#Hex edit file system indicators 05 android
#Hex edit file system indicators 05 download
#Hex edit file system indicators 05 windows

The document does not contain readable content on the topic the filename suggests, only a white rectangle image and unicode characters, which should alert victims that it is not a legitimate document. Ltd” respectively and BNS Bijoy is the name of a “Castle-class guided missile corvette” (small warship) of the Bangladesh Navy ( Wikipedia). The abbreviations csoc and cstc likely stand for “China Shipbuilding & Offshore International Co.

The filename of the document reads “Repair of different csoc cstc, china supplied system – BNS BIJOY.xls”. The sample was previously mentioned by Simon Kenin (k3yp0d) on Twitter. As with previous campaigns conducted by Bitter the file was likely distributed via a spearphishing email, which is not available for Analysis. The sample of the malicious Excel document ( 1bf615946ad9ea7b5a282a8529641bf6) was obtained through the public Any.Run Sandbox service. In addition to many analysis steps that match our approach, it was also demonstrated how the ZxxZ Downloader could be used with a custom C2 server. On the 4th of July released a report about a Bitter campaign targeting Pakistan. They also mentioned the RAT sample analyzed in this blog post. Shortly before the completion of this report the Qi Anxin Threat Intellingence Center published a report on recent Bitter activities targeting military branches of Bangladesh. This report builds on the findings published by Talos and covers an attack presumabily conducted in mid May 2022. In May 2022 Cisco Talos shared an Analysis of a new Bitter campaign targeting users in Bangladesh starting in October 2021 up to February 2022 with a new-ish second stage downloader called “ZxxZ”.

#Hex edit file system indicators 05 windows

Also Chinese and Saudi Arabian organizations were added to the list of targets.Īs discovered by Cyble and Kaspersky in 2021 the Bitter group is also capable of more than just old Office exploits, for example abusing 0-day vulnerabilities like a Windows Kernel vulnerability (CVE-2021-1732) and a vulnerability in the Windows Desktop Window Manager (CVE-2021-28310) for privilege escalation. In Februray of 2019 Palo Alto Networks documented Bitter attacks using a second stage Downloader dubbed “ArtraDownloader” which has been in use since 2017.

#Hex edit file system indicators 05 android

Occasionally they also target Android devices with Remote Access Trojans, as reported by BitDefender in 2020.

#Hex edit file system indicators 05 download

CVE-2012-0158) and download additional malware, so compared to their attacks today their modus operandi has not changed at all. Even back then the group was using spearphishing emails to exploit Microsoft Office (e.g. The threat group is suspected to be located in southern Asia. The Bitter APT group is said to be active since at least 2013 was first reported about by Forcepoint Labs in 2016 when it was primarily targeting Pakistan. We analyzed one of the newer utilized RATs, which we refer to as “Almond RAT”.

Keyloggers, Stealers or Remote Access Trojans (RATs).

The third stage of a Bitter attack can feature different types of Malware e.g.

The second stage consists of a Loader, which gathers information about the infected system and retrieves the third stage from a remote server.

Bitter employs malicious document files as lures containing different implementations of the so-called “Equation Editor exploits” to download following malware stages.

The SECUINFRA Falcon Team identified a recent attack consitent with the campaign targeting Bangladesh conducted by the advanced persistent threat group “Bitter”, also known as T-APT-17.

Hosting Infrastructure / Network Indicators.