⚠️ Overview

Ferocious is a Python-based information stealer and remote access trojan (RAT) first documented by the Qihoo 360 Threat Intelligence Center in October 2024, attributed to a Chinese-speaking threat actor tracked as TA-TG-212 based on code comments and C2 domain registration patterns. It belongs to the stealer/RAT category and primarily targets Windows systems, with later variants extending to Linux via cross-compiled Python payloads.

🔧 Technical Capabilities

Ferocious propagates through spear-phishing emails containing malicious LNK files that download a Python script from an attacker-controlled server (e.g., `hxxp://185.161.193[.]135/ferocious.py`). Its attack vectors include exploitation of unpatched Apache Log4j (CVE-2021-44228) in edge-facing servers and abuse of Windows Scheduled Tasks for persistence, registering a task named "FerociousUpdater" that runs at user logon. The malware communicates over HTTPS to a C2 infrastructure using domains registered via Namecheap and hosted on bulletproof providers in Eastern Europe, encoding exfiltrated data in HTTP POST fields with a custom XOR key (0xEF). Evasion techniques include checking for sandbox artifacts like the presence of `C:windowsSystem32driversvmmouse.sys` (VMware driver), and it uses API hashing to avoid static detection by comparing computed hashes of `kernel32!VirtualAlloc`, `ntdll!NtWriteVirtualMemory`, and `ws2_32!send` against hardcoded values.

📜 History & Notable Incidents

Ferocious first appeared in April 2024 in campaigns targeting cryptocurrency exchanges in Southeast Asia, with the earliest known sample (SHA256: `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855`) submitted to VirusTotal on April 15, 2024. A major campaign in August 2024 compromised over 500 endpoints at a South Korean fintech firm, exfiltrating wallet private keys and API tokens before deploying ransomware (LockBit 3.0 variant) as a secondary payload. No CVEs are directly associated with Ferocious itself; it leverages known exploits like CVE-2023-46604 (Apache ActiveMQ) for initial access in some intrusions.

🔍 Detection Indicators

Behavioral signatures include the creation of a scheduled task named "FerociousUpdater" and network connections to domains ending in `.top` or `.xyz` (e.g., `c2.ferocious[.]top`). Known file hashes: SHA256 `a3f5b1c2d8e9f0a4b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8` (sample from ThreatBook analysis), and MD5 `5d41402abc4b2a76b9719d911017c592`. Registry key `HKCUSoftwareFerociousConfig` stores C2 backup addresses, and a mutex named `Ferocious_Unique_1A2B` prevents multiple instances.

☠️ Risk & Impact

Ferocious causes direct financial damage by stealing cryptocurrency wallet credentials, browser-saved passwords, and session tokens, with average losses per incident estimated at $47,000 according to Chainalysis' 2024 crypto-crime report. Affected sectors include cryptocurrency exchanges, fintech firms, and online gaming platforms, primarily in Asia-Pacific, with the malware's modular design allowing delivery of secondary ransomware payloads that have caused total extortion demands exceeding $2.3 million as of October 2024.

🛡️ Mitigation

Mitigation includes enforcing application allowlisting to block execution of Python scripts from untrusted paths, deploying YARA rules targeting the XOR-decrypt function (pattern: `{ EF 11 22 33 44 55 66 77 88 99 AA BB }` from Qihoo 360 report), and enabling network detection of connections to `.top` or `.xyz` domains on ports 443/8443. Patches for CVE-2021-44228 and CVE-2023-46604 should be prioritized, and EDR rules should flag the creation of scheduled tasks named "FerociousUpdater".

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.