SombRAT

Malware updated 6 months ago (2024-05-04T23:17:55.758Z)
Download STIX
Preview STIX
Sombrat is a sophisticated malware that poses a significant financial threat, as reported by Mandiant in April 2021. It operates in conjunction with FIVEHANDS Ransomware under the umbrella of UNC2447, a malicious cyber activity group. The malware infects systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside a system, it can steal personal information, disrupt operations, or hold data hostage for ransom. This particular variant of malware is notable for its use of a 64-bit SombRAT loader, identifiable through the WwanSvc.b artifact when decoded. The threat actors behind Sombrat demonstrated advanced techniques to bypass organizational anti-malware programs. They used batch and text files to execute and invoke PowerShell scripts that decoded a SombRAT loader, enabling PowerShell to evade detection. These evasion tactics align with known methods such as Windows Command Shell and PowerShell scripting interpreters, as well as general defense evasion strategies, as outlined in MITRE ATT&CK framework. Sombrat exhibits unique characteristics that distinguish it from other malware types. It uses RSA for C2 encryption, HTTP for C2 communication, and a custom storage file. It also employs specific decryption and string decoding scripts for its payload. The malware is designed to be downloaded via the SombRAT loader, which is detected by code similarity. These features underscore the sophistication of Sombrat, making it a formidable threat to financial institutions and other potential targets.
Description last updated: 2024-05-04T22:29:02.051Z
What's your take? (Question 1 of 1)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Aliases We are not currently tracking any aliases
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Ransomware
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Malware
To see the evidence that has resulted in these malware associations, create a free account
Alias DescriptionAssociation TypeVotes
The FIVEHANDS Malware is associated with SombRAT. FiveHands, also known as HelloKitty, is a sophisticated form of malware that primarily targets financial institutions. It was first reported by Mandiant in April 2021 as part of a cyber threat posed by the UNC2447 group. The ransomware is typically delivered through Encryptor.exe, a loader that initis related to
3
Source Document References
Information about the SombRAT Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more