MariposaMalware
- Autorun
- palevo
- rimecud
Last reported 2 months ago, by Infosecurity Magazine5 reports
ATT&CK techniques
6 techniques · each with the sentence it comes from- T1053.005Scheduled Task
“Figure 15: Scheduled Task Creation”
- T1055Process Injection
“With the configuration file successfully created, defendnot now possesses all necessary components to begin the process injection sequence.”
- T1219.002Remote Desktop Software
“In another attempt to facilitate access, they also installed open-source remote desktop software TightVNC, as seen via the binary path from EDR telemetry: "C:\Program Files\TightVNC\tvnserver.exe" -service.”
- T1505.003Web Shell
“…o simplify the process, attackers have been observed in the wild using this exploit chain to upload a more traditional malicious .aspx web shell into the /_layouts/15/ directory.”
- T1543.003Windows Service
“…sequent MsiInstaller records indicating successful installation, and Service Control Manager records indicating the installation of Windows services.”
- T1559.001Component Object Model
“defendnot was rebuilt from scratch, a testament to direct reverse engineering of Windows Security Center (WSC) Component Object Model (COM) methods.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
Cursor Security Bug Allowed Repositories to Execute Commands Before Trust Verification“Read more on repository-triggered execution: Cursor Autorun Flaw Lets Repositories Execute Code Without Consent”
-
TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry“Workbench detects suspicious use of Node.js through the "Suspicious Autorun Entry Created by Node.js" model with a severity rating of High.”
-
Velociraptor Misuse, Pt. II: The Eye of the Storm“Figure 6: Autorun created for Velociraptor to run as a Windows service”
-
Detecting Malicious Security Product Bypass Techniques“Generally related (Artifacts): Autorun tasks, registry keys, and other artifacts are useful, but can be swapped or cleaned up by attackers.”
-
Cleo Software Actively Being Exploited in the Wild“Autorun files are immediately read, interpreted, and evaluated by LexiCom, Harmony, and VLTrader.”
Indicators in its reports
named in the reports above- hxxps://nodejs[.]org/dist/v24.13.0/node-v24.13.0-win-x64.zipin 1 report
- hxxps://tonapi[.]io/v2/blockchain/accounts/in 1 report
- tonapi[.]ioin 1 report
- c66119f0e5635c43…fc5dc2c1a5d9in 1 report
- hxxps://tonapi[.]io/v2/blockchain/accounts/0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9/transactionsin 1 report
- 746f6e616a756b62…322e73686f70in 1 report
- 4ec8b349dec92720…127e13d9ed6cin 1 report
- tonajukbhuakpo2[.]shopin 1 report
- ad8a41329520983b…1e65d8122ac8in 1 report
- zloapobikahy23[.]bondin 1 report
- 5853f2fb23c98243…90bf728a0d45in 1 report
- hsaertyuoang34[.]sbsin 1 report
- acf58e82c2716e3c…8ad3324e244ain 1 report
- amanohuguta[.]cfdin 1 report
- 6d5b44d0678e6bd6…679db4c12d41in 1 report
- 540d78d1b48059f4…a311c955c232in 1 report
- ed53b4d2adfe22d7…cc5b08086a6cin 1 report
- bf72fbba31df1d36…7c12cf8ed760in 1 report
- 0fe5a035b02526ae…104abb6ac459in 1 report
- aea565f34dff268b…8e64e4b9864fin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.