www.crowdstrike.com
Open in
urlscan Pro
104.16.180.118
Public Scan
URL:
https://www.crowdstrike.com/blog/threat-actor-distributes-python-based-information-stealer/
Submission: On August 27 via api from IT — Scanned from IT
Submission: On August 27 via api from IT — Scanned from IT
Form analysis
0 forms found in the DOMText Content
Skip to main contentEnable accessibility for low visionOpen the accessibility menu x * Root Cause Analysis Read now * * * * * * BLOG * Featured * Remediation and Guidance Hub: Channel File 291 Incident Jul 19, 2024 * Tech Analysis: CrowdStrike’s Kernel Access and Security Architecture Aug 09, 2024 * Channel File 291 Incident: Root Cause Analysis is Available Aug 06, 2024 * Tech Analysis: Addressing Claims About Falcon Sensor Vulnerability Aug 07, 2024 * Recent * Our 6 Key Takeaways from the 2024 Gartner® Market Guide for Cloud-Native Application Protection Platforms Aug 19, 2024 * August 2024 Patch Tuesday: Six Zero-Days and Six Critical Vulnerabilities Amid 85 CVEs Aug 14, 2024 * Tech Analysis: CrowdStrike’s Kernel Access and Security Architecture Aug 09, 2024 * Tech Analysis: Addressing Claims About Falcon Sensor Vulnerability Aug 07, 2024 * Videos * Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019 * Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VIDEO] Feb 21, 2019 * Analyzing Targeted Intrusions Through the ATT&CK Framework Lens [VIDEO] Jan 23, 2019 * Qatar’s Commercial Bank Chooses CrowdStrike Falcon®: A Partnership Based on Trust [VIDEO] Aug 20, 2018 * Categories * Cloud and Application Security Cloud and Application Security Our 6 Key Takeaways from the 2024 Gartner® Market Guide for Cloud-Native Application Protection Platforms 08/19/2024 Essential Considerations When Choosing a DSPM Solution 07/10/2024 Proactively Secure Serverless Functions Across AWS, Google Cloud and Azure with Falcon Cloud Security 07/08/2024 Falcon Cloud Security Supports Google Cloud Run to Strengthen Serverless Application Security 06/26/2024 * Counter Adversary Operations Counter Adversary Operations Malicious Inauthentic Falcon Crash Reporter Installer Delivers LLVM-Based Mythic C2 Agent Named Ciro 07/30/2024 Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity via Spearphishing Website 07/25/2024 Hacktivist Entity USDoD Claims to Have Leaked CrowdStrike’s Threat Actor List 07/25/2024 Lumma Stealer Packed with CypherIt Distributed Using Falcon Sensor Update Phishing Lure 07/24/2024 * Endpoint Security & XDR Endpoint Security & XDR CrowdStrike Named a Customers’ Choice in 2024 Gartner® Voice of the Customer for Endpoint Protection Platform Report 07/11/2024 3 Ways Small Businesses Can Make Big Strides in Cybersecurity 06/14/2024 CrowdStrike Falcon for Mobile Unlocks New Mobile Security Options for SMBs 06/13/2024 Retailer Compares Microsoft with CrowdStrike for Security. The Verdict? “It’s Not Even Close” 06/05/2024 * Engineering & Tech Engineering & Tech Tech Analysis: Channel File May Contain Null Bytes 07/24/2024 EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysis 06/06/2024 CrowdStrike Falcon Next-Gen SIEM Unveils Advanced Detection of Ransomware Targeting VMware ESXi Environments 04/15/2024 CrowdStrike’s Advanced Memory Scanning Stops Threat Actor Using BRc4 at Telecommunications Customer 09/27/2023 * Executive Viewpoint Executive Viewpoint Tech Analysis: CrowdStrike’s Kernel Access and Security Architecture 08/09/2024 Tech Analysis: Addressing Claims About Falcon Sensor Vulnerability 08/07/2024 Channel File 291 Incident: Root Cause Analysis is Available 08/06/2024 Preliminary Post Incident Review (PIR): Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System (BSOD) 07/24/2024 * Exposure Management Exposure Management August 2024 Patch Tuesday: Six Zero-Days and Six Critical Vulnerabilities Amid 85 CVEs 08/14/2024 July 2024 Patch Tuesday: Two Zero-Days and Five Critical Vulnerabilities Amid 142 CVEs 07/10/2024 Seeing the Unseen: Preventing Breaches by Spotting Malicious Browser Extensions 06/27/2024 June 2024 Patch Tuesday: 51 Vulnerabilities Addressed Including One Critical and One Zero-Day 06/11/2024 * From The Front Lines From The Front Lines CrowdStrike Named a Leader with “Bold Vision” in 2024 Forrester Wave for Cybersecurity Incident Response Services 06/10/2024 How to Defend Employees and Data as Social Engineering Evolves 03/22/2024 The Anatomy of an ALPHA SPIDER Ransomware Attack 02/29/2024 CrowdStrike Services Offers Incident Response Executive Preparation Checklist 10/23/2023 * Identity Protection Identity Protection CrowdStrike Brings Industry-Leading ITDR to All Major Cloud-Based Identity Providers 05/28/2024 CrowdStrike Named Overall Leader in Industry’s First ITDR Comparative Report 04/30/2024 CrowdStrike Extends Identity Security Capabilities to Stop Attacks in the Cloud 04/10/2024 Falcon Fund in Focus: Aembit Strengthens Security for Workload-to-Workload Access 01/30/2024 * Next-Gen SIEM & Log Management Next-Gen SIEM & Log Management CrowdStrike Simplifies Ingestion of High-Value Data into the Falcon Platform 07/08/2024 Stop Phishing Attacks with Next-Gen SIEM and SOAR 06/24/2024 Unlock Advanced Security Automation for Next-Gen SIEM 06/20/2024 Meeting the Need for Speed in the SOC 06/17/2024 * Public Sector Public Sector Achieving Ecosystem-level Cybersecurity: A U.S. Policy Perspective 06/11/2024 CrowdStrike Launches SEC Readiness Services to Prepare Boardrooms for New Regulations 03/14/2024 Montage Health Consolidates Its Cybersecurity Strategy with CrowdStrike 03/04/2024 After Years of Success, State of Wyoming Looks to Expand CrowdStrike Protections Statewide 02/28/2024 * Start Free Trial * Cloud and Application Security Cloud and Application Security Our 6 Key Takeaways from the 2024 Gartner® Market Guide for Cloud-Native Application Protection Platforms 08/19/2024 Essential Considerations When Choosing a DSPM Solution 07/10/2024 Proactively Secure Serverless Functions Across AWS, Google Cloud and Azure with Falcon Cloud Security 07/08/2024 Falcon Cloud Security Supports Google Cloud Run to Strengthen Serverless Application Security 06/26/2024 * Counter Adversary Operations Counter Adversary Operations Malicious Inauthentic Falcon Crash Reporter Installer Delivers LLVM-Based Mythic C2 Agent Named Ciro 07/30/2024 Malicious Inauthentic Falcon Crash Reporter Installer Distributed to German Entity via Spearphishing Website 07/25/2024 Hacktivist Entity USDoD Claims to Have Leaked CrowdStrike’s Threat Actor List 07/25/2024 Lumma Stealer Packed with CypherIt Distributed Using Falcon Sensor Update Phishing Lure 07/24/2024 * Endpoint Security & XDR Endpoint Security & XDR CrowdStrike Named a Customers’ Choice in 2024 Gartner® Voice of the Customer for Endpoint Protection Platform Report 07/11/2024 3 Ways Small Businesses Can Make Big Strides in Cybersecurity 06/14/2024 CrowdStrike Falcon for Mobile Unlocks New Mobile Security Options for SMBs 06/13/2024 Retailer Compares Microsoft with CrowdStrike for Security. The Verdict? “It’s Not Even Close” 06/05/2024 * Engineering & Tech Engineering & Tech Tech Analysis: Channel File May Contain Null Bytes 07/24/2024 EMBERSim: A Large-Scale Databank for Boosting Similarity Search in Malware Analysis 06/06/2024 CrowdStrike Falcon Next-Gen SIEM Unveils Advanced Detection of Ransomware Targeting VMware ESXi Environments 04/15/2024 CrowdStrike’s Advanced Memory Scanning Stops Threat Actor Using BRc4 at Telecommunications Customer 09/27/2023 * Executive Viewpoint Executive Viewpoint Tech Analysis: CrowdStrike’s Kernel Access and Security Architecture 08/09/2024 Tech Analysis: Addressing Claims About Falcon Sensor Vulnerability 08/07/2024 Channel File 291 Incident: Root Cause Analysis is Available 08/06/2024 Preliminary Post Incident Review (PIR): Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System (BSOD) 07/24/2024 * Exposure Management Exposure Management August 2024 Patch Tuesday: Six Zero-Days and Six Critical Vulnerabilities Amid 85 CVEs 08/14/2024 July 2024 Patch Tuesday: Two Zero-Days and Five Critical Vulnerabilities Amid 142 CVEs 07/10/2024 Seeing the Unseen: Preventing Breaches by Spotting Malicious Browser Extensions 06/27/2024 June 2024 Patch Tuesday: 51 Vulnerabilities Addressed Including One Critical and One Zero-Day 06/11/2024 * From The Front Lines From The Front Lines CrowdStrike Named a Leader with “Bold Vision” in 2024 Forrester Wave for Cybersecurity Incident Response Services 06/10/2024 How to Defend Employees and Data as Social Engineering Evolves 03/22/2024 The Anatomy of an ALPHA SPIDER Ransomware Attack 02/29/2024 CrowdStrike Services Offers Incident Response Executive Preparation Checklist 10/23/2023 * Identity Protection Identity Protection CrowdStrike Brings Industry-Leading ITDR to All Major Cloud-Based Identity Providers 05/28/2024 CrowdStrike Named Overall Leader in Industry’s First ITDR Comparative Report 04/30/2024 CrowdStrike Extends Identity Security Capabilities to Stop Attacks in the Cloud 04/10/2024 Falcon Fund in Focus: Aembit Strengthens Security for Workload-to-Workload Access 01/30/2024 * Next-Gen SIEM & Log Management Next-Gen SIEM & Log Management CrowdStrike Simplifies Ingestion of High-Value Data into the Falcon Platform 07/08/2024 Stop Phishing Attacks with Next-Gen SIEM and SOAR 06/24/2024 Unlock Advanced Security Automation for Next-Gen SIEM 06/20/2024 Meeting the Need for Speed in the SOC 06/17/2024 * Public Sector Public Sector Achieving Ecosystem-level Cybersecurity: A U.S. Policy Perspective 06/11/2024 CrowdStrike Launches SEC Readiness Services to Prepare Boardrooms for New Regulations 03/14/2024 Montage Health Consolidates Its Cybersecurity Strategy with CrowdStrike 03/04/2024 After Years of Success, State of Wyoming Looks to Expand CrowdStrike Protections Statewide 02/28/2024 * Featured * Recent * Videos * Categories * Start Free Trial THREAT ACTOR DISTRIBUTES PYTHON-BASED INFORMATION STEALER USING A FAKE FALCON SENSOR UPDATE LURE July 23, 2024 |Counter Adversary Operations |Counter Adversary Operations SUMMARY On July 23, 2024, CrowdStrike Intelligence identified a malicious ZIP file containing a Python-based information stealer now tracked as Connecio. A threat actor distributed this file days after the July 19, 2024, single content update for CrowdStrike’s Falcon sensor — which impacted Windows operating systems — was identified and a fix was deployed. The ZIP file uses the filename CrowdStrike Falcon.zip in an attempt to masquerade as a Falcon update. CrowdStrike Intelligence does not currently attribute the analyzed activity to any named adversary. TECHNICAL ANALYSIS Technical analysis is based on the ZIP archive (SHA256 hash: 5ba542fcfa45d50c0d65dda4dbbd7a28f737a2fc53841ddaab7f68ae1cdf5183) that was uploaded to a public malware repository on 2024-07-23 12:09 UTC with the filename CrowdStrike Falcon.zip. This archive contains the files shown in Table 1. Filename SHA256 Hash Readme.txt 56cbd8ce60f18d4cececfa703a92c0188dd81ed97b4de12e3f120d7ce736225a CrowdStrike Falcon.exe 21653e267a6c7e4f10064ad2489dba54e04612cc7ce4043b8c8dcaf8b39210d6 Table 1. Archive CrowdStrike Falcon.zip content The file CrowdStrike Falcon.exe is a self-extracting RAR (SFX) that contains and executes a Python-compiled executable; this executable contains the Connecio information stealer. The text file Readme.txt contains instructions for potential victims to disable Windows Defender and execute the malicious executable present in the archive (Figure 1). Figure 1. Readme.txt content Upon execution, the malicious file CrowdStrike Falcon.exe unpacks and invokes an information stealer written in the Python programming language that collects system information, the system’s external IP address (by making an HTTP GET request to the URL http[:]//ipinfo[.]io/[]?token=7fb82f5925fe8b), and data from multiple web browsers. Then, the information stealer resolves its command-and-control (C2) servers by making HTTP GET requests to the Pastebin dead-drop URLs shown in Table 2. Pastebin Dead-Drop URL Description https[:]//pastebin[.]com/FHfj1fYD C2 server configuration https[:]//pastebin[.]com/HeVWATy1 Simple Mail Transfer Protocol (SMTP) accounts to exfiltrate collected information via email https[:]//pastebin[.]com/2diVWcDQ List of cryptocurrency address patterns and potential replacements; the addresses are likely used for clipboard-hijacking cryptocurrency theft, as they match cryptocurrency addresses and the malware uses the Python library pyperclip to control the clipboard1 1 https[:]//pypi[.]org/project/pyperclip/ Table 2. Pastebin dead-drop URLs RECOMMENDATIONS These recommendations can be implemented to help protect against the activity described in this report. * Only accept updates delivered through CrowdStrike official channels and adhere to CrowdStrike support teams’ technical guidance * Train users to avoid executing files from untrusted sources * Check website certificates on the download page to ensure downloaded software originates from a legitimate source * Use browser settings to enable download protection that can issue warnings regarding potentially harmful websites or downloads * Block SMTP network connections to unknown servers when not required within the organization * Block Pastebin web access when not required within the organization APPENDIX YARA RULE This YARA rule detects common strings for the Connecio information stealer. rule CrowdStrike_CSA_240846_01 : connecio python stealer { meta: copyright = "(c) 2024 CrowdStrike Inc." description = "Common strings for Connecio Python stealer" reports = "CSA-240846" version = "202407231719" last_modified = "2024-07-23" malware_family = "Connecio" strings: $ = "C0nn3c+10nz" $ = "?token=" $ = "ACCOUNT(S) INFO COOKIE" $ = "Firefox.get_password" $ = "Brave.get_password" $ = "Chrome.get_password" $ = "MACHINE : " condition: 5 of them } FALCON LOGSCALE QUERIES This Falcon LogScale query detects the activity described in this report. // Indicators related to CSA-240846 case { in("SHA256HashData", values=["21653e267a6c7e4f10064ad2489dba54e04612cc7ce4043b8c8dcaf8b39210d6", "56cbd8ce60f18d4cececfa703a92c0188dd81ed97b4de12e3f120d7ce736225a", "5ba542fcfa45d50c0d65dda4dbbd7a28f737a2fc53841ddaab7f68ae1cdf5183", "d7c1be2d0b7d2714ff710676d228ac751c4eba280309e1241a9f7e441299a177"]); in("DomainName", values=["dshu.xyz", "klaxusonline.com", "mail.dshu.xyz", "theprofits.online", "web3versecoin.com", "xryptbx.com"]); in("RemoteAddressIP4", values=["139.99.232.135", "185.255.114.110", "185.255.114.63"]) } | table([cid, aid, #event_simpleName, ComputerName]) INDICATORS OF COMPROMISE (IOCS) This table details the IOCs related to the information provided in this report. Description Value C2 IP addresses 139.99.232[.]135:80 185.255.114[.]110:80185.255.114[.]63:80 SMTP exfiltration-sender accounts send@dshu[.]xyz logs@web3versecoin[.]com logsmaster@xryptbx[.]com SMTP exfiltration-recipient accounts logs@theprofits[.]online info2024@klaxusonline[.]com frank@dshu[.]xyz 6000@xryptbx[.]com SMTP exfiltration hosts mail.dshu[.]xyz:465 web3versecoin[.]com:465 xryptbx[.]com:465 Table 3. IOCs MITRE ATT&CK This table details the MITRE ATT&CK® tactics and techniques described in this report. Tactic Technique Observable Execution T1059.006 – Command and Scripting Interpreter: Python Connecio is written in the Python programming language T1204.002 – User Execution: Malicious File Connecio lures the user into executing the malware executable Command and Control T1102.001 – Web Service: Dead Drop Resolver Connecio uses Pastebin dead-drop URLs to resolve its C2 infrastructure Exfiltration T1048 – Exfiltration Over Alternative Protocol Connecio exfiltrates information over SMTP Table 4. Described Connecio activity MITRE ATT&CK mapping CRYPTOCURRENCY ADDRESSES The following table includes cryptocurrency addresses obtained from the dead-drop configuration URL. Address 0x2DCC92C27C4429B506588012CaC53764780f3e3D 0x6c5E3Ea51B382C49839417dAF3c84E3dA603D12f 0xd23896016eC1Ef2D25Fb8899a4a3a38e0a92F9c1 13KadCbGWS4rzXiAyc7HHW2HDopN59hKa6 17tVNxknYnnkrvY3vN4Tw23fXQdSmn7CDU 1Q4V4c1d6Vmr1Bf9BWejixnF8XnfdY6m4s bc1qfwx6sase663vranpr7mkf485ypz3nzvtl0xtld bc1qlneepetqamw7vmfludvrjgnk7tjprzlcy5e293 bc1qr9euay9qsfwsgh2edeqfk0rpw90c9zl9f69kfk bnb10nf3fc0xtfm6f7xfy6vjejnyq88ha7gjc8hx62 bnb130y4jppcnh2vmwc6u4kkktehswldmrk43l7nah bnb1xg0dn3lj6ggekxptv4mg7u89uqqu73ezpxkhup CrnP9VWgegWAFgKYHqsrLhxoWwBykAaHQDkz7A8njtMj DMqCf1f3wCHncDdbHmNZa2AFwyVYDeVSRL DMX3TTkhnDvB7nbhG3jn85U1bHedVsfgJs Fep17BczJDfVeSHytKmCS1n2MBM5j6BVdVEkcN5H1eXJ LcxgZpuNmbji8WfWrEpWHKDA41wGcRxJFe LLGtBdhMb7DABq9Q1yDEGUXAvtn4CyPGh7 ltc1qg9k9ren5rmu65l9jy69lt7tqrl60s7u8e6gv9m qz0zv0l5gqz5f69l8ezpwu8mpfhzv8lwruz5dh2h7p qz9zwucyjf8jw7yhr3dm85ejslaesrrp9y3qh6x2h9 qzanj5umvjs3h6fjplzxh68lnm3hzl7djq9aky0xwn t1KikBNAhHPWBTvDmzzcoUMJ8CKxo8dm2hF TAZnA51ca5P2hpcjUwY6eqYvDL9fGzad3M TFhAp8GYQiyYk3xGgDXoNDokDzKZnMoUuT XiDCvcyAnTKEr6vQn7rjwpjH6tiwhEPPA5 XkarQqC1GGjuF8eQEhWeBifFTz4UyLG7z3 Xy4yi1Qr7UgEh4hSi8dLv7iANecm11MDGM Table 5. Connecio-related cryptocurrency addresses ADDITIONAL RESOURCES Read other blog posts from CrowdStrike Intelligence regarding the Falcon content issue: * Falcon Sensor Content Issue from July 19, 2024, Likely Used to Target CrowdStrike Customers * Likely eCrime Actor Uses Filenames Capitalizing on July 19, 2024, Falcon Sensor Content Issues in Operation Targeting LATAM-Based CrowdStrike Customers * Threat Actor Uses Fake CrowdStrike Recovery Manual to Deliver Unidentified Stealer * Tweet * Share RELATED CONTENT HACKTIVIST ENTITY USDOD CLAIMS TO HAVE LEAKED CROWDSTRIKE’S THREAT ACTOR LIST LUMMA STEALER PACKED WITH CYPHERIT DISTRIBUTED USING FALCON SENSOR UPDATE PHISHING LURE THREAT ACTOR USES FAKE CROWDSTRIKE RECOVERY MANUAL TO DELIVER UNIDENTIFIED STEALER Categories * Cloud and Application Security 96 * Counter Adversary Operations 181 * Endpoint Security & XDR 303 * Engineering & Tech 78 * Executive Viewpoint 159 * Exposure Management 81 * From The Front Lines 189 * Identity Protection 34 * Next-Gen SIEM & Log Management 84 * Public Sector 36 CONNECT WITH US FEATURED ARTICLES Installing Falcon Sensor for Linux agosto 27, 2024 Our 6 Key Takeaways from the 2024 Gartner® Market Guide for Cloud-Native Application Protection Platforms agosto 19, 2024 August 2024 Patch Tuesday: Six Zero-Days and Six Critical Vulnerabilities Amid 85 CVEs agosto 14, 2024 Tech Analysis: CrowdStrike’s Kernel Access and Security Architecture agosto 9, 2024 SUBSCRIBE Sign up now to receive the latest notifications and updates from CrowdStrike. Sign Up SEE CROWDSTRIKE FALCON® IN ACTION Detect, prevent, and respond to attacks— even malware-free intrusions—at any stage, with next-generation endpoint protection. See Demo Threat Actor Uses Fake CrowdStrike Recovery Manual to Deliver Unidentified Stealer Preliminary Post Incident Review (PIR): Content Configuration Update Impacting the Falcon Sensor and the Windows Operating System (BSOD) * * * * * Copyright © 2024 CrowdStrike * Privacy * Request Info * Blog * Contact Us * 1.888.512.8906 * Accessibility ABOUT COOKIES ON THIS SITE By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. Cookie Notice Cookie Settings Reject All Accept All Cookies COOKIE PREFERENCE CENTER * YOUR PRIVACY * STRICTLY NECESSARY COOKIES * FUNCTIONAL COOKIES * PERFORMANCE COOKIES * TARGETING COOKIES YOUR PRIVACY When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information. STRICTLY NECESSARY COOKIES Always Active These cookies are necessary for the website to function and cannot be switched off in our systems. This includes diagnostic functions such as identifying 404 errors and monitoring page load speed. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details FUNCTIONAL COOKIES Functional Cookies These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Cookies Details PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collet is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button COOKIE LIST Filter Button Consent Leg.Interest checkbox label label checkbox label label checkbox label label Clear checkbox label label Apply Cancel Confirm My Choices Allow All