#BREAKING #Sandworm continues attacks in Ukraine 🇺🇦. #ESETresearch found an evolution of a malware loader used during the #Industroyer2 attacks. This updated piece of the puzzle is malware
@_CERT_UA calls #ArguePatch. ArguePatch was used to launch #CaddyWiper. #WarInUkraine 1/6
@_CERT_UA calls #ArguePatch. ArguePatch was used to launch #CaddyWiper. #WarInUkraine 1/6
The #Industroyer2 attacks used a patched version of @HexRaysSA IDA Pro’s remote debug server (win32_remote.exe). It was modified to include code to decrypt and run #CaddyWiper from an external file. 2/6
This time, #Sandworm chose an official @ESET executable to hide #ArguePatch. It was stripped of its digital signature and code was overwritten in a function called during the MSVC runtime initialization. 3/6
The added code is very similar in both cases, but it now includes a feature to launch the next stage at a particular time. This makes #ArguePatch a timed bomb when started. 4/6
This replaces the need to setup a Windows scheduled task for future detonation. This is perhaps a way to evade detections using known TTPs. 5/6
IoC:
eset_ssl_filtered_cert_importer.exe
SHA-1: 796362BD0304E305AD120576B6A8FB6721108752
ESET detection name: Win32/Agent.AEGY trojan #ESETresearch
6/6
eset_ssl_filtered_cert_importer.exe
SHA-1: 796362BD0304E305AD120576B6A8FB6721108752
ESET detection name: Win32/Agent.AEGY trojan #ESETresearch
6/6
• • •
Missing some Tweet in this thread? You can try to
force a refresh
