0x2038: Update the beacon interval based on a value in the configuration.

0x2031: Upload the current configuration.

0x2029: Deactivate until new start date and time.

0x2028: Update the beacon interval based on a value provided by the C2 server.

0x2009: Upload basic system information.

There are several supported command IDs and here below we have mentioned them:. The DAVESHELL program is used to drop the final payload into memory directly:. Using the enclosed credentials, the program will deploy in the form of a DLL packed with Themida a malicious DAVESHELL shellcode payload which will be executed upon successful SSH connection. There is a modification in PuTTY’s “connect_to_host()” function that is being used by the hackers. There is no difference between this version and the legitimate version, and it is fully functional.

Using the legitimate program, the threat actors compile the PuTTY executable file.

As a result, there will be a significant difference in the size of the legitimate version compared with the tampered version. There was a malicious payload installed in the data section of the PuTTY application shared by the hackers. In regards to the discussion between threat actors and victims, it is not known what was discussed between them. It is believed that the threat actors used the file name ‘Amazon-KiTTYexe’ to impersonate the KiTTY SSH client. A trojanized version of PuTTY (PuTTY.exe).In the next step, they will communicate through WhatsApp, where they will share a file containing the ISO image:-įiles that are included in the ISO are as follows: Threat actors begin the attack by emailing their targets with a lucrative job offer from Amazon in an attempt to lure them into the attack. As part of this campaign, which has been running since June 2020, media companies are being targeted at this time.

In the latest activities carried out by the group, it appears that the campaign ‘Operation Dream Job’ is being continued. The cybersecurity researchers at Mandiant have associated this campaign with the threat group known as ‘UNC4034’, and here below we have mentioned the other names of this group:.

Download kitty putty