SYMBOLCOMMON_NAMEaka. SYNONYMS
win.seduploader (Back to overview)

Seduploader

aka: jhuhugit, jkeyskw, downrage, carberplike

Actor(s): Sofacy


There is no description at this point.

References
2020SecureworksSecureWorks
@online{secureworks:2020:iron:48c68a0, author = {SecureWorks}, title = {{IRON TWILIGHT}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/iron-twilight}, language = {English}, urldate = {2020-05-23} } IRON TWILIGHT
X-Agent X-Agent X-Agent Computrace HideDRV Sedreco Seduploader X-Agent XTunnel Zebrocy Zebrocy (AutoIT)
2018-12-21Emanuele De Lucia
@online{lucia:20181221:apt28:466f390, author = {Emanuele De Lucia}, title = {{APT28 / Sofacy – SedUploader under the Christmas tree}}, date = {2018-12-21}, url = {https://www.emanueledelucia.net/apt28-sofacy-seduploader-under-the-christmas-tree/}, language = {English}, urldate = {2020-03-30} } APT28 / Sofacy – SedUploader under the Christmas tree
Seduploader
2018-10-04SymantecCritical Attack Discovery and Intelligence Team
@online{team:20181004:apt28:97a1356, author = {Critical Attack Discovery and Intelligence Team}, title = {{APT28: New Espionage Operations Target Military and Government Organizations}}, date = {2018-10-04}, organization = {Symantec}, url = {https://symantec-blogs.broadcom.com/blogs/election-security/apt28-espionage-military-government}, language = {English}, urldate = {2020-04-21} } APT28: New Espionage Operations Target Military and Government Organizations
LoJax Seduploader X-Agent XTunnel Zebrocy Sofacy
2017-12-21ESET ResearchESET Research
@online{research:20171221:sednit:630ff7c, author = {ESET Research}, title = {{Sednit update: How Fancy Bear Spent the Year}}, date = {2017-12-21}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/}, language = {English}, urldate = {2019-11-14} } Sednit update: How Fancy Bear Spent the Year
Seduploader X-Agent
2017-10-22CiscoWarren Mercer, Paul Rascagnères, Vitor Ventura
@online{mercer:20171022:cyber:b26ac86, author = {Warren Mercer and Paul Rascagnères and Vitor Ventura}, title = {{“Cyber Conflict” Decoy Document Used In Real Cyber Conflict}}, date = {2017-10-22}, organization = {Cisco}, url = {http://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html}, language = {English}, urldate = {2020-01-07} } “Cyber Conflict” Decoy Document Used In Real Cyber Conflict
Seduploader
2017-10-19ProofpointKafeine, Pierre T
@online{kafeine:20171019:apt28:927b889, author = {Kafeine and Pierre T}, title = {{APT28 racing to exploit CVE-2017-11292 Flash vulnerability before patches are deployed}}, date = {2017-10-19}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/apt28-racing-exploit-cve-2017-11292-flash-vulnerability-patches-are-deployed}, language = {English}, urldate = {2019-12-20} } APT28 racing to exploit CVE-2017-11292 Flash vulnerability before patches are deployed
Seduploader
2017-08-13Adam Chester
@online{chester:20170813:analysis:11db4f8, author = {Adam Chester}, title = {{Analysis of APT28 hospitality malware (Part 2)}}, date = {2017-08-13}, url = {https://blog.xpnsec.com/apt28-hospitality-malware-part-2/}, language = {English}, urldate = {2020-01-08} } Analysis of APT28 hospitality malware (Part 2)
Seduploader
2017-08-11FireEyeLindsay Smith, Ben Read
@online{smith:20170811:apt28:a39510a, author = {Lindsay Smith and Ben Read}, title = {{APT28 Targets Hospitality Sector, Presents Threat to Travelers}}, date = {2017-08-11}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2017/08/apt28-targets-hospitality-sector.html}, language = {English}, urldate = {2019-12-20} } APT28 Targets Hospitality Sector, Presents Threat to Travelers
Seduploader
2017-05-09ESET ResearchESET Research
@online{research:20170509:sednit:dde92c1, author = {ESET Research}, title = {{Sednit adds two zero‑day exploits using ‘Trump’s attack on Syria’ as a decoy}}, date = {2017-05-09}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2017/05/09/sednit-adds-two-zero-day-exploits-using-trumps-attack-syria-decoy/}, language = {English}, urldate = {2019-12-20} } Sednit adds two zero‑day exploits using ‘Trump’s attack on Syria’ as a decoy
Seduploader
2017-02-20Contagio DumpMila Parkour
@online{parkour:20170220:part:c54b5de, author = {Mila Parkour}, title = {{Part I. Russian APT - APT28 collection of samples including OSX XAgent}}, date = {2017-02-20}, organization = {Contagio Dump}, url = {https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html}, language = {English}, urldate = {2019-11-26} } Part I. Russian APT - APT28 collection of samples including OSX XAgent
X-Agent Komplex Coreshell Downdelph HideDRV SEADADDY Sedreco Seduploader X-Agent XTunnel
2016-08ESET ResearchESET Research
@techreport{research:201608:en:0617083, author = {ESET Research}, title = {{En Route with Sednit - Part 1: Approaching the Target}}, date = {2016-08}, institution = {ESET Research}, url = {http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part1.pdf}, language = {English}, urldate = {2019-12-10} } En Route with Sednit - Part 1: Approaching the Target
Komplex Seduploader
2016-06-14Palo Alto Networks Unit 42Robert Falcone, Bryan Lee
@online{falcone:20160614:new:b51d1ab, author = {Robert Falcone and Bryan Lee}, title = {{New Sofacy Attacks Against US Government Agency}}, date = {2016-06-14}, organization = {Palo Alto Networks Unit 42}, url = {https://researchcenter.paloaltonetworks.com/2016/06/unit42-new-sofacy-attacks-against-us-government-agency/}, language = {English}, urldate = {2020-09-15} } New Sofacy Attacks Against US Government Agency
Seduploader Sofacy
2015-12-04Kaspersky LabsGReAT
@online{great:20151204:sofacy:b437b35, author = {GReAT}, title = {{Sofacy APT hits high profile targets with updated toolset}}, date = {2015-12-04}, organization = {Kaspersky Labs}, url = {https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/}, language = {English}, urldate = {2020-08-30} } Sofacy APT hits high profile targets with updated toolset
Coreshell Sedreco Seduploader X-Agent Sofacy
2015-10-13Trend MicroBrooks Li, Feike Hacquebord, Peter Pi
@online{li:20151013:new:34dc6b1, author = {Brooks Li and Feike Hacquebord and Peter Pi}, title = {{New Adobe Flash Zero-Day Used in Pawn Storm Campaign Targeting Foreign Affairs Ministries}}, date = {2015-10-13}, organization = {Trend Micro}, url = {http://blog.trendmicro.com/trendlabs-security-intelligence/new-adobe-flash-zero-day-used-in-pawn-storm-campaign/}, language = {English}, urldate = {2019-10-15} } New Adobe Flash Zero-Day Used in Pawn Storm Campaign Targeting Foreign Affairs Ministries
Seduploader
2014-10-27Trend MicroLoucif Kharouni, Feike Hacquebord, Numaan Huq, Jim Gogolinski, Fernando Mercês, Alfred Remorin, Douglas Otis
@techreport{kharouni:20141027:operation:1b13f15, author = {Loucif Kharouni and Feike Hacquebord and Numaan Huq and Jim Gogolinski and Fernando Mercês and Alfred Remorin and Douglas Otis}, title = {{Operation Pawn Storm: Using Decoys to Evade Detection}}, date = {2014-10-27}, institution = {Trend Micro}, url = {https://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-operation-pawn-storm.pdf}, language = {English}, urldate = {2020-09-15} } Operation Pawn Storm: Using Decoys to Evade Detection
Sedreco Seduploader Sofacy
Yara Rules
[TLP:WHITE] win_seduploader_auto (20201014 | autogenerated rule brought to you by yara-signator)
rule win_seduploader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.seduploader"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bec 837d0800 7412 ff7508 6a08 e8???????? 50 }
            // n = 7, score = 1700
            //   8bec                 | mov                 ebp, esp
            //   837d0800             | cmp                 dword ptr [ebp + 8], 0
            //   7412                 | je                  0x14
            //   ff7508               | push                dword ptr [ebp + 8]
            //   6a08                 | push                8
            //   e8????????           |                     
            //   50                   | push                eax

        $sequence_1 = { 68???????? e8???????? ff751c e8???????? }
            // n = 4, score = 1700
            //   68????????           |                     
            //   e8????????           |                     
            //   ff751c               | push                dword ptr [ebp + 0x1c]
            //   e8????????           |                     

        $sequence_2 = { e8???????? 8bf0 56 e8???????? 56 8ad8 e8???????? }
            // n = 7, score = 1700
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   56                   | push                esi
            //   e8????????           |                     
            //   56                   | push                esi
            //   8ad8                 | mov                 bl, al
            //   e8????????           |                     

        $sequence_3 = { 59 ff7608 e8???????? 59 5f 66c746100000 5e }
            // n = 7, score = 1700
            //   59                   | pop                 ecx
            //   ff7608               | push                dword ptr [esi + 8]
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   5f                   | pop                 edi
            //   66c746100000         | mov                 word ptr [esi + 0x10], 0
            //   5e                   | pop                 esi

        $sequence_4 = { e9???????? be???????? e9???????? b991010000 }
            // n = 4, score = 1700
            //   e9????????           |                     
            //   be????????           |                     
            //   e9????????           |                     
            //   b991010000           | mov                 ecx, 0x191

        $sequence_5 = { e8???????? 8bf0 837d1000 7504 8bc6 }
            // n = 5, score = 1700
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   837d1000             | cmp                 dword ptr [ebp + 0x10], 0
            //   7504                 | jne                 6
            //   8bc6                 | mov                 eax, esi

        $sequence_6 = { 53 ff7510 50 53 53 56 e8???????? }
            // n = 7, score = 1700
            //   53                   | push                ebx
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   53                   | push                ebx
            //   56                   | push                esi
            //   e8????????           |                     

        $sequence_7 = { 8bec 68d7010000 68789cd01a 6a08 }
            // n = 4, score = 1700
            //   8bec                 | mov                 ebp, esp
            //   68d7010000           | push                0x1d7
            //   68789cd01a           | push                0x1ad09c78
            //   6a08                 | push                8

        $sequence_8 = { 8b5d0c 56 8d4301 50 e8???????? 8bf0 }
            // n = 6, score = 1000
            //   8b5d0c               | mov                 ebx, dword ptr [ebp + 0xc]
            //   56                   | push                esi
            //   8d4301               | lea                 eax, [ebx + 1]
            //   50                   | push                eax
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax

        $sequence_9 = { 50 e8???????? 8bf0 33c0 89450c 59 }
            // n = 6, score = 1000
            //   50                   | push                eax
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   33c0                 | xor                 eax, eax
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax
            //   59                   | pop                 ecx

        $sequence_10 = { 8b450c 40 89450c 3bc3 7cdb 5f }
            // n = 6, score = 1000
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   40                   | inc                 eax
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax
            //   3bc3                 | cmp                 eax, ebx
            //   7cdb                 | jl                  0xffffffdd
            //   5f                   | pop                 edi

        $sequence_11 = { 57 8b7d08 2bfe 8d0c30 }
            // n = 4, score = 1000
            //   57                   | push                edi
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]
            //   2bfe                 | sub                 edi, esi
            //   8d0c30               | lea                 ecx, [eax + esi]

        $sequence_12 = { 85db 7e2c 57 8b7d08 }
            // n = 4, score = 1000
            //   85db                 | test                ebx, ebx
            //   7e2c                 | jle                 0x2e
            //   57                   | push                edi
            //   8b7d08               | mov                 edi, dword ptr [ebp + 8]

        $sequence_13 = { 753b 6a08 c70302000000 e8???????? 59 }
            // n = 5, score = 1000
            //   753b                 | jne                 0x3d
            //   6a08                 | push                8
            //   c70302000000         | mov                 dword ptr [ebx], 2
            //   e8????????           |                     
            //   59                   | pop                 ecx

        $sequence_14 = { 3bc3 7cdb 5f 8bc6 5e 5b }
            // n = 6, score = 1000
            //   3bc3                 | cmp                 eax, ebx
            //   7cdb                 | jl                  0xffffffdd
            //   5f                   | pop                 edi
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

        $sequence_15 = { 32040f 8801 8b450c 40 }
            // n = 4, score = 1000
            //   32040f               | xor                 al, byte ptr [edi + ecx]
            //   8801                 | mov                 byte ptr [ecx], al
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   40                   | inc                 eax

    condition:
        7 of them and filesize < 401408
}
Download all Yara Rules