(FireEye) OLDBAIT is a credential harvester that installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe. There is a missing space in the MediaPlayer directory and the filename is missing the ‘o’ character. Both the internal strings and logic are obfuscated and are unpacked at startup. Credentials for the following applications are collected: • Internet Explorer • Mozilla Firefox • Eudora • The Bat! (an email client made by a Moldovan company) • Becky! (an email client made by a Japanese company) Both email and HTTP can be used to send out the collected credentials. Note: In some places it is mistakenly named {{Sasfis}}, which however seems to be a completely different and unrelated malware family.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|---|
| login.qwwxthn.xyz | 2022-07-14 |
| login.seafoodsconnection.com | 2022-07-14 |
| login.sunmarks.co.uk | 2022-07-14 |
| login.tfosorcimonline.xyz | 2022-07-14 |
| login.whitmanlab.uk | 2022-07-14 |
| login.yi087011.xyz | 2022-07-14 |
| login.mcrsfts-update.cloud | 2022-07-14 |
| login.mcrsfts-update.digital | 2022-07-14 |
| login.mcrsfts-virtualofficevm.com | 2022-07-14 |
| login.mcrsftsvm-app.digital | 2022-07-14 |
| URL | Timestamp |
|---|
2018-08-26 by SecJuice from SecJuice
2017-01-10 by FireEye iSIGHT Intelligence from FireEye
2014 by FireEye from FireEye
2012-11-01 by Micky Pun from Virus Bulletin
2012-10-09 by Dianne Lagrimas from Trend Micro
2011-04-16 by Sophos from Sophos
2010-05-31 by Joseph Cepe from Trend Micro
2010-05-27 by Kevin Liston from SANS ISC InfoSec Forums
2010-02-02 by Éamonn Young from Symantec
2010-01-21 by Loucif Kharouni from Trend Micro
Tool: OLDBAIT
Names: OLDBAIT, Sasfis
Description: (FireEye) OLDBAIT is a credential harvester that installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe. There is a missing space in the MediaPlayer directory and the filename is missing the ‘o’ character. Both the internal strings and logic are obfuscated and are unpacked at startup. Credentials for the following applications are collected: • Internet Explorer • Mozilla Firefox • Eudora • The Bat! (an email client made by a Moldovan company) • Becky! (an email client made by a Japanese company) Both email and HTTP can be used to send out the collected credentials. Note: In some places it is mistakenly named {{Sasfis}}, which however seems to be a completely different and unrelated malware family.
Category: Malware
Type: Credential stealer
Information: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
Information: https://www.secjuice.com/fancy-bear-review/
Mitre-attack: https://attack.mitre.org/software/S0138/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.oldbait
Last-card-change: 2022-12-29
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1036.005 MASQUERADING : MATCH LEGITIMATE NAME OR LOCATION oldbait installs itself in %alluserprofile%\application data\microsoft\mediaplayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o." T1027 OBFUSCATED FILES OR INFORMATION oldbait obfuscates internal strings and unpacks them at startup. | T1555.003 CREDENTIALS FROM PASSWORD STORES : CREDENTIALS FROM WEB BROWSERS oldbait collects credentials from internet explorer, mozilla firefox, and eudora. |