Elastic Details BRUSHWORM and BRUSHLOGGER Malware Found at South Asian Financial Institution
Summary
Elastic Security Labs analyzed BRUSHWORM and BRUSHLOGGER, custom malware found at a South Asian financial institution. The tools combine scheduled-task persistence, modular payload downloads, USB-based spread and file theft, and system-wide keylogging.
Key points
- Elastic Security Labs found two custom malware components on a South Asian financial institution’s infrastructure: BRUSHWORM, a backdoor, and BRUSHLOGGER, a keylogger.
- BRUSHWORM uses Windows scheduled tasks for persistence and downloads a DLL payload from resources.dawnnewsisl[.]com/updtdll; investigators could not recover that payload.
- BRUSHWORM spreads through removable drives using lure-named copies and can stage collected files on USB drives when internet access is unavailable.
- BRUSHLOGGER masquerades as libcurl.dll for DLL side-loading and captures system-wide keystrokes with active-window context; its logs are XOR-obfuscated.
- Analysis found basic sandbox checks and development builds on VirusTotal; Elastic assessed the author as likely inexperienced, with moderate confidence.
- Elastic published YARA rules and observables to help detect the two malware components.
Article Details
- Attack Vectors
- BRUSHWORM establishes persistence through Windows scheduled tasks named MSGraphics and MSRecorder, and downloads a DLL payload from its C2 endpoint.
- BRUSHWORM spreads through removable drives using lure-named copies and can copy stolen files to USB drives for transfer from systems without internet access.
- BRUSHWORM collects files with targeted document, archive, email, and code extensions from local and removable storage.
- BRUSHLOGGER uses DLL side-loading while masquerading as libcurl.dll and captures system-wide keystrokes with foreground-window context.
- Defensive Notes
- Elastic Security created YARA rules to identify BRUSHWORM and BRUSHLOGGER.
- Investigate the scheduled tasks MSGraphics and MSRecorder, the C2 resource, and the reported sample hashes.
- Check for BRUSHWORM staging and installation paths, including C:\Users\Public\Systeminfo and C:\ProgramData\Photoes\Pics, and for the reported keylogger log path pattern under C:\programdata\Photoes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 4f1ea5ed6035e7c951e688bd9c2ec47a1e184a81e9ae783d4a0979501a1985cf | SHA-256 hash of the BRUSHLOGGER sample libcurl.dll. |
| SHA256 | 89891aa3867c1a57512d77e8e248d4a35dd32e99dcda0344a633be402df4a9a7 | SHA-256 hash of the BRUSHWORM sample paint.exe. |
MITRE ATT&CK
T1005 · Data from Local SystemBRUSHWORM searches local and removable storage for targeted file types and stages collected files.T1052 · Exfiltration Over Physical MediumWhen internet connectivity is unavailable, BRUSHWORM copies stolen files to removable drives for physical transfer.T1053.005 · Scheduled TaskBRUSHWORM creates the MSGraphics scheduled task for persistence and the MSRecorder task to execute the downloaded DLL.T1056.001 · KeyloggingBRUSHLOGGER installs a system-wide low-level keyboard hook and records keystrokes with foreground-window context.T1071.001 · Web ProtocolsBRUSHWORM communicates with its C2 and retrieves payloads over web protocols.T1091 · Replication Through Removable MediaBRUSHWORM copies itself to connected removable drives using socially engineered filenames.T1105 · Ingress Tool TransferBRUSHWORM uses WinHTTP to download a DLL payload from its C2 resource.T1218.011 · Rundll32The MSRecorder scheduled task uses rundll32.exe to load and run the downloaded Recorder.dll.T1497.001 · System ChecksThe malware checks screen resolution, machine names, hypervisor information, and mouse activity to detect analysis environments.T1574.001 · DLLBRUSHLOGGER masquerades as libcurl.dll and executes its malicious functionality through DLL side-loading.
Malware
BRUSHLOGGERestablishes persistence, downloads plugins, spreads via USB, and steals a broad set of file types; and BRUSHLOGGER, a DLL side-loading keylogger that captures system-wide keystrokes with window context and writesBRUSHWORMElastic Security Labs discovered two custom tools deployed against a South Asian financial institution: BRUSHWORM, a modular backdoor that establishes persistence, downloads plugins, spreads via USB, and steals a broad