TelePowerBotMalware
Last reported 3 years ago, by Group-IB2 reports
ATT&CK techniques
6 of 46 · each with the sentence it comes from- T1053.005Scheduled Task
“Scheduled task name:”
- T1546Event Triggered Execution
“…eat actors utilize two core techniques: DLL Side-Loading and executing malicious content triggered by a file type association (Event Triggered Execution: Change Default File Association).”
- T1548.002Bypass User Account Control
“During their attacks, the threat actors used an already known technique to bypass User Account Control (UAC) to alter the settings in Windows Defender.”
- T1555.003Credentials from Web Browsers
“Additionally, Dark Pink APT utilizes the self-made stealers Ctealer and Cucky to steal victim credentials from web browsers.”
- T1005Data from Local System
“T1005”
- T1010Application Window Discovery
“T1010”
What the reports say
2 reports, newest first · the exact sentence from each-
Dark Pink. Episode 2“Dark Pink leveraged the functionalities of an MS Excel add-in to ensure the persistence of TelePowerBot within the infected system.”
-
Dark Pink“They leverage a custom toolkit, featuring TelePowerBot, KamiKakaBot, and Cucky and Ctealer information stealers (all names dubbed by Group-IB) with the aim of stealing confidential documentation held on the networks of government and military organizations.”
Indicators in its reports
named in the reports above- hxxps://api.telegram[.]org/bot$token/sendDocumentin 2 reports
- lolbas-project.github[.]ioin 1 report
- hxxps://github[.]com/peterlylyin 1 report
- hxxps://raw.githubusercontent[.]com/efimovah/abcd/main/ccc.gifin 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.