blog.sonicwall.com Open in urlscan Pro
107.154.76.50  Public Scan

Form analysis
1 forms found in the DOM

GET https://blog.sonicwall.com/en-us/

<form action="https://blog.sonicwall.com/en-us/" id="searchform" method="get" class="">
  <div>
    <input type="submit" value="" id="searchsubmit" class="button avia-font-entypo-fontello">
    <input type="text" id="s" name="s" value="" placeholder="Search">
  </div>
</form>

Text Content

 * Home
 * Topics
   * All Posts
   * Boundless Cybersecurity
   * BYOD and Mobile Security
   * Cloud Security
   * Education
   * Email Security
   * Government
   * Healthcare
   * Industry News and Events
   * Network Security
   * Partners
   * Retail
   * Small & Medium Businesses
   * SonicWall Community
   * Threat intelligence
   * Wireless Security
 * Authors
 * English
 * Search
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * 
 * Menu

 * Facebook
 * Twitter
 * Linkedin
 * Instagram
 * Mail
 * Rss




COREWARRIOR SPREADER MALWARE SURGE




By Security News
October 11, 2024

OVERVIEW

This week, the SonicWall Capture Labs threat research team investigated a sample
of CoreWarrior malware. This is a persistent trojan that attempts to spread
rapidly by creating dozens of copies of itself and reaching out to multiple IP
addresses, opening multiple sockets for backdoor access, and hooking Windows UI
elements for monitoring.

INFECTION CYCLE

The malware is a UPX-packed executable that has been manually tampered with and
will not unpack using the standard UPX unpacker.





Figures 1 (top), 2(bottom): Initial detection, and failure due to checksum error

On runtime, the executable creates a copy of itself with a randomly generated
name. The copy will launch a command prompt and use curl to POST data to
“http://wecan.hasthe(dot)technology/upload”. With each subsequent POST that is
completed, the parent program will delete the existing copy and create a new
copy. During testing, one hundred and seventeen copies were created and deleted
in under ten minutes.



Figure 3: Malware is connecting to site and posting data

As messages are being sent, the program will then bind a listener on ports
49730-49777 and 50334-50679. A secondary IP address of 172.67.183.40 had a
single connection made, but no TCP/UDP traffic was sent.



Figure 4: Multi-part output of data sent

The parent process will obtain information on the system drives, as well as
create a hook for the command prompt window to monitor for changes. The malware
has several types of anti-analysis capabilities, including:

 * Anti-debug using rdtsc to check debug times; program will exit if times
   exceed threshold
 * Evasion using a randomized sleep timer that changes per number of connection
   attempts/successes/failures (Figure 4)
 * VM environment detection, as there are strings to check for HyperV containers



Figure 5: Variables used in sleep determinations

Other protocols referenced by the code include FTP, SMTP, and POP3 for data
exfiltration.

SONICWALL PROTECTIONS

To ensure SonicWall customers are prepared for any exploitation that may occur
due to this malware, the following signatures have been released:

 * CoreWarrior.A

IOCS

85A6E921E4D5107D13C1EB8647B130A1D54BA2B6409118BE7945FD71C6C8235F (packed)

8C97329CF7E48BB1464AC5132B6A02488B5F0358752B71E3135D9D0E4501B48D (unpacked)

 * 
 * 
 * 
 * 
 * 

Security News

The SonicWall Capture Labs Threat Research Team gathers, analyzes and vets
cross-vector threat information from the SonicWall Capture Threat network,
consisting of global devices and resources, including more than 1 million
security sensors in nearly 200 countries and territories. The research team
identifies, analyzes, and mitigates critical vulnerabilities and malware daily
through in-depth research, which drives protection for all SonicWall customers.
In addition to safeguarding networks globally, the research team supports the
larger threat intelligence community by releasing weekly deep technical analyses
of the most critical threats to small businesses, providing critical knowledge
that defenders need to protect their networks.
Categories: Threat intelligence
Tags: Security News

SHARE THIS ENTRY

 * Share on Facebook
 * Share on Twitter
 * Share on Google+
 * Share on Pinterest
 * Share on Linkedin
 * Share on Tumblr
 * Share on Vk
 * Share on Reddit
 * Share by Mail



https://d3ik27cqx8s5ub.cloudfront.net/blog/media/uploads/sec-news-header-3.png
500 1200 Security News
https://blog.sonicwall.com/wp-content/uploads/images/logo/SonicWall_Registered-Small.png
Security News2024-10-11 13:01:582024-10-11 13:02:45CoreWarrior Spreader Malware
Surge


RECOMMENDED CYBER SECURITY STORIES

Microsoft Security Bulletins Coverage (Aug 10, 2010)
Microsoft Word Remote Code Execution Vulnerability (CVE-2015-0097) (Nov 25,2015)
Microsoft Security Bulletin Coverage for March 2023
Tyupkin: Malware which is designed for ATM infrastructure.
HydraCrypt Ransomware Targets Brazil and Charges $5,000 for Decryption
Yet another Delphi Infostealer Trojan (April 12, 2013)
Microsoft SharePoint server flaw CVE-2019-0604 actively being exploited in the
wild
Ivanti Authentication Bypass Vulnerability
Connect with an Expert


SEARCH




FACEBOOK


Recent
Tags
Recent
 * National Cybersecurity Awareness Month: Turn On Your MF...October 15, 2024 -
   10:00 am
 * HORUS Protector Part 2: The New Malware Distribution Se...October 14, 2024 -
   10:43 am
 * CoreWarrior Spreader Malware SurgeOctober 11, 2024 - 1:01 pm
 * Microsoft Security Bulletin Coverage for October 2024October 9, 2024 - 10:07
   am

Tags
802.11AC Advanced Threats Antivirus Awards Capture Cloud Platform Channel Cloud
App Security CRN Cyberattack Cyber Security Cybersecurity cyberthreats DDoS
Education Email Security Encrypted Attacks Encrypted Threats Endpoint Protection
endpoint security Firewall Industry Awards IoT Malware MSSP Network Security
news Next-Gen Firewalls next generation firewalls Phishing Ransomware Real-Time
Deep Memory Inspection (RTDMI) Resources Resources RSA Conference SecureFirst
Partner Program Secure Mobile Access Security Security News SMB SonicWall
Capture ATP SonicWall Capture Client SonicWall WiFi Cloud Manager Threat
Intelligence Threat Report zero-day


ABOUT SONICWALL

About Us
Leadership
Awards
News
Press Kit
Careers
Contact Us


PRODUCTS

Firewalls
Advanced Threat Protection
Remote Access
Email Security


SOLUTIONS

Advanced Threats
Risk Management
Industries
Managed Security
Use Cases
Partner Enabled Services


CUSTOMERS

How To Buy
MySonicWall.com
Loyalty & Trade-In Programs


SUPPORT

Knowledge Base
Video Tutorials
Technical Documentation
Partner Enabled Services
Support Services
CSSA and CSSP Certification Training
Contact Support
Community

© Copyright 2023 SonicWall. All Rights Reserved.
 * Facebook
 * Twitter
 * Linkedin
 * Instagram
 * Mail
 * Rss

Microsoft Security Bulletin Coverage for October 2024 HORUS Protector Part 2:
The New Malware Distribution Service




PIN IT ON PINTEREST


Scroll to top