PUMAKIT is a sophisticated loadable kernel module (LKM) rootkit that employs advanced stealth mechanisms to hide its presence and maintain communication with command-and-control servers.

PUMAKIT at a glance

Key takeaways

PUMAKIT Discovery

PUMAKIT code analysis

Stage 1: Cron overview

Stage 2: Memory-resident executables overview

Stage 3: LKM rootkit overview

LKM rootkit overview: symbol lookup and hooking mechanism

LKM rootkit overview: hooked syscalls overview

LKM rootkit overview: rmdir_hook()

LKM rootkit overview: getdents() and getdents64() hooks

Stage 4: Kitsune SO overview

PUMAKIT execution chain detection & prevention

Stage 1: Cron

Stage 2: Memory-resident executables

Stage 3: Rootkit kernel  module

One YARA signature to rule them all

Observations

Concluding Statement

Declawing PUMAKIT

The REF6138 campaign involved cryptomining, DDoS attacks, and potential money laundering via gambling APIs, highlighting the attackers' use of evolving malware and stealthy communication channels.

Introduction

Execution flow

Initial access

Fileserver

RUDEDEVIL/LUCIFER

Thread Management in the Malware

Understanding the KillPid Function

Understanding the Get_Net_Messages Function

Understanding the Get_Cpu_Message Function

Understanding the Send_Host_Message Function

Connecting to the Command-and-Control (C2) Server

Understanding the ConnectServer Function

Command-and-Control (C2) Commands

Variants of RUDEDEVIL Malware and XMRIG Configuration

GSOCKET

Post compromise dwell time

KAIJI malware: a comparison to previous samples

The saga continues

Custom built binaries

Additional reconnaissance 

Mining activities

Understanding the `obteneruid` Function

Understanding the `enviardatos` Function

Understanding the `hacerjugada` Function

Understanding the `completarbono` Function

Likely Used for Testing Purposes

REF6138 through MITRE ATT&CK

**Detecting REF6138**

Detection

Prevention

Hunting queries in Elastic

EQL queries

YARA

Defensive recommendations

References

Betting on Bots: Investigating Linux malware, crypto mining, and gambling API abuse

This research reveals insights into some of the large-scale malware analysis performed by Elastic Security Labs, and complements research related to the Detonate framework.

Overview

Ingest pipelines

Normalization

Fingerprint calculation

Enrichment process

Ingest pipeline chaining

Component templates

Automating the process

Creating the gsub ingest pipelines

Create Custom Pipelines

Generate Enrichment Processors

Results and limitations

Visualizing results

Beyond Dynamic Malware Analysis

Conclusion

An Elastic approach to large-scale dynamic malware analysis

Elastic Security Labs observes that the threat behind SIESTAGRAPH has shifted priorities from data theft to persistent access, deploying new malware like NAPLISTENER to evade detection.

Analysis

Malware analysis

Proof-of-concept prerequisites

Resources

Sources

NAPLISTENER: more bad dreams from developers of SIESTAGRAPH

Elastic Security Labs is releasing a triage analysis to assist 3CX customers in the initial detection of SUDDENICON, a potential supply-chain compromise affecting 3CX VOIP softphone users.

Hunting queries

KQL queries

Potentially malicious domains

Elastic alert telemetry has observed protection events related to the supply chain attacks targeting the 3CXDesktopApp update process.

Elastic users protected from SUDDENICON’s supply chain attack

Elastic Security Labs describes new persistence techniques used by the group behind SIESTAGRAPH, NAPLISTENER, and SOMNIRECORD.

Preamble

.NET Webshell

Persistence module

Open source tools

Background

Detection logic

REF2924: how to maintain persistence as an (advanced?) threat

Elastic Security discovered PHOREAL malware, which is targeting Southeast Asia financial organizations, particularly those in the Vietnamese financial sector.

What is the threat?

What is the impact?

What is Elastic doing about it?

Investigation Details

Adversary Assessment Justification

YARA Rules

Defensive Recommendations

Observables

Artifacts

PHOREAL Malware Targets the Southeast Asian Financial Sector

Elastic Security Labs is providing an update to the REF2924 research published in December of 2022. This update includes malware analysis of the implants, additional findings, and associations with other intrusions.

DOORME code analysis

Introduction to backdoored IIS modules

Introduction to the DOORME IIS module

Obfuscation

String obfuscation

Anti-disassembly technique

Control flow obfuscation

Dynamic import table resolution obfuscation

Authentication

GET request handling

POST requests handling

Base64 implementation

AES algorithm implementation

Command handling table

Command ID 0x42

Command ID 0x43

Command ID 0x63

Command ID 0x44

DOORME Summary

SIESTAGRAPH code analysis

Introduction to the SIESTAGRAPH implant

Command and control

C - run command

N - Sleep timer update

D - Upload to OneDrive

U - Download from OneDrive

NET - Gather network information

SS - Take screenshot

SIESTAGRAPH Summary

SHADOWPAD loader code analysis

Introduction to log.dll

Capabilities

API loading

Persistence

Shellcode

Other SHADOWPAD research

SHADOWPAD Summary

Campaign and adversary modeling

Winnti

Undisclosed REF, Winnti

REF2924, ChamelGang, Winnti

Undisclosed REF, ChamelGang

Campaign associations

Campaigns 1 and 3

Campaigns 3 and 4

Summary

Detections

Signatures

YARA rules

The DOORME IIS module

The SIESTAGRAPH implant

The SHADOWPAD malware family

Indicators

Elastic Security Labs is providing an update to the active intrusions using SIESTAGRAPH, DOORME, and SHADOWPAD, including malware analysis and associations with additional campaigns.

Update to the REF2924 intrusion set and related campaigns

This year's FLARE-ON consisted of 11 different reverse engineering challenges with a range of interesting binaries. We really enjoyed working on these challenges and have published our solutions here to Elastic Security Labs.

Challenge 1 - “Flaredle”

Solution

Challenge 2 - “Pixel Poker”

Challenge 3 - “Magic 8 Ball”

Challenge 4 - “darn_mice”

Challenge 5 - “T8”

PCAP file overview

Binary overview

Challenge 6 - “à la mode”

Challenge 7 - “anode”

Challenge 8 - “Backdoor”

Challenge 9 - “encryptor”

Challenge 10 - The Karaoke Labyrinth

Challenge 11 - “The challenge that shall not be named”

Acknowledgements

Burning down the house

FLARE-ON 9 Solutions:

Elastic Security Labs discusses the EMOTET trojan and is releasing a tool to dynamically extract configuration files using code emulators.

Encryption keys

C2 server list

Strings

Configuration extractor

The future of EMOTET

EMOTET key decryption function

EMOTET C2 aggregation

EMOTET string decoder

A tool for the dynamic extraction of EMOTET configurations based on emulation.

EMOTET Dynamic Configuration Extraction

Elastic Security Labs outlines the steps collect and analyze the various stages of the REF4526 intrusion set. This intrusion set uses a creative approach of Unicode icons in Powershell scripts to install a loader, a dropper, and RAT implants.

Loader phase

Dropper phase

RAT phase

Activity clusters

Collecting and parsing network data

Loader and Dropper

Diamond Model

Observed adversary tactics and techniques

Elastic Security Labs identified an interesting approach to frustrate the detection of the YIPPHB dropper and RAT implants.

Doing time with the YIPPHB dropper

作者

雷姆科·斯普罗滕

文章

为PUMAKIT去爪

押注机器人：调查 Linux 恶意软件、加密货币挖矿和赌博 API 滥用

大规模动态恶意软件分析的弹性方法

NAPLISTENER：来自 SIESTAGRAPH 开发者的更多噩梦

Elastic 用户受到 SUDDENICON 供应链攻击的保护

REF2924：如何作为（高级？）威胁保持持久性

PHOREAL 恶意软件针对东南亚金融业

REF2924 入侵集和相关活动的更新

FLARE-ON 9 解决方案：

EMOTET 动态配置提取

使用 YIPPHB 下载器进行时间旅行

Elastic 保护免受针对乌克兰的数据擦除恶意软件：HERMETICWIPER