Undetected For Years, Stantinko Malware Infected Half a Million Systems

itman · Jul 21, 2017

A massive botnet that remained under the radar for the past five years managed to infect around half a million computers and allows operators to “execute anything on the infected host,” ESET researchers warn.

The massive botnet is used mainly to install browser extensions that in turn perform ad injections and click fraud, but malicious Windows services are used to execute a broad range of operations: backdoor activities, searches on Google, and brute-force attacks on Joomla and WordPress administrator panels, ESET reveals.

The malicious browser extensions installed by Stantinko are called The Safe Surfing and Teddy Protection, both distributed through the Chrome Web Store and seemingly legitimate apps that block unwanted URLs. When installed by the botnet, however, the extensions receive a configuration to perform click fraud and ad injection.

Stantinko is a modular backdoor that includes a loader to execute any Windows executable sent by the C&C server directly in memory. Courtesy of a flexible plugin system, the malware’s operators can execute any code on an infected system.
Click to expand...

http://www.securityweek.com/undetected-years-stantinko-malware-infected-half-million-systems

guest · Nov 26, 2019

Stantinko botnet adds cryptomining to its pool of criminal activities
November 26, 2019
https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminal-activities/

The operators of the Stantinko botnet have expanded their toolset with a new means of profiting from the computers under their control. The roughly half-million-strong botnet – known to have been active since at least 2012 and mainly targeting users in Russia, Ukraine, Belarus and Kazakhstan – now distributes a cryptomining module.

In this article, we describe Stantinko’s cryptomining module and provide an analysis of its functionality.
This module’s most notable feature is the way it is obfuscated to thwart analysis and avoid detection. Due to the use of source level obfuscations with a grain of randomness and the fact that Stantinko’s operators compile this module for each new victim, each sample of the module is unique.
Conclusion
Their previous innovations were distributed dictionary-based attacks on Joomla and WordPress web sites aimed at harvesting server credentials, probably with the goal of selling them to other criminals.
This remotely configured cryptomining module, distributed since at least August of 2018 and still active at the time of writing, shows this group continues to innovate and extend its money-making capabilities.
Click to expand...

guest · Mar 19, 2020

This cryptocurrency miner uses unique, stealthy tactics to hide from prying eyes
A combination of botnet and cryptominer has been utilizing new obfuscation techniques never before made public
March 18, 2020
https://www.zdnet.com/article/this-malware-uses-a-unique-method-to-hide-from-prying-eyes/

Researchers have uncovered new obfuscation techniques they have described as "unique" in an active cryptocurrency mining botnet.

On Thursday, cybersecurity firm ESET said the discovery was made through an examination of the Stantinko botnet, which has been active since at least 2012.
The malware was spread through pirate software as an infection vector, in which downloaders would execute these files only to also deploy a range of nuisanceware and spyware on PCs at the same time.

The new Monero mining module is of interest, given the "protective techniques encountered during analysis are more advanced than the malware they protect," says Vladislav Hrčka.
The ESET malware analyst added that some of the techniques have not yet been "publicly described."
Click to expand...

Two obfuscation techniques, the way strings are hidden and a method called control-flow obfuscation, stand out.

The first technique relies on strings, constructed in memory, that are only present in memory when they are used.

"The strings used by the malware are generated in memory in order to avoid file-based detection and thwart analysis," the researchers note.
"The criminals behind the Stantinko botnet are constantly improving and developing new modules that often contain non-standard and interesting techniques," ESET says. As the botnet remains active, it is likely we will see new functionality or stealthy techniques in the future.
Click to expand...

ESET: Stantinko’s new cryptominer features unique obfuscation techniques

guest · Aug 8, 2020

Stadeo: Deobfuscating Stantinko and more
August 7, 2020
https://www.welivesecurity.com/2020/08/07/stadeo-deobfuscating-stantinko-and-more/

Stadeo is a set of tools primarily developed to facilitate analysis of Stantinko, which is a botnet performing click fraud, ad injection, social network fraud, password stealing attacks and cryptomining.

Stadeo was demonstrated for the first time at Black Hat USA 2020 and subsequently published for free use.
The scripts, written entirely in Python, deal with Stantinko’s unique control-flow-flattening (CFF) and string obfuscation techniques described in our March 2020 blogpost.

You can find Stadeo at https://github.com/eset/stadeo.
Click to expand...

guest · Nov 24, 2020

A new Stantinko Bot masqueraded as httpd targeting Linux servers
November 24, 2020
https://securityaffairs.co/wordpress/111393/malware/stantinkos-linux-variant.html

Researchers from Intezer have spotted a new variant of an adware and coin-miner botnet that is operated by Stantinko threat actors since 2012.

The Stantinko botnet was first spotted by ESET in 2017, at the time it infected around half a million computers worldwide. Operators behind the botnet powered a massive adware campaign active since 2012, crooks mainly targeted users in Russia, Ukraine, Belarus, and Kazakhstan searching for pirated software.
Click to expand...

According to a new analysis published by Intezer, the Linux trojan masqueraded as httpd, which is the Apache Hypertext Transfer Protocol Server commonly used on Linux servers. At the time of this analysis, the new version of the Trojan has a detection rate of one in VirusTotal. The sample, an unstripped 64-bit ELF binary, was uploaded on November 7, 2020 from Russia.

“We have identified a new version of this Linux trojan masqueraded as httpd. httpd is Apache Hypertext Transfer Protocol Server, a commonly used program on Linux servers. The sample’s version is 2.17, and the older version is 1.2*.” reads the analysis published by Intezer.
Click to expand...

Intezer: Stantinko’s Proxy After Your Apache Server

It is common for threat actors to evolve their Linux malware. BlackTech with their new ELF_PLEAD malware and Winnti’s PWNLNX tool are recent examples. On par with this trend, we have discovered a new version of a Linux proxy trojan related to Stantinko group. The malware has just one detection in VirusTotal at the time of this publication.
Click to expand...

Log in or Sign up

Undetected For Years, Stantinko Malware Infected Half a Million Systems

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Undetected For Years, Stantinko Malware Infected Half a Million Systems

itman Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches