BlackBerry CostaRicto November 2020

During CostaRicto, the threat actors collected data and files from compromised networks.

SombRAT has collected data and files from a compromised host.

SombRAT can enumerate services on a victim machine.

SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.

CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.

PS1 is distributed as a set of encrypted files and scripts.

SombRAT can execute getinfo to identify the username on a compromised host.

SombRAT has uploaded collected data and files from a compromised host to its C2 server.

During CostaRicto, the threat actors employed nmap and pscan to scan target environments.

During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.

CostaBricks can inject a payload into the memory of a compromised host.

PS1 can inject its payload DLL Into memory.

SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.

SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

PS1 can utilize a PowerShell loader.

SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.

SombRAT can communicate over DNS with the C2 server.

SombRAT can store harvested data in a custom database under the %TEMP% directory.

SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.

SombRAT can execute enum to enumerate files in storage on a compromised system.

During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.

SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.

CostaBricks has been used to load SombRAT onto a compromised host.

During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.

SombRAT has the ability to download and execute additional payloads.

CostaBricks can download additional payloads onto a compromised host.

CostaBricks has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.

SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.

SombRAT can execute getinfo to discover the current time on a compromised host.

During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.

PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.

CostaBricks has the ability to use bytecode to decrypt embedded payloads.

SombRAT can run upload to decrypt and upload files from storage.

SombRAT has encrypted collected data with AES-256 using a hardcoded key.

SombRAT can use a custom DGA to generate a subdomain for C2.

During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.

SombRAT has encrypted its C2 communications with AES.

SombRAT can SSL encrypt C2 traffic.

For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.

For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.

During CostaRicto, the threat actors obtained open source tools to use in their operations.