NosyDownloaderMalware
According to ESET Research, this malware is used by LongNosedGoblin and executes a chain of obfuscated commands passed to a spawned PowerShell process as one long command line argument, meaning that the script is not stored on disk. Every subsequent stage is encoded with base64, where the last one is additionally deflated with gzip. The second stage bypasses AMSI.From MISP Galaxy
Last reported 10 months ago, by ESET WeLiveSecurity1 report
ATT&CK techniques
6 of 38 · each with the sentence it comes from- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
- T1027.013Encrypted/Encoded File
“T1027.013”
- T1027.015Compression
“T1027.015”
- T1036Masquerading
“Masquerading: Match Legitimate Name or Location”
- T1036.005Match Legitimate Resource Name or Location
“T1036.005”
- T1053Scheduled Task/Job
“Scheduled Task/Job: Scheduled Task”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan“We provide a detailed analysis of NosyHistorian, NosyDoor, NosyStealer, NosyDownloader, NosyLogger, and other tools used by LongNosedGoblin.”
Indicators in its reports
named in the reports above- hxxps://login.microsoftonline[.]com/common/oauth2/v2.0/tokenin 1 report
- dev0-411506.iam.gserviceaccount[.]comin 1 report
- hxxps://accounts.google[.]com/o/oauth2/authin 1 report
- hxxps://oauth2.googleapis[.]com/tokenin 1 report
- hxxps://www.googleapis[.]com/oauth2/v1/certsin 1 report
- hxxps://www.googleapis[.]com/robot/v1/metadata/x509/dev0-660%40dev0-411506.iam.gserviceaccount.comin 1 report
- d53fcc01038e2019…6b000ebd8b1cin 1 report
- 118.107.234[.]29in 1 report
Copy these 8 indicators · defanged
Thanks — we review every report.