The BANSHEE malware is a macOS-based infostealer that targets system information, browser data, and cryptocurrency wallets.

Preamble

Key takeaways

Malware Analysis

Debugger, VM Detection, and Language Checks

System information collection

User password

File, software, and hardware information collection

Dump keychain passwords

Browser collection

Wallet collection

Exfiltration

Behavior detection

YARA rule

Conclusion

Observables

Beyond the wail: deconstructing the BANSHEE infostealer

Python script to extract the configuration from NETWIRE samples.

Getting started

Docker

Running it locally

Usage

Configuration extraction tool for the NETWIRE malware.

NETWIRE Configuration Extractor

Python script to extract the configuration and payload from BLISTER samples.

Getting Started

Running it Locally

References

BLISTER Configuration Extractor

Configuration extractor to dump out hardcoded passwords with BPFDoor.

Overview

BPFDoor Configuration Extractor

Python script to identify hosts infected with the BPFDoor malware.

Permissions

Running Locally

BPFDoor Scanner

Python script that collects Cobalt Strike memory data generated by security events from an Elasticsearch cluster, extracts the configuration from the CS beacon, and writes the data back to Elasticsearch.

Using an Elastic Cloud instance (this is a randomly generated example)

Default output will use localhost:9092, see reference config

Filter by time

Pipe output to other tools

Cobalt Strike Beacon Extractor

Python script to extract the configuration from EMOTET samples.

Configuration extraction tool for the EMOTET malware.

EMOTET Configuration Extractor

Python script to extract the configuration from ICEDID samples.

Configuration extraction tool for ICEDID malware.

ICEDID Configuration Extractor

Python script to extract the payload from PARALLAX samples.

PARALLAX Payload Extractor

Python script to extract the configuration from QBOT samples.

Configuration extraction tool for QBOT malware

QBOT Configuration Extractor

Elastic Security Labs has compiled the 2022 Global Threat Report to share trends and tactics adversaries and attack groups use, as observed by our threat research team and broader user community over the past year.

Sneak Peek: Elastic’s 2022 Global Threat Report

作者

Elastic 安全实验室

文章

超越哀嚎：解构 BANSHEE 信息窃取器

NETWIRE 配置提取器

BLISTER 配置提取器

BPFDoor 配置提取器

BPFDoor 扫描器

Cobalt Strike Beacon 提取器

EMOTET 配置提取器

ICEDID 配置提取器

PARALLAX 有效载荷提取器

QBOT 配置提取器

先睹为快：Elastic 2022 年全球威胁报告