A New Wave of the Separ Info-Stealer is Infecting Organizations through “Living off the Land” Attack

guest · Feb 23, 2019

Recently we came across renewed activity of the infamous credential stealer Separ, which our product prevented in customers’ environments. Previous attacks based on earlier variants of Separ date back to November 2017, with related info-stealers being active in the wild as far back as 2013.

The credential stealer Separ is unique, as it uses a combination of very short script or batch files, and legitimate executables, to carry out all of its malicious business logic. Therefore, Separ is an excellent example of the advanced and evasive attack technique commonly termed as “Living Off the Land”. In addition, Separ masquerades as a fake Adobe related program, using a fake PDF document as the initial infection vector, and malicious scripts and executable files named to resemble Adobe related programs.

“Living off the Land” attacks are based on legitimate files which are either common within the organization attacked, or are widely-used administrative tools, and can be abused to perform malicious functions. These tools are sometimes referred to as “Dual-Use” tools. Although “Living off the Land” is considered a type of file-less attack, this is an inaccurate definition, as the attack does involve executable files. In many cases these files are already found on disk in the victim’s machine (hence the term “Living off the Land”). In other cases, they are written to disk, but as mentioned before they are not malicious per-se and therefore go unnoticed. This technique, and the reason it is classified as a file-less attack, are described in detail in Deep Instinct’s whitepaper on file-less attacks, published in March 2018.
Click to expand...

https://www.deepinstinct.com/2019/0...s-through-living-off-the-land-attack-methods/

Scripts + LOLbins exploitation..again the famous winning cocktail...

This shows that many security solutions have difficulties detecting “Living off the Land” attack scenarios. Meanwhile, it should also be noted that the attack can be modified easily to evade detection and complicate analysis.
Click to expand...

so simple...makes me wondering how this still have potency those days.

stapp · Feb 23, 2019

Already being discussed here

https://www.wilderssecurity.com/thr...has-infected-1-200-and-is-still-going.413630/

Log in or Sign up

A New Wave of the Separ Info-Stealer is Infecting Organizations through “Living off the Land” Attack

guest Guest

stapp Global Moderator

Log in or Sign up

A New Wave of the Separ Info-Stealer is Infecting Organizations through “Living off the Land” Attack

guest Guest

stapp Global Moderator

Useful Searches