Article Content By Jerome Doaty and Garrett Primm The Cofense™ Phishing Defense Center (PDC) has recently defended against a resurgence of Astaroth, with dozens of hits across our customer base in the last week In just one week, some estimated 8,000 machines have been potentially compromised The Astaroth trojan, named for its use of satanic variable names (the “Great Duke of Hell” in ancient lore), has been around since late 2017 Astaroth is known for infecting victims through fake invoice emails, the majority of which originate from a malicious sender impersonating legitimate services using cam.br domains Fig 1 Impersonating TicketLog This revived campaign has been well planned and supported, exclusively targeting South Americans All the campaign’s URLs are Cloudflare hosted, only delivering their payloads to South American IP addresses and exit 3 WMIC abuse Astaroth retrieves a .php file from this URL containing a style sheet with embedded JavaScript 4 Embedded JS in .xsl After defining several variables, some of which contain ActiveX objects for file execution and manipulation later, the script uses a function to “roll” a random number 5 “radador” dice roll function The number selected is then used to select a payload URL from a list Fig 6 Domain list The code frequently reuses the “xVRxastaroth” variable, potentially useful for future fingerprinting All the 154 domains listed were hosted on CloudFlare 7 CloudFlare hosting After the domain has been selected, the payload URL to another stylesheet is loaded using WMIC yet again The domain that is selected will have the hard-coded value of /Seu7v130a.xsl? appended to it as well as a randomly selected number between 1111111 and 9999999 For example: hxxp://ta4dcmj[.]proxy6x-server[.]website/09//Seu7v130a[.]xsl?3314468[.]xsl This payload contains much more embedded JavaScript and is part of the core functionality of the malware delivery The same variables that are declared in the initial stylesheet are reused here, including the RNG roller for a payload domain The script creates a function that will run the copied certutil in the temp folder with parameters -urlcache and the options -f and -split This will cache a force fetched URL and save the fetched URL to a file 9 Caching URLs and downloading payloads This function is used repeatedly to retrieve the rest of the malware payload A check is also performed to ensure each file has been downloaded to the correct folder before proceeding 12 The trojan is complete A database of victims After the malware is successful in infecting a host it will generate a plaintext log (r1.log) located in the tempwl directory 13 Victim logging This information is then sent to a sqlite database located in the root directory of the first payload URL as seen in the snippet below There were multiple open directories in ~/9/ Decrementing the number to 0 revealed several other open directories with downloadable sqlite databases, more than likely from previous campaigns These victims totaled in the thousands, with approximately 8,000 in a single week 14 Open directory… Here is one of the databases viewed in a sqlite browser Each field is base64 decoded Note the first entry of a machine hosted on a Canadian VPS This was the first entry across every database dump gathered and was certainly an anomaly compared to the otherwise South American machines, the primary target of this malware It’s difficult to say for sure, but this was possibly the threat actor testing his infrastructure 16 Potentially infected machines  The Malware After the Astaroth trojan verifies that each core file and binary has been run, the malware payload is executed It is important to note that any payload could be delivered via WMIC stylesheet abuse, and Astaroth should be considered a versatile delivery method However, their magic bytes are not of any known file type and there are no .text or other PE sections in the hex, suggesting that they are not executable There are also several log files present, and a folder called vri that is also populated with logs as the malware runs 17-2 Magic Bytes of “.jpg” file  Fig Some cursory analysis of one of the .dlls reveals it was  coded in Delphi, as well as use the GetLocaleInfoA function, allowing it to pull the locale information of the infected machine 18-1 Coded with Delphi  Fig 18-2 Locale Aware This problem was easily defeated by changing registry values in HKEY_CURRENT_USER>Control Panel>International to reflect a Brazilian locale, as well as enabling a Portuguese keyboard The .dlls are first registered and run using regsrv32 in silent mode A startup event is also created to gain persistence 21 ieframe.dll and IWebBrowser2 This is crucial because the malware targets Internet Explorer specifically They more than likely must be XOR-ed against a specific string, so decoding is very difficult if not impossible 23-1 Exfiltrated data  Fig 23-2 Custom encoded strings Astaroth is a particularly potent threat for South American businesses Like malicious OfficeMacros, this form of social engineering-based attack is best mitigated with user training and awareness Thousands of global organizations use Cofense PhishMeTM to do just that Discover what it can do for yours 
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content By Jerome Doaty and Garrett Primm The Cofense™ Phishing Defense Center (PDC) has recently defended against a resurgence of Astaroth, with dozens of hits across our customer base in the last week In just one week, some estimated 8,000 machines have been potentially compromised The Astaroth trojan, named for its use of satanic variable names (the “Great Duke of Hell” in ancient lore), has been around since late 2017 Astaroth is known for infecting victims through fake invoice emails, the majority of which originate from a malicious sender impersonating legitimate services using cam.br domains Fig 1 Impersonating TicketLog This revived campaign has been well planned and supported, exclusively targeting South Americans All the campaign’s URLs are Cloudflare hosted, only delivering their payloads to South American IP addresses and exit 3 WMIC abuse Astaroth retrieves a .php file from this URL containing a style sheet with embedded JavaScript 4 Embedded JS in .xsl After defining several variables, some of which contain ActiveX objects for file execution and manipulation later, the script uses a function to “roll” a random number 5 “radador” dice roll function The number selected is then used to select a payload URL from a list Fig 6 Domain list The code frequently reuses the “xVRxastaroth” variable, potentially useful for future fingerprinting All the 154 domains listed were hosted on CloudFlare 7 CloudFlare hosting After the domain has been selected, the payload URL to another stylesheet is loaded using WMIC yet again The domain that is selected will have the hard-coded value of /Seu7v130a.xsl? appended to it as well as a randomly selected number between 1111111 and 9999999 For example: hxxp://ta4dcmj[.]proxy6x-server[.]website/09//Seu7v130a[.]xsl?3314468[.]xsl This payload contains much more embedded JavaScript and is part of the core functionality of the malware delivery The same variables that are declared in the initial stylesheet are reused here, including the RNG roller for a payload domain The script creates a function that will run the copied certutil in the temp folder with parameters -urlcache and the options -f and -split This will cache a force fetched URL and save the fetched URL to a file 9 Caching URLs and downloading payloads This function is used repeatedly to retrieve the rest of the malware payload A check is also performed to ensure each file has been downloaded to the correct folder before proceeding 12 The trojan is complete A database of victims After the malware is successful in infecting a host it will generate a plaintext log (r1.log) located in the tempwl directory 13 Victim logging This information is then sent to a sqlite database located in the root directory of the first payload URL as seen in the snippet below There were multiple open directories in ~/9/ Decrementing the number to 0 revealed several other open directories with downloadable sqlite databases, more than likely from previous campaigns These victims totaled in the thousands, with approximately 8,000 in a single week 14 Open directory… Here is one of the databases viewed in a sqlite browser Each field is base64 decoded Note the first entry of a machine hosted on a Canadian VPS This was the first entry across every database dump gathered and was certainly an anomaly compared to the otherwise South American machines, the primary target of this malware It’s difficult to say for sure, but this was possibly the threat actor testing his infrastructure 16 Potentially infected machines  The Malware After the Astaroth trojan verifies that each core file and binary has been run, the malware payload is executed It is important to note that any payload could be delivered via WMIC stylesheet abuse, and Astaroth should be considered a versatile delivery method However, their magic bytes are not of any known file type and there are no .text or other PE sections in the hex, suggesting that they are not executable There are also several log files present, and a folder called vri that is also populated with logs as the malware runs 17-2 Magic Bytes of “.jpg” file  Fig Some cursory analysis of one of the .dlls reveals it was  coded in Delphi, as well as use the GetLocaleInfoA function, allowing it to pull the locale information of the infected machine 18-1 Coded with Delphi  Fig 18-2 Locale Aware This problem was easily defeated by changing registry values in HKEY_CURRENT_USER>Control Panel>International to reflect a Brazilian locale, as well as enabling a Portuguese keyboard The .dlls are first registered and run using regsrv32 in silent mode A startup event is also created to gain persistence 21 ieframe.dll and IWebBrowser2 This is crucial because the malware targets Internet Explorer specifically They more than likely must be XOR-ed against a specific string, so decoding is very difficult if not impossible 23-1 Exfiltrated data  Fig 23-2 Custom encoded strings Astaroth is a particularly potent threat for South American businesses Like malicious OfficeMacros, this form of social engineering-based attack is best mitigated with user training and awareness Thousands of global organizations use Cofense PhishMeTM to do just that Discover what it can do for yours  ### Response: .