Cyber risk and advisory programs that identify security gaps and build strategies to address them.
MDR that provides improved detection, 24/7 threat hunting, end-to-end coverage and most of all, complete Response.
Our team delivers the fastest response time in the industry. Threat suppression within just 4 hours of being engaged.
Visibility and response across your entire Microsoft security ecosystem.
XDR with Machine Learning that eliminates noise, enables real-time detection and response, and automatically blocks threats.
Be protected by the best from Day 1.
24/7 Threat Investigation and Response.
Expert threat hunting, original research, and proactive threat intelligence.
TRU is foundational to our MDR service. No add-ons or additional costs required.
Stop ransomware attacks before they disrupt your business.
Detect and respond to zero-day exploits.
Protect against third-party and supply chain risk.
Adopt a risk-based approach to cybersecurity.
Protect your most sensitive data.
Meet cybersecurity regulatory compliance mandates.
Eliminate misconfigurations and policy violations.
Prevent business disruption by outsourcing MDR.
Defend brute force attacks, active intrusions and unauthorized scans.
Safeguard endpoints 24/7 by isolating and mediating threats to prevent lateral spread.
Enhance investigation and threat detection across multi-cloud or hybrid environments.
Remediate critical misconfigurations, security vulnerabilities and policy violations across cloud and containerized environments.
Detect malicious insider and identity-based behavior leveraging machine learning models.
Our Threat Response Unit (TRU) publishes security advisories, blogs, reports, industry publications and webinars based on its original research and the insights driven through proactive threat hunts.
eSentire is The Authority in Managed Detection and Response Services, protecting the critical data and applications of 2000+ organizations in 80+ countries from known and unknown cyber threats. Founded in 2001, the company's mission is to hunt, investigate and stop cyber threats before they become business disrupting events.
We provide sophisticated cybersecurity solutions for Managed Security Service Providers (MSSPs), Managed Service Providers (MSPs), and Value-Added Resellers (VARs). Find out why you should partner with eSentire, the Authority in Managed Detection and Response, today.
We believe a multi-signal approach is paramount to protecting your complete attack surface. See why eSentire MDR means multi-signal telemetry and complete response.
See how our 24/7 SOC Cyber Analysts and Elite Threat Hunters stop even the most advanced cyberattacks before they disrupt your business.
Choose the right mix of Managed Detection and Response, Exposure Management, and Incident Response services to strengthen your cyber resilience.
Try our interactive tools including the MITRE ATT&CK Tool, the SOC Pricing Calculator, the Cybersecurity Maturity Assessment, and our MDR ROI Calculator.
Read the latest security advisories, blogs, reports, industry publications and webinars published by eSentire's Threat Response Unit (TRU).
See why 2000+ organizations count on eSentire to build resilience and prevent business disruption.
Adversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters and Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.
We have discovered some of the most dangerous threats and nation state attacks in our space – including the Kaseya MSP breach and the more_eggs malware.
Our Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced Threat Analytics driven by our Threat Response Unit – the TRU team.
In TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We outline how we responded to the confirmed threat and what recommendations we have going forward.
Here’s the latest from our TRU Team…
In July, the eSentire Threat Response Unit (TRU) identified multiple BatLoader cases investigated by our SOC team. In these cases, the victims fell for suspected malicious advertisements impersonating Zoom and TradingView after performing web searches for these products.
The victims had then downloaded malicious MSIX installer files (such as Zoom-x64.msix) which attempted to infect their systems with Redline Stealer and SectopRAT. These were the first such observations in our telemetry since May 2023. Our analysis here will focus on discovering imposter websites and MSIX samples currently being used in BatLoader campaigns.
TRU identified several suspected BatLoader payload sites hosted on IP 80.68.159.10 registered in June and July 2023:
The domain names suggest an array of brands are impersonated in these attacks, including Microsoft, Zoom, Adobe, Steam, OpenAI, etc. (a more complete list can be found at the end of this blog). These brands have been used historically in previous BatLoader attacks, and landing pages comprise of an imposter download page for these products.
When visited manually, these sites present empty content or 403 HTTP errors, and successful recreation of infection chains has been minimal thus far. This may suggest operators may have improved the cloaking of these sites to evade discovery by researchers and scanners.
We did identify one successfully rendered page for Steam (store-steampowered[.]net) submitted to Urlscan.io on June 6, which shows an imposter page for the gaming service. The website was registered the same day and served a legitimate Steam binary at the time.
We assess this site likely served Steam-x64.msix (md5: c37aee1ebad9b0f7bd2e7755a3133d0e) in mid-July 2023 shown in Figure 2 below.
As we covered in our May blog, MSIX files are a relatively new installer format designed for Windows 10 and above. It requires the package contents to be signed; a barrier intended to limit abuse by threat actors. Unfortunately, these code signing certificates do find their way into threat actor hands and can be acquired on underground forums for a fee.
In a February post on XSS forums, a suspected BatLoader operator vouched for a code signing service offered by another forum member by providing a screenshot of their previous transaction with this member:
It's highly probable that BatLoader operators are purchasing the required code signing certificates used in their campaigns from other threat actors.
The latest MSIX app packages reviewed by TRU contained content signed by IMPERIOUS TECHNOLOGIES LIMITED, a private limited company based out of the UK.
The AppManifest shows the package was created with Advanced Installer version 20.2 configured with Russian-language settings.
When launched, the package executes with elevated privileges then executes an embedded PowerShell script then drops and executes a legitimate copy of the Steam installer as a decoy. The PowerShell script (“NEW_mormons_v1.ps1”, MD5: d87bc0bcfa1976ffa6a165545fb7ca62) contains a similar structure to prior samples, with some minor updates. It downloads Redline Stealer binary disguised as a jpg file (“czx.jpg”, MD5: d5a1d54158e110a8d9b0eea06d37e26f) from hxxps://tatmacerasi[.]com and SectopRAT/ArechClient (“zhelp.exe”, MD5: 3AC860860707BAAF32469FA7CC7C0192) from hxxps://fullpower682[.]store.
Additional details on the PowerShell script can be seen in the annotated image below.
Similarities with prior BatLoader samples include:
A May PowerShell sample for comparison:
SectopRAT is downloaded as an encrypted RAR archive and decrypted using 7zip (also downloaded). The SectopRAT payload (MD5: DD50DE3ACC26293986F40EB04F0F1A99) is written to AppData\Local\Temp\ and injected into MsBuild.exe. It retrieves its C2 configuration from Pastebin and connects to 194.26.135[.]180 for command and control.
Redline Stealer is loaded as assembly by PowerShell, with the resulting payload (MD5: D5A1D54158E110A8D9B0EEA06D37E26F) connecting to 194.26.135[.]119 port 12432 for command-and-control.
For a complete analysis of another Redline sample, read our Redline Stealer malware analysis.
Indicator | Note |
tradling-view[.]com | Suspected BatLoader Imposter Sites |
www[.]adlobe[.]net | |
www[.]get-adobe[.]net | |
adlobe[.]net | |
get-adobe[.]net | |
www[.]drlve-googie[.]com | |
www[.]zooml-us[.]com | |
drlve-googie[.]com | |
usblank[.]net | |
zooml-us[.]com | |
open-aii[.]com | |
so-lfi[.]com | |
virtuaibox[.]net | |
mldiourney[.]com | |
blt-warden[.]com | |
store-steampowered[.]net | |
mlcrosoft-online[.]net | |
qul-cken[.]com | |
fileziila-project[.]com | |
www.whcts-app[.]com | |
www.notcpad-pius-pius[.]org | |
623start[.]site | BatLoader C2 (confirmed) |
cdn-prok[.]site | BatLoader C2 (suspected) |
cdn-dwnld[.]ru | |
start-up-plus[.]site | |
newvision623[.]site | |
cdn-dwnld[.]site | |
cdn-dwnld[.]store | |
tatmacerasi[.]com | Secondary Payload Host |
fullpower682[.]store | Secondary Payload Host |
194.26.135[.]180 | SectopRAT C2 |
194.26.135[.]119 | Redline C2 |
C37AEE1EBAD9B0F7BD2E7755A3133D0E | Steam-x64.msix |
D87BC0BCFA1976FFA6A165545FB7CA62 | NEW_mormons_v1.ps1 |
D5A1D54158E110A8D9B0EEA06D37E26F | czx.jpg |
3AC860860707BAAF32469FA7CC7C0192 | zhelp.exe |
DD50DE3ACC26293986F40EB04F0F1A99 | SectopRAT |
D5A1D54158E110A8D9B0EEA06D37E26F | Redline |
Our industry-renowned Threat Response Unit (TRU) is an elite team of threat hunters and researchers, that supports our 24/7 Security Operations Centers (SOCs), builds detection models across our Atlas XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. TRU has been recognized for its threat hunting, original research and content development capabilities. TRU is strategically organized into cross-functional groups to protect you against advanced and emerging threats, allowing your organization to gain leading threat intelligence and incredible cybersecurity acumen.