SombRAT Malware IOCs

Indicators of Compromise (IoCs):

Indicator

Type

Description

130fa726df5a58e9334cc28dc62e3ebaa0b7c0d637fce1a66daff66ee05a9437

SHA256

SombRAT x86 loader

8062e1582525534b9c52c5d9a38d6b012746484a2714a14febe2d07af02c32d5

SHA256

SombRAT x86 loader

d69764b22d1b68aa9462f1f5f0bf18caebbcff4d592083f80dbce39c64890295

SHA256

SombRAT x86 loader

f6ecdae3ae4769aaafc8a0faab30cb66dab8c9d3fff27764ff208be7a455125c

SHA256

SombRAT x86 loader

561bf3f3db67996ce81d98f1df91bfa28fb5fc8472ed64606ef8427a97fd8cdd

SHA256

SombRAT x86 payload (memory dump)

8323094c43fcd2da44f60b46f043f7ca4ad6a2106b6561598e94008ece46168b

SHA256

SombRAT x86 payload

ee0f4afee2940bbe895c1f1f60b8967291a2662ac9dca9f07d9edf400d34b58a

ee0f4afee2940bbe895c1f1f60b8967291a2662ac9dca9f07d9edf400d34b58a

SHA256

SombRAT x86 payload (UPX)

70d63029c65c21c4681779e1968b88dc6923f92408fe5c7e9ca6cb86d7ba713a

SHA256

SombRAT encoded payload (x64)

79009ee869cec789a3d2735e0a81a546b33e320ee6ae950ba236a9f417ebf763

SHA256

SombRAT decoded payload (x64)

d8189ebdec637fc83276654635343fb422672fc5e3e2818df211fb7c878a3155

SHA256

Payload stager

fa74f70baa15561c28c793b189102149d3fb4f24147adc5efbd8656221c0960b

SHA256

GO-socks5 proxy

c0db3dadf2e270240bb5cad8a652e5e11e3afe41b8ee106d67d47b06f5163261

SHA256

Pcheck proxy

6df8271ae0380737734b2dd6d46d0db3a30ba35d7379710a9fb05d1510495b49

SHA256

Pcheck proxy

7424d6daab8407e85285709dd27b8cce7c633d3d4a39050883ad9d82b85198bf

SHA256

Pscan port scanner

svolcdst.exe

Filename

SombRAT loader

tunnusvcen.exe

Filename

SombRAT loader

C:\Projects\Sombra\_Bin\x64\Release\Sombra.pdb

PDB path

SombRAT x64

C:\Wokrflow\CostaRicto\Release\CostaBricks.pdb

PDB path

SombRAT loader

%HOSTNAME%UI724

Mutex

Run-once mutex

%HOSTNAME%SUI724

Mutex

Run-once mutex

sbibd[.]net

Domain

SombRAT C2

infosportals[.]com

Domain

SombRAT C2

akams[.]in

Domain

SombRAT C2

newspointview[.]com

Domain

SombRAT C2

159.65.31.84

IP

SombRAT hosting place

212.83.61.227

IP

sbibd[.]net

144.217.53.146

IP

sbibd[.]net, akams[.]in, infosportals[.]com

45.89.175.206

IP

akams[.]in

45.138.172.54

IP

newspointview[.]com

212.114.52.98

IP

infosportals[.]com



MITRE ATT&CK:

Tactic

ID

Name

Description

Initial Access

T1078

Valid Accounts

Suspected initial compromise using stolen credentials

Execution

T1106

Execution through API

SombRAT – C2 command

T1053/005

Scheduled Task/Job: Scheduled Task

Used to download SombRAT loader

T1059/001

Command and Scripting Interpreter: PowerShell

Used to load x64 SombRAT

Defence Evasion

T1055

Process Injection

Invoke-ReflectivePEInjection PowerSploit module

T1140

Deobfuscate/Decode Files or Information

SombRAT – Decode strings and custom storage data

Discovery

T1057

Process Discovery

SombRAT – C2 command

T1082

System Information Discovery

SombRAT – C2 command

T1124

System Time Discovery

SombRAT – C2 command

T1046

Network Service Scanning

pscan, nmap

Collection

T1560/003

Archive Collected Data: Archive via Custom Method

SombRAT – Custom storage file

Command and Control

T1572

Protocol Tunneling

SombRAT - DNS tunnelling for C2

T1071/001

Application Layer Protocol: Web Protocols

SombRAT – HTTP for C2

T1573/002

Encrypted Channel: Asymmetric Cryptography

SombRAT – RSA for C2 encryption

T1090/002

Proxy: External Proxy

pcheck HTTP/S proxy, GO SOCKS5 proxy, PuTTY

Exfiltration

T1041

Exfiltration Over C2 Channel

SombRAT



Yara Hunting Rules:

import "pe"
import "hash"

rule costaricto_vm_dropper
{
    meta:
        description = "Rule to detect SombRAT loader by code similarity"
        author = "BlackBerry Threat Hunting and Intelligence Team"

    strings:
        // vm class name
        $classname = "VMBASERUNNER" ascii wide nocase

        // start of vm bytecode
        $vmbytecode = {37C7359438C73594}

        // start of encrypted payload
        $encpayload_1 = {77D2C7AC59B2EB0DF37028AC950971FB}

       // binary string from enc payload (some payloads differ only in the header)
        $encpayload_2 = {06359D29C83125C321C201CF9AE7D1626B8F4281C33617EECE86BD106C628FE593936F00C2C
68E28843BE5374F876840FCD1BFD014D5DEFF4BA8EB6A5FFFB24F932138B04C1BE6D5BD8BB572B8116799AE1C8F0
D5DB774ABA4884B9E706981FC3740B4CD891F8A0EA6900D41B675CFC98A}

        // vm execution loop
        $vmcode_1 = {8B ?? 08 8B ?? 0C 89 ?? 29 ?? C1 ?? 02 39 ?? 74 4E 83 ?? ?? 08 8D ?? ?? 8B ?? ?? 8D ?? 01 89 ?? 8B ?? ?? 66 83 ?? 08 00 75 28 8B ?? ?? 8D ?? 04 5? 5? E8 ?? ?? FF FF 8B ?? ?? 83 ?? 0C 5? 8B ?? 0C 89 ?? 5? FF ?? 14 83 C4 08 8B ?? 8B ?? 08 8B ?? 0C 89 ?? 29 ?? C1 ?? 02 39 ?? 89 ?? 75 B9}

        // vm execution loop (sample from Nov 2019)
        $vmcode_2 = {8B ?? 4? 89 ?? 8B ?? 08 8B ?? 88 33 ?? 66 39 ?? 08 75 19 8D ?? 04 5? 8D ?? 08 E8 ?? ?? 00 00 8B ?? 8D ?? 0C 5? 5? FF ?? 5? 5? 8B ?? 8B ?? 0C 2B ?? 08 C1 ?? 02 3B ?? 75 C7}

    condition:
        uint16(0) == 0x5a4d and filesize < 5MB and filesize > 20KB and any of them
}

rule costaricto_vm_dropper_pdb_path
{
    meta:
        description = "Rule to detect samples with CostaRicto PDB path"
        author = "BlackBerry Threat Hunting and Intelligence Team"
        pdb_string = "C:\\Wokrflow\\CostaRicto\\Release\\CostaBricks.pdb"

    strings:
        $a = "CostaRicto" ascii wide nocase
        $b = "CostaBricks.pdb" ascii wide nocase
        $c1 = "C:\\Wokrflow\\" ascii wide nocase
        $c2 = "Release" ascii wide nocase
        $c3 = ".pdb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and filesize < 5MB and filesize > 20KB and ($a or $b or all of ($c*))
}

rule costaricto_sobmrat_pdb_path
{
    meta:
        description = "Rule to detect samples with SombRAT PDB path"
        author = "BlackBerry Threat Hunting and Intelligence Team"
        pdb_string = "C:\\Projects\\Sombra\\_Bin\\x64\\Release\\Sombra.pdb"
        pdb_string_2 = "c:\\projects\\sombra\\libraries"

    strings:
        $a = "\\Projects\\Sombra\\" ascii wide nocase
        $b = "Sombra.pdb" ascii wide nocase

     condition:
        uint16(0) == 0x5a4d and filesize < 5MB and filesize > 20KB and ($a or $b)
}

rule costaricto_backdoored_blink
{
    meta:
        description = "Rule to detect backdoored Blink application"
        author = "BlackBerry Threat Hunting and Intelligence Team"

    strings:
        $a1 = "Failed to open target application process!"
        $a2 = "Machine architecture mismatch between target application and this application!"
        $a3 = "Failed to create new communication pipe!"
        $b = "Plauger, licensed by Dinkumware, Ltd."

   condition:
     uint16(0) == 0x5a4d and filesize < 5MB and filesize > 50KB and ($b and 1 of ($a*))
}

rule costaricto_rich_header
{
    meta:
        description = "Rule to detect Rich header associated with CostaRicto campaign"
        author = "BlackBerry Threat Hunting and Intelligence Team"

    condition:
        pe.rich_signature.toolid(0xf1, 40116) and
        pe.rich_signature.toolid(0xf3, 40116) and
        pe.rich_signature.toolid(0xf2, 40116) and
        pe.rich_signature.toolid(0x105, 26706) and
        pe.rich_signature.toolid(0x104, 26706) and
        pe.rich_signature.toolid(0x103, 26706) and
        pe.rich_signature.toolid(0x93, 30729) and
        pe.rich_signature.toolid(0x109, 27023) and
        pe.rich_signature.toolid(0xff, 27023) and
        pe.rich_signature.toolid(0x97, 0) and
        pe.rich_signature.toolid(0x102, 27023)
}

rule costaricto_rich_header_august
{
    meta:
        description = "Rule to detect Rich header associated with CostaRicto campaign"
        author = "BlackBerry Threat Hunting and Intelligence Team"

    condition:
        pe.rich_signature.toolid(0xf1, 40116) and
        pe.rich_signature.toolid(0xf2, 40116) and
        pe.rich_signature.toolid(0xf3, 40116) and
        pe.rich_signature.toolid(0x102, 26428) and
        pe.rich_signature.toolid(0x103, 26131) and
        pe.rich_signature.toolid(0x104, 26131) and
        pe.rich_signature.toolid(0x105, 26131) and
        pe.rich_signature.toolid(0x103, 26433) and
        pe.rich_signature.toolid(0x104, 26433) and
        pe.rich_signature.toolid(0x109, 26428) and
        pe.rich_signature.toolid(0x93, 30729) and
        pe.rich_signature.toolid(0xff, 26428)
}

rule costaricto_rich_xor_key
{
    meta:
        description = "Rule to detect Rich header associated with CostaRicto campaign"
        author = "BlackBerry Threat Hunting and Intelligence Team"
    condition:
        // x86 droppers
        pe.rich_signature.key == 0x2e8d923f or
        pe.rich_signature.key == 0x97d94c45 or

        // x86 payload
        pe.rich_signature.key == 0xef257087 or
        pe.rich_signature.key == 0x4f257087 or
        pe.rich_signature.key == 0x1e816e7e or

        // x64 payload
        pe.rich_signature.key == 0xd1e5ae6c or
        pe.rich_signature.key == 0x5df9c60b
}

rule costaricto_sombrat_unpacked
{
    meta:
        description = "Rule to detect unpacked SombRAT backdoor"
        author = "BlackBerry Threat Hunting and Intelligence Team"

    strings:
        // class names
        $a1 = "PEHeadersBackup"
        $a2 = "PeLoaderDummy"
        $a3 = "PeLoaderLocal"
        $a4 = "PeLoaderBaseClass"
        $a5 = "PDTaskman"
        $a6 = "PDMessageParamArray"
        $a7 = "NetworkDriverLayerWebsockets"
        $a8 = "NetworkDriverLayerDNSReader"
        $a9 = "WaitForPluginIOCPFullyClosed"

        // substitution-encrypted strings
        $b1 = "~ydcv{{rs{~|r"           // installedlike
        $b2 = "~yg{vcqxez"              // winplatform
        $b3 = "~yqxezvc~xyvttrgcrs"     // informationaccepted
        $b4 = "xvsqexzdcxevpr"          // loadfromstorage
        $b5 = "xvsqexzzrzxen"           // loadfrommemory
        $b7 = "xgrydcxevpr"             // openstorage
        $b8 = "g{bp~y{xvstxzg{rcr"      // pluginloadcomplete
        $b9 = "g{bp~yby{xvs"            // pluginunload

        // AES-encrypted strings
        $c1 = {44 5B 7F 52 0C 13 52 1A 16 45 4C 75 65 72 60 53}

        // RSA public key
        $d1 = {EF C9 77 B9 A3 8E 48 92 77 C8 E1 E1 0C 46 35 2B}

    condition:
        uint16(0) == 0x5a4d and filesize < 5MB and filesize > 20KB and any of them
}

rule costaricto_pcheck_proxy
{
    meta:
        description = "Rule to detect a custom proxy tool related to the CostaRicto campaign"
        author = "BlackBerry Threat Hunting and Intelligence Team"
    strings:
        $a = "exe.exe host host_port proxy_host proxy_port"
        $b = "Tool jobs done"

    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and filesize > 10KB and ($a or $b)
}

rule costaricto_pscan_port_scanner
{
    meta:
        description = "Rule to detect a custom proxy tool related to the CostaRicto campaign"
        author = "BlackBerry Threat Hunting and Intelligence Team"
    strings:
        $a1 = "Invalid arguments count (ver "
        $a2 = "Example: ./pscan"
        $a3 = "127-130.0.0.1"
        $b1 = "[output.txt]"
        $b2 = "Invalid ip address range"

    condition:
        uint16(0) == 0x5a4d and filesize < 500KB and filesize > 10KB and any of ($a*) or all of ($b*)
}