Post #4044450

Interesting unlabeled malware sample shared by our friend smica83, apparently targeting UA users 🇺🇦🕵️ The malware sample: 1️⃣ Obtains the DNS A record of ns2.theendlessweb .com 2️⃣ Queries directly the DNS A record (207.90.251 .10) for the DNS TXT record of sni13.docsmanagement.endl .site 3️⃣ 207.90.251 .10 returns a PowerShell command as part of the DNS TXT record 4️⃣ Malware executes the PS command and obtains second stage from global-research .space/adv13.php global-research .space has been registered almost a year ago, which suggests that this campaign is already running since quite a while 📅 It also returns a fake HTTP 404, which indicates that the payload delivery is restricted to a handful targets 🎯 IOCs 📡 %ProgramData%\Microsoft\HTML Help\hhcolreg.dat %APPDATA%\Microsoft\HTML Help\hh.dat https://threatfox.abuse.ch/ioc/1855885/ https://threatfox.abuse.ch/ioc/1855883/ Malware sample 📄 https://bazaar.abuse.ch/sample/32a962439ec0fb5559e494fe1ea6be039815d3c4c1cceb95b16dc123e5abde61/