ROLLCOASTMalware
- arcane
- s4bb47h
- Sabbath
ROLLCOAST is a ransomware program that encrypts files on logical drives attached to a system. ROLLCOAST is a Dynamic Linked Library (DLL) with no named exports. When observed by Mandiant it uniquely had only one ordinal export 0x01. This suggested the sample was designed to avoid detection and be invoked within memory, possibly through BEACON provided to affiliates.From MISP Galaxy
Last reported 1 month ago, by ESET WeLiveSecurity3 reports
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Dynamic API Resolution”
- T1027.007Dynamic API Resolution
“T1027.007”
- T1033System Owner/User Discovery
“T1033”
- T1036Masquerading
“Masquerading: Invalid Code Signature”
- T1036.001Invalid Code Signature
“T1036.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
3 reports, newest first · the exact sentence from each-
Beware the SparroWock: The backdoor that bites, the commands that catch“Fortunately, while advanced, SparroWocky’s inner workings are much less arcane than a gyre and gimble in the wabe, so a through and through [of] the vorpal blade allowed us to bring you a detailed analysis of the backdoor.”
-
There's Payloads, And Then There's pAIloads: A Look At Selected Opportunistic (And Possibly AI-"Enhanced") React2Shell Probes and Attacks“…e should note that the shell content is (mostly) quality tradecraft: hand-rolled HTTP client using /dev/tcp to bypass missing curl/wget, arcane bash URL parsing (${1//// }), proper header stripping, and clean file descriptor management.”
-
“We find many things that others do not even see”“Recently Mandiant released a report on a group they are tracking, known as Sabbath.”
Indicators in its reports
named in the reports above- 44f0a22b143b79fa…fff714c8a2a1in 1 report
- 216.238.110[.]120in 1 report
- 3209689e509205cc…407ddc23cac1in 1 report
- 52c6646759cf6037…1c4bd794532fin 1 report
- 99e7070b5af24a0f…b03cb385e91fin 1 report
- 9aa9ff61bc63ccab…c980ca9ddc8cin 1 report
- 38.54.57[.]17in 1 report
- 38.60.197[.]55in 1 report
- 38.60.209[.]106in 1 report
- 38.60.224[.]51in 1 report
- 38.60.224[.]235in 1 report
- 38.60.241[.]65in 1 report
- 38.60.241[.]127in 1 report
- 38.60.241[.]193in 1 report
- 77.111.101[.]40in 1 report
- 91.148.134[.]115in 1 report
- 130.94.101[.]82in 1 report
- 140.99.164[.]199in 1 report
Copy these 18 indicators · defanged
Thanks — we review every report.