MalwarePublished 16 Feb 2020Updated 20 Nov 2024

tlp white · IRS Doc Malware

Affects tlp whiteSource CIRCL OSINT Feed

TLP:WHITE, disclosure is not limited

Description

IRS Doc Malware

Impact

For European organizations, the IRS Doc Malware poses a risk primarily through targeted spearphishing campaigns that can lead to unauthorized access, data exfiltration, or lateral movement within networks. The use of PowerShell and scripting can bypass traditional signature-based defenses, potentially compromising confidentiality and integrity of sensitive data. The persistence mechanisms enable long-term footholds, increasing the risk of prolonged espionage or data theft. While the malware does not appear to cause direct availability impacts, the stealthy communication and use of standard protocols complicate detection and response efforts. European entities handling sensitive financial, governmental, or personal data are particularly at risk, as attackers may leverage this malware to gain initial access or establish command and control channels. The low severity rating suggests limited widespread impact but does not preclude significant damage in targeted attacks, especially if combined with other attack vectors or follow-on exploitation.

Defensive guidance

European organizations should implement targeted defenses against spearphishing and maldoc threats. This includes advanced email filtering with attachment sandboxing to detect malicious documents before delivery. User awareness training focused on recognizing spearphishing attempts and suspicious attachments is critical. Endpoint detection and response (EDR) solutions should be configured to monitor and alert on suspicious PowerShell activity, command-line executions, and modifications to registry run keys or startup folders. Monitoring for unusual BITS job creations and network traffic over commonly used ports with encrypted protocols can help identify stealthy C2 communications. Implementing application whitelisting to restrict execution of unauthorized scripts and enforcing least privilege principles reduces the attack surface. Regularly auditing persistence mechanisms and network connections can detect anomalies early. Since no patches exist, emphasis on detection and prevention is paramount. Incident response plans should include procedures for maldoc infections and lateral movement containment.

Indicators of compromise

Domains 3

siliconmadeinhk.com
binupload.com
server237-5.web-hosting.com

URLs 1

http://siliconmadeinhk.com/Server2_36B4.exe

IP addresses 8

199.188.200.112
151.139.128.14legitmate OCSP CRL server
199.188.200.112tied to binupload.com
185.222.202.237tied to siliconmadeinhk.com
89.208.229.55tied to siliconmadeinhk.com
172.105.81.149tied to siliconmadeinhk.com
172.105.154.72tied to siliconmadeinhk.com
89.208.196.16tied to siliconmadeinhk.com

Hashes 10

%USERPROFILE%\PROTOZOA.vbs
9dec963dd964716405adbe9ef9006de7
452d05a5ad2fdd2b8f45b878b2078900b9f072b2
585f829c600736a9613d0870c6460068d9461a7be35c07149fe58143b2f24b6f
701a346228708332063529695210309a
651daa1d0e25c515d8ec9e40627efa0e572de9b7
ea755fc9ed86a2a8fd8712e76e1a8ebc2d871ec143b53f4abd3ef4d9150263fa
b102452e6d92a217995f4ca5523d0b85
ce297b51992a43698b61467beb7b1bae55605037
5be14f4258ed8d96da626dff4c8980f121208c45595639ba1fbeb9f895debaa4

File 4

Software\Microsoft\Windows\CurrentVersion\RunOnce
PROTOZOA.exe
PROTOZOA.vbs
Irs letter with W2.doc

Link 2

https://laskowski-tech.com/2020/02/17/what-is-this-bad-for-sure-racoon-stealer-maybe/Walkthrough writeup of malware execution
https://www.virustotal.com/gui/file/585f829c600736a9613d0870c6460068d9461a7be35c07149fe58143b2f24b6f/detection

Malware sample 3

PROTOZOA.exe|9dec963dd964716405adbe9ef9006de7
PROTOZOA.vbs|701a346228708332063529695210309a
Irs letter with W2.doc|b102452e6d92a217995f4ca5523d0b85

Size in bytes 3

36864
104
717585

Text 1

7/72 initially, later 38/70

Community reviews

Loading reviews…