines, with a ZIP file attachment containing a decoy MSC file named RIPCOY. Upon opening this file, an obfuscated VBScript downloads multiple files from a public cloud service like AWS, including a decoy PDF,NET applications, and a configuration file.

Phishing 351

Phishing File names Cloud Government 351

Security Affairs

JULY 11, 2024

The botnet shell script downloads an ELF file named “pty3” from a different IP address, likely a sample of Muhstik malware. top, which was observed in Muhstik botnet activities, and communicates via Internet Relay Chat. The bot also connects to the command and control domain p.findmeatthe[.]top,

Honeypots 349

Honeypots File names Mining IoT 349

Security Affairs

JANUARY 12, 2022

The new variant discovered by Fortinet has the file name “Omicron Stats.exe,” threat actors are attempting to exploit the enormous interest on a global scale on the COVID-19 Omicron variant. Over the course of the few weeks after this variant was released, we noticed one IP address in particular communicating with this C2 server.”

Manufacturing 363

Manufacturing File names Archiving Encryption 363

Security Affairs

FEBRUARY 17, 2022

. “Most employees have been trained to second-guess identities in email, but few know how to make sure that the name and photo they see in a Teams conversation are real. It is simple to edit a profile and become most anyone you like. ” concludes the report. Follow me on Twitter: @securityaffairs and Facebook. Pierluigi Paganini.

File names 363

File names Phishing Data breaches Access 363

Security Affairs

JULY 22, 2020

The main branch also has auxiliary modules that allow the Prometei botnet to communicate through TOR or I2P networks, to collect information about processes running on the system, check of open ports on target systems and to crawl the file systems in search for file names given as the argument to the module.

Mining 305

Mining File names Passwords Communications 305

Security Affairs

SEPTEMBER 3, 2020

The malware communicates with the C2 communications via POST HTTP requests and uses RC4 encryption with a hardcoded key encoded with Base64. The new infection chain starts by including just one LNK file in the ZIP archive attached to spear-phishing messages. The PyVil RAT stores the malware settings (i.e.

Phishing 363

Phishing Encryption File names Metadata 363

Security Affairs

OCTOBER 18, 2022

. “We also saw Mimikatz being executed on victim networks, as well as a Trojanized ZLib DLL that had multiple malicious exports, one of which appeared to be waiting for communication from a command-and-control (C&C) server, while the other would load a payload from the provided file name in the command-line.”

File names 328

File names Encryption Manufacturing Libraries 328

Security Affairs

MARCH 30, 2020

“Current malspam campaigns feature booby-trapped document files named “COVID 19 relief” and subject lines relying on the same theme. Sphinx’s targets have not changed from its past configuration files as it continues to focus on banks in the US, Canada, and Australia.” ” continues the post.”Next,

File names 341

File names Passwords Sales Government 341

Security Affairs

MAY 26, 2023

The backdoor uses emails for C2 communications, where the C2 is the victim’s Microsoft Exchange server. The infection chain commenced with spear phishing messages using a zip file named Brochure.zip in attachment. ” reads the analysis published by Fortinet. It also acts as a proxy for the attacker to mask himself.”

Communications 246

Communications File names Archiving Government 246

Security Affairs

NOVEMBER 30, 2018

But, unlike previous incidents using POWERSTATS, the command and control (C&C) communication and data exfiltration in this case is done by using the API of a cloud file hosting provider.” OS name, domain name, user name, IP address) into one long string. ” continues the experts.

Communications 270

Communications File names Cloud Government 270

Security Affairs

JULY 28, 2021

In the attacks investigated by Palo Alto Networks, the APT group leveraged legitimate executables such as BITSAdmin to download an innocuous file named Aro.dat from a GitHub repository under the control of the threat actors. The analysis of the file revealed that it includes the encrypted and compressed PlugX payload.

Encryption 302

Encryption File names Communications IT 302

Security Affairs

MARCH 3, 2020

Hash 757dfeacabf4c2f771147159d26117818354af14050e6ba42cc00f4a3d58e51f Threat Kimsuky loader Brief Description Scr file, initial loader Ssdeep 12288:APWcT1z2aKqkP/mANd2JiEWKZ52zfeCkIAYfLeXcj6uuLl:uhT1z4q030JigZUaULeXc3uLl. Figure 2: Written file (AutoUpdate.dll) in the “%AppData%LocalTemp” path. hwp” extension. Bypassing AV Detection.

IT 363

IT File names Libraries Communications 363

Security Affairs

APRIL 14, 2020

a United States defense research entity, a Turkish government agency managing public works, several large technology and communications firms headquartered in Canada, Germany, and the United Kingdom, and medical organizations/medical research facilities located in Japan and Canada). ” reads the analysis published by PaloAlto Networks.

Ransomware 360

Ransomware Phishing Government File names 360

Security Affairs

SEPTEMBER 13, 2023

According to Microsoft, the campaign aims at building capabilities that could disrupt critical communications infrastructure between the United States and Asia region in the case of future crises. “On May 29, the attackers returned and used a renamed version of ProcDump (file name: alg.exe) to dump credentials from LSASS.”

File names 338

File names Access Encryption Communications 338

Security Affairs

MARCH 11, 2019

.” One of the variants analyzed by BleepingComputer encrypts data and appends the.promorad extension to encrypted files, then it creates ransom notes named _readme.txt as shown below. The Promorad Ransomware variant samples tested by the experts also download a file named 5.exe exe and executed it.

Encryption 271

Encryption Ransomware Passwords File names 271

Security Affairs

NOVEMBER 20, 2018

” Cannon acts as a downloader and relies on emails to communicate with the C2 server and receive instructions. Hackers used weaponized files named ‘crash list (Lion Air Boeing 737).docx’ Once successfully executed, the macro will install a payload and save a document to the system.”

File names 266

File names Phishing Communications Government 266

Security Affairs

JUNE 15, 2019

“In this new attack, the threat actor first externally scans a given IP range by sending a TCP SYN packet to port 2375, the default port used for communicating with the Docker daemon.” “The output of this command is saved into a file named ips.txt, which is then fed into the Docker.exe file.

File names 279

File names Mining Access Communications 279

Security Affairs

JULY 22, 2019

The fake profiles asked the victims to open the weaponized excel file named ERFT-Details. The Tonedeaf malware is a backdoor which communicates with a single command-and-control (C2) server via HTTP GET and POST requests. xls that was used as a dropper.

File names 278

File names Phishing Government Passwords 278

Security Affairs

MARCH 28, 2019

The malicious code allows the attackers to download and execute files on the infected machine. “Interestingly, the backdoor communicates with the command and control (C2) server using the value of the Authorization HTTP header ” continues the analysis. The payload is executed the next time Windows starts up.”

Archiving 267

Archiving File names Education Libraries 267

Security Affairs

MAY 2, 2019

At this stage we might appreciate two communication ways. One of the most important function is the aa_AdrGen_bb which is the communication manager. It implements the control layer in order to send and to receive control informations such as: commands, bytes received, if the file transfer has been close, and so on and so forth.

Computer and Electronics 277

Computer and Electronics Communications Government Security 277

Security Affairs

MAY 19, 2021

” reads an update published by the Irish Department of the Environment, Climate and Communications. The malware involved in the attack is Conti Ransomware v3 (32 bit), which attempted to encrypt all files with the exception of the following file names: – CONTI_LOG.txt – readme.txt – *.FEEDC

Ransomware 313

Ransomware Encryption File names IoT 313

Security Affairs

MARCH 18, 2022

Upon executing the core component, the malware first checks if its executable file name starts with “[k” If it does not, it performs the following routine: It redirects both stdout and stderr file descriptors to /dev/null. It sets the default handlers for SIGTERM, SIGINT, SIGBUS, SIGPIPE, and SIGIO signals.

IoT 256

IoT Military File names Communications 256

Security Affairs

NOVEMBER 17, 2020

FunnyDream is a custom-made backdoor that supports advanced persistence and communication capabilities, it was used by the APT group to gathering intelligence and data exfiltration. “The attackers used the backdoor prevalently as DLL files, but we observed an executable to be used as well.” ” continues the report.

Government 306

Government File names Communications Access 306

Security Affairs

DECEMBER 17, 2019

The name Dacls comes from its file name and the hard-coded strings, the malware has a modular structure that could extend its capabilities by loading plugins. “With connection proxy, the number of target host connections can be reduced, and the communication between the target and the real C2 can be hidden.”

CMS 268

CMS File names Encryption Access 268

Security Affairs

JULY 14, 2021

. “The archive contains two malicious DLL libraries as well as two legitimate executables that sideload the DLL files. We found multiple archives like this with file names of government entities in Myanmar, for example “COVID-19 Case 12-11-2020(MOTC).rar” ” reads the analysis published by Kaspersky.

Archiving 246

Archiving File names Government Libraries 246

Security Affairs

JULY 7, 2020

Figure 6: Deofuscated VBS file – Lampion trojan July 2020. Some parts of the code are highlighted in Figure 6 and described below: Function to generate random strings is used to generate arbitrary folders and file names. LNK files from the Windows startup folder. VBS files from the Windows startup folder.

Communications 332

Communications Cloud Phishing Encryption 332

Security Affairs

APRIL 28, 2020

The executed crypto miner is the file named “” kswapd0 ” based on the famous XMRIG monero crypto miner. It is composed only by three files: “ a”, “run”, “stop ”. They are three bash scripts, which we start to analyze: Figure 10: Content of the “a” script file. The initial script is the file named “ a ”.

Mining 313

Mining File names Honeypots IT 313

Security Affairs

MARCH 1, 2019

“This Gh0st RAT sample communicated with IP address 43 [. ] In all the cases, attackers deliver a WinRAR self-extracting (SFX) file that installs the SysUpdate stage 1 payload, that gains persistence and downloads and executes the second stage payload, SysUpdate Main. Windows NT 6.3; ” continues the analysis.

IT 234

IT File names Financial Services Communications 234

Security Affairs

JUNE 3, 2023

According to government experts, the Royal ransomware attacks targeted numerous critical infrastructure sectors including, manufacturing, communications, healthcare and public healthcare (HPH), and education. ReadMe file name: README.BlackSuit.txt. New #ransomware #BlackSuit targets Windows, #Linux. Extension: blacksuit.

Ransomware 246

Ransomware Encryption File names Cybersecurity 246

Security Affairs

MAY 18, 2021

On execution of the Simps binary, it drops a log file containing that the device has been infected with malware by Simps Botnet (see Figure 2). Figure 2: Dropped log file. Figure 3: C2 communication. Figure 10: keksec.infected.you.log file. The binary also connects to the C2 23.95.80[.]200 200 (see figure 3).

IoT 351

IoT File names Communications Security 351

Security Affairs

MAY 13, 2023

The CheckMate ransomware operators have been targeting the Server Message Block (SMB) communication protocol used for file sharing to compromise their victims’ networks. Once the attacker successfully logs in to a device, they encrypt data in shared folders and leave a ransom note with the file name “!CHECKMATE_DECRYPTION_README”

Ransomware 246

Ransomware Encryption Passwords File names 246