1/ In a recent compromise, we saw the same multi-layered infection chain that eventually led to AsyncRAT, as described by the ASEC team. [1]
AsyncRAT could not connect to the C2 because the destination port on the firewall was blocked. 🧵
#CyberSecurity
AsyncRAT could not connect to the C2 because the destination port on the firewall was blocked. 🧵
#CyberSecurity
2/ As can be seen in the screenshot above, port 6666 was used, which can be chosen arbitrarily within the builder from AsyncRAT.
https://twitter.com/malmoeb/status/1555926324954423297
3/ Of course, connections within the firewall logs that connect to an IP address on a high port are interesting for #ThreatHunting.
And, even more, connections to a blocked high port.
And, even more, connections to a blocked high port.
4/ These blocked connections on the firewall (internal to external) can indicate a compromised system.
As an example: I analyzed the SystemBC Trojan IOC's on Threatfox:
curl -X POST threatfox-api.abuse.ch/api/v1/ -d '{ "query": "taginfo", "tag": "SystemBC", "limit": 1000 }'
As an example: I analyzed the SystemBC Trojan IOC's on Threatfox:
curl -X POST threatfox-api.abuse.ch/api/v1/ -d '{ "query": "taginfo", "tag": "SystemBC", "limit": 1000 }'
5/ Just five submitted samples from SystemBC are using port 443 for the callback.
All other samples use a C2 IP address with a high port, after which we, Defenders, can hunt in our network. Good luck ☘️
Reference:
[1] asec.ahnlab.com/en/37954/
All other samples use a C2 IP address with a high port, after which we, Defenders, can hunt in our network. Good luck ☘️
Reference:
[1] asec.ahnlab.com/en/37954/
• • •
Missing some Tweet in this thread? You can try to
force a refresh
