DDKONG Plugin : SHA256 : 0EB1D6541688B5C87F620E76219EC5DB8A6F05732E028A9EC36195D7B4F5E707 .


DDKONG Plugin : Compile Date and Time : 2017-02-17 08:33:45 AM .


DDKONG Plugin : File Type : PE32 executable ( DLL ) Intel 80386, for MS Windows .


DDKONG Plugin : File Name : H istory.nls .


The DllInstall export function is responsible for the core behavior of the malware , as just loading it does nothing .


Once this export is called , it checks for a hidden window with a caption of Hello Google !


This check is performed to ensure that only one instance of the malware is running at a time .


The hidden window created by the malware filters on any user input ( e.g . keyboard or mouse activity ) .


This could be an attempt to evade sandbox analysis as mouse and keyboard movement is typically not performed .


The malware then proceeds to beacon to a configured remote server of cswksfwq.kfesv.xyz on TCP port 8080 .


Upon successful connection , the malware transmits victim information such as : hostname , IP address , Language Pack along with other operating system information .


The data transmitted are XOR encoded .


The malware supports the following capabilities : Terminate specific process、Enumerate processes、Upload file、Download file、Delete file、List folder contents、Enumerate storage volumes、Execute a command、Reverse shell、Take a screenshot .


KHRAT : SHA256 : aaebf987b8d80d71313c3c0f2c16d60874ffecbdda3bb6b44d6cba6d380 .


KHRAT : Compile Date and Time : 2018-05-02 05:22:23 PM .


KHRAT : File Type : PE32 executable ( DLL ) Intel 80386, for MS Windows .


KHRAT : File Name : 8081.dll .


Rmcmd :


When the DLL is initially loaded , it dynamically resolves and imports additional modules ( DLLs ’ ) needed .


Once loaded and the export entry of Rmcmd is called , it creates a Windows mutex named gkdflbmdfk .


This ensures that only one copy of the malware is running at a time .


It then begins to beacon to a configured domain of connect.bafunpda.xyz on TCP port 8081 .


The malware collects and transmits data from the host , such as hostname and is XOR encoded with the first byte of the network traffic being the key .


Reverse Shell :


The malware behavior and code share similarities with an older KHRAT sample from May 2018 .


Sample ( SHA256 : bc1c3e754be9f2175b718aba62174a550cdc3d98ab9c36671a58073140381659 ) has the same export entry name and is also a reverse shell .


The newer sample appears to be a re-write for optimization purposes with the underlying behavior remaining the same , reverse shell .


Derusbi : SHA256 : 83d1d181a6d583bca2f03c3c4e517757a766da5f4c1299fbbe514b3e2ab .


Derusbi : Compile Date and Time : 2012-09-14 09:20:12 AM .


Derusbi : File Type :P E32 executable ( DLL ) Intel 80386, for MS Windows .


Derusbi : File Name : 32.dll .


Derusbi is a backdoor Trojan believed to be used among a small group of attackers , which includes the Rancor group .


This particular sample is a loader that loads an encrypted payload for its functionality .


This DLL requires the loading executable to include a 32-byte key on the command line to be able to decrypt the embedded payload , which unfortunately we do not have .


Even though we don’t have the decryption key or loader , we have uncovered some interesting artifacts .


If the module that loads the sample is named myapp.exe the module will exit Once loaded , it sleeps for six seconds .


Looks for a Windows pipe named \\.\pipe\_kernel32.dll.ntdll.dll.user32.dll .


Looks for a Windows device named \Device\acpi_010221 . n July 2019 , we discovered an interesting VBScript named Chrome.vbs ( SHA256 : 0C3D4DFA566F3064A8A408D3E1097C454662860BCACFB6675D2B72739CE449C2 ) associated with the Rancor group .


This particular VBScript payload beacons to domain bafunpda.xyz , which is also used by the KHRAT Trojan listed above in Table 2 .


This VBScript is obfuscated and contains packed data that is used to infect a target with multiple chained persistent artifacts .


The MOF file created by the VBScript is used as a persistence mechanism via Windows Management Instrumentation ( WMI ) Event Subscriptions .


MOF files are compiled scripts that describe Common Information Model ( CIM ) classes , which are compiled into the WMI repository .


The technique is described by MITRE ATT&CK IDT1084 .


This particular MOF file creates a timer event that is triggered every five seconds .


The DLL located in the Media registry key is a variant of the KHRAT Troja .


It beacons to domain connect.bafunpda.xyz and attempts to connect to TCP port 4433 .


This is the same domain used by the KHRAT Trojan .


Rancor , a cyber espionage group active since at least 2017 , continues to conduct targeted attacks in Southeast Asia and has been found using an undocumented , custom malware family – which we ’ve dubbed Dudell – to download a second stage payload once its malicious macro is executed .


Additionally , Rancor is also using the Derusbi malware family to load a secondary payload once it infiltrates a target .


Rancor : 0EB1D6541688B5C87F620E76219EC5DB8A6F05732E028A9EC36195D7B4F5E707 .


Rancor : AAEBF987B8D80D71313C3C0F2C16D60874FFECBDDA3BB6B44D6CBA6D38031609 .


Rancor : 0D61D9BAAB9927BB484F3E60384FDB6A3709CA74BC6175AB16B220A68F2B349E .


Rancor : DB982B256843D8B6429AF24F766636BB0BF781B471922902D8DCF08D0C58511E .


Rancor : CC081FFEA6F4769733AF9D0BAE0308CA0AE63667FA225E7965DF0884E96E2D2A .


Rancor : BC1C3E754BE9F2175B718ABA62174A550CDC3D98AB9C36671A58073140381659 .


Rancor : 83d1d181a6d583bca2f03c3c4e517757a766da5f4c1299fbbe514b3e2abd9e0d .


Rancor : cswksfwq.kfesv.xyz .


Rancor : Connect.bafunpda.xyz .


Rancor : 199.247.6.253 .


Cyberwarfare : A deep dive into the latest Gamaredon Espionage Campaign .


Gamaredon Group is a Cyber Espionage persistent operation attributed to Russians FSB ( Federal Security Service ) in a long-term military and geo-political confrontation against the Ukrainian government and more in general against the Ukrainian military power .


Gamaredon has been active since 2014 , and during this time , the modus operandi has remained almost the same .


The most used malware implant is dubbed Pteranodon or Pterodo and consists of a multistage backdoor designed to collect sensitive information or maintaining access on compromised machines .


It is distributed in a spear phishing campaign with a weaponized ofﬁce document that appears to be designed to lure military personnel .


In the recent months , Ukrainian CERT ( CERT-UA ) reported an intensiﬁcation of Gamaredon Cyberattacks against military targets .


The new wave dates back to the end of November 2019 and was ﬁrst analyzed by Vitali Kremez .


Starting from those ﬁndings , Cybaze-Yoroi ZLab team decided to deep dive into a technical analysis of the latest Pterodo implant .


The complex infection chain begins with a weaponized Ofﬁce document named “ f.doc ” .


Hash : 76ea98e1861c1264b340cf3748c3ec74473b04d042cd6bfda9ce51d086cb5a1a


Threat : Gamaredon Pteranodon weaponized document .


Brief Description : Doc ﬁle weaponized with Exploit .


Ssdeep : 768:u0foGtYZKQ5QZJQ6hKVsEEIHNDxpy3TI3dU4DKfLX9Eir : uG1aKQ5OwCrItq3TgGfLt9r .


The decoy document is written using the ukrainian language mixed to many special chars aimed to lure the target to click on it .


The document leverages the common exploit aka template injection and tries to download a second stage from “ http://win-apu.ddns.net/apu.dot ” .


Thanks to this  exploit ( Remote Code Execution exploit ) the user interaction is not required , in fact the “ enable macro ” button is not shown .


The downloaded document has a “ .dot ” extension , used by Microsoft Ofﬁce to save templates for different documents with similar formats .


Basic Information on the “ .dot ” ﬁle are provided :


Hash : e2cb06e0a5c14b4c5f58d0e56a1dc10b6a1007cf56c77ae6cb07946c3dfe82d8 .


Threat : Gamaredon Pteranodon loader dot ﬁle .


Brief Description : Dot ﬁle enabling the infection of the Gamaredon Pteranodon .


Ssdeep : 768:5KCB8tnh7oferuHpC0xw+hnF4J7EyKfJ : oI8XoWruHpp/P4 .


If we decide to open the document , we see that the document is empty , but it requires the enabling of the macro .


The body of the macro can be logically divided into two distinct parts :


The ﬁrst one is the setting of the registry key “ HKEY_CURRENT_USER\Software\Microsoft\Ofﬁce\ ” & Application.Version & _ ” \Word\Security\ ” and the declaration of some other variables , such as the dropurl “ geticons.ddns.net ” .


The second one is the setting of the persistence mechanism through the writing of the vbs code in the Startup folder with name “ templates.vbs ” .


This vbs is properly the macro executed by the macro engine of word .


Analyzing the content of “ templates.vbs ” it is possible to notice that it deﬁne a variable containing a URL like “ http://geticons.ddns.net/ADMIN-PC_E42CAF54//autoindex . ]php ” obtained from “ hxp://get-icons.ddns . ]net/ ” & NlnQCJG & “ _ ” & uRDEJCn & “ //autoindex . ]php ” , where “ NlnQCJG ” is the name that identiﬁes the computer on the network and “ uRDEJCn ” is the serial number of drive in hexadecimal encoding .


From this URL it tries to download another stage then storing it into “ C:\Users\admin\AppData\Roaming\ ” path with random name .


At the end , “ templates.vbs ” script will force the machine to reboot .


The dropped sample is an SFX archive , like the tradition of Gamaredon implants .


Hash : c1524a4573bc6acbe59e559c2596975c657ae6bbc0b64f943fffca663b98a95f .


Threat : Gamaredon Pteranodon implant SFX archive .


Brief Description : SFX Archive First Stage .


Ssdeep : 24576:zXwOrRsTQlIIIIwIEuCRqKlF8kmh/ZGg4kAL/WUKN7UMOtcv : zgwR/lIIIIwI6RqoukmhxGgZ+WUKZUMv .


By simply opening the SFX archive , it is possible to notice two different ﬁles that are shown below and named respectively “ 8957.cmd ” and “ 28847 ” .


When executed , the SFX archive will be extracted and the “ 8957.cmd ” will be run .


At this point , the batch script renames the “ 28847 ” ﬁle in “ 28847.exe ” , opens it using “ pﬂjk ,fkbcerbgblfhs ” as password and the ﬁle contained inside the “ 28847.exe ” ﬁle will be renamed in “ WuaucltIC.exe ” .


Finally , it will be run using “ post.php ” as argument .


The fact that the “ 28847.exe ” ﬁle can be opened makes us understand that  the “ 28847 ” ﬁle is another SFX ﬁle .


Some static information about SFX are :


Hash : 3dfadf9f23b4c5d17a0c5f5e89715d239c832dbe78551da67815e41e2000fdf1 .


Brief Description : SFX Archive Second Stage .


Ssdeep : 24576:vmoO8itbaZiW+qJnmCcpv5lKbbJAiUqKXM : OoZwxVvfoaPu .


Exploring it , it is possible to see several ﬁles inside of it ,  as well as the 6323 ﬁle .


In this case , the SFX archive contains 8 ﬁles : ﬁve of them are legit DLLs used by the “ 6323 ” executable to interoperate with the OLE format deﬁned and used by Microsoft Ofﬁce .


The “ ExcelMyMacros.txt ” and “ wordMacros.txt ” ﬁles contain further macro script , described next .


So , static analysis on the “ 6323 ” ﬁle shown as its nature : it is written using Microsoft Visual Studio .NET , therefore easily to reverse .


Before reversing the executable , it is possible to clean it allowing the size reduction and the junk instruction reduction inside the code .


The below image shows the information about the sample before and after the cleaning .


The ﬁrst check performed is on the arguments : if the arguments length is equal to zero , the malware terminates the execution .


After that , the malware checks if the existence of the ﬁles “ ExcelMyMacros.txt ” and “ wordMacros.txt ” in the same path where it is executed : if true then it reads their contents otherwise it will exit .


As visible in the previous ﬁgure , the only difference between the ﬁles are in the variable , registry key and path used by Word rather than by Excel .


Finally the macros are executed using the Ofﬁce engine .


So let ’s start to dissect the macros .


For a better comprehension we will be considering only one macro and in the speciﬁc case we will analyze “ wordMacros.txt ”   ones .


First of all the macro will set the registry key “ HKEY_CURRENT_USER\Software\Microsoft\Ofﬁce\ ” & Application.Version & _ ” \Word\Security\ ” and then will set up two scheduled tasks that will start respectively every 12 and 15 minutes : the ﬁrst one will run a “ IndexOfﬁce.vbs ” in the path “ %APPDATA%\Microsoft\Ofﬁce\ ” and the second one will run “ IndexOfﬁce.exe ” in the same path .


Finally , the malware will write the “ IndexOfﬁce.txt ” ﬁle in the  “ %APPDATA%\Microsoft\Ofﬁce\ ” path .


The script will check the presence of the  “ IndexOfﬁce.exe ” artifact : if true then it will delete it and it will download a new ﬁle/script from “ http://masseffect.space/<PC_Name>_<Hex_Drive_SN>/post.php ” .


The malware tries to save the C2 response and encoding it using Encode function .


This function accepts three parameters : the input ﬁle , the output ﬁle and the arrKey ; arrKey is calculated thanks to  GetKey function that accepts as input the Hexadecimal value of the Driver SN installed on the machine and returns the key as results .


Gamaredon cyberwarfare operations against Ukraine are still active .


This technical analysis reveals that the modus operandi of the Group has remained almost identical over the years .


The massive use of weaponized Ofﬁce documents , Ofﬁce template injection , sfx archives , wmi and some VBA macro stages that dinamically changes ,  make the Pterodon attack chain very malleable and adaptive .


However , the introduction of a .Net component is a novelty compared to previous Pterodon samples .


Gamaredon : 76ea98e1861c1264b340cf3748c3ec74473b04d042cd6bfda9ce51d086cb5a1a .


Gamaredon : e2cb06e0a5c14b4c5f58d0e56a1dc10b6a1007cf56c77ae6cb07946c3dfe82d8 .


Gamaredon : def13f94cdf793df3e9b42b168550a09ee906f07f61a3f5c9d25ceca44e8068c .


Gamaredon : c1524a4573bc6acbe59e559c2596975c657ae6bbc0b64f943fffca663b98a95f .


Gamaredon : 86977a785f361d4f26eb3e189293c0e30871de3c93b19653c26a31dd4ed068cc .


Gamaredon : http://win-apu.ddns.net/apu.dot/ .


Gamaredon : http://get-icons.ddns.net/apu.dot/ .


Gamaredon : http://masseffect.space/ .


JhoneRAT : Cloud based python RAT targeting Middle Eastern countries .


Today , Cisco Talos is unveiling the details of a new RAT we have identified we 're calling " JhoneRAT " .


This new RAT is dropped to the victims via malicious Microsoft Office docume .


The dropper , along with the Python RAT , attempts to gather information on the victim 's machine and then uses multiple cloud services : Google Drive , Twitter , ImgBB and Google Forms .


The RAT attempts to download additional payloads and upload the information gathered during the reconnaissance phase .


This particular RAT attempts to target a very specific set of Arabic-speaking countries .


The filtering is performed by checking the keyboard layout of the infected systems .


Based on the analysed sample , JhoneRAT targets Saudi Arabia , Iraq , Egypt , Libya , Algeria , Morocco , Tunisia , Oman , Yemen , Syria , UAE , Kuwait , Bahrain and Lebanon .


The campaign shows an actor that developed a homemade RAT that works in multiple layers hosted on cloud providers .


JhoneRAT is developed in python but not based on public source code , as it is often the case for this type of malware .


The attackers put great effort to carefully select the targets located in specific countries based on the victim 's keyboard layout .


Everything starts with a malicious document using a well-known vulnerability to download a malicious document hosted on the internet .


For this campaign , the attacker chose to use a cloud provider ( Google ) with a good reputation to avoid URL blacklisting .


The malware is divided into a couple of layers — each layer downloads a new payload on a cloud provider to get the final RAT developed in python and that uses additional providers such as Twitter and ImgBB .


This RAT is a good example of how a highly focused attack that tries to blend its network traffic into the crowd can be highly effective .


In this campaign , focusing detection of the network is not the best approach .


Instead , the detection must be based on the behaviour on the operating system .


Attackers can abuse well-known cloud providers and abuse their reputations in order to avoid detection .


The fact that this attacker decided to leverage cloud services and four different services — and not their own infrastructure — is smart from an opsec point of view .


It is hard for the targets to identify legitimate and malicious traffic to cloud provider infrastructure .


Moreover , this kind of infrastructure uses HTTPS and the flow is encrypted that makes man-in-the-middle interception more complicated for the defender .


It is not the first time an attacker used only cloud providers .


Even while using these services , the authors of this JhoneRAT went further and used different user-agent strings depending on the request , and even on the downloaders the authors used other user-agent strings .


We already published a couple of articles about ROKRAT ( here , here , here and here ) where another unrelated actor , Group123 , made the same choice but with different providers .


The attacker implemented filtering based on the keyboard 's layout .


The malware is executed only for the following layout , the country is based on the Microsoft website :


' 0401 ' : Saudi Arabia . ' 0801 ' : Iraq . ' 0c01 ' : Egypt . ' 1001 ' : Libya . ' 1401 ' : Algeria . ' 1801 ' : Morocco . ' 1c01 ' : Tunisia . ' 2001 ' : Oman . ' 2401 ' : Yemen . ' 2801 ' : Syria . ' 3801 ' : UAE . ' 3401 ' : Kuwait . ' 3c01 ' : Bahrain . ' 3001 ' : Lebanon .


We identified three malicious Microsoft Office documents that download and load an additional Office document with a Macro .


The oldest one from November 2019 , named " Urgent.docx " .


The author of the document asks to enable editing in English and in Arabic .


The second document from the beginning of January is named " fb.docx " and contains usernames and passwords from an alleged " Facebook " leak .


The more recent document is from mid-January and alleged to be from a United Arab Emirate organization .


The author blurred the content and asks the user to enable editing to see the content .


In the three documents , an additional Office document containing a Macro is downloaded and executed .


The documents are located on Google Drive .


The template located on Google Drive contains a macro .


The macro contains a virtual machine detection technique based on the serial number of the disks available in the victim environment .


Indeed , some VMs do not have serial numbers and the macro is executed only if a serial number exists .


A WMIC command is executed to get this information on the targeted system .


If a serial number exists , the rest of the code is executed .


The purpose is to download an image from a new Google Drive link .


It is interesting to note that the filename of the downloaded image is randomly generated based on a dictionary : Array ("cartoon" , "img" ,"photo") .


The filename will be cartoon.jpg or img.jpg or photo.jpg and the image usually depicts a cartoon .


The image file is a real image with a base64-encoded binary appended at the end .


The malware author has a curious sense of humor .


The base64 data and image are separated by the " **** " string .


The decoded binary filename is also randomly generated based on a dictionary : Array("proc" , "chrome" , "winrar") .


It can be proc.exe or chrome.exe or winrar.exe .


The decoded base64 data is an AutoIT binary .


This binary downloads a new file on Google Drive .


The filename is also randomly generated based on a dictionary $ARRAY[5]=["prc" ,"winrar" ,"chrome" ,"sync" ,"COM surr"] .


The final payload is a remote access tool ( RAT ) written in python .


We named this RAT " JhoneRAT " .


The python code is wrapped into an executable using pyinstaller .


It uses minimal obfuscation applied only on variables and function naming .


The RAT starts by launching three threads .


The first is responsible for checking if the system has the targeted keyboard layout — this is exclusively in Arabic-speaking countries .


The second will create the persistence and , finally , the last one to be started is the main cycle for the RAT .


As we explained before , the RAT targets specific countries by checking the keyboard 's layout .


In fact , this is one of the first checks it performs when it is executed .


The persistence is achieved by adding an entry with the name " ChromeUpdater " to the ' Software\\Microsoft\\Windows\\CurrentVersion\\Run ' .


This RAT uses three different cloud services to perform all its command and control ( C2 ) activities .


It checks for new commands in the tweets from the handle @jhone87438316 ( suspended by Twitter ) every 10 seconds using the BeautifulSoup HTML parser to identify new tweets .


These commands can be issued to a specific victim based on the UID generated on each target ( by using the disk serial and contextual information such as the hostname , the antivirus and the OS ) or to all of them .


The Exfiltration , however , is done via other cloud providers .


The screenshots are exfiltrated via the ImgBB website .


The remaining commands send feedback by posting data into Google Forms .


Finally , the RAT is able to download files encoded in base64 on Google Drive .


Feature-wise , the RAT has three commands :


Take a screenshot and upload it to ImgBB .


Download binary disguised has a picture from Google Drive and execute it .


Execute a command and send the output to Google Forms .


The attacker put a couple of tricks in place to avoid execution on virtual machines ( sandbox ) .


The first trick is the check of the serial number of the disk .


The actor used the same technique in the macro and in the JhoneRAT .


By default , most of the virtual machines do not have a serial number on the disk .


The attacker used a second trick to avoid analysis of the python code .


The actor used the same trick that FireEye in the Flare-On 6 : Challenge 7: They removed the header of the python bytecode .


It can be perfectly executed without the header , but tools such as uncompyle6 need this header : $ uncompyle6 final2 .


ImportError : Unknown magic number 227 in final2 .


Additionally , the generated code by uncompyle6 varies depending on the version and the impact is important .


Based on our analysis and the behaviour of the executed malware , the correct interpretation is the first one based on the oldest version of uncompyle6 .


For this specific condition , it is important because it 's filtering on the keyboard layout to identify the targets .


This campaign shows a threat actor interested in specific Middle Eastern and Arabic-speaking countries .


It also shows us an actor that puts effort in opsec by only using cloud providers .


The malicious documents , the droppers and the RAT itself are developed around cloud providers .


Additionally the attackers implemented anti-VM ( and sandbox ) and anti-analysis tricks to hide the malicious activities to the analyst .


For example , the VM or the sandbox must have the keyboard layout of the targeted countries and a disk serial number .


This campaign started in November 2019 and it is still ongoing .


At this time , the API key is revoked and the Twitter account is suspended .


However , the attacker can easily create new accounts and update the malicious files in order to still work .


This campaign shows us that network-based detection is important but must be completed by system behaviour analysis .


JhoneRAT : 273aa20c4857d98cfa51ae52a1c21bf871c0f9cd0bf55d5e58caba5d1829846f .


JhoneRAT : 29886dbbe81ead9e9999281e62ecf95d07acb24b9b0906b28beb65a84e894091 .


JhoneRAT : d5f10a0b5c103100a3e74aa9014032c47aa8973b564b3ab03ae817744e74d079 .


JhoneRAT : 6cc0c11c754e1e82bca8572785c27a364a18b0822c07ad9aa2dc26b3817b8aa4 .


JhoneRAT : 7e1121fca3ac7c2a447b61cda997f3a8202a36bf9bb08cca3402df95debafa69 .


JhoneRAT : b4a43b108989d1dde87e58f1fd6f81252ef6ae19d2a5e8cd76440135e0fd6366 .


JhoneRAT : https://drive.google.com/uc?export=download&id=1vED0wN0arm9yu7C7XrbCdspLjpoPKfrQ .


JhoneRAT : https://drive.google.com/uc?export=download&id=1LVdv4bjcQegPdKrc5WLb4W7ad6Zt80zl .


JhoneRAT : https://drive.google.com/uc?export=download&id=1OlQssMvjb7gI175qDx8SqTgRJIEp5Ypd .


JhoneRAT : https://drive.google.com/uc?export=download&id=1d-toE89QnN5ZhuNZIc2iF4-cbKWtk0FD .


JhoneRAT : https://drive.google.com/uc?export=download&id=1kbHVkvPIjX49qJ62TBz6drW2YPiiaX2a .


JhoneRAT : https://twitter.com/jhone87438316 .


New Cyber Espionage Campaigns Targeting Palestinians - Part 2 : The Discovery of the New , Mysterious Pierogi backdoor .


Since December 2019 , the Cybereason Nocturnus team has been investigating a campaign targeting Palestinian individuals and entities in the Middle East , mostly within the Palestinian territories .


This campaign uses social engineering and decoy documents related to geopolitical affairs and relations between the Palestinian government , and references Egypt , Hezbollah , and Iran .


Part one of this research investigates the Spark campaign , where attackers use social engineering to infect victims , mainly from the Palestinian territories , with the Spark backdoor .


For more information about part one , click here .


During the attacks , victims are infected with a previously undocumented backdoor , dubbed Pierogi by Cybereason .


This backdoor allows attackers to spy on targeted victims .


Cybereason suspects that the backdoor may have been obtained in underground communities rather than home-grown , as the evidence found in the code of the backdoor suggests it may have been developed by Ukranian-speaking hackers .


The tactics , techniques , and procedures ( TTPs ) , content , and theme of the decoy documents , as well as the victimology observed in the campaign , resemble previous attacks that have targeted Palestinians .


In particular , these campaigns appear to be related to attacks carried out by a group called MoleRATs ( aka , Gaza Cyber Gang , Moonlight ) , an Arabic-speaking , politically motivated group that has been operating in the Middle East since 2012 .


Cyber Espionage with a New Malware : The Cybereason Nocturnus team has discovered recent , targeted attacks in the Middle East to deliver the Pierogi backdoor for politically-driven cyber espionage .


Using Geopolitically-charged Lure Content : The attackers use specially crafted lure content to trick their targets into opening malicious files that infect the victim ’s machine with the Pierogi backdoor .


The decoy content of the malicious files revolves around various political affairs in the Middle East , specifically targeting the tension between Hamas and other entities in the region .


Perpetrated by an Arabic-speaking APT , MoleRATs : The modus-operandi of the attackers as well as the social engineering decoy content seem aligned with previous attacks carried out by an Arabic-speaking APT group called MoleRATs ( aka Gaza Cybergang ) .


Similar to previous attacks , this campaign starts with social engineering .


In one instance , it lures victims to open an email attachment .


In others , it persuades victims to download a report about a recent political affair pertaining to the Middle East and specifically to Palestinian matters .


In most cases , the downloaded file is either an executable that masquerades as a Microsoft Word document or a weaponized Microsoft Word document .


As soon as the victim double-clicks on the dropper , they are presented with the decoy document .


The document lowers the victim ’s suspicions by distracting them with a real document while the dropper installs the backdoor .


However , some of the documents also play an additional role in the attack .


While some are more neutral , quoting from newspapers and the media , others seem to report fake news to spread misinformation that serves a political agenda .


With regards to decoy content themes , this campaign resembles previous campaigns reported in blogs by Vectra , Unit 42 , and Talos .


The contents of the decoy documents seems to include :


Potentially fake documents that appear to be issued by the Palestinian government .


Meetings minutes of different Palestinian organizations .


News about Hamas and the Palestinian National Authority .


Potentially fake , leaked Hamas documents .


Criticism of and embarrassing content about Hamas .


APA adopted resolution Unlimited support for Palestinian people.docx :


Describes a resolution by the Asian Parliamentary Assembly ( APA ) held in Anatalya , announcing unlimited support for the Palestinian people 7b4c736b92ce702fb584845380e237aa55ddb4ef693ea65a766c9d9890b3852c . jalsa.rar :


Contains the above mentioned document , as well as photos of the assemblies and political cartoons criticizing Hamas 50a597aa557084e938e2a987ec5db99187428091e8141e616cced72e6a39de1b .


Internet in government.pdf / Define the Internet in government institutions.pdf :


Announcement about a new regulation regarding internet usage in Palestinian government institutions .


The announcement states that porn , gambling and entertainment sites will be blocked 9e4464d8dc8a3984561a104a93a7b8d6eb3d622d5187ae1d3fa6f6dafa2231a8 .


Congratulations_Jan-7.pdf :


Letter allegedly from the Barcelona branch of the


Federation of Independent Palestinian Communities and Organizations and Events in the Diaspora .


The letter commemorates the 73rd anniversary of the Syrian Army , and expresses the Palestinian support of Bashar Al-Asad .


The letter ends with “ Death to Israel ” and “ Humiliation and shame to the tyrant America ” 65c8b9e9017ac84d90553a252c836c38b6a3902e5ab24d3a4b8a584e2d615fcc .


Daily_Report.docx :


Daily summary of news concerning different Palestinian govenment related issues d3771d58051cb0f4435232769ed11c0c0e6457505962ddb6eeb46d900de55428 .


Directory of Government Services.pdf :


A screenshot from a website of the Palestinian government , showing a directory of the different ministries 9e4464d8dc8a3984561a104a93a7b8d6eb3d622d5187ae1d3fa6f6dafa2231a8 .


Meeting Agenda.pdf :


Corrupted file f6876fd68fdb9c964a573ad04e4e0d3cfd328304659156efc9866844a28c7427 . imgonline-com-ua-dexifEEdWuIbNSv7G.jpg :


potentially leaked Hamas document detailing Hamas 32nd anniversary expenses in different regions in the Palestinian Territories 932ecbc5112abd0ed30231896752ca471ecd0c600b85134631c1d5ffcf5469fb .


Asala.mp3 :


An .mp3 file of a song by the famous Syrian singer Asala Nasri ( song name : Fen Habibi , translation : “ where is my loved one? ” ) 4583b49086c7b88cf9d074597b1d65ff33730e1337aee2a87b8745e94539d964 .


In addition to the documents , the content includes a number of political cartoons that criticize Hamas ’ relations with Iran and Hamas ’ standing as a resistance movement .


While the majority of infections in this campaign did not originate from Malicious Microsoft Word document , the Cybereason Nocturnus team found several weaponized Microsoft Word document with an embedded downloader macro that downloads and installs the backdoor used in this attack .


CV Manal 1 :


Resume of a woman from Abu-Dis , Palestinian Authority 4a6d1b686873158a1eb088a2756daf2882bef4f5ffc7af370859b6f87c08840f .


Employee-entitlements-2020.doc :


A statement of the Ministry of Finance on civil and military employee benefits and salaries , discussing the conterversial issue Palestinian Authority employees that have not been paid or paid in full their salaries b33f22b967a5be0e886d479d47d6c9d35c6639d2ba2e14ffe42e7d2e5b11ad80 .


When the victims open the document , they are encouraged to click on Enable Content , which causes the embedded malicious macro code to run .


The macro code embedded in the document is rather simple and is not obfuscated .


In fact , it is almost unusual in its unsophistication .


The macro code does the following :


Downloads a Base64 encoded payload from the following URL :


http://linda-callaghan.icu/Minkowski/brown .


Writes the decoded payload to C:\ProgramData\IntegratedOffice.txt .


Decodes the Base64 payload and writes the file to C:\ProgramData\IntegratedOffice.exe .


Runs the executable file and deletes the .txt file .


Pierogi , the backdoor in this attack , appears to be a new backdoor written in Delphi .


It enables the attackers to spy on victims using rather basic backdoor capabilities .


While it is unknown at this point whether the backdoor was coded by the same members of the group behind the attacks , there are indications that suggest that the malware was authored by Ukranian-speaking malware developers .


The commands used to communicate with the C2 servers and other strings in the binary are written in Ukrainian .


This is why we chose to name the malware Pierogi , after the popular East European dish .


The backdoor has the following capabilities :


Collects information about the infected machine .


Uploads files to the attackers ’ server .


Downloads additional payloads .


Takes screenshots from the infected machine .


Executes arbitrary commands via the CMD shell .


In addition to spy features , the backdoor also implements a few checks to ensure it is running in a safe environment .


Specifically , it looks for antivirus and other security products .


The backdoor queries Windows for installed antivirus software using WMI : SELECT * FROM AntiVirusProduct It looks for specific antivirus and security products installed on the infected machine , such as Kaspersky , eScan , F-secure and Bitdefender .


The backdoor achieves persistence using a classic startup item autorun technique :


A shortcut is added to the the startup folder : C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup .


Once the user logs on to the infected machine , the shortcut points to the file binary location in the C:\ProgramData\ folder .


The GUID generated by the malware is saved in a file called GUID.bin .


This file is created in the same folder as the binary of the backdoor


( C:\ProgramData\GUID.bin ) .


The backdoor has rather basic C2 functionality implemented through a predefined set of URLs :


1 .


Sending machine information and a heartbeat to the C2 :


URL : http://nicoledotson.icu/debby/weatherford/Yortysnr The information sent to the C2 includes :


cname :


computer name , username , and GUID . av : Name of detected antivirus . osversion : version of the operating system . aname : the location of the malware on the infected machine .


Requesting commands from the C2 server :


URL : http://nicoledotson.icu/debby/weatherford/Ekspertyza .


Ekspertyza means expertise or examination in Ukranian .


There are 3 basic commands coming from the server in the form of MD5 hashes :


Dfff0a7fa1a55c8c1a4966c19f6da452 : cmd . 51a7a76a7dd5d9e4651fe3d4c74d16d6 : downloadfile . 62c92ba585f74ecdbef4c4498a438984 : screenshot .


Uploading data ( mainly screenshots ) to the C2 :


URL : http://nicoledotson.icu/debby/weatherford/Zavantazhyty .


Zavantazhyty means to load or download in Ukranian .


This command is used to upload collected data to the C2 server .


For example , in some instances the backdoor uploads screenshots taken from an infected machine , as can be seen in the example below .


Removing information :


URL : http://nicoledotso.icu/debby/weatherford/Vydalyty .


Vydalyty means to remove or delete in Ukrainian .


The malware can delete various requests based on the command below .


The records of the domains and IPs involved in this campaign seem to show that the attackers created a new infrastructure specifically for this campaign .


The domains were registered in November 2019 and operationalized shortly after .


In part two of this research , we examined the Pierogi campaign .


Cybereason suspects this


campaign targets Palestinian individuals and entities in the Middle East , specifically directed at


those in the Palestinian government .


The threat actors behind the campaign use social engineering to infect their victims with the Pierogi backdoor for cyber espionage purposes .


The threat actor behind the attack invested considerable time and effort to lure their victims with specially-crafted documents that target Palestinian individuals and entities in the Middle East .


In our analysis , we reviewed the TTPs and the decoy content , and pointed out the similarities between previous attacks that have been attributed to MoleRATs , an Arabic-speaking , politically motivated group that has operated


in the Middle East since 2012 .


The Pierogi backdoor discovered by Cybereason during this investigation seems to be undocumented and gives the threat actors espionage capabilities over their victims .


Based on the Ukranian language embedded in the backdoor , Cybereason raises the possibility that the backdoor was obtained in underground communities by the threat actors , rather than developed in-house by the group .


We also considered the move as an obfuscation technique , as it was mixed with a lot of script kiddie activities that can easily be mistaken for grey noise online .


The attackers could hide their activities if they noted the business hours of the intended targets and performed the actions coinciding with said times .


2e2c9d08c7c955f6ce5e27e70b0ec78a888c276d71a72daa0ef9e3e40f019a1a install .


. 93ce211a71867017723cd78969aa4cac9d21c3d8f72c96ee3e1b2712c0eea494


We also found traces of Android Package Kits- ( APK- ) and Android Debug Bridge ( ADB )-based commands that enable cryptocurrency mining activities in Android-based TVs .


Furthermore , based on the group ’s use of dated exploits as vectors that companies would have likely addressed with monitoring and regular patching schedules , it appears that they ’re going after enterprises who have yet to patch their systems , as well as companies with internet-facing systems with weak to no monitoring of traffic and activities .


Considering the amount of resources needed to deploy all the necessary patches for an enterprise ( such as quality testing and operations alignment ) , which implies costly downtime for operations and the hesitation to update all systems immediately , Outlaw may find even more targets and victims for their updated botnets every time there is a patch released and waiting to be downloaded .


Save for a few iteration updates , combinations from previous deployments , and using the routines repetitively for every campaign , we found very little changes in the group ’s toolkit , which allowed various honeypots across the Eastern European region to detect many of the sent binaries .


Meanwhile , the group uses a wide range of IP addresses as input for scanning activities that are grouped by country , allowing them to attack certain regions or areas within particular periods of the year , as previously observed .


We think the group has likely become more enterprising , and learned to take advantage of some details from their previous campaigns to maximize profit opportunities while exerting minimal effort .


By shaping the attack , the group may be able to create niches in the underground , catering to the specific needs of their customers .


Also aware of the existing laws in Europe , they can avoid prosecution in certain countries as long as they avoid attacking them .


Collection of results and data from scanning in this manner might be easier to sort ( while allowing them to stay under the radar ) , as compared to getting feedback from zombie bots deployed around the world simultaneously .


We will continue to monitor this hacking group ’s activities and their toolkit ’s developments .


Outlaw ’s attack routines may not be new , but it still serves as a reminder for enterprises to update their systems regularly .


Legacy system users may use their providers ’ virtual patches .


Users are advised to close unused ports , to secure ports and other internet-facing devices that are regularly open for system administrators ’ support .


Users can also adopt a multilayered security solution that can protect systems from the gateway to the endpoint , actively blocking malicious URLs by employing filtering , behavioral analysis , and custom sandboxing .


Users can consider adopting security solutions that can defend against malicious bot-related activities such as Outlaw ’s through a cross-generational blend of threat defense techniques .


Trend Micro™ XGen™ security provides high-fidelity machine learning that can secure the gateway and endpoints , and protect physical , virtual , and cloud workloads .


With technologies that employ web/URL filtering , behavioral analysis , and custom sandboxing , XGen security offers protection against ever-changing threats that bypass traditional controls and exploit known and unknown vulnerabilities .


A multi-layered connected network defense and complete visibility into all network traffic , in addition to next-generation intrusion prevention system ( NGIPS ) , can help organizations stay a step ahead of threats that could compromise intangible assets .


XGen security also powers Trend Micro ’s suite of security solutions : Hybrid Cloud Security and User Protection .


Outlaw : 1800de5f0fb7c5ef3c0d9787260ed61bc324d861bc92d9673d4737d1421972aa Cryptocurrency miner Trojan.SH.MALXMR.UWEJP .


Outlaw : b68bd3a54622792200b931ee5eebf860acf8b24f4b338b5080193573a81c747d Shellbot Backdoor.SH.SHELLBOT.AA .


Outlaw : 620635aa9685249c87ead1bb0ad25b096714a0073cfd38a615c5eb63c3761976 Tool Trojan.Linux.SSHBRUTE.B .


Outlaw : fc57bd66c27066104cd6f8962cd463a5dfc05fa59b76b6958cddd3542dfe6a9a Cryptocurrency miner Coinminer.Linux.MALXMR.SMDSL32 .


Outlaw : 649280bd4c5168009c1cff30e5e1628bcf300122b49d339e3ea3f3b6ff8f9a79 Cryptocurrency miner Coinminer.Linux.MALXMR.SMDSL64 .


Outlaw : 159.203.141.208 .


Outlaw : 104.236.192.6 .


Outlaw : 45.9.148.129:80 Miner pool .


Outlaw : 45.9.148.125:80 Miner pool .


Outlaw : http://www.minpop.com/sk12pack/idents.php Command and control .


Outlaw : http://www.minpop.com/sk12pack/names.php Command and control .


Winnti Group targeting universities in Hong Kong .


In November 2019 , we discovered a new campaign run by the Winnti Group against two Hong Kong universities .


We found a new variant of the ShadowPad backdoor , the group ’s flagship backdoor , deployed using a new launcher and embedding numerous modules .


The Winnti malware was also found at these universities a few weeks prior to ShadowPad .


The Winnti Group , active since at least 2012 , is responsible for for high-profile supply-chain attacks against the video game and software industries leading to the distribution of trojanized software ( such as CCleaner , ASUS LiveUpdate and multiple video games ) that is then used to compromise more victims .


It is also known for having compromised various targets in the healthcare and education sectors .


ESET researchers recently published a white paper updating our understanding of the arsenal of the Winnti Group , following a blog post documenting a supply-chain attack targeting the videogame industry in Asia .


Additionally , we published a blog post on a new backdoor named skip-2.0 that targets Microsoft SQL Server .


This article focuses on the technical details of this new ShadowPad variant .


About the “ Winnti Group ” naming :


We have chosen to keep the name “ Winnti Group ” since it ’s the name first used to identify it , in 2013 , by Kaspersky .


Since Winnti is also a malware family , we always write “ Winnti Group ” when we refer to the malefactors behind the attacks .


Since 2013 , it has been demonstrated that Winnti is only one of the many malware families used by the Winnti Group .


In November 2019 , ESET ’s machine-learning engine , Augur , detected a malicious and unique sample present on multiple computers belonging to two Hong Kong universities where the Winnti malware had already been found at the end of October .


The suspicious sample detected by Augur is actually a new 32-bit ShadowPad launcher .


Samples from both ShadowPad and Winnti found at these universities contain campaign identifiers and C&C URLs with the names of the universities , which indicates a targeted attack .


In addition to the two compromised universities , thanks to the C&C URL format used by the attackers we have reasons to think that at least three additional Hong Kong universities may have been compromised using these same ShadowPad and Winnti variants .


This campaign of the Winnti Group against Hong Kong universities was taking place in the context of Hong Kong facing civic protests that started in June 2019 triggered by an extradition bill .


Even though the bill was withdrawn in October 2019 , protests continued , demanding full democracy and investigation of the Hong Kong police .


These protests gathered hundreds of thousands of people in the streets with large support from students of Hong Kong universities , leading to multiple university campus occupations by the protesters .


We have contacted the compromised universities and provided the necessary information and assistance to remediate the compromise .


Unlike previous ShadowPad variants documented in our white paper on the arsenal of the Winnti Group , this launcher is not obfuscated using VMProtect .


Furthermore , the encrypted payload is neither embedded in the overlay nor located in a COM1:NULL.dat alternate data stream .


And the usual RC5 encryption with a key derived from the volume ID of the system drive of the victim machine ( as seen in the PortReuse backdoor , skip-2.0 and some ShadowPad variants ) is not present either .


In this case , the launcher is much simpler .


The launcher is a 32-bit DLL named hpqhvsei.dll , which is the name of a legitimate DLL loaded by hpqhvind.exe .


This executable is from HP and is usually installed with their printing and scanning software called “ HP Digital Imaging ” .


In this case the legitimate hpqhvind.exe was dropped by the attackers , along with their malicious hpqhvsei.dll , in C:\Windows\Temp .


Although we do not have the component that dropped and executed this launcher , the presence of these files leads us to think that the initial execution of this launcher is done through DLL side-l .


When the malicious DLL is loaded at hpqhvind.exe startup , its DLLMain function is called that will check its parent process for the following sequence of bytes at offset 0x10BA .


In the case where the parent process is hpqhvind.exe , this sequence of bytes is present at this exact location and the malicious DLL will proceed to patch the parent process in memory .


It replaces the original instructions at 0x10BA with an unconditional jump ( jmp – 0xE9 ) to the address of the function from hpqhvsei.dll that decrypts and executes the encrypted payload embedded in the launcher .


The decompiled function responsible for patching the parent process .


In case hpqhvsei.dll is loaded by a different process than hpqhvind.exe , the malicious code will not be decrypted and executed .


The difference between the original and patched hpqhvind.exe .


The part of the code that is patched is located at the very beginning of the main function of hpqhvind.exe .


The patched code is located right after the load of hpqhvsei.dll .


This means that the function responsible for decrypting and executing the payload is executed directly after the load of the malicious DLL .


The encrypted payload is located in the .rdata section of hpqhvsei.dll and the decryption algorithm is an XOR loop where the XOR key is updated at each iteration .


The decrypted payload is the usual shellcode responsible for ShadowPad initialization ( obfuscated using fake conditional jumps to hinder disassembly ) .


After having been decrypted , ShadowPad ’s shellcode is executed .


It will first achieve persistence on the system by writing the in-memory patched parent process to disk to a path specified in the configuration string pool .


In the case we examined , the path was C:\ProgramData\DRM\CLR\CLR.exe .


It then creates a service named clr_optimization_v4.0.30229_32 , which is responsible for executing CLR.exe .


To avoid suspicion , this service name , as well as the executable name , were chosen to look similar to the name of a Microsoft .NET optimiza Service .


The numbering on each arrow corresponds to the chronological sequence of events .


ShadowPad is a multimodular backdoor where the modules are referenced from the Root module with a circular list from which one can extract the module address , a UNIX timestamp ( probably embedded automatically during the module ’s compilation process ) and a module identifier .


From the module itself we can also extract the name the developer gave to the module .


This version embeds the 17 modules listed in the following table :


100 Root Thu 24 Oct 2019 12:08:27 PM UTC Initial shellcode . 101 Plugins Thu 24 Oct 2019 12:07:02 PM UTC Provides API for the other modules ; loads modules . 102 Config Thu 24 Oct 2019 12:07:09 PM UTC Handles encrypted configuration string pool . 103 Install Thu 24 Oct 2019 12:07:46 PM UTC Achieves persistence . 104 Online Thu 24 Oct 2019 12:07:17 PM UTC Overall communications with the C&C server . 106 ImpUser Thu 24 Oct 2019 12:07:24 PM UTC User impersonation via token duplication . 200 TCP Thu 24 Oct 2019 12:01:01 PM UTC TCP communications . 202 HTTPS Thu 24 Oct 2019 12:01:15 PM UTC HTTPS communications . 207 Pipe Thu 24 Oct 2019 12:01:35 PM UTC Handles named pipes . 300 Disk Thu 24 Oct 2019 12:02:29 PM UTC File system operations . 301 Process Thu 24 Oct 2019 12:02:36 PM UTC Process handling . 302 Servcie Thu 24 Oct 2019 12:02:45 PM UTC Service handling . 303 Register Thu 24 Oct 2019 12:02:52 PM UTC Registry operations . 304 Shell Thu 24 Oct 2019 12:03:00 PM UTC Command line operations . 306 Keylogger Thu 24 Oct 2019 12:03:16 PM UTC Keylogging to file system . 307 Screen Thu 24 Oct 2019 12:03:25 PM UTC Screenshot capture . 317 RecentFiles Thu 24 Oct 2019 12:04:44 PM UTC Lists recently accessed files .


These modules , except for RecentFiles , have already been mentioned by Kaspersky and Avast .


Notice the “ Servcie ” typo .


As usual , all the module timestamps are spread over a short time range , which could suggest the use of a build framework to compile these modules .


This also suggests that these modules were built a few hours before the launcher itself , whose compilation timestamp is Thu Oct 24 14:10:32 2019 .


Since this compilation timestamp dates back two weeks before this campaign , it ’s likely that it has n’t been tampered with by the attackers .


One might also note that the number of modules embedded in this variant is much higher ( 17 ) than the number of modules embedded in the variants previously documented in our white paper ( 8 to 10 modules ) .


By default , every keystroke is recorded using the Keylogger module ( 306, previously documented by Avast ) and saved to disk in the file %APPDATA%\PAGM\OEY\XWWEYG\WAOUE .


The log file is encrypted using the same algorithm as the one used to encrypt static strings from the module .


Using this module by default indicates that the attackers are interested in stealing information from the victims ’ machines .


In contrast , the variants we described in our white paper did n’t even have that module embedded .


As with previous ShadowPad variants , the Config module ( 102 ) contains an encrypted string pool that can be accessed from any other module .


The string pool is never stored entirely decrypted in memory ; the field of interest is decrypted when needed and then immediately freed ( thus quickly unavailable ) .


The configuration size is 2180 bytes and the encrypted strings are located at offset 0x84 .


The algorithm used to decrypt the strings is the same as the one used to decrypt the static strings of the module .


The campaign ID is located at offset 0x99 and is the name of the targeted university .


Having a campaign ID related to the target is quite common in the case of ShadowPad and Winnti .


Interestingly , the timestamp present in this config at offset 0x84 is later than the modules ’ timestamps and the loader compilation timestamp .


This suggests that this config is added manually to the sample after having been built .


Even though it ’s probably coincidental , the date within the config corresponds to the date of the first detection of this sample at the corresponding university .


Once installed on the system , ShadowPad starts a hidden and suspended Microsoft Windows Media Player wmplayer.exe process and injects itself into that process .


The path to wmplayer.exe is provided by the Config module .


Once ShadowPad is injected into wmplayer.exe , the Online module will contact the C&C server using the URL specified in the configuration .


The communication is then handled by the TCP module ( 200 ) , which was previously documented by Kaspersky .


In addition to ShadowPad , the Winnti malware was found on some machines at these two universities at the end of October ( i.e . two weeks before ShadowPad ) in the file C:\Windows\System32\oci.dll and is detected by ESET products as Win64/Winnti.CA .


The Winnti malware usually contains a configuration specifying a campaign ID and a C&C URL .


On all machines the campaign ID matches the name of the targeted university and the C&C URLs are :


w[redacted].livehost.live : 443 . w[redacted].dnslookup.services : 443 . where the redacted part corresponds to the name of the targeted university .


One can observe that the C&C URL used by both Winnti and ShadowPad complies to the scheme [backdoor_type][target_name].domain.tld : 443 where [backdoor_type] is a single letter which is either “ w ” in the case of the Winnti malware or “ b ” in the case of ShadowPad .


From this format , we were able to find several C&C URLs , including three additional Hong Kong universities ’ names .


The campaign identifiers found in the samples we ’ve analyzed match the subdomain part of the C&C server , showing that these samples were really targeted against these universities .


The Winnti Group is still actively using one of its flagship backdoors , ShadowPad , this time against Hong Kong universities .


In this campaign , the VMProtected launcher used with ShadowPad , as well as with the PortReuse backdoor and skip-2.0 , was replaced by a simpler one .


That these samples , in addition to having been found at these universities , contain campaign IDs matching the universities ’ names and use C&C URLs containing the universities ’ names are good indications that this campaign is highly targeted .


We will continue to monitor new activities of the Winnti Group and will publish relevant information on our blog .


For any inquiries , contact us at threatintel@eset.com .


The IoCs are also available in our GitHub repository .


ESET detection names : Win32 / Shadowpad.C trojan Win64 / Winnti.CA trojan .


Winnti : hpqhvsei.dll .


Winnti : CLR.exe .


Winnti : hpqhvind.exe .


Winnti : oci.dll .


Winnti : C&C : b[org_name].dnslookup.services : 443 .


Winnti : C&C : w[org_name].livehost.live : 443 .


Winnti : C&C : w[org_name].dnslookup.services : 443 .


Middle Eastern hacking group is using FinFisher malware to conduct international espionage .


Recently , there was a blog post on the takedown of a botnet used by threat actor group known as Group 72 and their involvement in Operation SMN .


This group is sophisticated , well funded , and exclusively targets high profile organizations with high value intellectual property in the manufacturing , industrial , aerospace , defense , and media sector .


The primary attack vectors are watering-hole , spear phishing , and other web-based attacks .


Frequently , a remote administration tool ( RAT ) is used to maintain persistence within a victim ’s organization .


These tools are used to further compromise the organization by attacking other hosts inside the targets network .


ZxShell ( aka Sensocode ) is a Remote Administration Tool ( RAT ) used by Group 72 to conduct cyber-espionage operations .


Once the RAT is installed on the host it will be used to administer the client , exfiltrate data , or leverage the client as a pivot to attack an organization ’s internal infrastructure .


Here is a short list of the types of tools included with ZxShell :


Keylogger ( used to capture passwords and other interesting data ) .


Command line shell for remote administration .


Remote desktop .


Various network attack tools used to fingerprint and compromise other hosts on the network .


Local user account creation tools .


For a complete list of tools please see the MainConnectionIo section .


The following paper is a technical analysis on the functionality of ZxShell .


The analysts involved were able to identify command and control ( C2 ) servers , dropper and installation methods , means of persistence , and identify the attack tools that are core to the RAT ’s purpose .


In addition , the researchers used their analysis to provide detection coverage for Snort , Fireamp , and ClamAV .


ZxShell has been around since 2004 .


There are a lot of versions available in the underground market .


We have analyzed the most common version of ZxShell , version 3.10 .


There are newer versions , up to version 3.39 as of October 2014 .


An individual who goes by the name LZX in some online forums is believed to be the original author of ZxShell .


Since ZxShell has been around since at least 2004 , numerous people have purchased or obtained the tools necessary to set up ZxShell command and control servers ( C&C ) and generate the malware that is placed on the victim ’s network .


ZxShell has been observed to be distributed through phishing attacks , dropped by exploits that leverage vulnerabilities such as CVE-2011-2462 , CVE-2013-3163 , and CVE-2014-0322 .


To illustrate the functionality of main ZxShell module , Let ’s take a look at the following sample :


MD5 : e3878d541d17b156b7ca447eeb49d96a .


SHA256 : 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d08f9459342e26c .


It exports the following functions , which are examined in greater detail below : DllMain Install UnInstall ServiceMain ShellMain ShellMainThread zxFunction001 zxFunction002 .


DllMain performs the initialization of ZxShell .


It allocates a buffer of 0x2800 bytes and copies the code for the ZxGetLibAndProcAddr function .


To copy memory , the memcpy function is invoked .


It is not directly used from msvcrt.dll but is instead copied to another memory chunk before being called .


Finally , the trojan Import Address Table ( IAT ) is resolved and the file path of the process that hosts the DLL is resolved and saved in a global variable .


ZxShell.dll is injected in a shared SVCHOST process .


The Svchost group registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost is opened and the netsvc group value data is queried to generate a name for the service .


Before the malware can be installed a unique name must to be generated for the service .


The malware accomplishes this through querying the netsvc group value data located in the svchost group registry key which is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost .


At startup , Svchost.exe checks the services part of the registry and constructs a list of services to load .


Each Svchost session can contain multiple shared services that are organized in groups .


Therefore , separate services can run , depending on how and where Svchost.exe is started .


Svchost.exe groups are identified in the above registry key .


Each value under this key represents a separate Svchost group and appears as a separate instance when you are viewing active processes .


Each value is a REG_MULTI_SZ value and contains the services that run under that Svchost group .


Each Svchost group can contain one or more service names that are extracted from the following registry key , whose Parameters key contains a ServiceDLL value : HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Service .


On a Windows machine , the netsvc group contains names of both existing and non-existing services .


ZxShell exploits this fact by cycling between each of the names , verifying the existence of the real service .


The service ’s existence is verified with the ServiceExists function , which attempts to open the relative registry sub-key in HKLM\SYSTEM\CurrentControlSet\Services .


The first service name that is not installed on the system becomes the ZxShell service name .


A new service is then created using the service parser function ProcessScCommand .


ZxShell implemented its own version of the Windows SC command .


There are minor differences between the ZxShell implementation of this command and the original Windows one .


The installed service registry key is opened and the 2 values under its Parameter subkey are created .


These 2 values , ServiceDll and ServiceDllUnloadOnStop are needed for services that run in a shared process .


Before the service is started ChangeServiceConfig is called to modify the service type to shared and interactive .


If the service fails to start then a random service name formatted as netsvc_xxxxxxxx , where xxxxxxxx represent an 8-digit random hex value , is added to the netsvc group and the entire function is repeated .


This function is the entry point of the service .


It registers the service using the RegisterServiceCtrlHandler Windows API function .


The ZxShell service handler routine is only a stub : it responds to each service request code , doing nothing , and finally exits .


It sets the service status to RUNNING and finally calls the ShellMain function of ZxShell .


The ShellMain function is a stub that relocates the DLL to another buffer and spawns a thread that starts from ShellMainThreadInt at offset +0xC0CD .


The ShellMainThreadInt function gets the HeapDestroy Windows API address and replaces the first 3 bytes with the RET 4 opcode .


Subsequently , it calls the FreeLibrary function to free its own DLL buffer located at its original address .


Because of this , the allocated heaps will not be freed .


It re-copies the DLL from the new buffer to the original one using the memcpy function .


Finally , it spawns the main thread that starts at the original location of ShellMainThread procedure , and terminates .


At this point , the ZxShell library is no longer linked in the module list of the host process .


This is important because if any system tool tries to open the host process it will never display the ZxShell DLL .


This thread implements the main code , responsible for the entire botnet DLL .


First , it checks if the DLL is executed as a service .


If so , it spawns the service watchdog thread .


The watchdog thread checks the registry path of the ZxShell service every 2 seconds , to verify that it has n’t been modified .


If a user or an application modifies the ZxShell service registry key , the code restores the original infected service key and values .


The buffer containing the ZxShell Dll in the new location is freed using the VirtualFree API function .


A handle to the DLL file is taken in order to make its deletion more difficult .


The ZxShell mutex is created named @_ZXSHELL_@ .


ZxShell plugins are parsed and loaded with the AnalyseAndLoadPlugins function .


The plugin registry key HKLM\SYSTEM\CurrentControlSet\Control\zxplug is opened and each value is queried .


The registry value contains the plugin file name .


The target file is loaded using the LoadLibrary API function , and the address of the exported function zxMain is obtained with GetProcAddress .


If the target filename is incorrect or invalid the plugin file is deleted and the registry value is erased .


That is performed by the function DeleteAndLogPlugin .


Otherwise , the plugin is added to an internal list .


The thread KeyloggerThread is spawned and is responsible for doing keylogging on the target workstation .


We will take a look at the keylogger later on .


Finally the main network communication function GetIpListAndConnect is called .


This function is at the core of the RAT ’s network communication .


It starts by initializing a random number generator and reading 100 bytes inside the ZxShell Dll at a hardcoded location .


These bytes are XOR encrypted with the byte-key 0x85 and contains a list of remote hosts where to connect .


The data is decrypted , the remote host list is parsed and verified using the BuildTargetIpListStruct function .


There are 3 types of lists recognized by ZxShell : plain ip addresses , HTTP and FTP addresses .


If the list does not contain any item , or if the verification has failed , the ZxShell sample tries to connect to a hardcoded host


with the goal of retrieving a new updated list .


Otherwise , ZxShell tries to connect to the first item of the list .


If ZxShell successfully connects to the remote host , the function DoHandshake is called .


This function implements the initial handshake which consists of exchanging 16 bytes , 0x00001985 and 0x00000425,


with the server .


The function GetLocalPcDescrStr is used to compose a large string that contains system information of the target workstation .


The string is sent to the remote host and the response is checked to see if the first byte of the response is 0xF4, an arbitrary byte .


If it is , the botnet connection I/O procedure is called through the MainConnectionIo function .


Otherwise , the ZxShell code closes the socket used and sleeps for 30 seconds .


It will then retry the connection with the next remote host , if there is one .


It is noteworthy that this function includes the code to set the ZxShell node as a server : if one of the hardcoded boolean value is set to 1, a listening socket is created .


The code waits for an incoming connection .


When the connection is established a new thread is spawned that starts with the MainConnectionIo function .


The MainConnectionIo function checks if the Windows Firewall is enabled , sets the Tcp Keep Alive value and Non-blocking mode connection options and receives data from the remote host through the ReceiveCommandData function .


Then the connection is retried .


The received command is then processed by the ZxShell function with the ProcessCommand function .


The command processing function starts by substituting the main module name and path in the hosting process PEB , with the one of the default internet browser .


This trick renders identification by firewall more cumbersome .


A host firewall


recognize the outgoing connection as originated by the browser instead of the ZxShell service host process .


The browser process always performs outgoing connections and the firewall should n’t block them .


The command processing is straightforward .


Here is the list of common commands :


Help / ? Get help .


Exit / Quit Exit and shut down the botnet client .


SysInfo Get target System information .


SYNFlood Perform a SYN attack on a host .


Ps Process service Unix command implementation .


CleanEvent Clear System Event log .


FindPass Find login account password .


FileTime Get time information about a file .


FindDialPass List all the dial-up accounts and passwords .


User Account Management System .


TransFile Transfer file in or from remote host .


Execute Run a program in the remote host .


SC Service control command , implemented as the Windows one .


CA Clone user account .


RunAs Create new process as another User or Process context .


TermSvc Terminal service configuration ( working on Win Xp/2003 ) .


GetCMD Remote Shell .


Shutdown Logout , shutdown or restart the target system .


ZXARPS Spoofing , redirection , packet capture .


ZXNC Run ZXNC v1.1 – a simple telnet client .


ZXHttpProxy Run a HTTP proxy server on the workstation .


ZXSockProxy Run a Sock 4 & 5 Proxy server .


ZXHttpServer Run a custom HTTP server .


PortScan Run TCP Port MultiScanner v1.0 .


KeyLog Capture or record the remote computer ’s keystrokes .


The implementation is a userland keylogger that polls the keymap with each keystroke .


LoadDll Load a DLL into the specified process .


End Terminate ZxShell DLL .


Uninstall Uninstall and terminate ZxShell bot DLL .


ShareShell Share a shell to other .


CloseFW Switch off Windows Firewall .


FileMG File Manager . winvnc Remote Desktop . rPortMap Port Forwarding . capsrv Video Device Spying . zxplug Add and load a ZxShell custom plugin .


This set of functionality allows the operator complete control of a system .


Being able to transfer and execute files on the infected system means the attacker can run any code they please .


Further , the keylogging and remote desktop functionality allows the operator to spy on the infected machine , observing all keystrokes and viewing all user actions .


Unloads ZxShell and deletes all of the active components .


This simply deletes the ZxShell service key from the Windows registry ( using SHDeleteKey Api ) and all of the subkeys .


Finally , it marks ZxShell main Dll for deletion with the MoveFileEx Windows API .


This function is the supporting functionality for WinVNC .


To allow the VNC session to connect , the current network socket WSAProtcol_Info structure is written to a named pipe prior to calling zxFunction001 . zxFunction001 modifies the current process memory , uses data contained in the named pipe to create a socket , and then executes the code that sends the remote desktop session to the server controller .


ZxFunction002 This will either bind the calling process to a port or has the calling process connect to a remote host .


The functionality ( connect or bind ) depends on the data contained within the named pipe .


Unlike zxFunction001, this is not used by


any of the RAT commands in the zxshell.dll .


Apart from user-mode ZxShell droppers mentioned earlier , there is a file ( SHA256 : 1e200d0d3de360d9c32e30d4c98f07e100f6260a86a817943a8fb06995c15335 ) that installs a kernel device driver called loveusd.sys .


The architecture of this dropper is different from the others : it starts extracting the main driver from itself .


It adds the SeLoadDriver privilege to its access token and proceeds to install the driver as a fake disk filter driver .


It then adds the “ Loveusd.sys ” extracted driver name to the upper filter list .


In our analysed sample the “ Loveusd.sys ” driver is installed with the name “ USBHPMS ” .


Finally the driver is started using the ZwLoadDriver native API .


The ZxShell driver starts by acquiring some kernel information and then hooking “ ObReferenceObjectByHandle ” API .


Finally it spawns 2 system threads .


The first thread is the “ communication ” thread .


ZxShell employs a strange method for communication : it hooks the NtWriteFile API and recognizes 5 different special handle values as commands :


0x111111111 : Hide “ Loveusd ” driver from the system kernel driver list . 0x22222222 : Securely delete an in-use or no-access target file-name . 0x44444444 : Unhook the ZwWriteFile API and hook KiFastCallEntry . 0x55555555 : Remove the ZxShell Image Load Notify routine . 0x88888888 : Set a special value called “ type ” in Windows registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\DriverMain .


The second Loveusd system thread does a lot of things .


Its principal duties are to create the ZxShell main DLL in “ c:\Windows\System32\commhlp32.dll ” and to install the Kernel “ Load Image Notify routine ” .


The code then tries to kill each process and service that belongs to the following list of AV products : Symantec Firewall Norton ESET McAfee Avast Avira Sophos Malwarebytes .


Next , the ZxShell Load-Image Notify function prevents the AV processes from restarting .


The installation procedure continues in the user-mode dropper .


The ZxShell service is installed as usual , and the in-execution dropper is deleted permanently using the special handle value 0x22222222 for the WriteFile API call .


This handle value is invalid : all the windows kernel handle values are by design a multiple of 4 .


The ZxShell hook code knows that and intercept it .


ObReferenceObjectByHandle is a Kernel routine designed to validate a target object and return the pointer to its object body ( and even its handle information ) , starting from the object handle ( even the user-mode one ) .


The hook installed by ZxShell implements one of its filtering routine .


It filters each attempt to open the ZxShell protected driver or the main DLL , returning a reference to the “ netstat.exe ” file .


The protection is enabled to all processes except for ones in the following list : Svchost.exe , Lsass.exe , Winlogon.exe , Services.exe , Csrss.exe , ctfmon.exe , Rundll32.exe , mpnotify.exe , update.exe .


If the type of the object that the system is trying to validate is a process , the hook code rewrites again the configuration data of the ZxShell service in the windows registry .


The last type of Kernel modification that ZxShell rootkit performs is the system call dispatcher ( KiFastCallEntry ) hook .


In this manner , ZxShell is able to completely hide itself , intercepting the following Kernel API calls : ZwAllocateVirtualMemory , ZwOpenEvent , ZwQueryDirectoryFile , ZwWriteFile , ZwEnumerateKey , and ZwDeviceIoControlFile .


Command and Control Server : Sample ( SHA256 : 1eda7e556181e46ba6e36f1a6bfe18ff5566f9d5e51c53b41d08f9459342e26c ) is configured to act as a server .


The symbol “ g_bCreateListenSck ” is set to 1 .


This means that , as seen above , the ZxShell Dll is started in listening mode .


It connects to the first remote C&C that tries to contact it and succeeds in the handshake .


The encrypted IP address is “ 127.0.0.2 ” ( used as loopback ) and no connection is made on that IP address ( due to the listening variable set to 1 ) .


We used the ZxShell package for version 3.10 ( SHA256 : 1622460afbc8a255141256cb77af61c670ec21291df8fe0989c37852b59422b4 ).The convenient thing about this is that the CNC panel worked with any version , 3.10 and above .


The buttons are all in Chinese , with the help of Google Translate and keen detective skills ( read : button clicking ) , we ’ve deciphered the functionality .


Once an infected machine connects , you see its information displayed in a selection box at the top .


There are some built in functions on the side for the more common features .


These include remote desktop , webcam spying , remote shell , and file management .


You can also select a host and type help for a full list of commands .


I have the same machine infected with two different version of ZxShell .


Sending the help command for each , you can see the extra features added between version 3.1 and 3.2 .


Keylogging , ZXARPS ( IP and URL spoofing ) , and SYNFlood are some of the interesting features added to version 3.2 .


In versions 3.1 – 3.21, the configuration info is xor encoded with 0x85 .


This configuration info can be changed with a tool included in the ZxShell package .


In versions 3.22 and 3.39 the routine changes .


The new xor encoding byte is 0x5B .


The data is stored in the last 0x100 bytes of the file .


The first 8 bytes of data are static .


Then there is the dll install name , the domain , and the port .


Knowing the obfuscation routines for this data we wrote a script to extract the URLs / IPs and ports stored .


The most common ports used are , 80, 1985, 1986, and 443 . 1985 is the default port for the malware , 1986 is the lazy variation of that port .


Port 80 and 443 are the default ports for HTTP and HTTPS traffic .


The next most common is port 53 .


This is used in some of the newer 3.22 and 3.39 samples .


After that , the count for each port starts declining sharply .


The choices are interesting though , many correspond to what looks like the birth year of the controller ( ie . years in the late 1980s and early 1990s ) , and others seem to match what year the malware was launched in ( ie . in the 2000s , relatively close to the current year ) .


Since this malware dates back to around 2004 , there are many samples containing CNC URLs from the 3322.org page .


This page used to offer no-ip type hosting and was widely used by malware authors .


So much so that Microsoft did a takedown in 2012 .


A similar service , vicp.net , is also seen in many of the domains .


In the malware , if a domain is configured , it will retrieve domain.tld / myIP .


txt .


This file contains a list of IP addresses for the infected machine to connect back to .


Otherwise , if an IP address is configured , it will connect directly to that IP address .


We have written a simple C++ ZxShell Server that implements the communication and the handshake for the version 3.10 and 3.20 of the ZxShell DLL .


The implementation is quite simple : After the handshake , 2 threads that deal with data transfer are spawned .


Advanced persistent threats will remain a problem for companies and organizations of all sizes , especially those with high financial or intellectual property value .


Group 72 ’s involvement in Operation SMN is another example of what sort of damage that can be done if organizations are not diligent in their efforts to secure their networks .


ZxShell is one sample amongst several tools that Group 72 used within their campaign .


ZxShell is a sophisticated tool employed by Group 72 that contains all kinds of functionality .


Its detection and removal can be difficult due to the various techniques used to conceal its presence , such as disabling the host anti-virus , masking its installation on a system with a valid service name , and by masking outbound traffic as originating from a web browser .


While other techniques are also utilized to conceal and inhibit its removal , ZxShell ’s primary functionality is to act as a Remote Administration Tool ( RAT ) , allowing the threat actor to have continuous backdoor access on to the compromised machine .


As our analysis demonstrates , ZxShell is an effective tool that can be ultimately used to steal user credentials and other highly valuable information .


The threat posed by ZxShell to organizations is one that cannot be ignored .


Organizations with high financial or intellectual property value should take the time to ensure their security requirements are met and that employee ’s are educated about the security threats their organizations face .


Threat Spotlight : Group 72 , Opening the ZxShell .


The incident , as described by security researchers with Moscow-based cybersecurity firm Kaspersky Lab , shines a rare light on the opaque although apparently vibrant market for software exploits and spyware , which in this case appears to have been purchased by a nation-state .


The Middle Eastern hacker group in this case is codenamed “ BlackOasis . ” Kaspersky found the group was exploiting a Adobe Flash Player zero-day vulnerability ( CVE-2016-4117 ) to remotely deliver the latest version of “ FinSpy ” malware , according to a new blog post published Monday .


Adobe issued a fix Monday to its users in the form of a software update .


These emails contained malicious Microsoft Word documents with the aforementioned Flash Player zero-day hidden inside an embedded ActiveX object .


The term zero-day is indicative of a software flaw that remains unknown to the software ’s creator .


Zero-days can be highly disruptive because they provide a window of time for an attacker to breach victims before the vendor is able to apply a software update to address the specific security hole .


U.S . cybersecurity firm FireEye also recently captured BlackOasis activity as part of a similar incident where the group relied on a different zero-day exploit — more specifically , a SOAP WSDL parser code injection vulnerability — to install FinSpy onto a small number of devices .


Again , the attacker ’s intention appeared to be espionage . “ Unlike other FinFisher customers or users who focus mostly on domestic operations , BlackOasis focuses on external operations and go after a wide range of targets around the world , ” explained Costin Raiu , director of the global research and analysis team at Kaspersky Lab .


Gamma Group has been accused of selling its products to authoritarian regimes that can use the technology to both track dissidents and conduct foreign espionage over the internet .


It ’s unclear whether the hackers are purchasing the exploits and spyware together , directly from Gamma Group , or if they were able to acquire some of the tools through other avenues . “ BlackOasis ’ interests span a wide gamut of figures involved in Middle Eastern politics and verticals disproportionately relevant to the region .


This includes prominent figures in the United Nations , opposition bloggers and activists , and regional news correspondents , ” a blogpost about Kaspersky ’s findings reads .


The post continues , “ during 2016 , we observed a heavy interest in Angola , exemplified by lure documents indicating targets with suspected ties to oil , money laundering , and other illicit activities .


There is also an interest in international activists and think tanks … Victims of BlackOasis have been observed in the following countries : Russia , Iraq , Afghanistan , Nigeria , Libya , Jordan , Tunisia , Saudi Arabia , Iran , Netherlands , Bahrain , United Kingdom and Angola . ”


Intent was clearly espionage in many cases , going outside of that "lawful surveillance" boundary.— Brian Bartholomew ( @Mao_Ware ) October 16, 2017 Brian Bartholomew , a senior security researcher with Kaspersky , said on Twitter that BlackOasis ’ espionage included non-traditional targets — “ going outside of that lawful surveillance boundary. ”


An advanced persistent threat group , previously identified by Microsoft and codenamed Neodymium , is closely associated with BlackOasis ’ operations .


Last year , Microsoft researchers described Neodymium ’s behavior as unusual : “ unlike many activity groups , which typically gather information for monetary gain or economic espionage , PROMETHIUM and NEODYMIUM appear to launch campaigns simply to gather information about certain individuals .


These activity groups are also unusual in that they use the same zero-day exploit to launch attacks at around the same time in the same region .


Their targets , however , appear to be individuals that do not share common affiliations. ”


A cursory review of BlackOasis ’ espionage campaign suggests there is some overlap between the group ’s actions and Saudi Arabia ’s geopolitical interests .


For example , the targeting of Angolan organizations in mid-2016 coincidences directly with the rise of Angola ’s oil business with China , which displaced Saudi Arabia as the number one exporter of crude oil to China at the time .


In addition , Saudi Arabia is a known customer of spyware and has used the technology domestically , according to Citizen Lab , a cybersecurity and human-rights focused research laboratory .


Kaspersky ’s research notes that BlackOasis hacked into computers based in Saudi Arabia .


Insights from one year of tracking a polymorphic threat .


A little over a year ago , in October 2018 , our polymorphic outbreak monitoring system detected a large surge in reports , indicating that a large-scale campaign was unfolding .


We observed as the new threat attempted to deploy files that changed every 20-30 minutes on thousands of devices .


We gave the threat the name “ Dexphot , ” based on certain characteristics of the malware code .


The Dexphot attack used a variety of sophisticated methods to evade security solutions .


Layers of obfuscation , encryption , and the use of randomized file names hid the installation process .


Dexphot then used fileless techniques to run malicious code directly in memory , leaving only a few traces that can be used for forensics .


It hijacked legitimate system processes to disguise malicious activity .


If not stopped , Dexphot ultimately ran a cryptocurrency miner on the device , with monitoring services and scheduled tasks triggering re-infection when defenders attempt to remove the malware .


In the months that followed , we closely tracked the threat and witnessed the attackers upgrade the malware , target new processes , and work around defensive measures .


While Microsoft Defender Advanced Threat Protection ’s pre-execution detection engines blocked Dexphot in most cases , behavior-based machine learning models provided protection for cases where the threat slipped through .


Given the threat ’s persistence mechanisms , polymorphism , and use of fileless techniques , behavior-based detection was a critical component of the comprehensive protection against this malware and other threats that exhibit similar malicious behaviors .


Microsoft Defender ATP data shows the effectiveness of behavioral blocking and containment capabilities in stopping the Dexphot campaign .


Over time , Dexphot-related malicious behavior reports dropped to a low hum , as the threat lost steam .


Our close monitoring of Dexphot helped us ensure that our customers were protected from the evolving threat .


More importantly , one year ’s worth of intelligence helped us gain insight not only into the goals and motivations of Dexphot ’s authors , but of cybercriminals in general .


The early stages of a Dexphot infection involves numerous files and processes .


During the execution stage , Dexphot writes five key files to disk :


1 、An installer with two URLs ;


2 、An MSI package file downloaded from one of the URLs ;


3 、A password-protected ZIP archive ;


4 、A loader DLL , which is extracted from the archive ;


5 、An encrypted data file that holds three additional executables that are loaded into system processes via process hollowing .


Except for the installer , the other processes that run during execution are legitimate system processes .


This can make detection and remediation more difficult .


These legitimate system processes include msiexec.exe ( for installing MSI packages ) , unzIP .


exe ( for extracting files from the password-protected ZIP archive ) , rundll32.exe ( for loading the loader DLL ) , schtasks.exe ( for scheduled tasks ) , powershell.exe ( for forced updates ) .


In later stages , Dexphot targets a few other system processes for process hollowing : svchost.exe , tracert.exe , and setup.exe .


Based on Microsoft Defender ATP signals , SoftwareBundler : Win32/ICLoader and its variants are primarily used to drop and run the Dexphot installer .


The installer uses two URLs to download malicious payloads .


These are the same two URLs that Dexphot use later to establish persistence , update the malware , and re-infect the device .


The installer downloads an MSI package from one of the two URLs , and then launches msiexec.exe to perform a silent install .


This is the first of several instances of Dexphot employing living-off-the-land techniques , the use of legitimate system processes for nefarious purposes .


Dexphot ’s package often contains an obfuscated batch script .


If the package contains this file , the script is the first thing that msiexec.exe runs when it begins the installation process .


The said obfuscated script is designed to check for antivirus products .


Dexphot halts the infection process immediately if an antivirus product is found running .


When we first began our research , the batch script only checked for antivirus products from Avast and AVG .


Later , Windows Defender Antivirus was added to the checklist .


If the process is not halted , Dexphot decompresses the password-protected ZIP archive from the MSI package .


The password to this archive is within the MSI package .


Along with the password , the malware ’s authors also include a clean version of unzIP .


exe so that they do n’t have to rely on the target system having a ZIP utility .


The unzIP .


exe file in the package is usually named various things , such as z.exe or ex.exe , to avoid scrutiny .


The ZIP archive usually contains three files : the loader DLL , an encrypted data file ( usually named bin.dat ) , and , often , one clean unrelated DLL , which is likely included to mislead detection .


Dexphot usually extracts the decompressed files to the target system ’s Favorites folder .


The files are given new , random names , which are generated by concatenating words and numbers based on the time of execution ( for example , C:\Users\<user>\Favorites\\Res.Center.ponse\<numbers> ) .


Msiexec.exe next calls rundll32.exe , specifying loader DLL ( urlmon.7z in the example above ) in order to decrypt the data file .


The decryption process involves ADD and XOR operations , using a key hardcoded in the binary .


The decrypted data contains three executables .


Unlike the files described earlier , these executables are never written to the filesystem .


Instead , they exist only in memory , and Dexphot runs them by loading them into other system processes via process hollowing .


Process hollowing is a technique that can hide malware within a legitimate system process .


It replaces the contents of the legitimate process with malicious code .


Detecting malicious code hidden using this method is not trivial , so process hollowing has become a prevalent technique used by malware today .


This method has the additional benefit of being fileless : the code can be run without actually being saved on the file system .


Not only is it harder to detect the malicious code while it ’s running , it ’s harder to find useful forensics after the process has stopped .


To initiate process hollowing , the loader DLL targets two legitimate system processes , for example svchost.exe or nslookup.exe , and spawns them in a suspended state .


The loader DLL replaces the contents of these processes with the first and second decrypted executables .


These executables are monitoring services for maintaining Dexphot ’s components .


The now-malicious processes are released from suspension and run .


Next , the loader DLL targets the setup.exe file in SysWoW64 .


It removes setup.exe ’s contents and replaces them with the third decrypted executable , a cryptocurrency miner .


Although Dexphot always uses a cryptocurrency miner of some kind , it ’s not always the same miner .


It used different programs like XMRig and JCE Miner over the course of our research .


The two monitoring services simultaneously check the status of all three malicious processes .


Having dual monitoring services provides redundancy in case one of the monitoring processes is halted .


If any of the processes are terminated , the monitors immediately identify the situation , terminate all remaining malicious processes , and re-infect the device .


The monitoring components also detect freshly launched cmd.exe processes and terminate them promptly .


As a final fail-safe , Dexphot uses schtasks.exe to create scheduled tasks .


This persistence technique is interesting , because it employs two distinct MITRE ATT&CK techniques : Scheduled Task and Signed Binary Proxy Execution .


The scheduled tasks call msiexec.exe as a proxy to run the malicious code , much like how msiexec.exe was used during installation .


Using msiexec.exe , a legitimate system process , can make it harder to trace the source of malicious activity .


Furthermore , the tasks allow Dexphot to conveniently update the payload from the web every time the tasks run .


They automatically update all of Dexphot ’s components , both upon system reboot as well as every 90 or 110 minutes while the system is running .


Dexphot also generates the names for the tasks at runtime , which means a simple block list of hardcoded task names will not be effective in preventing them from running .


The names are usually in a GUID format , although after we released our first round of Dexphot-blocking protections , the threat authors began to use random strings .


The threat authors have one more evasion technique for these scheduled tasks : some Dexphot variants copy msiexec.exe to an arbitrary location and give it a random name , such as %AppData%\<random>.exe .


This makes the system process running malicious code a literal moving target .


Dexphot exhibits multiple layers of polymorphism across the binaries it distributes .


For example , the MSI package used in the campaign contains different files , as shown in the table below .


The MSI packages generally include a clean version of unzIP .


exe , a password-protected ZIP file , and a batch file that checks for currently installed antivirus products .


However , the batch file is not always present , and the names of the ZIP files and Loader DLLs , as well as the password for extracting the ZIP file , all change from one package to the next .


In addition , the contents of each Loader DLL differs from package to package , as does the encrypted data included in the ZIP file .


This leads to the generation of a different ZIP archive and , in turn , a unique MSI package , each time the attacker bundles the files together .


Because of these carefully designed layers of polymorphism , a traditional file-based detection approach wouldn’t be effective against Dexphot .


Besides tracking the files and processes that Dexphot uses to execute an attack , we have also been monitoring the domains used to host malicious payloads .


The URLs used for hosting all follow a similar pattern .


The domain address usually ends in a .info or .net TLD , while the file name for the actual payload consists of random characters , similar to the randomness previously seen being used to generate file names and scheduled tasks .


Many of the URLs listed were in use for an extended period .


However , the MSI packages hosted at each URL are frequently changed or updated .


In addition , every few days more domains are generated to host more payloads .


After a few months of monitoring , we were able to identify around 200 unique Dexphot domains .


Dexphot is not the type of attack that generates mainstream media attention ; it ’s one of the countless malware campaigns that are active at any given time .


Its goal is a very common one in cybercriminal circles — to install a coin miner that silently steals computer resources and generates revenue for the attackers — yet Dexphot exemplifies the level of complexity and rate of evolution of even everyday threats , intent on evading protections and motivated to fly under the radar for the prospect of profit .


To combat threats , several next-generation protection engines in Microsoft Defender Advanced Threat Protection ’s antivirus component detect and stop malicious techniques at multiple points along the attack chain .


For Dexphot , machine learning-based detections in the cloud recognize and block the DLLs loaded by rundll32.exe , stopping the attack chain in its early stages .


Memory scans detect and terminate the loading of malicious code hidden by process hollowing — including the monitoring processes that attempt to update the malware code and re-infect the machine via PowerShell commands .


Behavioral blocking and containment capabilities are especially effective in defeating Dexphot ’s fileless techniques , detection evasion , and persistence mechanisms , including the periodic and boot-time attempts to update the malware via scheduled tasks .


As mentioned , given the complexity of the attack chain and of Dexphot ’s persistence methods , we released a remediation solution that prevents re-infection by removing artifacts .


The detection , blocking , and remediation of Dexphot on endpoints are exposed in Microsoft Defender Security Center , where Microsoft Defender ATP ’s rich capabilities like endpoint detection and response , automated investigation and remediation , and others enable security operations teams to investigate and remediate attacks in enterprise environments .


With these capabilities , Microsoft Defender ATP provides comprehensive protection against Dexphot and the countless other complex and evolving threats that we face every day .


Dexphot : 72acaf9ff8a43c68416884a3fff3b23e749b4bb8fb39e16f9976643360ed391f .


Dexphot : 22beffb61cbdc2e0c3eefaf068b498b63a193b239500dab25d03790c467379e3 .


Dexphot : 65eac7f9b67ff69cefed288f563b4d77917c94c410c6c6c4e4390db66305ca2a .


Dexphot : ba9467e0d63ba65bf10650a3c8d36cd292b3f846983032a44a835e5966bc7e88 .


Dexphot : 537d7fe3b426827e40bbdd1d127ddb59effe1e9b3c160804df8922f92e0b366e .


Dexphot : 504cc403e0b83233f8d20c0c86b0611facc040b868964b4afbda3214a2c8e1c5 .


Dexphot : aa5c56fe01af091f07c56ac7cbd240948ea6482b6146e0d3848d450977dff152 .


RevengeHotels : cybercrime targeting hotel front desks worldwide .


RevengeHotels is a targeted cybercrime malware campaign against hotels , hostels , hospitality and tourism companies , mainly , but not exclusively , located in Brazil .


We have confirmed more than 20 hotels that are victims of the group , located in eight states in Brazil , but also in other countries such as Argentina , Bolivia , Chile , Costa Rica , France , Italy , Mexico , Portugal , Spain , Thailand and Turkey .


The goal of the campaign is to capture credit card data from guests and travelers stored in hotel systems , as well as credit card data received from popular online travel agencies ( OTAs ) such as Booking.com .


The main attack vector is via email with crafted Word , Excel or PDF documents attached .


Some of them exploit CVE-2017-0199 , loading it using VBS and PowerShell scripts and then installing customized versions of RevengeRAT , NjRAT , NanoCoreRAT , 888 RAT and other custom malware such as ProCC in the victim ’s machine .


The group has been active since 2015 , but increased its attacks in 2019 .


In our research , we were also able to track two groups targeting the hospitality sector , using separate but similar infrastructure , tools and techniques .


PaloAlto has already written about one of them .


We named the first group RevengeHotels , and the second ProCC .


These groups use a lot of social engineering in their attacks , asking for a quote from what appears to be a government entity or private company wanting to make a reservation for a large number of people .


Their infrastructure also relies on the use of dynamic DNS services pointing to commercial hosting and self-hosted servers .


They also sell credentials from the affected systems , allowing other cybercriminals to have remote access to hotel front desks infected by the campaign .


We monitored the activities of these groups and the new malware they are creating for over a year .


With a high degree of confidence , we can confirm that at least two distinct groups are focused on attacking this sector ; there is also a third group , though it is unclear if its focus is solely on this sector or if carries out other types of attacks .


One of the tactics used in operations by these groups is highly targeted spear-phishing messages .


They register typo-squatting domains , impersonating legitimate companies .


The emails are well written , with an abundance of detail .