Mexican Banks and Cryptocurrency Platforms Targeted With AllaKore RAT

逆向病毒分析 3个月前 admin

62 0 0

Mexican Banks and Cryptocurrency Platforms Targeted With AllaKore RAT

Summary 总结

A financially motivated threat actor is targeting Mexican banks and cryptocurrency trading entities with custom packaged installers delivering a modified version of AllaKore RAT – an open-source remote access tool.
一个出于经济动机的威胁行为者正在瞄准墨西哥银行和加密货币交易实体，其定制打包安装程序提供 AllaKore RAT 的修改版本——一种开源远程访问工具。

Lures use Mexican Social Security Institute (IMSS) naming schemas and links to legitimate, benign documents during the installation process. The AllaKore RAT payload is heavily modified to allow the threat actors to send stolen banking credentials and unique authentication information back to a command-and-control (C2) server for the purposes of financial fraud.
诱饵在安装过程中使用墨西哥社会保障协会（IMSS）命名架构和指向合法、良性文档的链接。AllaKore RAT 有效载荷经过大量修改，允许威胁行为者将被盗的银行凭证和唯一身份验证信息发送回命令和控制（C2）服务器，以进行金融欺诈。

The targeting we observed was indifferent to industry; the attackers appear to be most interested in large companies, many with gross revenues over $100M USD. We know this because the lures sent out by the threat actors only work for companies that are large enough to be reporting directly to the Mexican government’s IMSS department.
我们观察到的目标对行业漠不关心;攻击者似乎对大公司最感兴趣，其中许多公司的总收入超过1亿美元。我们知道这一点，因为威胁行为者发出的诱饵只适用于大到足以直接向墨西哥政府 IMSS 部门报告的公司。

Based on the large number of Mexico Starlink IPs used in the campaign and the long timeframe of these connections, plus the addition of Spanish-language instructions to the modified RAT payload, we believe that the threat actor is based in Latin America.
基于该活动中使用的大量墨西哥 Starlink IP 和这些连接的较长时间范围，以及在修改后的 RAT 有效载荷中添加了西班牙语指令，我们认为威胁行为者位于拉丁美洲。

Brief MITRE ATT&CK® Information
MITRE ATT&CK®简介

Tactic 策略	Technique 技术
Initial Access 初始访问	T1189 T1189型
Execution 执行	T1204.001, T1059.001 编号：T1204.001、T1059.001
Defense Evasion 防御规避	T1218.007, T1480, T1070.004, T1140 T1218.007、T1480、T1070.004、T1140
Command and Control 指挥与控制	T1105, T1071.001, T1219 T1105、T1071.001、T1219
Credential Access 凭据访问	T1056.001 编号：T1056.001
Collection 收集	T1056.001, T1113 T1056.001、T1113
Exfiltration 渗出	T1041 T1041型

Weaponization and Technical Overview
武器化和技术概述

Weapons 武器	Malicious MSI installer, .NET downloader, customized AllaKore RAT 恶意 MSI 安装程序、.NET 下载器、自定义 AllaKore RAT
Attack Vector 攻击媒介	Spear-phishing; Drive-by 鱼叉式网络钓鱼;路过式
Network Infrastructure 网络基础设施	Statically hosted C2 静态托管 C2
Targets 目标	Retail, Agriculture, Public Sector, Manufacturing, Transportation, Commercial Services, Capital Goods, and Banking 零售业、农业、公共部门、制造业、运输业、商业服务业、资本货物和银行业

Technical Analysis 技术分析

Context 上下文

A long running campaign targeting Mexican entities with large revenues ($1 million USD and above) was discovered by BlackBerry cyber threat intelligence (CTI) analysts. This campaign has been using consistently detectable C2 infrastructure since 2021 and has yet to be disrupted.
BlackBerry 网络威胁情报（CTI）分析师发现了针对收入巨大（100 万美元及以上）的墨西哥实体的长期活动。自 2021 年以来，该活动一直在使用始终如一的可检测 C2 基础设施，并且尚未中断。

Attack Vector 攻击媒介

Samples from the middle of 2022 and before, such as 942865d0c76b71a075b21525bd32a1ceca830071e5c61123664bd332c7a8de2a, were packaged as RAR files containing the AllaKore sample itself. RAR is a proprietary archive file format that supports data compression, error correction and file spanning.
2022 年年中及之前的样本，例如 942865d0c76b71a075b21525bd32a1ceca830071e5c61123664bd332c7a8de2a，被打包为包含 AllaKore 样本本身的 RAR 文件。RAR 是一种专有的存档文件格式，支持数据压缩、纠错和文件跨区。

Newer samples have a more complicated installation structure that delivers the downloader, compressed in an MSI file, which is a Microsoft software installer. The downloader first verifies that the target is located in Mexico, verified via network IP location services, before downloading the customized AllaKore RAT.
较新的示例具有更复杂的安装结构，该结构提供下载程序，压缩在 MSI 文件中，这是一个 Microsoft 软件安装程序。下载器首先验证目标是否位于墨西哥，通过网络IP定位服务进行验证，然后下载定制的AllaKore RAT。

Installer files are structured like malspam attachments and have the following execution path:
安装程序文件的结构类似于恶意垃圾邮件附件，并具有以下执行路径：

Figure 1: RAT delivery process
图 1：RAT 交付流程

What is AllaKore RAT? 什么是 AllaKore RAT？

AllaKore RAT is a simple, open-source remote access tool written in Delphi. It was first observed in 2015, and was most recently used by the threat group known as SideCopy in May 2023 to infiltrate organizations within a specific geographic area.
AllaKore RAT 是用 Delphi 编写的简单开源远程访问工具。它于 2015 年首次被发现，最近一次是在 2023 年 5 月被名为 SideCopy 的威胁组织用来渗透特定地理区域内的组织。

Early 2022 Sample 2022 年初示例

Hashes (md5, sha-256) 哈希（md5、sha-256）

21b7319ae748c43e413993ad57e8d08c

942865d0c76b71a075b21525bd32a1ceca830071e5c61123664bd332c7a8de2a

File Name 文件名

aluminio.rar 铝.rar

File Size 文件大小

3840823

“Aluminio.rar” decompresses “aluminio.exe”, which is the AllaKore RAT payload. Worthy of note is the fact that new commands in the Spanish language have been added to the original RAT payload.
“Aluminio.rar”解压缩“aluminio.exe”，这是AllaKore RAT有效载荷。值得注意的是，西班牙语的新命令已被添加到原始 RAT 有效载荷中。

Figure 2: Custom function names
图 2：自定义函数名称

This earlier sample reaches out to uplayground[.]online, a domain which was in use from late 2021 until mid-2022. The endpoint of “/registrauser.php” was originally used as the AllaKore server. The endpoint “/license.txt” was used as an update location, always pointing to the latest version of the threat actor’s RAT. A breakdown of the custom functionality is given a little further down in this report.
这个早期的示例延伸到 uplayground[.]在线，一个从 2021 年底到 2022 年年中一直在使用的域名。“/registrauser.php”的端点最初用作AllaKore服务器。终结点“/license.txt”用作更新位置，始终指向威胁参与者的 RAT 的最新版本。本报告中进一步提供了自定义功能的细分。

Late 2022 Sample 2022 年末示例

Hashes (md5, sha-256) 哈希（md5、sha-256）

e5447d258c5167db494e6f2a297a9be8

bf26025974c4cbbea1f6150a889ac60f66cfd7d758ce3761604694b0ceaa338d

File Name 文件名

PluginIMSSSIPARE (1).zip
插件IMSSSIPARE （1）.zip

File Size 文件大小

14220446

The file obfuscation was changed in late 2022. This file has the following structure:
文件混淆已于 2022 年底更改。此文件具有以下结构：

PLUGINIMSSSIPARE (1).zip 插件imsssipare （1）.zip
- _
- INSTRUCCIONES.txt
- InstalarPluginSIPARE.zip
  - InstalarPluginSIPARE.msi

The instructions read: 说明内容如下：

Figure 3: INSTRUCCIONES.txt
图 3：INSTRUCCIONES.txt

Translated, this reads: 翻译过来，内容如下：

INSTRUCTIONS 指示

1.- EXTRACT THE CONTENT OF THE INSTALARPLUGINSIPARE.ZIP FILE
1.- 提取 INSTALARPLUGINSIPARE.ZIP 文件的内容
2.- RUN THE FILE CALLED “INSTALARPLUGIN”
2.- 运行名为“INSTALARPLUGIN”的文件
3.- WHEN YOU FINISH THE INSTALLATION YOU WILL BE ABLE TO LOG IN NORMALLY
3.- 完成安装后，您将能够正常登录

“InstalarPluginSIPARE.msi” is built with Advanced Installer 18.3. This file deploys a .NET downloader and a couple of PowerShell scripts for cleanup. “ADV.exe” is the .NET downloader, while the PowerShell command employed is:
“InstalarPluginSIPARE.msi”是使用高级安装程序 18.3 构建的。此文件部署一个 .NET 下载程序和几个用于清理的 PowerShell 脚本。“ADV.exe”是 .NET 下载程序，而使用的 PowerShell 命令是：

“C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe” -NonInteractive -NoLogo -ExecutionPolicy AllSigned -Command
“C：\Windows\system32\WindowsPowerShell\v1.0\powershell.exe” -非交互式 -NoLogo -ExecutionPolicy AllSigned -命令
“C:\Users\admin\AppData\Local\Temp\AI_4ECB.ps1 -paths ‘C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\file_deleter.ps1′,’C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\aipackagechainer.exe’,’C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files’,’C:\Users\admin\AppData\Roaming\ADV’,’C:\Users\admin\AppData\Roaming\ADV’ -retry_count 10”
“C：\Users\admin\AppData\Local\Temp\AI_4ECB.ps1 -paths ‘C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\file_deleter.ps1’，’C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\aipackagechainer.exe’，’C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files’，’C：\Users\admin\AppData\Roaming\ADV’，’C：\Users\admin\AppData\Roaming\ADV’ -retry_count 10”

Both “file_deleter.ps1” and “AI_4ECB.ps1” are the same file, with sha256 80C274014E17C49F84E6C9402B6AA7D09C3282ADC426DA11A70A5B9056D6E71D. They are used to clear out the ADV directory once the final payload is delivered.
“file_deleter.ps1”和“AI_4ECB.ps1”是同一个文件，sha256 80C274014E17C49F84E6C9402B6AA7D09C3282ADC426DA11A70A5B9056D6E71D。它们用于在交付最终有效负载后清除 ADV 目录。

The “aipackagechainer.ini” file shows the installation and execution parameters:
“aipackagechainer.ini”文件显示了安装和执行参数：

[GeneralOptions] [常规选项]
Options=bh 选项=bh
DownloadFolder=C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\
DownloadFolder=C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\
ExtractionFolder=C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\
ExtractionFolder=C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\

[PREREQUISITES] [先决条件]
App1=4.4.7 应用1=4.4.7

[App1] [应用1]
SetupFile=C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\ADVin\ADV.exe
SetupFile=C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\ADVin\ADV.exe
Options=ip 选项=ip

[PREREQ_CHAINER]
CleanupFiles=C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\ADVin\ADV.exe
CleanupFiles=C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\ADVin\ADV.exe
CleanupFolders=C:\Users\admin\AppData\Roaming
CleanupFolders=C：\Users\admin\AppData\Roaming
CleanupScript=C:\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\file_deleter.ps1
CleanupScript=C：\Users\admin\AppData\Roaming\ADV\4.4.7 New-Files\prerequisites\file_deleter.ps1

This shows the MSI installation path and execution chain. “ADV.exe” is the .NET downloader that will be run first, followed by the “file_deleter.ps1” script, which removes the installation files.
这显示了 MSI 安装路径和执行链。“ADV.exe”是将首先运行的 .NET 下载程序，然后是“file_deleter.ps1”脚本，用于删除安装文件。

Hashes (md5, sha-256) 哈希（md5、sha-256）	2c84d115a74d2e9d00a14f19eb7f8129 2843582FE32E015479717DA8BF27F0919B246A39495C6D6E00AC7ECA8B1D789C
File Name 文件名	ADV.exe, App.exe ADV.exe、应用.exe
File Size 文件大小	47104
Created 创建	2039-08-06 15:13:14 UTC 世界协调时 2039-08-06 15：13：14

“ADV.exe” checks ipinfo[.]io for a geolocation in Mexico with the obfuscated function below. If MX is not in the response string then the downloader exits.
“ADV.exe” 检查 ipinfo[.]io，用于墨西哥的地理位置，具有以下混淆功能。如果 MX 不在响应字符串中，则下载程序将退出。

Figure 4: Function checking for Mexican geolocation
图 4：墨西哥地理位置的函数检查

The rest of the downloader’s execution deobfuscates strings and then downloads content from hxxps://trapajina[.]com/516. The file is saved as “kaje.zip”. “Kaje.zip” is decompressed into the final payload, “chancla.exe”.
下载程序执行的其余部分对字符串进行反混淆，然后从 hxxps://trapajina[.] 下载内容。com/516号文件。文件另存为“kaje.zip”。“Kaje.zip”被解压缩到最终有效负载“chancla.exe”中。

All payloads utilize the user_agent “Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.0.3705;)”.
所有有效载荷都使用user_agent“Mozilla/4.0（兼容;微星 6.0;Windows NT 5.2; .NET CLR 1.0.3705;）”。

“Chancla.exe” can also be found at hxxps://dulcebuelos[.]com/perro516[.]exe.
“Chancla.exe”也可以在 hxxps://dulcebuelos[.]找到。com/perro516[.]exe。

AllaKore RAT AllaKore 大鼠

AllaKore RAT, although somewhat basic, has the potent capability to keylog, screencapture, upload/download files, and even take remote control of victim’s machine.
AllaKore RAT 虽然有些基础，但具有强大的功能，可以记录键盘、截屏、上传/下载文件，甚至可以远程控制受害者的机器。

Hashes (md5, sha-256) 哈希（md5、sha-256）	aa11bedc627f4ba588d444b977880ade AA11BEDC627F4BA588D444B977880ADE中 6d516a96d6aa39dd9fc2d745ea39658c52ab56d62ef7a56276e2e050d916e19f
File Name 文件名	chancla.exe 钱克拉 .exe
File Size 文件大小	7696896
Created 创建	2023-09-15 07:26:42 UTC 世界协调时 2023-09-15 07：26：42
Copyright 版权	CreatiUPRPS Win Service CreatiUPRPS Win 服务
Product 产品	CreatiUPRPS Win Service CreatiUPRPS Win 服务
Description 描述	CreatiUPRPS Win Service CreatiUPRPS Win 服务
Original Name 原产地名称	CreatiUPRPS Win Service CreatiUPRPS Win 服务
Internal Name 内部名称	CreatiUPRPS Win Service CreatiUPRPS Win 服务
File Version 文件版本	3.4.0.0
Comments 评论	CreatiUPRPS Win Service CreatiUPRPS Win 服务

“Chancla.exe” is the threat group’s modified version of AllaKore, which contains the following functionalities besides those originally found in the open-source AllaKore RAT:
“Chancla.exe”是威胁组织的AllaKore修改版本，除了最初在开源AllaKore RAT中发现的功能外，它还包含以下功能：

Additional commands related to banking fraud, targeting Mexican banks and crypto trading platforms.
与银行欺诈相关的其他命令，针对墨西哥银行和加密交易平台。
Reverse shell through command <|RESPUESTACMD|>.
通过命令 <|RESPUESTACMD|> 反转 shell。
Clipboard function through commands <|CLIPBOARD|>, which only executes Ctrl+C, and <|PEGATEXTO|> “grab text”, which copies content by executing the shortcut Ctrl+C. It can then paste copied content via the shortcut Ctrl+V.
通过命令<|CLIPBOARD|>（仅执行Ctrl+C）和<|PEGATEXTO|>“grab text”（通过执行快捷键Ctrl+C复制内容）实现剪贴板功能。然后，它可以通过快捷键 Ctrl+V 粘贴复制的内容。
Downloads and executes files, providing an easy way for the RAT to become a loader and install additional components not hard-coded in the malicious binary.
下载并执行文件，为 RAT 提供一种简单的方法，使其成为加载程序并安装未在恶意二进制文件中硬编码的其他组件。

Figure 5: PEGATEXTO function
图 5：PEGATEXTO 函数

Figure 6: Descarun function
图 6：Descarun 函数

This sample utilizes uperrunplay[.]com as the C2 with the same URL as previous campaigns, using as endpoints “license.txt”, “license2.txt”, and “registrauser.php”. At the time of writing they pointed to the following:
此示例利用 uperrunplay[.]com 作为 C2，其 URL 与以前的活动相同，使用“license.txt”、“license2.txt”和“registrauser.php”作为端点。在撰写本文时，他们指出了以下几点：

license.txt: version_400_https://domain[.]com/perro516[.]exe is a placeholder for AllaKore RAT itself; when pushing for new versions, the threat actors changed the domain to dulcebuelos[.]com.
许可证.txt： version_400_https：//domain[.]com/perro516[.]exe 是 AllaKore RAT 本身的占位符;在推送新版本时，威胁参与者将域更改为 dulcebuelos[.]com。
registrauser[.]php is the C2, which is used for communication with the RAT.
注册用户[.]php 是 C2，用于与 RAT 通信。
license2.txt: http://23.254.202[.]85/Chrome32[.]exe
许可证2.txt： http://23.254.202[.]85/铬32[.]exe文件
Chrome32.exe (SHA256: 0b8b88ff7cec0fb80f64c71531ccc65f2438374dda3aa703a1919ae878f9eb67) is a Chrome extension that blocks access to URLs starting with enlaceapp[.]santader[.]com[.]mx/js/vsf_generales/.
Chrome32.exe （SHA256： 0b8b88ff7cec0fb80f64c71531ccc65f2438374dda3aa703a1919ae878f9eb67）是一个 Chrome 扩展程序，可阻止访问以 enlaceapp[.] 开头的 URL桑塔德[.]com[.]mx/js/vsf_generales/。

Figure 7: Chrome extension blocking rules
图 7：Chrome 扩展程序屏蔽规则

Network Infrastructure 网络基础设施

The network infrastructure is not obfuscated in any way other than regular domain updates. The majority of servers used in this campaign are purchased through Hostwinds, while the domains are registered through eNom LLC.
除了常规域更新外，网络基础结构不会以任何方式进行混淆。此活动中使用的大多数服务器都是通过Hostwinds购买的，而域名是通过eNom LLC注册的。

Domain 域	Type 类型	First Seen 初次见面	Last Seen 上次出现
flapawer[.]com	C2	2023-12-13	Active 积极
chaucheneguer[.]com Chauchenegér[.]com	C2	2023-10-27	Active 积极
hhplaytom[.]com	C2	2023-10-05	Active 积极
zulabra[.]com 祖拉布拉[.]com	C2	2023-04-29	Active 积极
uperrunplay[.]com	C2	2022-11-08	Active 积极
uplayground[.]online uplayground[.]在线	C2	2021-05-12	2023-04-28
praminon[.]com/519 普拉米农[.]com/519号文件	Delivery 交货	2023-12-23	Active 积极
trapajina[.]com/516 特拉帕吉纳[.]COM/516号文件。	Delivery 交货	2023-10-07	Active 积极
zaguamo[.]com/500 扎瓜莫[.]com/500	Delivery 交货	2023-05-10	Active 积极
pemnias[.]com/433 佩姆尼亚斯[.]com/433号文件	Delivery 交货	2023-05-10	2023-10-16
isepome[.]com/435 isepome[.]com/435号文件。	Delivery 交货	2023-02-03	Active 积极
narujiapo[.]com/435 narujiapo[.]com/435号文件。	Delivery 交货	2023-05-30	Active 积极
manguniop[.]com/422 曼古尼奥普[.]COM/422号文件。	Delivery 交货	2022-06-06	2023-06-06
debirpa[.]com 黛比尔帕[.]com	Delivery 交货	2023-05-02	Active 积极
dulcebuelos[.]com	Delivery 交货	2023-03-15	Active 积极
iomsape[.]com	Delivery 交货	2023-02-03	Active 积极
bstelam[.[com/431 bstelam[.[com/431号文件	Delivery 交货	2022-08-06	2023-08-05
rudiopw[.]com/430 鲁迪奥普[.]com/430号	Delivery 交货	2022-06-29	2023-06-26
ppmunchi[.]com	Delivery 交货	2022-05-18	2023-06-30
pelicanomwp[.]com/422 pelicanomwp[.]COM/422号文件。	Delivery 交货	2022-04-29	2023-04-29
andripawl[.]com 安德里帕尔[.]com	Delivery 交货	2022-04-03	2023-04-19

All of the C2s utilize the same HTML and favicons, and are traceable with the following MMH hashes:
所有 C2 都使用相同的 HTML 和网站图标，并且可通过以下 MMH 哈希进行跟踪：

http.html_hash:1125970204
http.html_hash：1125970204
http.favicon.hash:-2055641252
http.favicon.hash：-2055641252

IP Match MMH IP 匹配 MMH

192.119.99[.]234

192.119.99[.]235

192.119.99[.]236

192.119.99[.]237

192.119.99[.]238

23.236.143[.]214

23.254.138[.]211

23.254.202[.]85

Aside from a short resolution of uperrunplay[.]com to 23.236.143[.]214, these C2 are also hosted on Hostwinds servers.
除了 uperrunplay 的简短分辨率[.]com 到 23.236.143[.]214，这些C2也托管在Hostwinds服务器上。

All delivery servers are hosted on 23.254.136[.]60 and utilize ZeroSSL certificates. The server has been used for delivery purposes since 2022-04-03.
所有交付服务器都托管在 23.254.136[.] 上60 并使用 ZeroSSL 证书。该服务器自 2022-04-03 起用于交付目的。

BlackBerry telemetry shows that remote desktop protocol (RDP) access to C2 servers is accomplished via express-vpn and mullvad-vpn, in addition to the use of Starlink IP addresses located in Mexico. The large number of Mexico Starlink IPs and long timeframe of connections indicate the geolocation of the threat actor is likely Latin America.
BlackBerry 遥测数据显示，除了使用位于墨西哥的 Starlink IP 地址外，对 C2 服务器的远程桌面协议（RDP）访问是通过 express-vpn 和 mullvad-vpn 完成的。大量的墨西哥 Starlink IP 和较长的连接时间表明威胁行为者的地理位置很可能是拉丁美洲。

Targets 目标

This threat actor is specifically targeting Mexican entities, especially large companies with gross revenues over $100M US. All lures have utilized legitimate and benign Mexican government resources, such as the IDSE software update document “guia_de_soluciones_idse.pdf” and the IMSS payment system SIPARE.
该威胁行为者专门针对墨西哥实体，尤其是总收入超过 1 亿美元的大公司。所有诱饵都利用了合法和良性的墨西哥政府资源，例如IDSE软件更新文件“guia_de_soluciones_idse.pdf”和IMSS支付系统SIPARE。

Figure 8: IDSE PDF header used as a lure
图 8：用作诱饵的 IDSE PDF 标题

During the installation process, the .NET loader confirms the Mexican geolocation of the victim through IP location services, before proceeding to download and deploy the RAT.
在安装过程中，.NET 加载程序会通过 IP 位置服务确认受害者的墨西哥地理位置，然后再继续下载和部署 RAT。

Targeting is indifferent to industry, as we saw targeted entities across Retail, Agriculture, Public Sector, Manufacturing, Transportation, Commercial Services, Capital Goods, and Banking industries. The actors are most interested in large companies, many with gross revenues over $100M USD. We know this because the lures used only work for companies that are large enough to be reporting directly to the Mexican government’s IMSS department.
目标与行业无关，因为我们看到了零售、农业、公共部门、制造业、运输、商业服务、资本货物和银行业的目标实体。演员们对大公司最感兴趣，其中许多公司的总收入超过1亿美元。我们知道这一点，因为使用的诱饵只适用于那些足够大的公司，可以直接向墨西哥政府的IMSS部门报告。

Function naming inside the RAT imply specific targeting of banks residing in Mexico. Prefixes to those names explicitly reference six Mexican banks and a Mexican crypto trading broker.
RAT中的功能命名意味着针对居住在墨西哥的银行的特定目标。这些名称的前缀明确引用了六家墨西哥银行和一家墨西哥加密货币交易经纪人。

Attribution 归因

The targeting of Mexican entities by this threat actor has been ongoing since at least late 2021. In December of 2021, Mandiant released an investigative report about FIN13, where they state that only two financial actors that they know of limit their targeting to one single country over a timeframe of multiple years. Only 14 of the financially motivated groups they track persist for longer than one year. These statistics point to this actor being unique in its persistence and regional targeting.
至少自 2021 年底以来，该威胁行为者一直在针对墨西哥实体。2021 年 12 月，Mandiant 发布了一份关于 FIN13 的调查报告，他们指出，他们所知道的只有两个金融参与者在多年的时间范围内将其目标限制在一个国家。在他们追踪的有经济动机的群体中，只有14个持续了一年以上。这些统计数字表明，这一行为者在持久性和区域定位方面是独一无二的。

Custom functionality built into the RAT gives its operators specific fields to paste credentials and data related to their target’s banking infrastructure. This implies a segmented operation, where operators utilize the RATs to upload victim data to the C2 server in a specific format. That can then be used by the malicious individuals in charge of conducting fraudulent banking actions to take further action.
RAT 内置的自定义功能为其运营商提供了特定字段，用于粘贴与其目标银行基础设施相关的凭据和数据。这意味着分段操作，操作员利用 RAT 以特定格式将受害者数据上传到 C2 服务器。然后，负责进行欺诈性银行行为的恶意个人可以利用它来采取进一步行动。

Function naming in Spanish, and Mexican Starlink IPs accessing RDP ports of the C2 indicate that this actor group is mostly likely located in Latin America.
西班牙语的函数命名，以及访问 C2 的 RDP 端口的墨西哥 Starlink IP 表明该参与者组很可能位于拉丁美洲。

Conclusions 结论

This threat actor has been persistently targeting Mexican entities for the purposes of financial gain. This activity has continued for over two years, and shows no signs of stopping.
该威胁行为者一直以墨西哥实体为目标，以获取经济利益。这项活动已经持续了两年多，而且没有停止的迹象。

The number of sightings from within BlackBerry’s own internal telemetry, and the vast number of sample submissions to VirusTotal (the majority submitted from within Mexico itself), point to an extremely active group targeting any large Mexican company they can contact, with the hope of exfiltrating financial information.
黑莓内部遥测数据中的目击事件数量，以及提交给VirusTotal的大量样本（大多数来自墨西哥本土），都表明一个非常活跃的组织瞄准了他们能联系到的任何大型墨西哥公司，希望泄露财务信息。

APPENDIX 1 – Indicators of Compromise (IoCs)
附录 1 – 入侵指标（IoC）

File IoCs 文件 IoC

sha256 SHA256的	Type 类型
94489764825f620e777a34161d0ce506a49eec20bc27c3d63370e493a737d50e	.NET Loader .NET 加载程序
884789b63fe432938e1bb76c9976976c1905b74c2974340a60eb7ea8261d48fb	.NET Loader .NET 加载程序
b18e0c7c9569b33187e2beaf3318e99b50ed40c54e7dee8a26ce711bc782b150 货号：b18e0c7c9569b33187e2beaf3318e99b50ed40c54e7dee8a26ce711bc782b150	.NET Loader .NET 加载程序
4085c9829e2b18fd4721688dc25c0611f260b6e4f827b667999d9603cfe5e2d7	.NET Loader .NET 加载程序
66f5b7ca8760fb017b0750441707c24eaa916d5b8aa021b3aa92082c6129ca22	.NET Loader .NET 加载程序
0a3aa8c2485a3b8525f044f33c6d268ab79e1942885792d95f6a1c0c45be6106	.NET Loader .NET 加载程序
84a468a25a8c65dac51f520732d2e9e6afa6b59e4b2f485c262a9bd305cd61c0	.NET Loader .NET 加载程序
9402128b9602fbb485be887def8cd72c3265cd09f6dbf4e0a3ad2ea42da66870	.NET Loader .NET 加载程序
e4a6be2fb70603f1545641240680b44e21b5601e8016c0d144711423eef9778e	.NET Loader .NET 加载程序
d5ac0f4efa8396ae9ba74cc3ea2a62485e4d49a930efed0d69b043162bb66cc2	.NET Loader .NET 加载程序
d63447877be48156032cc9ec9def7e25d62e7bc544bd3e19da75c0f55e09dcc0	.NET Loader .NET 加载程序
7bb22d7013dede7b866ab25cbe32246228c46bd8a951b5a72557b7280ebb066f	.NET Loader .NET 加载程序
2867d87bbc088b8cc50ff66f1d9c064cba978433cdb900649bbbb44370f8cbd1	.NET Loader .NET 加载程序
b00fee1c275d12a05ca8a06ab54ffac2e3e8da68fd2be450f34c36c8a38e4887	.NET Loader .NET 加载程序
e7e2a6fe7325ad7945a6020202ab5581e0a204f8b8ad9ffc48c18f129a6f8c46	.NET Loader .NET 加载程序
42f1d24e135b9d3e4fd38e1ec3ab20cae495ec3526ae4037d937c6344914e923	.NET Loader .NET 加载程序
88a9e666d4231a98a909ae5780778b85ffdb8a5207b8f7dfca2a0911cc0f6580	.NET Loader .NET 加载程序
872c58b72962c1f0696b26563425c6734cc2246d1ea3375f675c1bd1ca915e59	.NET Loader .NET 加载程序
49de6df83c5fe55c4e45b5744203513832f0435dbbd7913a3ce7f827afe51236	.NET Loader .NET 加载程序
0eb20898a0a3c1f4a4210a819fa0bd8f8574db3413db8b85e381ab0c1963791a	.NET Loader .NET 加载程序
d928ce7383d8582163c36773d1d97360a5ded812d11ee0faf99c7afa78251850	.NET Loader .NET 加载程序
8a1381a829776220ec4bf0a9d36cf6842a5638b0190e667ee696bab04b8e7c9f	.NET Loader .NET 加载程序
0835d21b60e3443892988d675f20393d79503ca6e37a889d9f7da19c321b3426	.NET Loader .NET 加载程序
4276b4b4504edff275a4d56b99f66b23c48b49f4081abab36bf4d8f88818e2da	.NET Loader .NET 加载程序
8cc14643ec452aa35e709ae34b874e0f070a20b174e7eeb2a046351a329cdde9	.NET Loader .NET 加载程序
0eeb357abcd3864538dc26000f3a1d706c2c330fadfb845f7fc350b382d00c4e	.NET Loader .NET 加载程序
61037a3321e143d85cdf77abf31f33ca5a701da0b84cef172bcf89457dfb4e7d	.NET Loader .NET 加载程序
0324d8ed29829e5fa7add2bab1e73f2ad0094e80867caf57d35369a5e22fe79c	.NET Loader .NET 加载程序
2444dd2bb0a0fa0631935ddeb829b753d1ba46c9149ee45f79794903f26e16fa	.NET Loader .NET 加载程序
19d357351a29f6530624556bd31c475d56ea9ad76f31eb28f7d251fa3c751d62	.NET Loader .NET 加载程序
da0b73d2f42f0232762f7c8d3eaa6863969f1982b798cd9fc19431c901ae4635	.NET Loader .NET 加载程序
2843582fe32e015479717da8bf27f0919b246a39495c6d6e00ac7eca8b1d789c	.NET Loader .NET 加载程序
b1489b216fb25bcf57329546c160800645c0a6620add3c8323e2b589d7150e9e 货号：b1489b216fb25bcf57329546c160800645c0a6620add3c8323e2b589d7150e9e	.NET Loader .NET 加载程序
a72018420f8aab9cb431d120bfa06acd09d777a88aa186ec495dffdc22395f0e	.NET Loader .NET 加载程序
2a0d1c7354b43acd6fd0303beb6277db92691f03e37baea0c39249ae0d8b5301	.NET Loader .NET 加载程序
906d49817970955847f64d2f868e418579549e9cfa91c575f38342a1bd66ad4b	.NET Loader .NET 加载程序
e01b10fc4131b8eec32148e559b95fd82da817166b831ae32a0fa89be883e8e9	.NET Loader .NET 加载程序
08f0954be207eaa1a85cdc9eed4ad2737613bbbf240a7c30b658b583c3ddef0c	.NET Loader .NET 加载程序
3499e5bd9daad587e05337bae5e953f279ebee20d9cf6d2a1707be28ce6295bf	.NET Loader .NET 加载程序
1230b1a189b17a4da79bc10bde0fbb439c37997c8f927d4a80c61b006d8b3267	.NET Loader .NET 加载程序
17213aa5a43fcf6a6baf5e784f33411cd0fa3a2fb00418486085c5a24695af7c	.NET Loader .NET 加载程序
c86f9d739ea3c6b57fd070892be9d1d4b3c50fca8a8c3e05cf84875378fcc649	.NET Loader .NET 加载程序
b61c027adcef5d2108dc13735cef5d4bce295f13de6032f3fee5129be74816b6	.NET Loader .NET 加载程序
968f90a4567cdf67885c116379c792b4eeda1f7f8bd2cf34daf8c58b17f2ec0f	.NET Loader .NET 加载程序
a65091e8912e4b65458041f866d37410b46e7a9432a57e0d7dc01ca4a21f3940	.NET Loader .NET 加载程序
bf3e96bb6273890f48b566e9d484e0e747e8f21e3dbd6606a39edf98faedc7b1	.NET Loader .NET 加载程序
6d3a50a354bcf2df226ce1065563755b3ab16d2e440900e3b80a9f0571c0f73a	.NET Loader .NET 加载程序
da61eb41bffd50a07793ccc8b2ead76f5c49313445f07aa685c28523bbf39a00	.NET Loader .NET 加载程序
caa7ef0b9a6ea51752813b7107348f46a3475acf9b3f1242e675f6a1296ccb2c	.NET Loader .NET 加载程序
eaf26e1d12e0ae355441499bdf9d13c582540f3876bddfdef95c676f185609b8	.NET Loader .NET 加载程序
cee2730a6e4100e3b865cb6fee41f77ec5a8bfce186b1e121ebb4236cd3dff88	.NET Loader .NET 加载程序
e1246fbac51f8369292aec96270dd4b2a62fd148d9b6f2ca8ee208631237a44f	.NET Loader .NET 加载程序
f292911c11a15001ca66e90df341f8763d4d149482f06f85cc2873651d205a6b	.NET Loader .NET 加载程序
8d4d672eeba756c7ace20aea90219c8f7409b23ecc9c2eb47a31b1cd2d3577a6	.NET Loader .NET 加载程序
7474cd11f62a53f0f3035fb62753561067cd771ec3e5d73823e74d4f4b8d31cb	.NET Loader .NET 加载程序
74f637b21f7c68e6d56f0d64378336b28f500d82d4eb876d5b1cbbfe3a952ac2	.NET Loader .NET 加载程序
bbd94254223f4ec3edbcc44c5d6d5ae5029c8d9c4512f02d3c61d2a28c3c5416	.NET Loader .NET 加载程序
31e060d82ef68613d26b5e47c3934d482fc2975dad71fa6e677900cc8a938116	.NET Loader .NET 加载程序
55455d2488d127fc7bb6976821c36ad5661a5e57e2d57dcc7ae7cb12ba7282d3	.NET Loader .NET 加载程序
301f27dc88655927ce45b0c1138b4931b0d3aa7dcfdd424315d5c7339c540e52	.NET Loader .NET 加载程序
5c1306596589d0b0c0f0d04be6687e5c2dbe92fbba493760b0ded7a47942fbb1	.NET Loader .NET 加载程序
bc81f08ad4c543a35f899da8d45787751b50d221d67dae083d62097631ace059	.NET Loader .NET 加载程序
582aa139fb1c315f68106cc2e50c10835874e8bc77aeb7302453f9aa3c25d920	.NET Loader .NET 加载程序
7bced78c519befdb1b7ef3b973250f4ee2d3c2404309cea372df16b8ff5b1d84	.NET Loader .NET 加载程序
8185e9784adfd6c2f1a286a724e7e374008667ae1f50cfa1a58451a5c33af536	.NET Loader .NET 加载程序
05d0dd9916646c6144506bb26cab500d807ab015609bd19634e890fbeb63e48f	.NET Loader .NET 加载程序
f8262a0c746bbfbb3e7cb17398953cd8391cdf416b759d4be1f1fc11611f4eb3	.NET Loader .NET 加载程序
14f15b1d7951f078bbf412bb2ef774c812efff70280b86b8176994374c0e766d	.NET Loader .NET 加载程序
ec1ea0b01ad6cd431c8441dc83537c3d9ef00994f9dd76a3041ff50c2526ce38	.NET Loader .NET 加载程序
53e196f293b4f99face97449d18106f7dc9df5b9170354d1c1da27f9ec71849c	.NET Loader .NET 加载程序
a20672a07f3cf2e67682486c1a2b6684e9a50ca129260a74353d1664be25aa92 编号：A20672A07F3CF2E67682486C1A2B6684E9A50CA129260A74353D1664BE25AA92	.NET Loader .NET 加载程序
cdf35bb3a256d4bd4e09a2a9b19e4682a3952233c720e37d9ae88e4050b8473a	.NET Loader .NET 加载程序
b9ea5ecbda6abd328bd7370d250fa9ab5a38a104955ac383cecee8ce581b9d80	.NET Loader .NET 加载程序
933858679466d57b4ea47003f08d864b1a417d7be75008e42ecd62f05dde7964	.NET Loader .NET 加载程序
3ad89c70d77b9fec35bbbac25d3dabca9d6c1fc055b8570a2d34b3af5ac58aef 3ad89c70d77b9fec35bbba25d3dabca9d6c1fc055b8570a2d34b3af5ac58aef	.NET Loader .NET 加载程序
55f1b8346fc2e94791431a237d8a38fb6bb2014380b1905955d12bccb8c24e79	.NET Loader .NET 加载程序
c1e18c6a611ccf23971a43fcdc0186d6a3f2bb0ee792140c35fc1e1a34582551	.NET Loader .NET 加载程序
225d10a0b3880eebafb327769e39a2484161e21e5d07ddef8fe16b65d2a90113	.NET Loader .NET 加载程序
dcea0d579d3d6ab2d29a3665e3e0c3849ccd42abe390b80bf362c79088a1ebbe	.NET Loader .NET 加载程序
4865a260754a6a8740a85c40ef4185420334f9b21cc0d865295fdae4bb1e94a4	.NET Loader .NET 加载程序
ae192d14a916ecdb55803830eace5ef820b1b520a751b6b689fa9591f6f292bc	.NET Loader .NET 加载程序
bdc0a1ad95b1a62ae1e702681949fea485f42d5884aca78df02a64869688192e	.NET Loader .NET 加载程序
c625ac5c134a74d84f8ce91504e41af15972ec71c064f7a5d31c588a8ff2c332	.NET Loader .NET 加载程序
ea357305411b9c6b27657782e2bb14bc0c18149a7ad4093b30c12b041f785933	.NET Loader .NET 加载程序
f76f5c12b81aa6d7fac0eeb4b775004c525ae50ebb049b6f4177417104eb8ef4	.NET Loader .NET 加载程序
2be8c01e5ffcabb566212268a63ef3c42db5c57d3e879abe99b06b48ac9bacda	.NET Loader .NET 加载程序
46f5ffcc04ea1eaf09cfce1a9329624c85a5c5435d91444a55ce02fceebfd2f7	.NET Loader .NET 加载程序
ed7da8aef7dbe652b429d64a918a943c6586e1d4cec353c84663f8b451c09874	.NET Loader .NET 加载程序
3c1be333e85f0243cdbcecfd727e86d582569809e2c45fefb64261b473ca1734	.NET Loader .NET 加载程序
f0dfa2297df28f64dc38da3a54bbef5c499691a8cf05de0f08e20f4f7077e67c	.NET Loader .NET 加载程序
40fc64907dcd0063e5f2b604fe78d0484d821cb9cda199d3cdca5e0219b43587	.NET Loader .NET 加载程序
fc39aa0d2486c746f9b8d4d459a65517a21f961fb24ec25c4470f0b86e8c7cae	.NET Loader .NET 加载程序
4bfa7c32d9eb8f7468a1919dbf9698e971052c091de4b66b125ba18b04bbe607	.NET Loader .NET 加载程序
d8e22f8b5964428b4a29e5aad9ec9186bd96e7d29bc56ede8821a24294629931	.NET Loader .NET 加载程序
bc3fcaa746c261af6b72ee0720fa739d7f79df71709b7067f016e30578f94c22	.NET Loader .NET 加载程序
263bc3729f5785acb6647af950f3fe0a0cbbe05d2fcc9639276852ba39ecbaa2	.NET Loader .NET 加载程序
f31a6b19572b668dbb473a0e43e53b9c1e5020b057421de8fc019c150ed3fb38	.NET Loader .NET 加载程序
ee32169bef700d3dcceb86a101e188e5c0146a1104ee8809d1e031d93cdee36c	.NET Loader .NET 加载程序
9946fb2e81d07ad7780a20cf06b59bd27177c8bd6ed543e13089c47957adab1a	.NET Loader .NET 加载程序
c5a4bf56670d51fed1e88050eddb003f39af0e22fbb01163679fef758b000392	.NET Loader .NET 加载程序
4524d47ca7b7d71764f12807fd3722e4b890388eb2f5bf975d58c6afd0221fb3	MSI Installer MSI 安装程序
8e2fc9de5da07a6cf6cfeb3349185e282cec5eed944cb66873136bd697389516	MSI Installer MSI 安装程序
2f9f289224482204b0f3bb4f0af8fe99f235daea99fe435cbc53dcbb9bc22bb0	MSI Installer MSI 安装程序
434ec6d3575f72e680a8bf9211b3a853d80457644ff01d7acc41657b9bfdca24	MSI Installer MSI 安装程序
eee76b24be7121434ec7ad1ca39792cbfec594916f8e143fad18698955ba0870	MSI Installer MSI 安装程序
81c5b7940a69854c72cb99d4af6a1092f0adc9182e9e8fd729b1857126d096ba	MSI Installer MSI 安装程序
70d6cf1d106783bced15e4bd31b91a6be8ae9d9746955da60cfdf1cb1f9dbf7d	MSI Installer MSI 安装程序
77607c0a0a1dcaa4f1ba27e17d5eba5d79fbbf64e1e71b8f4e03a6f724653355	MSI Installer MSI 安装程序
80bc99cd883421432e034d0c714d892ecaac6385fd86bd74e9291a736e118f28	MSI Installer MSI 安装程序
d48d277f7891ed1e2797d551c1470eae87af7b82746fa8dc2083440c42bcc112	MSI Installer MSI 安装程序
71a106f9fbce3e5b48baaacc250beb292cbc0c63190c3ae390f69c17e0be5465	MSI Installer MSI 安装程序
c9c18f3eb35b9359c52737e12c35701401867b91aad0ca17822e8a82fce46001	MSI Installer MSI 安装程序
9cbf221cfb8fe33c0a3e352742c8b9b931fef5b5c6a07e33cdeebe97b6113622	MSI Installer MSI 安装程序
335b69874aff8bc4c45404917fb34523c7205854a979a5293b40d0b2aa52ed89	MSI Installer MSI 安装程序
6eed0ff8083a07cf43850e74a9667267613783721834c7593338f888b419ca47	MSI Installer MSI 安装程序
5925f48a5b1abc6d25858bf7d3cfc4ec98991ecc5fddebe79b80c29789a2f5fe	MSI Installer MSI 安装程序
a6fbcc0b368109a964e55869969d33db7287726b2e0dbf46bdcaa91f6adc1edb	MSI Installer MSI 安装程序
98f7bda5f3c4d7f845b6812d774765907b7b943b7d97386c1a8135c2051b2225	MSI Installer MSI 安装程序
8a444480e1a313ce35b3535c8df8f5511817e57897e7b5de0e36b5973c21fb82	MSI Installer MSI 安装程序
a8f7253907eb8ab7021c58cc8a03c32f33d4a3a86494b9198b68cec3219a968c	MSI Installer MSI 安装程序
aeda5536fe7239843130547c677d2094883fd45aafeffb91c196c9b12c36232b	MSI Installer MSI 安装程序
750baeecb35d18010fbdfd0c90ecd4be3083a51b39837f596f0887bfd294e170	MSI Installer MSI 安装程序
28107b1104bb5fd61d49b64460a0f1f75c664930b251849361783cf60d518c7d	MSI Installer MSI 安装程序
56f7283604960cca96200e5da47dd6a4408086a77973f96ca230b2a583545cd8	MSI Installer MSI 安装程序
490bd1a59cb2d43828c301d943b7c6a848f2b70d901d69234ccc7c88db8f8ca7	MSI Installer MSI 安装程序
44339460d0dfe01d68c10c9a084f1d4530b0c135d6be55bcbc8666822b454f3f	MSI Installer MSI 安装程序
39be7067ccedfac84b9ff7d15bc6297d8d8637357aaa4b68286ed8af2e65a2e7	MSI Installer MSI 安装程序
4edc594040c0a3b0dfa5b343d1f000271b0e6d3bd3f29988c360735c6ffd9fc0	MSI Installer MSI 安装程序
9103f43dcf834b696ff3f6f4ea58dc0bdf14e1483f91420313157bb1a41ba76b	MSI Installer MSI 安装程序
13d88bcf312896fae6d03d59c564bc9521e0916096098cfe41508395955aab0e	AllaKore 阿拉科雷
168ac972b7f0610f978e50b426e39938f889422b1bcfaf9cddf518e3e1ed9aa9	AllaKore 阿拉科雷
2ff3cdb886b1caf3eaad9a2467bfa16b9269b88695b76bb6a0da481458e30aa3	AllaKore
305cde85573131949fab5a3973525a886962c4f8c02558d3a215689a49f53406	AllaKore
33578228c11ad0b3d86a198a32b602aa93a91d2feeae2fb2e83f8c6595c8acd9	AllaKore
422c9471c29fe17457e142df1a567c273212019eb20b0b4783891c529c1248a8	AllaKore
46c14c2f0d04710f53db16473877d3315c13e1a33a3236846a87e8f91808c8eb	AllaKore
49a04f31e49cee3ae65e9d776bc0f8aedf40c52fafcd002ccf7de4044abec2dd	AllaKore
52134d02cd77f8a65fd5b15c7c57ff2909ac39f0b5779592c533a18bf6b23879	AllaKore
5961b42f8efad58c437bdad862a0337c6bcd57f7cbf35184f2de60f4609fd477	AllaKore
673d4fe6f9e46fae37649c525f1d0d89cfd3b8310210dff4ddc7349418d9e80f	AllaKore
6d516a96d6aa39dd9fc2d745ea39658c52ab56d62ef7a56276e2e050d916e19f	AllaKore
89206ca169747d4aa70d49350415f21df7f1a00a3bf8d0c253b6beda2eb919d9	AllaKore
8fce1d24cf952528169f473b9462724482511615ed31165710e5e3a74cefdd02	AllaKore
911e45d053bdf3a41e812203ae29db739cf3505a4e37209936c1cc83ee42e8e9	AllaKore
9221470c77b46bcd457951ae3a3d31d60ad4602ea9d152d51d1e4f9a5b3bca3a	AllaKore
a5af60355c423fa4cc9695b86a5697f847259eaee724065162d303cc4523d447	AllaKore
b858d451804a641fc51dd6d3c50668d6a08dc9033252aee52f582264a970cff8	AllaKore
bc423bd9acd7c5a1f2849091f21de5429f2fc79e2655f92866e1c8b7b1f96f7e	AllaKore
c778739c5214aa580cba05f01afe2d9fc8f12d3fa7ad864a279bcb4ad6d266b4	AllaKore
cde045a0269a5a05928128c6ca7c030947f96034c9204e2b747a0d626e3f22f3	AllaKore
e2d82ab6cc71a1d8d2a2ba2312b0d8a4a3d23e3902d5b180383d9e406097a9ff	AllaKore
ee772e1260c6adc532bed57cacdbb6e0b8db311996074ad42eaf1aefd243187a	AllaKore
eecc201c80809b636d945aa537b954dd2e39382c36067a040a672167a1257a09	AllaKore
fba031543c3ab694a09e603a7df6417f93742f0b87f9fedaf9ab84d11340ccb5	AllaKore
fd8c49d00effa8bc730e06ae217655a430ba03122ca974945d41642299853dfa	AllaKore

Network IoCs

IoC	Type 类型
flapawer[.]com	C2
chaucheneguer[.]com Chauchenegér[.]com	C2
hhplaytom[.]com	C2
zulabra[.]com 祖拉布拉[.]com	C2
uperrunplay[.]com	C2
uplayground[.]online uplayground[.]在线	C2
192.119.99[.]234	C2
192.119.99[.]235	C2
192.119.99[.]236	C2
192.119.99[.]237	C2
192.119.99[.]238	C2
23.236.143[.]214	C2
23.254.138[.]211	C2
23.254.202[.]85	C2
23.254.136[.]60	Delivery 交货
trapajina[.]com	Delivery 交货
narujiapo[.]com	Delivery 交货
zaguamo[.]com	Delivery 交货
debirpa[.]com 黛比尔帕[.]com	Delivery 交货
isepome[.]com	Delivery 交货
iomsape[.]com	Delivery 交货
pemnias[.]com	Delivery 交货
bstelam[.]com	Delivery 交货
rudiopw[.]com	Delivery 交货
manguniop[.]com	Delivery 交货
ppmunchi[.]com	Delivery 交货
pelicanomwp[.]com	Delivery 交货
andripawl[.]com 安德里帕尔[.]com	Delivery 交货
dulcebuelos[.]com	Delivery 交货

APPENDIX 2 – Applied Countermeasures

Yara Rules

rule MX_fin_downloader_kaje_decode_func {

meta:

author = “BlackBerry Threat Research & Intelligence Team”
description = “Locates .NET function that deobfuscates kaje filename”
date = “2023-12-19”

strings:

$s1 = {1A8D??00000125161F6A0658D29C25171F620659D29C25181F6B0659D29C25191F660659D29C0B}

condition: 条件：

all of them

}

rule MX_fin_downloader_elearnscty_string {

meta:

author = “BlackBerry Threat Research & Intelligence Team”

description = “Locates unique strings to the MX fin .NET downloaders.”

date = “2023-12-19”

strings:

//ElearnScty Testing course

$s1 = {52 00 57 00 78 00 6c 00 59 00 58 00 4a 00 75 00 55 00 32 00 4e 00 30 00 65 00 53 00 42 00 55 00 5a 00 58 00 4e 00 30 00 61 00 57 00 35 00 6e 00 49 00 47 00 4e 00 76 00 64 00 58 00 4a 00 7a 00 5a 00 51 00 3d 00 3d 00}

condition: 条件：

all of them

}

rule MX_fin_custom_allakore_rat {

meta:

author = “BlackBerry Threat Research & Intelligence Team”

description = “Find MX fin custom function names and prefixes.”

date = “2023-12-19”

strings:

$main = “<|MAINSOCKET|>”

$cnc1 = “<|MANDAFIRMA|>”

$cnc2 = “<|FIRMASANTA|>”

$cnc3 = “<|MENSAJE” wide

$cnc4 = “<|DESTRABA” wide

$cnc5 = “<|TOKEN” wide

$cnc6 = “<|TRABAR” wide

$cnc7 = “<|USU” wide

$cnc8 = “<|ACTUALIZA|>” wide

$cnc9 = “<|BANA” wide
$cnc 9 = “<|BANA“宽

$cnc10 = “<|CLAVE” wide
$cnc 10 = “<|CLAVE“宽

condition: 条件：

uint16(0) == 0x5A4D and
uint16（0） == 0x5A4D和

$main and $main和

2 of ($cnc*) and
（$cnc*）中的 2 和

filesize > 5MB and filesize < 12MB
文件大小 > 5MB 文件大小 < 12MB

}

APPENDIX 3 – Detailed MITRE ATT&CK® Mapping
附录 3 – 详细的 MITRE ATT&CK® 映射

Tactic 策略	Technique 技术	Sub-Technique Name 子技术名称
Initial Access 初始访问	T1189 – Drive-by Compromise T1189 – 偷渡式妥协
Execution 执行	T1204 – User Execution T1204 – 用户执行	T1204.004 – Malicious File T1204.004 – 恶意文件
Execution 执行	T1059 – Command and Scripting Interpreter T1059 – 命令和脚本解释器	T1059.001 – PowerShell
Defense Evasion 防御规避	T1218 – System Binary Proxy Execution T1218 – 系统二进制代理执行	T1218.007 – Msiexec
Defense Evasion 防御规避	T1480 – Execution Guardrails T1480 – 执行护栏
Defense Evasion 防御规避	T1070 – Indicator Removal T1070 – 指示灯移除	T1070.004 – File Deletion T1070.004 – 文件删除
Defense Evasion 防御规避	T1140 – Deobfuscate/Decode Files or Information T1140 – 对文件或信息进行反混淆/解码
Command and Control 指挥与控制	T1105 – Ingress Tool Transfer T1105 – 入口工具转移
Command and Control 指挥与控制	T10171 – Application Layer Protocol T10171 – 应用层协议	T10171.001 – Web Protocols T10171.001 – Web 协议
Command and Control 指挥与控制	T1219 – Remote Access Software T1219 – 远程访问软件
Credential Access, Collection 凭据访问、收集	T1056 – Input Capture T1056 – 输入捕获	T1056.001 – Keylogging T1056.001 – 键盘记录
Collection 收集	T1113 – Screen Capture T1113 – 屏幕截图
Exfiltration 渗出	T1041 – Exfiltration Over C2 Channels T1041 – 通过 C2 通道外泄

原文始发于The BlackBerry Research & Intelligence Team：Mexican Banks and Cryptocurrency Platforms Targeted With AllaKore RAT

版权声明：admin 发表于 2024年1月29日下午6:41。
转载请注明：Mexican Banks and Cryptocurrency Platforms Targeted With AllaKore RAT | CTF导航

疑似与高校关联的远控程序分析

admin

Earth Kapre组织网络入侵事件调查（下）

admin

针对思科被黑客攻击事件的简单分析

admin

389

恶意 Tor 浏览器安装程序正通过 YouTube 进行分发

admin

470

安全研究人员发现新的恶意软件 Redis p2pinfect

admin

243

流行木马紫狐取证分析和反思

admin

357

Mexican Banks and Cryptocurrency Platforms Targeted With AllaKore RAT

Summary 总结

Brief MITRE ATT&CK® Information
MITRE ATT&CK®简介

Weaponization and Technical Overview
武器化和技术概述

Technical Analysis 技术分析

What is AllaKore RAT? 什么是 AllaKore RAT？

Early 2022 Sample 2022 年初示例

Late 2022 Sample 2022 年末示例

AllaKore RAT AllaKore 大鼠

Network Infrastructure 网络基础设施

Targets 目标

Attribution 归因

Conclusions 结论

APPENDIX 1 – Indicators of Compromise (IoCs)
附录 1 – 入侵指标（IoC）

Network IoCs

APPENDIX 2 – Applied Countermeasures

APPENDIX 3 – Detailed MITRE ATT&CK® Mapping
附录 3 – 详细的 MITRE ATT&CK® 映射

Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver

JAVA-Based Sophisticated Stealer Using Discord Bot as EventListener

相关文章

相关文章

Mexican Banks and Cryptocurrency Platforms Targeted With AllaKore RAT

Summary 总结

Brief MITRE ATT&CK® Information MITRE ATT&CK®简介

Weaponization and Technical Overview 武器化和技术概述

Technical Analysis 技术分析

What is AllaKore RAT? 什么是 AllaKore RAT？

Early 2022 Sample 2022 年初示例

Late 2022 Sample 2022 年末示例

AllaKore RAT AllaKore 大鼠

Network Infrastructure 网络基础设施

Targets 目标

Attribution 归 因

Conclusions 结论

APPENDIX 1 – Indicators of Compromise (IoCs) 附录 1 – 入侵指标 （IoC）

Network IoCs

APPENDIX 2 – Applied Countermeasures

APPENDIX 3 – Detailed MITRE ATT&CK® Mapping 附录 3 – 详细的 MITRE ATT&CK® 映射

Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver

JAVA-Based Sophisticated Stealer Using Discord Bot as EventListener

相关文章

广告位

相关文章

Brief MITRE ATT&CK® Information
MITRE ATT&CK®简介

Weaponization and Technical Overview
武器化和技术概述

Attribution 归因

APPENDIX 1 – Indicators of Compromise (IoCs)
附录 1 – 入侵指标（IoC）

APPENDIX 3 – Detailed MITRE ATT&CK® Mapping
附录 3 – 详细的 MITRE ATT&CK® 映射

Kasseika Ransomware Deploys BYOVD Attacks, Abuses PsExec and Exploits Martini Driver 