Truebot Enhanced New Campaign

Researchers have seen an increase in TrueBot infections, where threat actors have shifted from BEC to other techniques.

Two different Truebot botnets were traced, one is distributed worldwide, with a particular focus on Mexico, Pakistan, and Brazil, and the second one is focused on the US.

In the recent campaign, the delivery methods used include the exploitation of a now-patched vulnerability (CVE-2022-31199) in Netwrix Auditor, an IT asset management tool, and the Raspberry Robin worm.

The attack took place only a few weeks after the vulnerability was publicly disclosed, a circumstance that suggests threat actors quickly test new attack vectors.

Truebot, active since 2017 is a downloader malware, it is used to infect systems, collect information on the targets, and deploy additional malicious payloads. Gathered data are sent back to the attacker’s C2.

The set of commands to exfiltrate stolen data through a previously unknown custom tool dubbed Teleport. The analysis of the commands issued via Teleport reveals that the tool is used by the attackers to collect files from OneDrive and Downloads folders, and from the victim’s Outlook email messages.

Multiple occurrences of Raspberry Robin delivering Truebot. The researchers investigated an attack leveraging Truebot to deliver the Clop ransomware.

The primary function of TrueBot is to collect information from the host and deploy next-stage payloads such as Cobalt Strike, FlawedGrace, and Teleport. This is followed by the execution of the ransomware binary after harvesting relevant information.

Indicators Of Compromise

• 092910024190a2521f21658be849c4ac9ae6fa4d5f2ecd44c9055cc353a26875
• 1ef8cdbd3773bd82e5be25d4ba61e5e59371c6331726842107c0f1eb7d4d1f49
• 2d50b03a92445ba53ae147d0b97c494858c86a56fe037c44bc0edabb902420f7
• 55d1480cd023b74f10692c689b56e7fd6cc8139fb6322762181daead55a62b9e
• 58b671915e239e9682d50a026e46db0d775624a61a56199f7fd576b0cef4564d
• 6210a9f5a5e1dc27e68ecd61c092d2667609e318a95b5dade3c28f5634a89727
• 68a86858b4638b43d63e8e2aaec15a9ebd8fc14d460dd74463db42e59c4c6f89
• 72813522a065e106ac10aa96e835c47aa9f34e981db20fa46a8f36c4543bb85d
• 7a64bc69b60e3cd3fd00d4424b411394465640f499e56563447fe70579ccdd00
• 7c79ec3f5c1a280ffdf19d0000b4bfe458a3b9380c152c1e130a89de3fe04b63
• 7e39dcd15307e7de862b9b42bf556f2836bf7916faab0604a052c82c19e306ca
• 97d0844ce9928e32b11706e06bf2c4426204d998cb39964dd3c3de6c5223fff0
• bf3c7f0ba324c96c9a9bff6cf21650a4b78edbc0076c68a9a125ebcba0e523c9
• c3743a8c944f5c9b17528418bf49b153b978946838f56e5fca0a3f6914bee887
• c3b3640ddf53b26f4ebd4eedf929540edb452c413ca54d0d21cc405c7263f490
• c6c4f690f0d15b96034b4258bdfaf797432a3ec4f73fbc920384d27903143cb0
• b95a764820e918f42b664f3c9a96141e2d7d7d228da0edf151617fabdd9166cf
• 80b9c5ec798e7bbd71bbdfffab11653f36a7a30e51de3a72c5213eafe65965d9
• hxxp://179[.]60[.]150[.]34:80/download/file.ext
• hxxp://179[.]60[.]150[.]53:80/download/msruntime.dll
• hxxp://179[.]60[.]150[.]53:80/download/GoogleUpdate.dll
• hxxp://tddshht[.]com/chkds.dll
• hxxp://nefosferta.com/gate.php
• hxxp://185[.]55.[.]243[.]110/gate.php
• hxxp://gbpooolfhbrb[.]com/gate.php
• hxxp://88[.]214[.]27[.]100/gate.php
• hxxp://hiperfdhaus.com/gate.php
• hxxp://88[.]214[.]27[.]101/gate.php
• hxxp://jirostrogud[.]com/gate.php