Rewterz Threat Intel – The Evolution of Agrius APT Group Targeting Pakistan – Active IOCs

Severity

High

Analysis Summary

A new attack group called Agrius is launching damaging wiper attacks against Pakistani targets, which researchers said are hiding behind ransomware to make their state-sponsored activities appear financially motivated.

The Agrius Advanced Persistent Threat (APT) appears to use both public and private malware families to aid their attacks. Recent research made by Rewterz Threat Intel shows that  they have been planting the open-source ASPXSpy Malware on compromised networks, but they have also relied on a previously unidentified ransomware/wiper called Apostle.

Apostle,was initially deployed in an attempt to wipe data but failed to do so, likely because of a logic flaw in its code. The internal name its developers gave it was “wiper-action.” In a later version, the bug was fixed and the malware gained full-fledged ransomware behaviors, including the ability to leave notes demanding that victims pay a ransom in exchange for a decryption key.

The Apostle Malware is a custom-built malware threat that also uses webshells so that attackers can move laterally inside a compromised network. To conceal their IP addresses, members use the ProtonVPN (Ehrlich, 2021).

References

Ehrlich, A., 2021. From Wiper to Ransomware | The Evolution of Agrius. [online] SentinelLabs. Available at: <https://labs.sentinelone.com/from-wiper-to-ransomware-the-evolution-of-agrius/>.

Impact

• File Encryption
• Data Exfiltration
• Information Disclosure
• Cyber Espionage

Indicators of Compromise

IP

• 37[.]120[.]238[.]15
• 37[.]59[.]236[.]232
• 185[.]147[.]131[.]81
• 81[.]177[.]22[.]16
• 81[.]177[.]23[.]16
• 54[.]37[.]99[.]4

MD5

• 01ed1914b55a2d6ca4e4c97827fba3f4
• 02aa4ba656d49ebbe930b923b8399b6b
• 1caaacebe309474d36d8243a3c393351
• 32616cdd343ad938e385b32aa482fea4
• 338236f51e666e26e4547273e9a23d98
• 4ea373d0ab8d50b644c95f415e1c0694
• 851b7b8dd006dc889bf8f9282dc853ce

URL

• http[:]//185[.]142[.]97[.]81/css/v1/template/main[.]php
• http[:]//185[.]142[.]98[.]32/Scripts/_Data/25/lastupdate[.]php
• http[:]//195[.]123[.]208[.]152/Admins/login[.]php
• http[:]//5[.]2[.]67[.]85/View/list[.]php
• http[:]//5[.]2[.]73[.]67/Panel/new/File/css/boot[.]php
• http[:]//whynooneistherefornoneofthem[.]com/about[.]php
• http[:]//theisnonamelikethis29123[.]com/mail[.]php

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.