We encountered a new loader advertised as "Morpheus" in underground forums 🕵️, recently dropped by #Amadey ⬇️🪲. Morpheus' C2 protocol is based on HTTP and works with tasks, where each task consists of an ID and a command 📣 Botnet C2: sophos-upd-srv .info 🇳🇱 The #malware accepts two command line parameters: ➡️ log: Path where debug logs are stored ➡️ update-url: URL used by the self-update process #Morpheus has the following capabilities 💡: 1⃣ Persistence through the Windows registry. It copies itself to the AppData Roaming directory under "SysSvc64.exe" and creates a new registry Run key that points to its location. 2⃣ A host-based ID generated by collecting the current time, hostname and the MAC address of the compromised host. 3⃣ Collects system information of the compromised host and sends them to a botnet C2, both, in the form of "HeartBeat" but also as Task command 4⃣ A self update mechanism, where it will download a new version of itself, write it to disk with a ".tmp" suffix and immediately execute it. The current running instance will then exit. 5⃣ Execution of various actions based on the commands received from the #botnet C2 The commands received from the botnet C2 come as a JSON object with two properties: "id" and "command". The following command-values are supported: ℹ️ sysinfo: Collects the following information from the compromised host: - Installed AV - CPU (number of cores, architecture) - Available Hard Disk (name, free space, total space) - Domain (is domain joined, domain name) - Available Memory (free, total) - Network ( addresses, MAC, name) - Processes (name, PID) - Installed Apps 💥 selfdestruct: Deletes the Registry Run key and the executable from the disk running the command "/C ping 127.0.0.1 -n 3 > nul & del /f /q {sample_path}" 🌐 Anything starting with http/https: Downloads the files from the aforementioned URL and writes it to Windows Temp directory, using the current time as a name (nanoseconds since epoch). The file is then executed using the 'open' command of Windows. 💻 If there is no match from the above, but the command length is not zero, it will execute the value using "cmd". A Morpheus sample is available on MalwareBazaar: 📄 bazaar.abuse.ch/sample/6e1b1… IOCs are available on ThreatFox: 🦊 threatfox.abuse.ch/browse/ma…