Open Hunting - Threat Library

Openhunting Threat Library

OutSteel

(Type: Info stealer)

(Palo Alto) The OutSteel tool is a simple document stealer. It searches for potentially sensitive documents based on their file type and uploads the files to a remote server. The use of OutSteel may suggest that this threat group’s primary goals involve data collection on government organizations and companies involved with critical infrastructure.

[News Analysis] Trends:

Total Trend: 1

Trend Per Year

2022

Trend Per Month

Feb 2022

[News Analysis] News Mention Another Threat Name:

[TTP Analysis] Technique Performance:

reconnaissance

0/43

resource development

0/45

initial access

2/19

execution

3/36

persistence

0/113

privilege escalation

0/96

defense evasion

1/184

credential access

0/63

discovery

2/44

lateral movement

0/22

collection

2/37

command and control

2/39

exfiltration

2/18

impact

0/26

[TTP Analysis] Mitre Attack Matrix:

TA0043	TA0042	TA0001	TA0002	TA0003	TA0004	TA0005	TA0006	TA0007	TA0008	TA0009	TA0011	TA0010	TA0040
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
		T1566.001 Phishing : Spearphishing Attachment T1566.002 Phishing : Spearphishing Link	T1059.003 Command And Scripting Interpreter : Windows Command Shell T1204.001 User Execution : Malicious Link T1204.002 User Execution : Malicious File			T1070.004 Indicator Removal : File Deletion		T1083 File And Directory Discovery T1057 Process Discovery		T1119 Automated Collection T1005 Data From Local System	T1071.001 Application Layer Protocol : Web Protocols T1105 Ingress Tool Transfer	T1020 Automated Exfiltration T1041 Exfiltration Over C2 Channel

[Infrastructure Analysis] Based on Related IOC:

IP:Port	Timestamp

Domain	Timestamp

URL	Timestamp

[Target Analysis] Region/Sector:

No information

References:

News Basic Information Indicator of Compromise Mitre Attack

News Article (Credit @Malpedia)

BabaDeda and LorecCPL downloaders used to run Outsteel against Ukraine

2022-02-16 by Telsy Research Team from Telsy

Basic Information (Credit @etda.or.th)

Tool: OutSteel

Names: OutSteel

Description: (Palo Alto) The OutSteel tool is a simple document stealer. It searches for potentially sensitive documents based on their file type and uploads the files to a remote server. The use of OutSteel may suggest that this threat group’s primary goals involve data collection on government organizations and companies involved with critical infrastructure.

Category: Malware

Type: Info stealer

Information: https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/

Mitre-attack: https://attack.mitre.org/software/S1017/

Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.outsteel

Last-card-change: 2022-12-30

Source: https://apt.etda.or.th/cgi-bin/listtools.cgi

TTP Info (Credit @Mitre)

TA0043	TA0042	TA0001	TA0002	TA0003	TA0004	TA0005	TA0006	TA0007	TA0008	TA0009	TA0011	TA0010	TA0040
Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
		T1566.001 PHISHING : SPEARPHISHING ATTACHMENT outsteel has been distributed as a malicious attachment within a spearphishing email. T1566.002 PHISHING : SPEARPHISHING LINK outsteel has been distributed through malicious links contained within spearphishing emails.	T1059.003 COMMAND AND SCRIPTING INTERPRETER : WINDOWS COMMAND SHELL outsteel has used cmd.exe to scan a compromised host for specific file extensions. T1204.001 USER EXECUTION : MALICIOUS LINK outsteel has relied on a user to click a malicious link within a spearphishing email. T1204.002 USER EXECUTION : MALICIOUS FILE outsteel has relied on a user to execute a malicious attachment delivered via spearphishing.			T1070.004 INDICATOR REMOVAL : FILE DELETION outsteel can delete itself following the successful execution of a follow-on payload.		T1083 FILE AND DIRECTORY DISCOVERY outsteel can search for specific file extensions, including zipped files. T1057 PROCESS DISCOVERY outsteel can identify running processes on a compromised host.		T1119 AUTOMATED COLLECTION outsteel can automatically scan for and collect files with specific extensions. T1005 DATA FROM LOCAL SYSTEM outsteel can collect information from a compromised host.	T1071.001 APPLICATION LAYER PROTOCOL : WEB PROTOCOLS outsteel has used http for c2 communications. T1105 INGRESS TOOL TRANSFER outsteel can download files from its c2 server.	T1020 AUTOMATED EXFILTRATION outsteel can automatically upload collected files to its c2 server. T1041 EXFILTRATION OVER C2 CHANNEL outsteel can upload files from a compromised host over its c2 channel.