FlawedGrace (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.flawedgrace (Back to overview)

FlawedGrace

aka: GraceWire

Actor(s): TA505

According to ProofPoint, FlawedGrace is written in C++ and can be categorized as a Remote Access Trojan (RAT). It seems to have been developed in the second half of 2017 mainly.

FlawedGrace uses a series of commands:
FlawedGrace also uses a series of commands, provided below for reference:
* desktop_stat
* destroy_os
* target_download
* target_module_load
* target_module_load_external
* target_module_unload
* target_passwords
* target_rdp
* target_reboot
* target_remove
* target_script
* target_servers
* target_update
* target_upload

References

2022-12-08 ⋅ Cisco Talos ⋅ Tiago Pereira
Breaking the silence - Recent Truebot activity
Clop Cobalt Strike FlawedGrace Raspberry Robin Silence Teleport

2022-11-11 ⋅ Codesec ⋅ Hugo Caron
GraceWire / FlawedGrace malware adventure
FlawedGrace

2021-12-01 ⋅ NCC Group ⋅ Nikolaos Pantazopoulos, Michael Sandee
Tracking a P2P network related to TA505
FlawedGrace Necurs

2021-10-21 ⋅ CrowdStrike ⋅ Alex Clinton, Tasha Robinson
Stopping GRACEFUL SPIDER: Falcon Complete’s Fast Response to Recent SolarWinds Serv-U Exploit Campaign
Cobalt Strike FlawedGrace TinyMet

2021-10-19 ⋅ Proofpoint ⋅ Zydeca Cass, Axel F, Crista Giering, Matthew Mesa, Georgi Mladenov, Brandon Murphy
Whatta TA: TA505 Ramps Up Activity, Delivers New FlawedGrace Variant
FlawedGrace MirrorBlast

2021-03-02 ⋅ Möbius Strip Reverse Engineering ⋅ Rolf Rolles
An Exhaustively-Analyzed IDB for FlawedGrace
FlawedGrace

2020-08-20 ⋅ CERT-FR ⋅ CERT-FR
Development of the Activity of the TA505 Cybercriminal Group
AndroMut Bart Clop Dridex FlawedAmmyy FlawedGrace Get2 Locky Marap QuantLoader SDBbot ServHelper tRat TrickBot

2020-06-22 ⋅ CERT-FR ⋅ CERT-FR
Évolution De Lactivité du Groupe Cybercriminel TA505
Amadey AndroMut Bart Clop Dridex FlawedGrace Gandcrab Get2 GlobeImposter Jaff Locky Marap Philadephia Ransom QuantLoader Scarab Ransomware SDBbot ServHelper Silence tRat TrickBot

2020-06-17 ⋅ Twitter (@MsftSecIntel) ⋅ Microsoft Security Intelligence
A tweet thread on TA505 using CAPTCHA to avoid detection and infecting victims with FlawedGrace
FlawedGrace

2020-05-21 ⋅ Intel 471 ⋅ Intel 471
A brief history of TA505
AndroMut Bart Dridex FlawedAmmyy FlawedGrace Gandcrab Get2 GlobeImposter Jaff Kegotip Locky Necurs Philadephia Ransom Pony QuantLoader Rockloader SDBbot ServHelper Shifu Snatch TrickBot

2020-03-26 ⋅ Telekom ⋅ Thomas Barabosch
TA505's Box of Chocolate - On Hidden Gems packed with the TA505 Packer
Amadey Azorult Clop FlawedGrace Get2 SDBbot Silence TinyMet TA505

2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA

2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy

2020 ⋅ Secureworks ⋅ SecureWorks
GOLD TAHOE
Clop FlawedAmmyy FlawedGrace Get2 SDBbot ServHelper TA505

2019-01-14 ⋅ Möbius Strip Reverse Engineering ⋅ Rolf Rolles
A Quick Solution to an Ugly Reverse Engineering Problem
FlawedGrace

2019-01-09 ⋅ Proofpoint ⋅ Dennis Schwarz, Proofpoint Staff
ServHelper and FlawedGrace - New malware introduced by TA505
FlawedGrace ServHelper

Yara Rules

[TLP:WHITE] win_flawedgrace_auto (20230407 | Detects win.flawedgrace.)

rule win_flawedgrace_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.flawedgrace."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.flawedgrace"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c685bff3ffff77 c685c0f3ffffe4 c685c1f3ffffb9 c685c2f3ffff03 c685c3f3ffff00 c685c4f3ffff00 }
            // n = 6, score = 200
            //   c685bff3ffff77       | mov                 byte ptr [ebp - 0xc41], 0x77
            //   c685c0f3ffffe4       | mov                 byte ptr [ebp - 0xc40], 0xe4
            //   c685c1f3ffffb9       | mov                 byte ptr [ebp - 0xc3f], 0xb9
            //   c685c2f3ffff03       | mov                 byte ptr [ebp - 0xc3e], 3
            //   c685c3f3ffff00       | mov                 byte ptr [ebp - 0xc3d], 0
            //   c685c4f3ffff00       | mov                 byte ptr [ebp - 0xc3c], 0

        $sequence_1 = { c6852be6ffff00 c6852ce6ffff00 c6852de6ffff00 c6852ee6ffff00 c6852fe6ffff00 c68530e6ffff00 c68531e6ffff00 }
            // n = 7, score = 200
            //   c6852be6ffff00       | mov                 byte ptr [ebp - 0x19d5], 0
            //   c6852ce6ffff00       | mov                 byte ptr [ebp - 0x19d4], 0
            //   c6852de6ffff00       | mov                 byte ptr [ebp - 0x19d3], 0
            //   c6852ee6ffff00       | mov                 byte ptr [ebp - 0x19d2], 0
            //   c6852fe6ffff00       | mov                 byte ptr [ebp - 0x19d1], 0
            //   c68530e6ffff00       | mov                 byte ptr [ebp - 0x19d0], 0
            //   c68531e6ffff00       | mov                 byte ptr [ebp - 0x19cf], 0

        $sequence_2 = { c68567deffff00 c68568deffff2d c68569deffff00 c6856adeffff2d c6856bdeffff00 c6856cdeffff00 c6856ddeffff00 }
            // n = 7, score = 200
            //   c68567deffff00       | mov                 byte ptr [ebp - 0x2199], 0
            //   c68568deffff2d       | mov                 byte ptr [ebp - 0x2198], 0x2d
            //   c68569deffff00       | mov                 byte ptr [ebp - 0x2197], 0
            //   c6856adeffff2d       | mov                 byte ptr [ebp - 0x2196], 0x2d
            //   c6856bdeffff00       | mov                 byte ptr [ebp - 0x2195], 0
            //   c6856cdeffff00       | mov                 byte ptr [ebp - 0x2194], 0
            //   c6856ddeffff00       | mov                 byte ptr [ebp - 0x2193], 0

        $sequence_3 = { 8b08 6aff 50 ff5110 85c0 783f }
            // n = 6, score = 200
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   6aff                 | push                -1
            //   50                   | push                eax
            //   ff5110               | call                dword ptr [ecx + 0x10]
            //   85c0                 | test                eax, eax
            //   783f                 | js                  0x41

        $sequence_4 = { e8???????? ba22000000 8d4f04 e8???????? ffb56cfbffff 8bcb 8907 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   ba22000000           | mov                 edx, 0x22
            //   8d4f04               | lea                 ecx, [edi + 4]
            //   e8????????           |                     
            //   ffb56cfbffff         | push                dword ptr [ebp - 0x494]
            //   8bcb                 | mov                 ecx, ebx
            //   8907                 | mov                 dword ptr [edi], eax

        $sequence_5 = { c6854df6ffff00 c6854ef6ffff00 c6854ff6ffff00 c68550f6ffff68 c68551f6ffff22 c68552f6ffff00 }
            // n = 6, score = 200
            //   c6854df6ffff00       | mov                 byte ptr [ebp - 0x9b3], 0
            //   c6854ef6ffff00       | mov                 byte ptr [ebp - 0x9b2], 0
            //   c6854ff6ffff00       | mov                 byte ptr [ebp - 0x9b1], 0
            //   c68550f6ffff68       | mov                 byte ptr [ebp - 0x9b0], 0x68
            //   c68551f6ffff22       | mov                 byte ptr [ebp - 0x9af], 0x22
            //   c68552f6ffff00       | mov                 byte ptr [ebp - 0x9ae], 0

        $sequence_6 = { 8b55ec 8bc1 0bc2 741e 8b45f0 85c0 7417 }
            // n = 7, score = 200
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]
            //   8bc1                 | mov                 eax, ecx
            //   0bc2                 | or                  eax, edx
            //   741e                 | je                  0x20
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   85c0                 | test                eax, eax
            //   7417                 | je                  0x19

        $sequence_7 = { c68524e7ffff00 c68525e7ffff00 c68526e7ffff10 c68527e7ffff00 c68528e7ffff00 c68529e7ffff10 c6852ae7ffff00 }
            // n = 7, score = 200
            //   c68524e7ffff00       | mov                 byte ptr [ebp - 0x18dc], 0
            //   c68525e7ffff00       | mov                 byte ptr [ebp - 0x18db], 0
            //   c68526e7ffff10       | mov                 byte ptr [ebp - 0x18da], 0x10
            //   c68527e7ffff00       | mov                 byte ptr [ebp - 0x18d9], 0
            //   c68528e7ffff00       | mov                 byte ptr [ebp - 0x18d8], 0
            //   c68529e7ffff10       | mov                 byte ptr [ebp - 0x18d7], 0x10
            //   c6852ae7ffff00       | mov                 byte ptr [ebp - 0x18d6], 0

        $sequence_8 = { c685a0f4ffff00 c685a1f4ffff5f c685a2f4ffff56 c685a3f4ffff6a c685a4f4ffff01 c685a5f4ffffff c685a6f4ffff75 }
            // n = 7, score = 200
            //   c685a0f4ffff00       | mov                 byte ptr [ebp - 0xb60], 0
            //   c685a1f4ffff5f       | mov                 byte ptr [ebp - 0xb5f], 0x5f
            //   c685a2f4ffff56       | mov                 byte ptr [ebp - 0xb5e], 0x56
            //   c685a3f4ffff6a       | mov                 byte ptr [ebp - 0xb5d], 0x6a
            //   c685a4f4ffff01       | mov                 byte ptr [ebp - 0xb5c], 1
            //   c685a5f4ffffff       | mov                 byte ptr [ebp - 0xb5b], 0xff
            //   c685a6f4ffff75       | mov                 byte ptr [ebp - 0xb5a], 0x75

        $sequence_9 = { c6856bcfffffd9 c6856ccfffff83 c6856dcffffff9 c6856ecfffff04 c6856fcfffff77 c68570cfffffc2 c68571cfffff0f }
            // n = 7, score = 200
            //   c6856bcfffffd9       | mov                 byte ptr [ebp - 0x3095], 0xd9
            //   c6856ccfffff83       | mov                 byte ptr [ebp - 0x3094], 0x83
            //   c6856dcffffff9       | mov                 byte ptr [ebp - 0x3093], 0xf9
            //   c6856ecfffff04       | mov                 byte ptr [ebp - 0x3092], 4
            //   c6856fcfffff77       | mov                 byte ptr [ebp - 0x3091], 0x77
            //   c68570cfffffc2       | mov                 byte ptr [ebp - 0x3090], 0xc2
            //   c68571cfffff0f       | mov                 byte ptr [ebp - 0x308f], 0xf

    condition:
        7 of them and filesize < 966656
}

Download all Yara Rules

FlawedGrace Propose Change

References

Yara Rules

FlawedGrace