Researchers Identify Five Servers Potentially Linked to SpiceRAT
Summary
Hunt.io researchers matched a distinctive HTML response to five IP addresses potentially linked to SpiceRAT, examined associated domains, and reported that only one was still active at the time of publication.
Key points
- Researchers searched for servers returning the HTML response “<HTML>RESPONSE</HTML>,” identified in prior Cisco Talos research on SpiceRAT.
- The response content had SHA-1 hash df608e9587f37a5d7f13deaa99d312b4acda463c.
- Five IP addresses matched the response; the article says only one remained active at publication, while the others were historical.
- Associated domains included apparent impersonations of telecommunications, email, browser, and communications services.
- One IP was associated with a file named chromeupdate.zip that Talos had also identified as communicating with SpiceRAT.
- The article links the infrastructure to suspected SpiceRAT activity but says a possible Uzbekistan connection requires further investigation.
Article Details
- Attack Vectors
- SneakyChef reportedly used HTA or LNK files in two infection chains to deploy SpiceRAT.
- SpiceRAT collects information from the victim’s machine and sends encrypted victim data to its C2 server.
- The article identifies suspected C2 infrastructure by matching an HTML response pattern and associates additional IP addresses and domains with SpiceRAT.
- Defensive Notes
- The article recommends using malware-report findings, including distinctive C2 response patterns, to identify additional infrastructure.
- The article notes that several identified IP addresses were historical and only one was still active at the time of writing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA1 | 1bb0a205953c1c86c058bcf428ea15b2f5b25020 | SHA-1 of the archive file identified as SpiceRAT. |
| SHA1 | df608e9587f37a5d7f13deaa99d312b4acda463c | SHA-1 of the HTML response pattern used to identify suspected SpiceRAT C2 infrastructure. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoverySpiceRAT reportedly gathers the victim machine’s IP address and MAC address.T1033 · System Owner/User DiscoverySpiceRAT reportedly gathers the victim machine’s username.T1071.001 · Web ProtocolsThe article describes SpiceRAT sending encrypted victim data to its C2 server and identifies the server through HTTP requests and responses.T1082 · System Information DiscoverySpiceRAT reportedly gathers the victim machine’s operating system version.T1105 · Ingress Tool TransferThe article says SpiceRAT includes downloaded plugins.
People
Threat Actors
Malware
SpiceRATinfrastructure not highlighted in the initial findings. A recent blog post by Cisco Talos highlighted SpiceRAT, a remote access trojan targeting organizations in Asia, Europe, the Middle East, and Africa.SugarGh0st RATto a newly discovered group named SneakyChef, who, according to reporting, also has access to the SugarGh0st RAT.
Products
Mozilla Firefoxconnected to Turkmenistan, suggesting an affiliation with Mozilla, the renowned organization behind the Firefox browser.Roundcube WebmailFigure 4: IP with two resolving domains, one likely impersonating RoundCube email.The next IP under examination, 45.144.31_244, resolves to two domains: webmail.roundcube_email and update.mozilia-tm_com—the former
Countries
Angoladomain and response identified by a red bug on port 80. (Try it here)SneakyChef targeted the country of Angola with actual documents from a Turkmenistan news agency. As shown in the above screenshot, the domainTurkmenistanbug on port 80. (Try it here)SneakyChef targeted the country of Angola with actual documents from a Turkmenistan news agency. As shown in the above screenshot, the domain update.telecom-tm_com closely mimics theUzbekistanone day in March of this year (Figure 9)—the domain site.yoshlar_info suggests a possible connection to Uzbekistan, indicating a broader geographic scope to these attacks, though further investigation is necessary to