"pattern":"[x509-certificate:hashes.SHA1 = '970f993ad1a289620b5f5033ff5e0b5c4491bb2b' AND x509-certificate:serial_number = '136234453590953102797263558291395548452' AND x509-certificate:subject = 'servidor' AND x509-certificate:x_misp_is_ca = '0']",
"pattern":"[x509-certificate:hashes.SHA1 = 'b0238c547a905bfa119c4e8baccaeacf36491ff6' AND x509-certificate:serial_number = '13098529066745705731' AND x509-certificate:subject = 'localhost' AND x509-certificate:x_misp_is_ca = '0']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'http://4.204.233.44/Rump/Rump.xls' AND url:x_misp_resource_path = '/Rump/Rump.xls' AND url:x_misp_host = '4.204.233.44' AND url:x_misp_domain_without_tld = '4.204.233.44' AND url:x_misp_domain = '4.204.233.44']",
"description":"Enriched via the url_import module",
"pattern":"[url:value = 'http://4.204.233.44/Dll/Dll.ppam' AND url:x_misp_resource_path = '/Dll/Dll.ppam' AND url:x_misp_host = '4.204.233.44' AND url:x_misp_domain_without_tld = '4.204.233.44' AND url:x_misp_domain = '4.204.233.44']",
"value":"Is Hagga Threat Actor (ab)using FSociety framework ?\r\napt cybersecurity malwareNovember 21, 2022\r\nIntroduction\r\n\r\nToday I\u2019d like to share a quick analysis initiated during a threat hunting process. The first observable was found during hunting process over OSINT sources, the entire infrastructure was still up and running during the analyses as well as malicious payload were downloadable.",
"abstract":"Report from - https://marcoramilli.com/2022/11/21/is-hagga-threat-actor-abusing-fsociety-framework/ (1683876572)",
"content":"#aptcybersecuritymalwareNovember21,2022November21,2022.container.container-medium####Introduction\n\nTodayI\u2019dliketoshareaquickanalysisinitiatedduringathreathuntingprocess.ThefirstobservablewasfoundduringhuntingprocessoverOSINTsources,theentireinfrastructurewasstillupandrunningduringtheanalysesaswellasmaliciouspayloadweredownloadable.\n\n####Analysis\n\nMyfirstobservablewasazippedtextfilecompressingasimpleupdate.jsscript.Thescriptwascreatedtoavoidautomaticanalisistoolssincethedimension(>9MB)reallymakeshardtobeautifyorremoveunwanted/funnyoraddedtrashcodeeverywhichhappenstobeeverywhere.\n\nnameupdate.jssha2569ea4eebd9cf2a5d4e6343cb559d8c996fae6bf0f3bd7ffada0567053c08acc31typeDropandExecuteStage1Thefollowingimagesshowhowitlookedlikeatfirstsight.Asmanyofyouareaware,analyzingscriptsisjustamatteroftimeor,ifyouhaveenoughmemoryonyourmachine(ortimetospendoverthattask)acomputationalmatterduringvirtualization.Ifyouareoldstyle(Idolikeitalot)itisamatterof\u201ckeywords\u201d,inotherwordsaddingsomeconsole.printlnorwhatsoeveryouliketomakedebuggingquickandeasy.Fewstringsinthisupdate.jsremindedmetotheuseofobfuscator.iotool,butIdidnotinvestigatefurtheronthisdirection,itwasquiteeasyaswelltoreachthepoint.\n\n\nFinallyitsexecutionwasreached.IobtainedthisstatusbyusingsomeclassicandromantichandworkingbalancetodynamicexecutionwiththealwaysgreatJSDetox.Finallytherealbehaviorcameout.Itlooksliketobeadropandexecuteartifact.IttakesafilecalledDll.ppamfromanIPaddress(pleasetakealooktoIoCsectiontoseedetailsonfoundIoC),itdecodesitfrombase64,anditinvokedthemethodVAI(reallyinterestedItalianwordtosay\u201cGO\u201d,nicecoincidence!?)intheFiber.Homeclass.Itthenpassestosuchafunctionaninterestingaddress:https://firebasestorage. googleapis. com with some parameters as the following image shows (please reverse the byte order on the right string).\n\nStage1 Drop and execute Lets take a closer look to what Dll.ppam is. First it\u2019s a .NET Portable Executable, so we might have an easy path ahead.\n\n nameDll.ppam sha256 ab5b1989ddf6113fcb50d06234dbef65d871e41ce8d76d5fb5cc72055c1b28ba type Drop, evasion and Memory Invoke The .NET is not packed and the code reading is quite \u201cstraight forward\u201d. An interesting technique that I\u2019d like to highlight (and to track) is in the way the malware developer used to step forward the malware control flow, which reminds me a known threat actor. Many different techniques could be used at this point if you want to make something happening after specific conditions or if you simply want to give an execution order. The most easy and (maybe) quick way to follow could be the adoption of nested functions or, if you are a more sophisticated malware developer, you might decide to use exception handlers or, again, you might decide to switch from function to function in different libraries, or for the shake of example, a simple single flow as a simple unique function. But this malware developer decided to use a quite characteristic way developing an interesting combination of switch/case. In other words it starts by assigning 0 to num variable which it makes case 0 to switch. In each case it updates the num variable to control the switch(num) selector making the flow running in the desired way. The following image shows the VAI function, in where you might appreciate the control flow and additional IoC (such as IP address, dropped url and artifact name, etc..). \n\n Principal routine on Dll.ppam The VAI routing starts by downloading a file called Rump.xls from a remote server. It places the file content into a variable and it reverse its bytes order, later it replaces special characters to the letter A. The resulting decoded file (bytes Inverted, Special Character replaced a
