CISA and CNMF Identify a New Malware Variant

guest · Oct 1, 2020

CISA and CNMF Identify a New Malware Variant
October 1, 2020
https://us-cert.cisa.gov/ncas/current-activity/2020/10/01/cisa-and-cnmf-identify-new-malware-variant

The Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Defense (DOD) Cyber National Mission Force (CNMF) have identified a malware variant—referred to as SLOTHFULMEDIA—used by a sophisticated cyber actor. In addition, U.S. Cyber Command has released the malware sample to the malware aggregation tool and repository, VirusTotal.

CISA encourages users and administrators to review Malware Analysis Report MAR-10303705-1.v1 and U.S. Cyber Command’s VirusTotal page for more information.
Click to expand...

MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA

The malware variant, known as SlothfulMedia, has been used by a sophisticated cyber actor.

The sample is a dropper, which deploys two files when executed. The first is a remote access tool (RAT) named ‘mediaplayer.exe’’, which is designed for command and control (C2) of victim computer systems. Analysis has determined the RAT has the ability to terminate processes, run arbitrary commands, take screen shots, modify the registry, and modify files on victim machines. It appears to communicate with its C2 controller via Hypertext Transfer Protocol (HTTP) over Transmission Control Protocol (TCP).

The second file has a random five-character name and deletes the dropper once the RAT has persistence. Persistence is achieved through the creation of a service named “Task Frame”, which ensures the RAT is loaded after a reboot.
Click to expand...

guest · Oct 15, 2020

Kaspersky shares findings on group behind infamous SlothfulMedia malware
October 15, 2020
https://vmblog.com/archive/2020/10/...up-behind-infamous-slothfulmedia-malware.aspx

On October 1, 2020, the Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) released information about a malware family called SlothfulMedia, which they have attributed to a sophisticated threat actor.
A closer look into the report revealed that Kaspersky has been tracking this set of activity since June 2018 and previously dubbed the actor behind it IAmTheKing. Based on its activity, the researchers identified the group as a state-sponsored actor, whose primary focus is on collecting intelligence from high-profile entities, mainly in Russia.

While the public has only recently been made aware of this set of activity, IAmTheKing has been very active for a few years. The actor possesses a rapidly evolving toolset, has mastered traditional penetration testing methodologies and has a solid command of Powershell, a task automation and configuration management tool.
Click to expand...

In the last couple of years, Kaspersky researchers discovered three malware families, all developed by the same threat actor, called KingOfHearts, QueenOfHearts and QueenOfClubs. DHS CISA identifies QueenOfClubs as SlothfulMedia. All three malware families are backdoors, a term for programs that provide remote access to an infected device. However, the toolset used by the threat actor also includes an extensive arsenal of Powershell scripts, a JackOfHearts dropper and screenshot capture utility.
Click to expand...

Kaspersky: IAmTheKing and the SlothfulMedia malware family

Log in or Sign up

CISA and CNMF Identify a New Malware Variant

guest Guest

guest Guest

Log in or Sign up

CISA and CNMF Identify a New Malware Variant

guest Guest

guest Guest

Useful Searches