New data wiper malware used in Ukraine

Text acquired from the source

Evento MISP pubblicato con TLP:CLEAR: New data wiper malware used in Ukraine. Report from - [URL rimossa] (1645824136) html [if IE 8 ]> **WMI query format:** > > *SELECT * FROM Win32\_PingStatus WHERE Address={configured\_c2\_domain}* > > **3.** Sends a network request to download the next stage payload using the IP address obtained from step #2 and also exfiltrate the information collected from step #1 using the UserAgent field > **UserAgent Format:** > > {hardcoded\_useragent\_string}**::**%USERPROFILE%**\_**%SYSTEMDRIVE%.SerialNumber**::\.**{static\_string}**\.** > > **4.** Drops and executes the downloaded payload **Note:** At the time of analysis we didn’t get this next stage payload but based on past analysis the threat actor is known to drop some remote desktop application like UltraVNC **Attack Chain #2** We identified another attack-chain used by the same threat actor which is not documented anywhere in the public domain, to the best of our knowledge. Based on our research, this campaign has been active since as early as November 2020 and only 7 unique samples have been identified till date related to this campaign. The most recent instance was observed on 11th Feb 2022 and based on the filename, we believe that it was distributed on 8th Feb 2022 to the targeted victim(s). This low-volume campaign involves RAR archive files distributed through spear phishing emails. These RAR archive files contain a malicious Windows shortcut file (LNK) which do