Malware

PeckBirdy

According to Trend Micro, PeckBirdy is a script-based framework which, while possessing advanced capabilities, is implemented using JScript, an old script language. This is to ensure that the framework could be launched across different execution environments via LOLBins (Living off the land binaries). This flexibility allowed to use PeckBirdy in various kill chain stages, including being used as a watering-hole control server during the initial attack phase, as a reverse shell server during the lateral movement phase, and as a C&C server during the backdoor phase.

Indicators of Compromise 30

Domain evil[.]com Domain fonts[.]chrorne[.]com Domain fonts[.]tarotfree101[.]top Domain microsoft-flash[.]com Domain robot[.]avbliud[.]com Domain wps-cn[.]com Filename Adobe_installer.exe Filename flashcenter_pp_ax_install_en.exe GitHub Repo microsoft-flash/download SHA-256 065d18fcfeddbd718c054f4b21c3cde5b9291db921d01f343d7ac0d4b41f29ce SHA-256 0c39264337a1186b2e765e24073399cbdcba118306614eb411e315887af578bd SHA-256 24d69139cb2d32598f0f4983876f6320485fac134a66ade59cab76b50b4128f7 SHA-256 265c2b36060e4b21c25aa86a8bb22d1db5f806117b484774c75c65b5b38222e0 SHA-256 2ebe36f1322b77264a33fded81cd4b8817f93362945070bf0bb5845dd27c0575 SHA-256 2ed834d92bfefc9d07a9f1a48f986974ae2a29669029f8163a1f6e8706388fcd SHA-256 32af8413cbd38ce8beb257288cb8e6aa2f9b781d56d0f5272bffbcdc22d999f4 SHA-256 356b96c2267c5f2d8c07693643626e090b6389318b4ffa74699fa1732da5a00c SHA-256 3e535d63af8a95221fb517fa1b3e4a0029d3463d8b767443abdff385ee8cb6e9 SHA-256 3e923f11db08413fca8a3a69d33d8896cfd56309e5179e8604d7fb7110428da2 SHA-256 3eab406d841fa22a4b0200c95c1afab068347f835400d5771e8de60aef732016 SHA-256 5711586125909863b91c1b5ff7cf70ef5d35249d67b11d7a23dc864405cddfe2 SHA-256 66e9098551a1c0c74077d6cf55570e5d307a4a5ef0b0f2053e139394e61c442d SHA-256 857429faffe0e0747ce299e86eed063ed781b4e403b917ca7e853e89bedf072c SHA-256 88e8b07bdf294ace0357d35acb7e108c66ba65a2c4ad66351fb8f7806dae0862 SHA-256 898656c33effb51e109c548fc213f157f151a870ea64a4601eda74ae75bd3af6 SHA-256 b33f2e95943e3ff0a72dea1be9fdea03d986bada4def34f6991b3113ec161ad7 SHA-256 b3d8ea89b19a87bf2fdd63127086681059f41d67b6e5f8c939f5636a1b2315ce SHA-256 b6a7be724871ed3e81c986b74d62da8911c82a336c4c1857b35f2446b2d49fda SHA-256 e2b6b1becdbcc340121e163b5afdfc5437a480ca132248ed5c7c309c45ac3dbb SHA-256 f8b86238e179d88a9979b6f97750a39dda1d07b54d634bc1348fdfb0944a3b92

MITRE ATT&CK TTPs 17

Command And Control

Command And Control

Command And Control

Ingress Tool Transfer

Command And Control

Non-Standard Encoding

Command And Control

Browser Session Hijacking

Indirect Command Execution

Defense Evasion

Exploitation for Credential Access

Credential Access

Credentials from Password Stores

Credential Access

Adversary-in-the-Middle

Credential Access

DLL Side-Loading

Path Interception by Search Order Hijacking

Services File Permissions Weakness

Services Registry Permissions Weakness

Source Articles

The XG Files: Falcon C2 Flying Under The (Browser) Radar

Unit 42 identified Falcon (aka XG or Xiàng Gē), a browser-based command and control (C2) framework that compromises victims by injecting malicious JavaScript into webmail portals and government websites. The framework enables attackers to steal session cookies, passwords, emails, and other sensitive data, and to deploy a malicious browser extension for persistent access. Falcon has been used in targeted campaigns against government entities in one Middle Eastern and four Southeast Asian countries, with objectives aligned to strategic intelligence collection. A secondary Rust-based implant named Antino, which uses Microsoft OneDrive for C2, was also deployed in some attacks.

unit42 ·22h ago