BIOPASSMalware
BIOPASS RAT is a malware family which targets online gambling companies in China by leveraging a watering hole attack. This Remote Access Trojan (RAT) is unique in that it leverages the Open Broadcaster Software (OBS) framework to monitor the user's screen.From MISP Galaxy
Last reported 4 months ago, by ESET WeLiveSecurity (ES)3 reports
ATT&CK techniques
6 of 51 · each with the sentence it comes from- T1007System Service Discovery
“T1007”
- T1008Fallback Channels
“T1008”
- T1010Application Window Discovery
“T1010”
- T1014Rootkit
“T1014”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“T1027.007”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Arsenal de FishMonger actualizado: SprySOCKS para Windows“El toolset de FishMonger incluye ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS y el BIOPASS RAT.”
-
FishMonger’s arsenal upgraded: SprySOCKS for Windows“FishMonger’s toolset includes ShadowPad, Spyder, Cobalt Strike, FunnySwitch, SprySOCKS, and the BIOPASS RAT.”
-
PeckBirdy: A Versatile Script Framework for LOLBins Exploitation Used by China-aligned Threat Groups“This certificate was also used in the BIOPASS RAT campaign that we also reported on.”
Indicators in its reports
named in the reports above- ffc3aa7909d4e72c…60dffe5c99b7in 2 reports
- 207.148.78[.]36in 2 reports
- 207.148.75[.]122in 2 reports
- 955bfc3dcc867256…0779fa3416d8in 2 reports
- 44dc4a08c5eb0972…4e06f09006bbin 2 reports
- ab87b29b6f79487c…9001e536f083in 2 reports
- 6490b8e4aade25a3…2db2122470bcin 2 reports
- e7484c24b88a1a24…9a993670285bin 2 reports
- 621d1952839be4b0…e5062ca368edin 2 reports
- 2457eed2ab28e377…9dad2c8079d4in 2 reports
- d2c706b1eaf662bf…73ed84bda24ain 2 reports
- 5f3b87cef56683d9…0d8019b559c4in 2 reports
Copy these 12 indicators · defanged
Thanks — we review every report.