Severity
Medium
Analysis Summary
A memory loader tool called Ezuri is used by TeamTNT and other threat actors to hide their malware from detection. It is designed to work on Linux hosts as opposed to Windows. The tool is open source and can be used by attackers to execute malware in memory instead of writing the payload to a disk. When an attacker runs the Ezuri tool, they provide the path to the file they want to be encrypted, the destination process name, and, optionally, an AES key for encryption. The generated executable can then be run on a victim host in order to infect them with the attacker’s malware. This is done by decrypting the embedded payload and using “memfd create” to create the target process. Ezuri loader leads to a lower detection rate by AV vendors. TeamTNT used the Ezuri loader to install their cryptomining and stealer malware. Additionally, the researchers were able to identify Gafgyt samples packed using Ezuri.
Impact
- Malware code execution
- Detection evasion
Indicators of Compromise
MD5
- 283e0172063d1a23c20c6bca1ed0d2bb
- 849b45fee92762d2b6ec31a11e1bcd76
- 38071b617742b9a85178ced8de20bf99
- 4f754627122b7b0080ad74c22fc22c97
- 731e88ae5f22ba01372a3b0cc5adccdf
- b8568c474fc342621f748a5e03f71667
- da5ae0f2a4b6a52d483fb006bc9e9128
SHA-256
- 0a569366eeec52380b4462b455cacc9a788c2a7883b0a9965d20f0422dfc44df
- 35308b8b770d2d4f78299262f595a0769e55152cb432d0efc42292db01609a18
- b494ca3b7bae2ab9a5197b81e928baae5b8eac77dfdc7fe1223fee8f27024772
- ddbb714157f2ef91c1ec350cdf1d1f545290967f61491404c81b4e6e52f5c41f
- 751014e0154d219dea8c2e999714c32fd98f817782588cd7af355d2488eb1c80
- e15550481e89dbd154b875ce50cc5af4b49f9ff7b837d9ac5b5594e5d63966a3
- e1836676700121695569b220874886723abff36bbf78a0ec41cce73f72c52085
SHA1
- 08ee7bdd0e015e6ab7a8893254b62b2c2a4a18c7
- 06c3b12889b25548c040c8f7e3ea6991fd480979
- 2bf984fad801fada75c94ef9f4cb678d29004d9c
- 0c14f26fc759a0300491aa55ecca1438cee740ba
- 893db829a8b0af8e37f3e0c25d63779afdc575b9
- b10b1b6e88198c6abe3c0d6af7defc992f4cc840
- 4251595dbb718364566a74cb761e745f103d85a1
Remediation
- Block the threat indicators at their respective controls.
- Ensure anti-virus software and associated files are up to date.
- Keep all systems and software updated to latest patched versions.