Ongoing Malvertising Campaign leads to Ransomware
May 15, 2024, 3:32 p.m.
Tags
External References
Description
Rapid7 detected an ongoing malware distribution campaign involving trojanized installers of WinSCP and PuTTY, delivered via malicious search engine ads. The infection chain employs DLL side-loading, credential access, and deploys Sliver beacons followed by Cobalt Strike. In one case, the threat actor attempted data exfiltration and ransomware deployment after gaining elevated access. The analysis provides indicators, MITRE ATT&CK mappings, and detection guidance.
Date
Published: May 15, 2024, 3:14 p.m.
Created: May 15, 2024, 3:14 p.m.
Modified: May 15, 2024, 3:32 p.m.
Indicators
f89720497b810afc9666f212e8f03787d72598573b41bc943cd59ce1c620a861
f36e9dec2e7c574c07f3c01bbbb2e8a6294e85863f4d6552cccb71d9b73688ad
f36089675a652d7447f45c604e062c2a58771ec54778f6e06b2332d1f60b1999
f18367d88f19c555f19e3a40b17de66d4a6f761684a5ef4cdd3d9931a6655490
ed501e49b9418fcfaf56a2eff7adcf85a648bdee2c42bb09db8c11f024667bfa
d95f6dec32b4ebed2c45ecc05215e76bf2f520f86ad6b5c5da1326083ba72e89
df0213e4b784a7e7e3b4c799862db6ea60e34d8e22eb5e72a980a8c2e9b36177
d94ed93042d240e4eaac8b1b397abe60c6c50a5ff11e62180a85be8aa0b0cc4a
d27f9c0d761e5e1de1a741569e743d6747734d3cdaf964a9e8ca01ce662fac90
cf82366e319b6736a7ee94cca827790e9fdedface98601f0499abee61f613d5d
cd7d59105b0d0b947923dd9ed371b9cfc2c2aa98f29b2afbdcd3392ad26bde94
c9042a7ed34847fee538c213300374c70c76436ee506273b35282c86a11d9e6a
ca05485a1ec408e2f429e2e377cc5af2bee37587a2eb91dc86e8e48211ffc49e
c8a982e2be4324800f69141b5be814701bcc4167b39b3e47ed8908623a13eb10
c33975aa4ab4cdf015422608962bd04c893f27bd270cf3f30958981541cdfead
bfc2ef3b404294fe2fa05a8b71c7f786b58519175b7202a69fe30f45e607ff1c
bd4abc70de30e036a188fc9df7b499a19a0b49d5baefc99844dfdec6e70faf75
bbdf350c6ae2438bf14fc6dc82bb54030abf9da0c948c485e297330e08850575
a5dfc9c326b1303cc1323c286ecd9751684fb1cd509527e2f959fb79e5a792c2
a1cb8761dd8e624d6872960e1443c85664e9fbf24d3e208c3584df49bbdb2d9c
9be715df88024582eeabdb0a621477e04e2cf5f57895fa6420334609138463b9
9bd3c7eff51c5746c21cef536971cc65d25e3646533631344728e8061a0624cb
989a8e6a01aa20e298b1ffae83b50cef3e08f6b64a8f022288dc8d5729301674
972ca168f7a8cddd77157e7163b196d1267fe2b338b93dabacc4a681e3d46b57
96ea33a5f305015fdd84bea48a9e266c0516379ae33321a1db16bc6fabad5679
8bc39017b1ea59386f74d7c7822063b3b00315dd317f55ddc6634bde897c45c1
8b1946e3e88cff3bee6b8a2ef761513fb82a1c81f97a27f959c08d08e4c75324
8834ec9b0778a08750156632b8e74b9b31134675a95332d1d38f982510c79acb
8b0d04f65a6a5a3c8fb111e72a1a176b7415903664bc37f0a9015b85d3fc0aa7
8827b6fa639afe037bb2c3f092ccb12d49b642ce5cec496706651ebcb23d5b9e
7d53122d6b7cff81e1c5fcdb3523ccef1dbd46c93020a0de65bc475760faff7d
868cd4974e1f3ac7ef843da8040536cb04f96a2c5779265a69df58e87dc03029
725aa783a0cd17df603fbe6b11b5a41c9fbfd6fc9e4f2e468c328999e5716faa
69583c4a9bf96e0edafcf1ac4362c51d6ff71bba0f568625ae65a1e378f15c65
61214a7b14d6ffb4d27e53e507374aabcbea21b4dc574936b39bec951220e7ea
51d898de0c300cae7a57c806d652809d19beb3e52422a7d8e4cb1539a1e2485d
51af3d778b5a408b725fcf11d762b0f141a9c1404a8097675668f64e10d44d64
500574522dbcde5e6c89803c3dca7f857f73e0868fd7f8d2f437f3cc31ce9e8d
4b618892c9a397b2b831917264aaf0511ac1b7e4d5e56f177217902daab74a36
47ec3a1ece8b30e66afd6bb510835bb072bbccc8ea19a557c59ccdf46fe83032
35161a508dfaf8e04bb6de6bc793a3840a05f2c04bbbbf8c2237abebe8e670aa
33f6acd3dfeda1aadf0227271937c1e5479c2dba24b4dca5f3deccc83e6a2f04
2ee435033d0e2027598fc6b35d8d6cbca32380eb4c059ba0806b9cfb1b4275cc
28e5ee69447cea77eee2942c04009735a199771ba64f6bce4965d674515d7322
242b2c948181f8c2543163c961775393220d128ecb38a82fa62b80893f209cab
17e0005fd046e524c1681304493f0c51695ba3f24362a61b58bd2968aa1bd01a
169ef0e828c3cd35128b0e8d8ca91fbf54120d9a2facf9eb8b57ea88542bc427
1576f71ac41c4fc93c8717338fbc2ba48374894345c33bdf831b16d0d06df23d
13b2e749eb1e45ce999427a12bb78cbebc87c415685315c77cdfb7f64cb9aab0
12afbec79948007e87fdf9e311736160797f245857a45c040966e8e029ca97b3
0aa248300a9f6c498f5305ae3cb871e9ec78ae62e6d51c05c4d6dd069622f442
03d18441c04f12270aab3e55f68284dcd84721d1e56b32f8d8b732a52a654d2d
02d8e4e5f74d38c8e1c9ad893e0cec1cc19aa08a43ecc87ac043fa825382a583
02330e168d4478a4cd2006dd3a856979f125fd30f5ed24ee70a41e03e4c0d2f8
94.156.67.83
94.156.67.188
94.156.67.185
91.92.255.77
91.92.255.71
91.92.253.80
91.92.252.238
91.92.249.155
91.92.249.106
91.92.244.41
91.92.242.183
185.82.219.92
94.156.65.115
94.156.65.98
vvinscp.net
winnscp.net
putyy.org
wnscp.net
puutty.org
puttyy.org
puttty.org
mkt.geostrategy-ec.com
fkm-system.com
areauni.com
Attack Patterns
T1583
T1567
T1222
T1189
T1486
T1574
T1106
T1570
T1543
T1055
T1204
T1140
T1027
T1053
T1059