F.A.C.C.T experts analyzed the tools and connections of cybercriminals attacking Russian accountants. An analysis of the infection chain of the VasyGrek attacker, his forum activity and connection with the malware developer Mr.Burns is presented. The history of Mr.Burns, starting in 2010, is given, as well as a description of the current version of the BurnsRAT malware, sold on forums and used in attacks on Russian companies. Author: AlienVault
Related Tags:
RMS
WarzoneRAT – S0670
BurnsRAT
T1036.004
T1055.002
T1497.001
T1569.002
T1566.002
T1573.001
Associated Indicators:
BA629F7EE519379F1A5A8A4683EE9A48D1B0996268BFAF1162E4BF0F2B792B77
AF8018B310BF030F6FECA0F6F23D3E65F8926114D7CD493573BADAE24F5DA0D1
2BCFBB053EC4936BDED589848B8429CD37B0A7BF5BF85E5E3ACE494F4512BFA9
E4A91DB9E43655931FD3926EC00DBE8A063FBE0D3F0AF7D902FD3B9D8281FB3D
E360674D2ABF0BEA085D01BC3595E19EFB3AC061AB8090A32D0C579C621C46F6
1FD5A9570A894C751610C1B49B2F2F00C0C618D365BE14A4980F1266A3772C90
20A77D76F250B75309E8CCAF1470D9729DC99B95168085FF30B1E46BE6CE2138
1304A1EC426AA4D39C255AEF059BC5B2CB9FEF096CD6D136C63DDF8A3B936B96
BF9FC94905D75CCF3640D35899D533E50C7BA8BDCE396443AE2D0507657A9E81