IMPORTANT WARNING: TrickBot-Ryuk Activity Increased
TrickBot malware and Ryuk ransomware activity has grown significantly over the past 48 hours. This activity has been noticed by our technology team in the AEC customer base, across several different segments. Therefore, we recommend taking this warning with the utmost seriousness.
Update 02/11/2020:
Further indicators of compromise were added, connected with, among others, the Emotet botnet. When investigating incidents at our customers’, we identified additional IOCs, which have been newly added in the table below.
You may be aware of this malicious software due to the attacks successfully executed both this and last year; TrickBot malware and Ryuk ransomware were also taking part in the attack on the Benešov Hospital last December. We have already written several times about the abovementioned attack as well as about other activities by attackers using the Emotet botnet or the malware in question [1, 2].
On Wednesday October 25, 2020, the Cybersecurity and Infrastructure Security Agency (CISA) reported on the increased activity of this malware and the likeness of attacks on hospitals and other healthcare facilities [3]. The Czech National Cyber and Information Security Agency (NÚKIB) also warned about the increased activity of the botnet Emotet in early October [4].
The current version of the TrickBot malware is no longer just your regular banking trojan. Now, after your computer has been attacked, the attackers have the ability to steal credentials and e-mail messages, to extract cryptocurrencies, steal data from payment systems, or to download additional malware or ransomware to the infected system.
We recommend all our customers to check how up-to-date is their endpoint protection solution and to scan for vulnerabilities, since the exploitation of vulnerabilities is the way this malware spreads across the network the most often. Companies with an IOC search tool can search the managed devices for IOCs listed in the table below.
IOC type | IOC | Note |
| File name | 12 characters (including ".exe") | F.e. mfjdieks.exe |
| anchorDiag.txt | ||
| Location of the suspicious file in the directory | C:\Windows\ | |
| C:\Windows\SysWOW64\ | ||
| C:\Users\\AppData\Roaming\ | ||
| String | Global\fde345tyhoVGYHUJKIOuy | Typically present in running memory |
| /anchor_dns/[COMPUTERNAME]_ [WindowsVersionBuildNo].[32CharacterString]/ | Typically present in the communication to the C&C server | |
| Planned tasks | [random_folder_name_in_%APPDATA%_excluding_Microsoft] autoupdate#[5_random_numbers] | |
| CMD command | cmd.exe /c timeout 3 && del C:\Users\[username]\[malware_sample] | |
| cmd.exe /C PowerShell \"Start-Sleep 3; Remove-Item C:\Users\[username]\[malware_sample_location]\" | ||
| DNS | kostunivo[.]com | DNS names connected with Anchor_DNS (included in the TrickBot malware) |
| chishir[.]com | ||
| mangoclone[.]com | ||
| onixcellent[.]com | ||
| innhanmacquanaogiare[.]com - update 2020-11-02 | ||
| edgeclothingmcr[.]com - update 2020-11-02 | ||
| DNS | ipecho[.]net | DNS names used for connectivity checks |
| api[.]ipify[.]org | ||
| checkip[.]amazonaws[.]com | ||
| ip[.]anysrc[.]net | ||
| wtfismyip[.]com | ||
| ipinfo[.]io | ||
| icanhazip[.]com | ||
| myexternalip[.]com | ||
| IP address | 23[.]95[.]97[.]59 | C&C servers IP addresses |
| 51[.]254[.]25[.]115 | ||
| 193[.]183[.]98[.]66 | ||
| 91[.]217[.]137[.]37 | ||
| 87[.]98[.]175[.]85 | ||
| 81[.]214[.]253[.]80 - update 2020-11-02 | ||
| 94[.]23[.]62[.]116 - update 2020-11-02 | ||
| 104[.]28[.]27[.]212 - update 2020-11-02 | ||
| 172[.]67[.]169[.]203 - update 2020-11-02 | ||
| 104[.]28[.]26[.]212 - update 2020-11-02 | ||
| 93[.]114[.]234[.]109 - update 2020-11-02 |
If you register any of the IOCs listed above or any other suspicious activity in your network, please do not hesitate to contact us directly and ask for a consultation, incident analysis or the implementation of specific security measures.
Sources:
[1]:
https://aec.cz/cz/novinky/Stranky/zprava-o-bezpecnosti-v-prosinci-2019.aspx
[2]:
https://www.antivirus.cz/Blog/Stranky/pozvanka-na-vanocni-vecirek-poradany-botnetem-emotet.aspx
[3]:
https://us-cert.cisa.gov/ncas/alerts/aa20-302a
[4]:
https://www.nukib.cz/cs/infoservis/hrozby/1638-upozorneni-na-zvysenou-aktivitu-malwaru-emotet/