Bypassing Antivirus using Amber (Reflective PE Packer)

Amber is a proof-of-concept tool used for bypassing antivirus software. Amber uses techniques that convert Portable Executables (PEs) to reflectively load those PEs. This can be used as a multi-stage payload for infection on a target system. Amber takes advantage of in-memory execution methods. In-memory fileless execution can be defined as executing a compiled PE inside the memory, without actually writing data to storage. This results in fewer footprints, as the malware does not leave a file on the hard drive. This method also makes it difficult for any antivirus or anti-malware solutions to be used for detection...READ MORE

Wapack Labs has cataloged and reported on anti-detection tools in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Warhorse Botnet and Attack Framework

In August 2017, Wapack Labs uncovered a new botnet leveraging a recently released attack framework dubbed "Warhorse". The bots were observed delivering the GlobeImposter malware to numerous targets including those in the government, military, telecommunications, and energy sectors. Javascript downloaders such as Warhorse have become a popular delivery mechanism for multiple malware campaigns. The speed by which Warhorse was adopted by cyber criminals is notable with the campaign described in this report taking place only a few days after the project appeared on Github. While Warhorse currently has an above average detection ratio on VirusTotal, it is still undetected by several major anti-virus vendors. Furthermore, since it is likely that the delivery infrastructure is part of a larger botnet then there is a high probability the bots are being leveraged in other attacks. This report provides an early warning on this new botnet and details on the Warhorse attack framework...READ MORE

Wapack Labs has cataloged and reported extensively on botnets and malware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.

WWW.WAPACKLABS.COM

Google AdWords Phishing Campaign

Wapack Labs has discovered a new phishing campaign. While generally simplistic, it contains some elements of high sophistication. It is also fairly expensive to operate, which suggests it is a precursor to a more sophisticated and potentially harmful campaign. Wapack Labs conducted a brief tactical analysis and is providing this report for your situational awareness.

• Search for “Facebook” in Google Chrome produced a link to a fake anti-virus malware. 
• Facebook was notified of this activity.
• A much more serious malware campaign targeting major social, retail, and online companies may be in the works...READ MORE

Publication Date: 19 December 2016

Handling Requirements: Traffic light protocol (TLP) GREEN

Attribution/Threat Actors: Google AD campaign phishing/unknown author

Actor Type:  Adversary capabilities have been assessed as Tier II

Industries Targeted: Financial, business and retail sectors

Past Reporting: Red Sky Alliance: DOC-2901

Companies Cited In This Report: Facebook, EBay, and Home Deport

The full report may be viewed in the Red Sky Alliance as DOC-4557.  
Contact Wapack Labs for more information.

Indetectables RAT Receives Help from Several White Hat Hackers

In late September 2016, a Spanish speaking hacker released an updated version of a popular white hat developed Remote Access Tool (RAT) named “Indetectables RAT” on the Spanish language hacker forum Indetectables.net. This tool is posted to dozens of international hacker groups who have targeted US and international institutions and has a low anti-virus detection payload (13/56) for samples submitted to Virus Total. The hacker also received the advice of several well-known international white hat hackers whom he/she credits in the latest builder version (v.0.9.2).

Publication date:                        24 October 2016

Handling requirements:            Traffic light protocol (TLP) AMBER

Attribution/Threat Actors:       Indectables hacker

Actor Type:                                 Adversary capabilities have been assessed as Tier III*

Potential Targets:                       US/International institutions

Past Reporting:                           N/A

Indicators:                                   https://www.threatrecon.co/search?keyword= Indetectables_RAT

*Practitioners who focus on the discovery and use of unknown malicious code, are adept at installing user and kernel mode root kits10, frequently use data mining tools, target corporate executives and key users (government and industry) for the purpose of stealing personal and corporate data with the expressed purpose of selling the information to other criminal elements. 

The full attribution report has been published in its entirety in the Red Sky Alliance portal.  For more information please contact the lab directly at 844-4-WAPACK, 603-606-1246, or feedback@wapacklabs.com.

About Wapack Labs

Wapack Labs, located in New Boston, NH is a Cyber Threat Analysis and Intelligence organization supporting the Red Sky Alliance, the FS-ISAC and individual organizations by offering expert level targeted intelligence analysis answering some of the hardest questions in Cyber.  Wapack Labs’ engineers, researchers and analysts use deep analysis techniques and visualization to design and deliver transformational cyber-security analysis tools that fuse open source and proprietary information.  The intelligence derived from these tools and techniques serve as the foundation of Wapack Labs’ information reporting to the cyber-security teams of its customers and industry partners located around the world.