Check Point Wirte NOV 2024

IronWind has used Base64 encoding and XOR encryption with the key “53” to obfuscate command strings.

WIRTE has XOR encrypted command line strings to conceal malware execution chains.

Havoc has utilized XOR encryption with the key “01-01-1900” to obfuscate command strings.

WIRTE has compressed malicious files within RAR and ZIP archives for obfuscation.

IronWind can enumerate the username on victim's systems.

WIRTE has used security service provider naming conventions such as ESET and Kasperky ("Kaspersky Update Agent") in order to appear legitimate.

SameCoin has named files to appear legitimate such as "MicrosoftEdge.exe."

SameCoin has the ability to set a scheduled task for execution.

WIRTE has used the Windows command line as part of infection chains to open documents.

IronWind has used the Windows command shell to execute malicious files.

IronWind has used a .NET DLL named "exit-DN4-core.dll" to terminate malicious processes running on victim's systems.

IronWind can used HTTP to send information to C2 about the targeted system.

IronWind can capture the OS version and computer name of the compromised host.

SameCoin can list all system files and can avoid wiping specific directories such as Program Files, Windows, and Users.

WIRTE has used the `RtlIpv4StringToAddressA` to convert IP-formatted string to a byte array.

IronWind can deobfuscate the next stage payload using Base64 and XOR operations with the key "53".

WIRTE has used links embedded in emails to lure users into downloading malicious files.

Havoc has been executed by victims through the use of targeted lures and crafted decoy documents.

WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.

SameCoin can overwrite designated files on targeted systems with random bytes.

SameCoin can alter the victim’s background to display an image showing the name of Hamas’s military wing.

IronWind can list installed software on targeted hosts.

SameCoin can send its Setup.exe file as an attachment to other addresses in the same compromised organization.

WIRTE has sent targeted spearphishing emails with malicious links directing victims to malware downloads.

SameCoin can copy its wiper executable to remote machines within the same Active Directory.

IronWind has used DLL sideloading for execution.

Havoc has leveraged legitimate executables to side-load malicious payloads.

WIRTE has used RAR archives containing a legitimate executable and a lure document to execute malicious DLLs via sideloading.

WIRTE has registered domains designed to mimic legitimate sites for use in phishing campaigns.

WIRTE has used compromised emails, including one belonging to an Israel-based technology reseller, to deliver targeted spearphishing messages.

SameCoin can attempt to connect to the Israel Home Front Command site, oref.org[.]il, which is only reachable from within Israel to verify the target's location.

SameCoin can avoid overwriting file names that contain “desktop.ini” and “conf.conf."

WIRTE has used utilized look-alike domains and graphics of trusted security solution providers to entice victims to click on phishing links.