As per the US-Certreport, HddenB Cobra has been using this malware since 2009 to target multiple victims globally and in the United States, including media, aerospace, financial industries, and critical infrastructure sectors. US-Cert recently issued notification regarding malicious cyber activity by the North Korean government [1] Hidden Cobra.<\/p>\n","protected":false},"author":2,"featured_media":4526,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[],"_links":{"self":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/6004"}],"collection":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/comments?post=6004"}],"version-history":[{"count":0,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/6004\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media\/4526"}],"wp:attachment":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media?parent=6004"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/categories?post=6004"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/tags?post=6004"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nIn this blog, we share the technical details and spreading techniques used by the Brambul worm. Thereafter, we discuss how it can be detected by distributed deception platform.
\nBrambul Worm <\/b>
\nThe worm invokes multiple threads which then randomly generates IP addresses for infection.
\n![\"\"](\"https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/06\/Screen-Shot-2018-06-11-at-3.33.49-PM.png\")
\nFigure 1.0 Showing the code for random generation of IP address.
\nOnce the victimb\u0000\u0019s IP addresses have been generated it connects to \\\\IPC$ share, on the port 445 of the victim machine using Administrator as the username and fixed hardcoded passwords.
\nThereafter, the malware code makes a call to the WNetAddConnection2 API B to connect to a network resource and constructs the below command.
\nb\u0000\u001ccmd.exe \/q \/c net share admin$=%%SystemRoot%% \/GRANT:%s, FULL<\/i>b\u0000\u001d
\nIt then makes calls to the service manager. OpenSCManagerA()<\/i> with the victim machine machines on the network as the parameter. B StartSeviceA()<\/i> then executes the command which grants full permission on the remote machine. B Once the command has been executed, the code makes aB call to DeleteService<\/i>() which then deletes the service.
\n![\"\"](\"https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/06\/Screen-Shot-2018-06-11-at-2.19.07-PM-1024x379-1.png\")
\nOnce the full permission is granted on the remote machine, the worm is copied to the remote machine.
\nDetection by Distributed Deception Platform <\/b>
\nAs such, the worm is not quite sophisticated and primarily relies on brute force attempts. This will be successful only in weak environments. If a Distributed Deception Platform is deployed in a threat agnostic <\/a>manner network, enumeration by the Brambul Worm will get detected with very high confidence. [deployment of a distributed deception platform is discussed inB a previous blog<\/a>]. Brute force attacks on the Distributed Deception Platform leads to isolation of the end-point, thereby containing damage in a timely manner.
\nReferences:<\/b>
\n[1] B Hidden Cobra b\u0000\u0013 North Korean Malicious B Cyber Activity. https:\/\/www.us-cert.gov\/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity<\/a>
\n[2] HIDDEN COBRA b\u0000\u0013 Jonap Backdoor Trojan and Brambul SMB worm B https:\/\/www.us-cert.gov\/ncas\/alerts\/TA18-149A<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"