Alpha Team Research: Probable TA505 Domains Uncovered

TA505 is a financially motivated threat actor group that frequently changes their malware and distribution techniques to attack their victims. A recent report on BleepingComputer shows that they are using a new Remote Access Trojan, dubbed SDBot, in their malspam campaigns. This downloader is used to deliver a combination of payloads such as ransomware, information stealers and more. A recent tweet showed a domain associated with TA505, dropbox-eu[.]com, which delivered a malicious XLS document and matched the TTPs of TA505. Alpha Team pivoted on this domain to potentially uncover 20+ other domains with similar patterns as dropbox-eu[.]com

Recommendations

Consider enabling ZeroFOX email security rules to detect indicators associated with this campaign
Blacklist file hashes, domains and URLs associated with this campaign. IOCs are included at the end of this report, and are also in the ZeroFOX ThreatFeed
Always verify the sender of unexpected or suspicious emails
Never open attachments or click links in these emails

Details

Issuing a WHOIS request on dropbox-eu[.]com yielded an interesting registrant e-mail address:

Domain Name: DROPBOX-EU.COM
Registry Domain ID: 2443820029_DOMAIN_COM-VRSN
Registrar WHOIS Server: whois.publicdomainregistry.com
Registrar URL: www.publicdomainregistry.com
Updated Date: 2019-10-15T17:02:56Z
Creation Date: 2019-10-15T17:02:55Z
Registrar Registration Expiration Date: 2020-10-15T17:02:55Z
Registrar: PDR Ltd. d/b/a PublicDomainRegistry.com
Registrar IANA ID: 303
Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited
Registry Registrant ID: Not Available From Registry
Registrant Name: Wiet Lee
Registrant Organization:
Registrant Street: NO.1111 Chaoyang Road
Registrant City: Beijing
Registrant State/Province: Beijing
Registrant Postal Code: 361322
Registrant Country: CN
Registrant Phone: +86.86756381050
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: [email protected]
Registry Admin ID: Not Available From Registry
Admin Name: Wiet Lee
Admin Organization:
Admin Street: NO.1111 Chaoyang Road
Admin City: Beijing
Admin State/Province: Beijing
Admin Postal Code: 361322
Admin Country: CN
Admin Phone: +86.86756381050
Admin Phone Ext:
Admin Fax:
Admin Fax Ext:
Admin Email: [email protected]
Registry Tech ID: Not Available From Registry
Tech Name: Wiet Lee
Tech Organization:
Tech Street: NO.1111 Chaoyang Road
Tech City: Beijing
Tech State/Province: Beijing
Tech Postal Code: 361322
Tech Country: CN
Tech Phone: +86.86756381050
Tech Phone Ext:
Tech Fax:
Tech Fax Ext:
Tech Email: [email protected]
Name Server: a.dnspod.com
Name Server: b.dnspod.com
Name Server: c.dnspod.com
DNSSEC: Unsigned
Registrar Abuse Contact Email: [email protected]
Registrar Abuse Contact Phone: +1.2013775952
URL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/
>>> Last update of WHOIS database: 2019-10-17T17:40:34Z <<<

whois-protect@hotmail[.]com is a unique e-mail address associated with the following domains:

coinxkeep.com
drm-server-booking.com
dropbox-en.com
dropbox-eu.com
etimerando.com
ie-settings.com
ioustories.com
magestories.com
mesinotek.com
mgstrs.com
netflix-members.com
onedrive-download-en.com
onedrive-download.com
onedrive-sd.com
onedrive-sn.com
pleiadesheaven.com
veracc.com
verzerchk.com
windows-afx-update.com
windows-en-us-update.com
windows-several-update.com
www1-worldremit.com
yries.com

windows-afx-update[.]com and dropbox-en[.]com have been identified by security researchers as possible TA505 domains. They all have served malicious documents that are consistent with the behavior of TA505 and with the BleepingComputer article.

Many of these domains responded to the common patterns seen in the distribution of malware, specifically related to the subdomains. For example, dw[1-3].dropbox-eu[.]com were all used to deliver the malicious documents. DNS resolution on these domains are listed in the indicators at the end of this report.

Two interesting findings with this data include the e-mail address, and the domain mesinotek[.]com. When visiting that webpage, it returns a login panel for Predator the Thief, a stealer malware commonly sold on the Dark Web.

Predator the Thief

Fortinet did a good writeup of the kit, but its main focus is gathering information on the target host to steal passwords, replace cryptocurrency wallets, access web-cameras and other capabilities. This does suggest that if this e-mail address is associated with TA505, then they are also using and deploying Predator the Thief in their toolset.

Predator The Thief2 Screenshot courtesy of Fortinet

As of 6 October 2019, Predator the Thief is still under development, according to their Telegram channel.

The second finding pertains to the e-mail address whois-protect@hotmail[.]com. Last year, this e-mail address was attributed to the Necurs botnet by TALOS. This could provide a linking between TA505 and the Necurs botnet, both due to the whois registrant and both of the campaigns usage of malspam to distribute their attacks.

Alpha Team will continue to monitor these domains and add indicators to Alpha Team page as well as Threat Feed for our customers. Below, we list the IP addresses, domains and subdomains with the common patterns associated with the campaign. Not all of the subdomains resolve to an IP address, but we recommend adding the patterns of dw[1-3] and dl[1-3].

IOCs

------
104.24.113.191
161.117.35.201
185.212.128.146
185.33.86.40
185.74.252.164
193.124.191.47
195.123.246.71
217.8.117.28
38.135.122.153
45.136.111.150
45.136.111.23
45.136.111.244
45.136.111.25
45.136.111.33
45.136.111.5
47.254.175.94
93.189.42.139
coinxkeep.com
drm-server-booking.com
dropbox-en.com
dropbox-eu.com
etimerando.com
ie-settings.com
ioustories.com
magestories.com
mesinotek.com
mgstrs.com
netflix-members.com
onedrive-download-en.com
onedrive-download.com
onedrive-sd.com
onedrive-sn.com
pleiadesheaven.com
veracc.com
verzerchk.com
windows-afx-update.com
windows-en-us-update.com
windows-several-update.com
www1-worldremit.com
yries.com
dl1.coinxkeep.com
dl1.dropbox-eu.com
dl1.etimerando.com
dl1.ie-settings.com
dl1.ioustories.com
dl1.magestories.com
dl1.mesinotek.com
dl1.mgstrs.com
dl1.netflix-members.com
dl1.onedrive-sd.com
dl1.onedrive-sn.com
dl1.pleiadesheaven.com
dl1.veracc.com
dl1.verzerchk.com
dl1.windows-afx-update.com
dl1.windows-several-update.com
dl1.www1-worldremit.com
dl1.yries.com
dl2.coinxkeep.com
dl2.dropbox-eu.com
dl2.etimerando.com
dl2.ie-settings.com
dl2.ioustories.com
dl2.magestories.com
dl2.mesinotek.com
dl2.mgstrs.com
dl2.netflix-members.com
dl2.onedrive-sd.com
dl2.onedrive-sn.com
dl2.pleiadesheaven.com
dl2.veracc.com
dl2.verzerchk.com
dl2.windows-afx-update.com
dl2.windows-several-update.com
dl2.www1-worldremit.com
dl2.yries.com
dl3.coinxkeep.com
dl3.dropbox-eu.com
dl3.etimerando.com
dl3.ie-settings.com
dl3.ioustories.com
dl3.magestories.com
dl3.mesinotek.com
dl3.mgstrs.com
dl3.netflix-members.com
dl3.onedrive-sd.com
dl3.onedrive-sn.com
dl3.pleiadesheaven.com
dl3.veracc.com
dl3.verzerchk.com
dl3.windows-afx-update.com
dl3.windows-several-update.com
dl3.www1-worldremit.com
dl3.yries.com
dw1.coinxkeep.com
dw1.dropbox-eu.com
dw1.etimerando.com
dw1.ie-settings.com
dw1.ioustories.com
dw1.magestories.com
dw1.mesinotek.com
dw1.mgstrs.com
dw1.netflix-members.com
dw1.onedrive-sd.com
dw1.onedrive-sn.com
dw1.pleiadesheaven.com
dw1.veracc.com
dw1.verzerchk.com
dw1.windows-afx-update.com
dw1.windows-several-update.com
dw1.www1-worldremit.com
dw1.yries.com
dw2.coinxkeep.com
dw2.dropbox-eu.com
dw2.etimerando.com
dw2.ie-settings.com
dw2.ioustories.com
dw2.magestories.com
dw2.mesinotek.com
dw2.mgstrs.com
dw2.netflix-members.com
dw2.onedrive-sd.com
dw2.onedrive-sn.com
dw2.pleiadesheaven.com
dw2.veracc.com
dw2.verzerchk.com
dw2.windows-afx-update.com
dw2.windows-several-update.com
dw2.www1-worldremit.com
dw2.yries.com
dw3.coinxkeep.com
dw3.dropbox-eu.com
dw3.etimerando.com
dw3.ie-settings.com
dw3.ioustories.com
dw3.magestories.com
dw3.mesinotek.com
dw3.mgstrs.com
dw3.netflix-members.com
dw3.onedrive-sd.com
dw3.onedrive-sn.com
dw3.pleiadesheaven.com
dw3.veracc.com
dw3.verzerchk.com
dw3.windows-afx-update.com
dw3.windows-several-update.com
dw3.www1-worldremit.com
dw3.yries.com

Threat Feed Customers

Threat Feed Customers can access these indicators through the following cURL command:

curl -X GET --header 'Accept: application/json' --header 'Authorization: Token TOKEN' 'https://tg-api.zerofox.com/campaigns/106/list_indicators/