STOWAWAYMalware
According to Mandiant, STOWAWAY is a publicly available backdoor and proxy. The project supports several types of communication like SSH, socks5. Backdoor component supports upload and download of files, remote shell and basic information gathering.From MISP Galaxy
Last reported 2 years ago, by Elastic Security Labs1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1055Process Injection
“This call stack was generated along with a process injection alert, and enabled researchers to extract an in-memory DLL that was set with Read/Write/Execute(RWX) page protections.”
- T1056Input Capture
“Input Capture: Keylogging”
- T1056.001Keylogging
“The most current iteration of the backdoor at the time of this publication has 35 handler functions including keylogging and screen capture capabilities.”
- T1197BITS Jobs
“This medium is appealing to adversaries because many organizations still struggle to monitor BITS network traffic and detect unusual BITS jobs.”
- T1543.003Windows Service
“| 1 | Get Windows services via EnumServicesStatusW |”
- T1559.001Component Object Model
“The BITS API is exposed through Window’s Component Object Model (COM) using the IBackgroundCopyManager interface.”
What the reports say
1 report, newest first · the exact sentence from each-
BITS and Bytes: Analyzing BITSLOTH, a newly identified backdoor“Additionally the attackers used the STOWAWAY utility to proxy encrypted traffic over HTTP to their C2 servers.”
Indicators in its reports
named in the reports above- hxxps://192.168.182[.]130/00-0C-29-0E-29-87/wu.htmin 1 report
- hxxp://192.168.182[.]130/00-0C-29-0E-29-87/IF/P.binin 1 report
- 15.235.132[.]67in 1 report
- 4a4356faad620bf1…a4c404bf45dfin 1 report
- dfb76bcf5a3e2922…525628006d88in 1 report
- 4fb6dd11e723209d…7e7da1874f50in 1 report
- 0944b17a4330e1c9…4c8d76ef1507in 1 report
- 0f9c0d9b77678d73…7299b4e64afdin 1 report
- 216.238.121[.]132in 1 report
- 45.116.13[.]178in 1 report
- hxxps://github[.]com/SafeBreach-Labs/SimpleBITSServer/tree/masterin 1 report
- hxxps://github[.]com/T4y1oR/RingQin 1 report
- hxxps://github[.]com/EddieIvan01/ioxin 1 report
- hxxps://github[.]com/ph4ntonn/Stowaway/in 1 report
Copy these 14 indicators · defanged
Thanks — we review every report.