Our team recently did a full teardown on #RevStealer. The malware is full of features and super interesting, unlike a lot of AI-generated stuff we are seeing nowadays. Blog: elastic.co/security-labs/thr… Whitepaper: assets.contentstack.io/v3/as…

We are seeing #CobaltStrike, #Mimikatz, and #FlawedGrace deployed after the exploit. Here's a screenshot of the loader starting the attack chain

Woot! Presentation went great at #VB2023, I got to share additional research/tooling around #PIPEDANCE. We have released a client application that works with the malware, check it out! github.com/elastic/PIPEDANCE

We also ran into a .NET PowerShell runner they called #PowerSeal. It leverages syscalls for evading AMSI/ETW. Definitely got a lot of red teaming vibes with this one.

#SPECTRALVIPER is their new backdoor that performs C2 via HTTP or over named pipe. It contains over 33 event handler functions. Kudos to brilliant work by @cyril_t_f on this!

They leveraged LOLBIN's and DONUTLOADER for initial execution then move to custom tooling

Lastly, we wrote a config extractor to rip out the IP addresses from each #LOBSHOT sample. Enjoy! github.com/elastic/labs-rele…

It's main functionality is centered around it's hVNC capability. This feature popularized by #Zeus allows the attacker to use standard Windows API's to create a hidden desktop and assign it to the malware. This ends up providing full interactive capabilities to attacker.

As pointed out by @lazy_daemon recently, it uses a seed for decrypting strings using the WTS_SESSION_INFO structure from a call to WTSEnumerateSessionsA. In our sample, this XOR was done on the SessionID (0) and the "S" char from the "Services" value from WinStationName.