YESROBOTMalware
Last reported 25 days ago, by Microsoft Security Blog1 report
ATT&CK techniques
6 of 7 · each with the sentence it comes from- T1036Masquerading
“…ved an MSI installer creating a scheduled task that uses control.exe to download and execute a remotely hosted CosmicPulse downloader masquerading as a Control Panel applet (CPL).”
- T1053.005Scheduled Task
“…t of this evolution, Star Blizzard adopted RedFlick, a malware delivery technique that helps evade detection by initiating a set of scheduled tasks to deploy the actor’s custom backdoor, CosmicPulse.”
- T1136Create Account
“Using compromised websites to create accounts to send phishing emails”
- T1218.002Control Panel
“…r creating a scheduled task that uses control.exe to download and execute a remotely hosted CosmicPulse downloader masquerading as a Control Panel applet (CPL).”
- T1556.009Conditional Access Policies
“Lockdown account access using Conditional Access policies.”
- T1564.003Hidden Window
“When the victim opens the LNK file, conhost.exe is launched in a hidden window and cmd.exe is subsequently spawned to execute the embedded BAT script:”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Star Blizzard refines phishing and malware delivery with the RedFlick technique“…ry, recovers it using an embedded key in AES-ECB mode, and then uses the recovered key to decode the CosmicPulse payload (also known as YESROBOT) contained in the second ZIP file.”
Indicators in its reports
named in the reports above- 103.245.231[.]248in 1 report
- 2.57.241[.]246in 1 report
- 89.125.209[.]168in 1 report
- 103.245.231[.]79in 1 report
- 45.84.59[.]66in 1 report
- 103.160.59[.]97in 1 report
- etia[.]cain 1 report
- groy[.]ccin 1 report
- gliderrompercycl[.]comin 1 report
- muvb[.]netin 1 report
- divekickspolic[.]orgin 1 report
- matjk[.]clickin 1 report
- bpdaersa[.]clickin 1 report
- stuseamandesilt[.]orgin 1 report
- itechx[.]telin 1 report
- guach[.]netin 1 report
- ruten[.]observerin 1 report
- byveo[.]orgin 1 report
- secure-dns-hub[.]comin 1 report
- qumel[.]linkin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.