EntryShellMalware
Fileless malware 'EntryShell', a variant of the KeyBoy malware, due to similarities in backdoor command IDs and debug messages with old KeyBoy samples. The embedded malware config was encrypted with a unique algorithm.From MISP Galaxy
Last reported 6 months ago, by Zscaler ThreatLabz1 report
ATT&CK techniques
6 of 17 · each with the sentence it comes from- T1001Data Obfuscation
“…ommand and Control: Encrypted Channel: Asymmetric CryptographyThe threat actor used the GitHub API for C2, which communicates over HTTPS.T1001.003Exfiltration: Exfiltration Over Web Service: Exfiltration to Code RepositoryThe threat actor used the GitHub API to exfiltrate files t…”
- T1027Obfuscated Files or Information
“… SumatraPDF loader downloaded a second-stage shellcode from the C2 IP 58.247.193.100 which reflectively loads the AdaptixC2 Beacon agent.T1027.007Defense Evasion: Obfuscated Files or Information: Dynamic API ResolutionThe initial loader identified Windows APIs by comparing Adler-…”
- T1036Masquerading
“…uled TaskThe threat actor created a scheduled task using schtasks /create to execute the AdaptixC2 agent every two hours for persistence.T1036.001Defense Evasion: Masquerading: Invalid Code SignatureThe threat actor used a trojanized SumatraPDF executable that includes the origin…”
- T1053Scheduled Task/Job
“…ommand Shell to run several commands for reconnaissance purposes (e.g., arp, net view, tasklist) and to use cURL for downloading VS Code.T1053.005Persistence: Scheduled Task/Job: Scheduled TaskThe threat actor created a scheduled task using schtasks /create to execute the Adaptix…”
- T1053.005Scheduled Task
“…tasklist) and to use cURL for downloading VS Code.T1053.005Persistence: Scheduled Task/Job: Scheduled TaskThe threat actor created a scheduled task using schtasks /create to execute the AdaptixC2 agent every two hours for persistence.T1036.001Defense Evasion: Masquerading: Invali…”
- T1059Command and Scripting Interpreter
“Additionally, it employed the ShellExecuteW API to launch a decoy PDF document.T1059.003Execution: Command and Scripting Interpreter: Windows Command ShellThe threat actor utilized the Windows Command Shell to run several commands for reconnaissance purposes (e.g., arp, net view,…”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Tropic Trooper Pivots to AdaptixC2 and Custom Beacon Listener“…ng GitHub as their command-and-control (C2) platform.The staging server involved in this attack also hosted CobaltStrike Beacon and an EntryShell backdoor.”
Indicators in its reports
named in the reports above- ip[.]mein 1 report
- bashupload[.]appin 1 report
- below[.]postin 1 report
- confidence[.]inin 1 report
- 58.247.193[.]100in 1 report
- hxxp://bashupload[.]app/6e1lhccurlin 1 report
- hxxp://bashupload[.]app/zgel2a.binin 1 report
- 158.247.193[.]100in 1 report
- tunnel[.]postin 1 report
- tunnel[.]hostingin 1 report
- loader[.]inin 1 report
- 47.76.236[.]58in 1 report
- stg.lsmartv[.]comin 1 report
- hxxps://code.visualstudio[.]com/sha/download?build=stable&os=cli-win32-x64in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.