SentinelOne Agrius 2021

IPsec Helper can identify specific files and folders for follow-on exfiltration.

Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.

DEADWOOD contains an embedded, AES-encrypted payload labeled METADATA that provides configuration information for follow-on execution.

DEADWOOD contains an embedded, AES-encrypted resource named METADATA that contains configuration information for follow-on execution.

IPsec Helper contains an embedded XML configuration file with an encrypted list of command and control servers. These are written to an external configuration file during execution.

DEADWOOD will attempt to masquerade its service execution using benign-looking names such as ScDeviceEnums.

IPsec Helper exfiltrates specific files through its command and control framework.

Apostle achieves persistence by creating a scheduled task, such as MicrosoftCrashHandlerUAC.

IPsec Helper can identify the process it is currently running under and its number, and pass this back to a command and control node.

Apostle retrieves a list of all running processes on a victim host, and stops all services containing the string "sql," likely to propagate ransomware activity to database files.

IPsec Helper can run arbitrary PowerShell commands passed to it.

Agrius uses ASPXSpy web shells to enable follow-on command execution via cmd.exe.

IPsec Helper can run arbitrary commands passed to it through cmd.exe.

IPsec Helper can run arbitrary Visual Basic scripts and commands passed to it.

IPsec Helper can delete various registry keys related to its execution and use.

Apostle writes batch scripts to disk, such as system.bat and remover.bat, that perform various anti-analysis and anti-forensic tasks, before finally deleting themselves at the end of execution. Apostle attempts to delete itself after encryption or wiping operations are complete and before shutting down the victim machine.

IPsec Helper can delete itself when given the appropriate command.

IPsec Helper can delete various service traces related to persistent execution when commanded.

IPsec Helper connects to command and control servers via HTTP POST requests based on parameters hard-coded into the malware.

IPsec Helper can make arbitrary changes to registry keys based on provided input.

DEADWOOD will set a timestamp value to determine when wiping functionality starts. When the timestamp is met on the system, a trigger file is created on the operating system allowing for execution to proceed. If the timestamp is in the past, the wiper will execute immediately.

DEADWOOD XORs some strings within the binary using the value 0xD5, and deobfuscates these items at runtime.

Apostle compiled code is obfuscated in an unspecified fashion prior to delivery to victims.

Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.

Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.

Apostle's ransomware variant requires that a base64-encoded argument is passed when executed, that is used as the Public Key for subsequent encryption operations. If Apostle is executed without this argument, it automatically runs a self-delete function.

DEADWOOD overwrites files on victim systems with random data to effectively destroy them.

Apostle initially masqueraded as ransomware but actual functionality is a data destruction tool, supported by an internal name linked to an early version, wiper-action. Apostle writes random data to original files after an encrypted copy is created, along with resizing the original file to zero and changing time property metadata before finally deleting the original file.

Apostle creates new, encrypted versions of files then deletes the originals, with the new filenames consisting of a random GUID and ".lock" for an extension.

IPsec Helper will sleep for a random number of seconds, iterating 200 times over sleeps between one to three seconds, before continuing execution flow.

Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.

Apostle reboots the victim machine following wiping and related activity.

DEADWOOD changes the password for local and domain users via net.exe to a random 32 character string to prevent these accounts from logging on. Additionally, DEADWOOD will terminate the winlogon.exe process to prevent attempts to log on to the infected system.

Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.

Apostle searches for files on available drives based on a list of extensions hard-coded into the sample for follow-on wipe activity.

DEADWOOD deletes files following overwriting them with random data.

DEADWOOD opens and writes zeroes to the first 512 bytes of each drive, deleting the MBR. DEADWOOD then sends the control code IOCTL_DISK_DELETE_DRIVE_LAYOUT to ensure the MBR is removed from the drive.

DEADWOOD can be executed as a service using various names, such as ScDeviceEnums.

IPsec Helper is run as a Windows service in victim environments.

IPsec Helper can download additional payloads from command and control nodes and execute them.

Agrius typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.

Apostle will attempt to delete all event logs on a victim machine following file wipe activity.