• Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Advisory – CVE-2020-25776 – Trend Micro Antivirus for Mac privilege escalation
October 5, 2020
Rewterz Threat Alert – Chinese Hacker Group Spotted Using a UEFI Bootkit in the Wild
October 6, 2020

Rewterz Threat Alert – Black-T; New Cryptojacking Variant from TeamTnT

October 6, 2020

Severity

Medium

Analysis Summary

Black-T Malware, a new cryptojacking variant from TeamTnT, favors targeting AWS credential files. TeamTnT is a cloud-focused cryptojacking group that often targets AWS credential files on compromised cloud systems to mine for Monero. By September, TeamTnT was able to gain full remote takeover of cloud instances. The researchers found that Black-T includes features not found in the group’s earlier malware, including “targeting and stopping of previously unknown cryptojacking worms – the Crux worm, ntpd miner and a redis-backup miner,”.
Black-T also features memory password scraping using mimipy and mimipenguins, which are *NIX equivalents to the commonly used Windows-specific memory password scraper functionality of Mimikatz. Mimikatz is a tool capable of scraping plaintext passwords from Windows OS systems, and also has the capability to perform pass-the-hash and pass-the-token operations, allowing attackers to hijack user sessions. Any identified passwords which were obtained through mimipenguins are then exfiltrated to a TeamTnT command and control (C2) node. This is the first time TeamTnT actors have been witnessed including this type of post-exploitation operation in their TTPs. The Black-T tool also has the capability to use three different network scanning tools to identify additional exposed Docker daemon APIs, within the local network of the compromised system and across any number of publicly accessible networks, to extend their cryptojacking operations. 

Impact

  • Credential Theft
  • Remote Takeover
  • Unauthorized Access
  • Session hijacking

Indicators of Compromise

MD5

  • 8007d1507587af220ebaa4fbf4311a72
  • df386df8c8a376686f788ceff1216f11
  • 48858971bb4f5bcd6a972cbdaabfe9ea
  • 8ffdba0c9708f153237aabb7d386d083
  • 492ffed6e5cdc872f00a3f8b7cd3e512
  • 8ffdba0c9708f153237aabb7d386d083
  • 1238baab2e029d86f29fa1e67671a95c
  • 3acc4bb5971c31c7544378a448fa8ff0
  • 75363103bb838ca8e975d318977c06eb
  • a315439d6c1a769f7f751b1744a2a075
  • b0dc91d2591c46944976697b3c5b002e
  • cdc433224a594395f16fcd637050bff7

SHA-256

  • a5dd446b2a7b8cfd6b6fd4047cc2fddfcea3a4865d8069dcd661e422046de2a1
  • a506c6cf25de202e6b2bf60fe0236911a6ff8aa33f12a78edad9165ab0851caf
  • a5e6b084cdabe9a4557b5ff8b2313db6c3bb4ba424d107474024030115eeaa0f
  • 139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375
  • 9f8cb3f25a8b321b86ee52c16b03b3118f3b157b33e29899d265da3433a02c79
  • 139f393594aabb20543543bd7d3192422b886f58e04a910637b41f14d0cad375
  • 5b417032a80ddf4d9132a3d7d97027eeb08d9b94b89f5128863930c1967c84c4
  • fae2f1399282508a4f01579ad617d9db939d0117e3b2fcfcc48ae4bef59540d9
  • 84fabfbbd134bbeeb5481a96b023f44a671382349e5b39928baf0e80e28fd599
  • 79b478d9453cb18d2baf4387b65dc01b6a4f66a620fa6348fa8dbb8549a04a20
  • 3acfe74cd2567e9cc60cb09bc4d0497b81161075510dd75ef8363f72c49e1789
  • 73a956f40d51da737a74c8ad4ecbfab12350621ffc167b5c278cd33ce9e0e0f0

SHA1

  • 68d25f6ce7d12be1536ed5933660fe9aa717adec
  • b878d4c559855d65a4359341e11e7382f18aeb54
  • 9da572c471aa6a6d7265b2a96c233b9c694a756a
  • 712390c705335787f2601987746bda98657446d0
  • 3a82f6f27aca8d4bfdc3b030d7b7d9c2bf68ade9
  • 712390c705335787f2601987746bda98657446d0
  • 1adf462605836e65fe494fb518d892b481ac7552
  • c9cdefa94375c8c2979614d2999cf0882c7cec69
  • 7719e1b7001fd7e704b3da67f84d40ac8c151b84
  • 20d201cdf4116adaafc925f53f4fdacb823186fb
  • 496c657df343631526f2b9da8cd630ccd351ca70
  • f95d22bbfd2cf51227af0f35a8e46170b8ccde79

URL

  • hxxps[:]//teamtnt[.]red
  • hxxps[:]//teamtnt[.]red/BLACK-T/beta
  • hxxps[:]//teamtnt[.]red/BLACK-T/CleanUpThisBox
  • hxxps[:]//teamtnt[.]red/BLACK-T/setup/bd
  • hxxps[:]//teamtnt[.]red/BLACK-T/setup/docker-update
  • hxxps[:]//teamtnt[.]red/BLACK-T/setup/hole
  • hxxps[:]//teamtnt[.]red/BLACK-T/setup/kube
  • hxxps[:]//teamtnt[.]red/BLACK-T/setup/tshd
  • hxxps[:]//teamtnt[.]red/BLACK-T/SetUpTheBLACK-T
  • hxxps[:]//teamtnt[.]red/BLACK-T/SystemMod
  • hxxps[:]//teamtnt[.]red/ip_log/getip[.]php
  • hxxps[:]//teamtnt[.]red/only_for_stats/dup[.]php
  • hxxps[:]//teamtnt[.]red/x/getpwds[.]tar[.]gz
  • hxxps[:]//teamtnt[.]red/x/pw
  • hxxps[:]//iplogger[.]org/blahblahblah

Remediation

  • Block the threat indicators at their respective controls.
  • Search for IoCs in your environment.
  • Services
    • Asses
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.