BUGHATCHMalware
According to Elastic, BUGHATCH is an in-memory implant loaded by an obfuscated PowerShell script that decodes and executes an embedded shellcode blob in its allocated memory space using common Windows APIs (VirtualAlloc, CreateThread, WaitForSingleObject).From MISP Galaxy
Last reported 4 years ago, by Elastic Security Labs2 reports
ATT&CK techniques
6 of 19 · each with the sentence it comes from- T1055Process Injection
“This path has also been observed as a SpawnTo parameter in Cobalt Strike process injection configurations.”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter - PowerShell, Windows Command Shell”
- T1059.003Windows Command Shell
“Command and Scripting Interpreter - PowerShell, Windows Command Shell”
- T1003OS Credential Dumping
“OS Credential Dumping - LSA Secrets”
- T1003.004LSA Secrets
“OS Credential Dumping - LSA Secrets”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
What the reports say
2 reports, newest first · the exact sentence from each-
BUGHATCH Malware Analysis“BUGHATCH Malware Analysis”
-
CUBA Ransomware Campaign Analysis“BUGHATCH”
Indicators in its reports
named in the reports above- b495456a2239f3ba…a48746e8051fin 2 reports
- 0f385cc69a93abea…805bdfe468a3in 1 report
- 33352a38454cfc24…8ec45b4d3d0ein 1 report
- f1325f8a55164e90…5a232658c3cfin 1 report
- a6e30ccf838569781703c943f18dc3f5in 1 report
- 9d9ad1251943ecace81644a7ac320b3cin 1 report
- b983b8eb258220628be2a88ca44286b4in 1 report
- 39324a58d79fc5b8910cbd9afbf1a6cbin 1 report
- 159.203.70[.]39in 1 report
- hxxp://208.76.253[.]84in 1 report
- 208.76.253[.]84in 1 report
- hxxp://108.170.31[.]115/add.dllin 1 report
- 108.170.31[.]115in 1 report
- 104.217.8[.]100in 1 report
- 193.23.244[.]244in 1 report
- 86.59.21[.]38in 1 report
- 199.58.81[.]140in 1 report
- 204.13.164[.]118in 1 report
- 194.109.206[.]212in 1 report
- 131.188.40[.]189in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.