Resubmissions

18-04-2024 20:25

240418-y7llksfb61 7

18-04-2024 20:23

240418-y6dvcafb3z 7

18-04-2024 20:21

240418-y5cwnadh36 6

18-04-2024 20:18

240418-y3rxssfa7s 6

18-04-2024 20:16

240418-y169psdg36 6

18-04-2024 20:12

240418-yy98ksdf74 6

General

  • Target

    https://github.com/enforcer-pro/ddostor

  • Sample

    240418-y7llksfb61

Malware Config

Targets

    • Target

      https://github.com/enforcer-pro/ddostor

    • Changes its process name

    • Reads user data of web browsers

      Reads stored browser data which can include saved credentials.

    • Checks CPU configuration

      Checks CPU information which indicate if the system is a virtual machine.

    • Legitimate hosting services abused for malware hosting/C2

    • Reads CPU attributes

MITRE ATT&CK Matrix ATT&CK v13

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Discovery

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Tasks