توزیع بدافزارهای Bumblebee و IcedID توسط Dropper جاوا اسکریپت قدرتمند به نام PindOS

?? ????? ??????? ?????? ????  ???? ????? ???? ????? ?? Dropper ???? ??????? ?? ??? PindOS ?????? ??? ??? ?? payload??? ????? ???? ????? Bumblebee ? IcedID ?? ????? ??????.

???? ????? ?????? Deep Instinct ?? ??? ?????? ???????? ???????? PindOS ??? ?? ??? ?? ?? ?? ???? “User-Agent” ??? ????[?].

?? ??? [?]Bumblebee ? IcedID ???????? loader ??? ??????? ? ???????? ?? ????? ???? ???? ????????? ?? ?????????? ?? ???? ???? ?? ???? ????????? ??? ???????. ????? ???? ?? Proofpoint ?? ?????????? ????????? ?????????? ????? ???? IcedID ? ????? ????? ?? ????? ??????? ????? ???[?].

???????? Bumblebee[4] ???????? ???? loader ????? ?? ??? BazarLoader ???[?] ?? ?? ???????? TrickBot ? Conti ????? ??? ???.

?????? ?? Secureworks ?? ????? ???? ?????? ?? ?????? ??? ????? ?????? ?? ???????? ????? ?????? ?????? ?? ???? [?]Conti? Emotet[7] ? IcedID ???? ???[?].

???????????? ?? ???? Deep Instinct ?? PindOS ???? ?????? ?? ???? ?????? ?? ???? ???? ??? ?? ????? ?????? ????? ??? ???????? ????? ?????????? ?? ?????? ??????.

??? loader ?? ???????? ?? loader “?? ??? ??????????? ????” ????? ??????? ???? ?????? ???????? ?????? ???? ?? ?? ???? ??? ??? ????? ??? ???. ??? loader ?? ?? URL ??????? ??????? ??? ?? ????? ?????????? URL ??? ?????? ??? DLL ?? fetch ???? ???????? ??????? ??? ??????.

Shaul Vilkomir-Preisman ? Mark Vaitzman? ?????? ??????? ?? ??? ???? ?????[?]: ” payload??? ??????? ??? ??????? ?????????? “?? ???? ?????” ????? ??????? ?? ?? ??? ?? fetch ?????? ?? ?? ????? ???? ????? ??????.

???????? DLL ?? ????? ?? ??????? ?? [??]rundll32.exe? ?? ????? ?????? ?????? ???? ??????? ? ????? DLL ?????????? ???????.

?????? ????? ?????? ?? ??? PindOS ?? ??? ???? ???? ???????? ??? Bumblebee ? IcedID ??????? ??? ??? ?? ???.

??? ??? «??????» ???? ?? ?? ?? ??? ?????????? ??????? «?????» ??????????? ????? ???? ??? ?? ?????? ????? ?? ???????? ????? ????? ??? ? ?? ???? ???? ????? ????? ??????? ???? ???.

  ?????

[?] https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/User-Agent

[?] https://thehackernews.com/2023/04/new-all-in-one-evilextractor-stealer.html

[?] https://thehackernews.com/2023/03/icedid-malware-shifts-focus-from.html

[?] https://apa.aut.ac.ir/?p=8966

[?] https://thehackernews.com/2022/08/hackers-using-bumblebee-loader-to.html

[?] https://thehackernews.com/2022/05/conti-ransomware-gang-shut-down-after.html

[?] https://thehackernews.com/2023/03/emotet-rises-again-evades-macro.html

[?] https://thehackernews.com/2022/04/gold-ulrick-hackers-still-in-action.html

[?] https://www.deepinstinct.com/blog/pindos-new-javascript-dropper-delivering-bumblebee-and-icedid

[??] https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32

[??] https://thehackernews.com/2023/06/powerful-javascript-dropper-pindos.html

??????? :
???? ??????
???? :
????????? ???? ??????? ????? ???? ????

پویش #دو_درجه_کمتر