Combine cutting-edge XDR technology, multi-signal threat intelligence and 24/7 Elite Threat Hunters to help you build a world-class security operation.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Cyber risk and advisory programs that identify security gaps and build security strategies to address them.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
XDR with machine learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Seamless integration and threat investigation across your existing tech stack.
Defend brute force attacks, active intrusions and unauthorized scans.
Guard endpoints by isolating and remediating threats to prevent lateral spread.
Investigation and threat detection across multi-cloud or hybrid environments.
Remediate misconfigurations, vulnerabilities and policy violations.
Investigate and respond to compromised identities and insider threats.
Stop ransomware before it spreads.
Meet regulatory compliance mandates.
Detect and respond to zero-day exploits.
End misconfigurations and policy violations.
Defend third-party and supply chain risk.
Prevent disruption by outsourcing MDR.
Adopt a risk-based security approach.
Meet insurability requirements with MDR.
Protect your most sensitive data.
Build a proven security program.
Operationalize timely, accurate, and actionable cyber threat intelligence.
THE THREATThe critical severity vulnerability CVE-2024-28986 (CVSS: 9.8), identified in SolarWinds' Web Help Desk (WHD) software, is a Remote Code Execution (RCE) flaw resulting from a Java…
Aug 14, 2024THE THREATOn August 12th, Ivanti disclosed a new critical vulnerability impacting Ivanti Virtual Traffic Manager (vTM). The vulnerability, tracked as CVE-2024-7593 (CVSS: 9.8), impacts…
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company’s mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
Multi-Signal MDR with 300+ technology integrations to support your existing investments.
24/7 SOC-as-a-Service with unlimited threat hunting and incident handling.
Three MDR package tiers are available based on per-user pricing and level of risk tolerance.
The latest security advisories, blogs, reports, industry publications and webinars published by TRU.
Compare eSentire to other Managed Detection and Response vendors to see how we stack up against the competition.
See why 2000+ organizations globally have chosen eSentire for their MDR Solution.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
In July 2024, eSentire’s Threat Response Unit (TRU) observed a phishing attack that led to a 0bj3ctivity Stealer malware infection. The user clicked on a Discord CDN link containing a malicious JavaScript file named Enquiry-Dubai.js (MD5: 42436fb03b579a159464fb2af53696f1). This file contained instructions to retrieve and execute additional payloads, including Ande Loader and the aforementioned stealer.
The JavaScript file contains an AES-encrypted PowerShell script. Figure 1 shows the decrypted script.
It searches for specific markers “<<BASE64_START>>” and “<<BASE64_END>>” that define a base64-encoded segment within the new-image.jpg file (MD5: 41914711cfdaba63ddf1701270077855). The extracted base64-encoded blob is then decoded to get a byte array, which is a .NET payload which is loaded into the memory. The PowerShell script retrieves the type RunPE.Home from the .NET payload then accesses the “VAI” method and invokes it with the following arguments:
Based on the method name and the .NET code, we can attribute it to Ande Loader. We wrote about Ande Loader in our analysis of the Blind Eagle campaign.
The .NET payload is responsible for the following:
The downloaded payload is responsible for retrieving the stealer from the server (hxxps://whatismyipaddressnow[.]co/API/FETCH/filter.php?countryid=14&token=FEzEd9JbsoLF) and executing it in memory. The payload also checks if it is being debugged via the “get_IsAttached” method, and if it is, the process exits.
As mentioned before, the final payload is the 0bj3ctivity Stealer. The stealer was previously analyzed by CERT-AGID. The strings in the stealer payload are obfuscated, as shown in Figure 3.
The decryption works by iterating over each character of an encrypted string, subtracting a constant integer value passed as the third parameter (A_2) from each character of the encrypted string, and then reconstructing the string for Base64 decoding.
Upon successful execution, the stealer sends the data to Telegram, indicating with boolean values “True” or “False” whether the data is present, as shown in Figure 4.
It’s worth mentioning that if it fails to send data to the Telegram bot, it will send the data to a C2 server at hxxps://whatismyipaddressnow.co/API/FETCH/getcountry[.]php or an SMTP server instead.
Password decryption occurs locally on the user's machine rather than remotely on a server. The software loads the necessary libraries required to decrypt the passwords.
The stealer also has Virtualization checks. Specifically, it checks for the presence of specific DLL, system, and video properties that are commonly associated with virtual environments and sandboxes (Figure 6).
The checks are also performed for the presence of monitoring and debugging tools, as shown in Figure 7.
If the virtualization environment or one of the monitoring and debugging tools is detected, the stealer terminates the process and removes itself from the host machine via the “cmd.exe /C choice /C Y /N /D Y /T 3 & Del \” command.
The stealer also checks if the host is a VPS or cloud-hosted machine by reaching out to hxxp://ip-api[.]com/line/?fields=hosting and reaches out to hxxp://icanhazip[.]com to get the public IP address of the infected machine.
The stealer exfiltrates data from the following browsers:
For credit card extraction, the stealer uses a dictionary of regular expressions to match credit card numbers from different issuers.
The collected data will be archived and sent out to the C2, Telegram, or SMPT server in the following format:
Below is an example of what the contents of Info.txt look like.
We further looked into the Telegram bot that received the exfiltrated data using the TeleTracker tool and identified the owner of the bot (@bukky101) as well as some exfiltrated data the bot received, as shown in Figure 8.
We found two samples in the wild that referenced the Telegram username tied to Agent Tesla RAT (refer to https://tria.ge/240304-vreasafg5s and https://tria.ge/240418-lwnwcaah8v).
The case study from July 2024, analyzing the phishing attack that led to the 0bj3ctivity Stealer infection, highlights the usage of Ande Loader in the attack chain. This loader, previously analyzed in relation to the Blind Eagle campaign, keeps enhancing its capabilities with new features such as anti-debugging techniques and a new string obfuscation method.
These developments might significantly increase the time required for researchers to analyze the malware effectively, particularly when they do not have the relevant deobfuscation scripts readily available.
You can access the indicators of compromise here.
The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.