NAPLISTENERMalware
Last reported 3 years ago, by Elastic Security Labs4 reports
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information”
- T1036Masquerading
“This malware functions as a backdoor and communicates with command and control (C2) while masquerading as DNS, allowing attackers to bypass network security controls such as firewalls and intrusion detection systems.”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1053.005Scheduled Task
“Elastic Security Labs observed this binary persisting via a Scheduled Task, though other mechanisms would likely be compatible.”
- T1055Process Injection
“Shortly after being executed, Elastic Defend registered a process injection alert.”
What the reports say
4 reports, newest first · the exact sentence from each-
Introducing the REF5961 intrusion set“This environment has already seen the emergence of the REF2924 intrusion set (SIESTAGRAPH, NAPLISTENER, SOMNIRECORD, and DOORME), as well as the deployment of SHADOWPAD and COBALTSTRIKE.”
-
NAPLISTENER: more bad dreams from developers of SIESTAGRAPH“NAPLISTENER: more bad dreams from developers of SIESTAGRAPH”
-
REF2924: how to maintain persistence as an (advanced?) threat“We also note that the technique used to deploy NAPLISTENER is described here and the deployment method for malicious IIS modules like DOORME can be found in this blog post.”
-
Not sleeping anymore: SOMNIRECORD's wake-up call“Like NAPLISTENER and SIESTAGRAPH, these factors make it difficult to detect and block using strictly network-based technologies.”
Indicators in its reports
named in the reports above- decoded.avast[.]ioin 1 report
- hxxp://president[.]mn/en/ebooksheets.phpin 1 report
- president[.]mnin 1 report
- www.president[.]mnin 1 report
- datacenter.gov[.]mnin 1 report
- hxxps://intranet.gov[.]mn/upload.phpin 1 report
- intranet.gov[.]mnin 1 report
- 45.90.58[.]103in 1 report
- 185.195.237[.]123in 1 report
- 185.82.217[.]164in 1 report
- 195.123.245[.]79in 1 report
- paper.hosted-by-bay[.]netin 1 report
- news.hosted-by-bay[.]netin 1 report
- hosted-by-bay[.]netin 1 report
- 45.133.194[.]106in 1 report
- paypal.goodspaypal[.]comin 1 report
- d218680140ad2c6e…41c02d889a59in 1 report
- redacted[.]mnin 1 report
- shop.redacted[.]mnin 1 report
- 192.123.245[.]79in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.