Custom Signature Request for Recent Malicious Healthcare Activity (Per FBI)

SethF — Thu, 21 Aug 2014 19:56:48 GMT

Hello, we received the following from the FBI. Can you help us create a custom signature? Thanks

Seth

There is a snort signature for this...

alert tcp any any -> any any (content:"|6E|"; depth: 1; content:"|36 36 36 58 36 36 36|"; offset: 3; depth: 7; msg: "Beacon C2"; sid: 1000000001; rev:0)

UNCLASSIFIED

FBI FLASH

FBI Liaison Alert System

#A-000039-TT

The following information was obtained through FBI investigation and is provided in conjunction with the FBI's statutory requirement to conduct victim notification as outlined in 42 USC § 10607.

SUMMARY

The FBI is providing the following information with HIGH confidence. The FBI has observed malicious actors targeting healthcare related systems, perhaps for the purpose of obtaining Protected Healthcare Information (PHI) and/or Personally Identifiable Information (PII). These actors have also been seen targeting multiple companies in the healthcare and medical device industry typically targeting valuable intellectual property, such as medical device and equipment development data.

TECHNICAL DETAILS

The FBI has received the following information pertaining to a recent intrusion into a health care system that resulted in data exfiltration. Though the initial intrusion vector is unknown, we believe that a spear phish email message was used to deliver the initial malware. Typically, these actors use Information Technology themed spear-phishing messages which contain a malicious link that may connect to a new VPN site/service/client or a new Webmail site/software. Once access is obtained, the actors may collect and use legitimate account credentials to connect to the targeted system, usually through VPN.

The following are indicators of possible compromise:

Network-Based Indicator

Outgoing traffic through standard HTTP/HTTPS ports 80, 443 (and possibly others), but obfuscates traffic by XORing the traffic with 0x36. The below is a SNORT signature related to this activity:

alert tcp any any -> any any (content:"|6E|"; depth: 1; content:"|36 36 36 58 36 36 36|"; offset: 3; depth: 7; msg: "Beacon C2"; sid: 1000000001; rev:0)

Host-Based Indicator

The malware runs as a Windows service "RasWmi (Remote Access Service)" from the malicious .dll C:\Windows\system32\wbem\raswmi.dll. The implant is installed from an executable file (the file has been observed under a variety of names) which drops the raswmi.dll file into the same directory and sets it to run as a service.

POINT OF CONTACT

Please contact the FBI with any questions related to this FLASH report at either your local CTF or FBI CYWATCH: Email: cywatch@ic.fbi.gov or Voice: +1-855-292-3937

Re: Custom Signature Request for Recent Malicious Healthcare Activity (Per FBI)

justamoment — Thu, 02 Oct 2014 19:45:06 GMT

In case you didn't see it, this was added in update 453 (ID 13540).

Re: Custom Signature Request for Recent Malicious Healthcare Activity (Per FBI)

HYamanaka — Wed, 09 Nov 2016 22:04:00 GMT

If a signature didn't exist on the PA, how would you cover this snort signature to a PA custom pattern match?

Snort:

alert tcp any any -> any any (content:"|6E|"; depth: 1; content:"|36 36 36 58 36 36 36|"; offset: 3; depth: 7

PA Pattern:

Thanks

topic Re: Custom Signature Request for Recent Malicious Healthcare Activity (Per FBI) in Automation/API Discussions

Custom Signature Request for Recent Malicious Healthcare Activity (Per FBI)

Re: Custom Signature Request for Recent Malicious Healthcare Activity (Per FBI)

Re: Custom Signature Request for Recent Malicious Healthcare Activity (Per FBI)