Malware

LocalOlive

According to Microsoft, this is a web shell, written in ASPX supporting C#, carrying sufficient yet rudimentary functionality to support the following secondary activities: uploading and downloading files, running shell commands, opening a port (default port is set to TCP 250).

Indicators of Compromise 27

Domain ciscoheartbeat[.]com Filename assembler.py Filename cloud.exe Filename dotnet-install.ps1 Filename link.ps1 Filename service.aspx Filename service.exe Filename winbox64.exe SHA-256 08ced2cca0b22dd7a211ebf318b8186fc1c2149943338c77ee2ac677b473727f SHA-256 2866763ebd3124bfe9cf3f65d6341dda6bbb98e2653c98dd2f001f152e082291 SHA-256 44b1f3f06607cd3ee16517d31b30208910ce678cb69ba7a0514546dff183dfce SHA-256 47e83dfd0f9680d2e9623fee92c0acc4db40ea4272edeb53164304620305a24f SHA-256 636e04f0618dd578d107f440b1cf6c910502d160130adae5e415b2dd2b36abcb SHA-256 6865685f75a64780aa24a05b267bea128bcc6efdc682fa2893e13a4f63e6d6e7 SHA-256 69cb709bffbeccea60776c49935acb41ecfb160973f1f11b195007c254c1c28c SHA-256 70a5492db39585ec18de512058a5389c9a4043fba13ca8ad7d057ead66298626 SHA-256 79d1c7158d374ed80ec7f9305f6638ad95aefd600c9e280fc7fe081c7ef2f4b4 SHA-256 8140326d7474722e6bdd51dd305609e82319c0150ed429b74587d689acea2d54 SHA-256 8c07c37ac84d4c6fd76de3d966e26b65e401bc641a845baf6f73ad0d6a10fc6b SHA-256 8eb178d5b1d528380c9ccfe1ea7f43aebd97b018a5b449ec911a05c0bd52d207 SHA-256 8fe4e336fbac4f5227f802ba1853f1b07ffdb414cec961c532c115078a2aa55e SHA-256 ba6301e35fc3feb41ece82e518f97a81263aa3bd750de7a84eef01dbf15f3507 SHA-256 c2cf27810cc11ed7c6ae9f70f156f18cf3f73550ab5d675278e3b725fc88e2b0 SHA-256 cf8e09f013fcb5f34c8c274bf07d9047956ba441dabf2d3de87ea025e14058b7 SHA-256 e03b8c54ac916b363f956e4e4e04a19eb4119455d8006c92e9328e16a8cee52f SHA-256 e9a19d42da93e9257dc9b89afc34341e1c13d6a6f7dacd309f2fc545e6b749a3 IP 185[.]145[.]245[.]209

MITRE ATT&CK TTPs 16

T1012
Query Registry
Discovery
 T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol
Exfiltration
 T1059.001
PowerShell
Execution
 T1059.003
Windows Command Shell
Execution
 T1069.002
Domain Groups
Discovery
 T1070.001
Clear Windows Event Logs
Defense Evasion
 T1071.001
Web Protocols
Command And Control
 T1078.004
Cloud Accounts
Defense Evasion
 T1083
File and Directory Discovery
Discovery
 T1087.002
Domain Account
Discovery
 T1090
Proxy
Command And Control
 T1129
Shared Modules
Execution
 T1136.002
Domain Account
Persistence
 T1204.002
Malicious File
Execution
 T1217
Browser Information Discovery
Discovery
 T1566
Phishing
Initial Access

Source Articles

Ukrainian Organizations Still Heavily Targeted by Russian Attacks | SECURITY.COM
Russian-linked attackers continue to target Ukrainian organizations with a focus on espionage and persistent access. The intrusions involved the use of webshells, living-off-the-land tactics, and minimal malware deployment to harvest credentials and sensitive data. Techniques included memory dumping, registry exfiltration, and disabling security tools, indicating a highly skilled and stealthy threat actor.
security.com