PocoDownMalware
- Blitz
- pocodownloader
uses POCO C++ cross-platform library, Xor-based string obfuscation, SSL library code and string overlap with Xtunnel, infrastructure overlap with X-Agent, probably in use since mid-2018From MISP Galaxy
Last reported 1 month ago, by Hudson Rock (Infostealers)3 reports
ATT&CK techniques
6 of 8 · each with the sentence it comes from- T1033System Owner/User Discovery
“System Owner/User Discovery Linux”
- T1036Masquerading
“… kswapd0 serves as a stealthy persistence mechanism — allowing for continuous Monero mining and unauthorized remote access, all while masquerading as a legitimate system process.”
- T1049System Network Connections Discovery
“System Network Connections Discovery”
- T1053.005Scheduled Task
“The HTA created a scheduled task, launched 32-bit PowerShell, disabled AMSI, and calculated a victim-specific subdomain based on the computer name and username.”
- T1098.004SSH Authorized Keys
“SSH Authorized Keys File Modification”
- T1110Brute Force
“Worm-like propagation: OUTLAW uses its compromised hosts to launch further SSH brute-force attacks on their local subnets, rapidly expanding the botnet.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation“A Broader 48-Hour Malvertising Blitz”
-
Elastic goes all-in on Hacker Summer Camp at Black Hat and DEF CON in Las Vegas“Blitz & Defend, an executive evening with Elastic and AWS at Allegiant Stadium, a behind-the-scenes tour, and reception in the Raiders locker room.”
-
Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective“Upon successful authentication, Blitz logs attack details into a "v" file, structured as follows:”
Indicators in its reports
named in the reports above- loldrivers[.]ioin 1 report
- bash[.]pidin 1 report
- 212.234.225[.]29in 1 report
- c3efbd6b5e512e36…1ebaa959dd27in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.