In this version of Rotexy , dynamic generation of lowest-level domains was not used . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period . FBI has high confidence that HIDDEN COBRA actors are using malware variants in conjunction with proxy servers to maintain a presence on victim networks and to further network exploitation .


2016 From mid-2016 on , the cybercriminals returned to dynamic generation of lowest-level domains . The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) . Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others .


No other significant changes were observed in the Trojan ’ s network behavior . Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 . Ransomware that has been publicly named " WannaCry " , " WCry " or " WanaCrypt0r " ( based on strings in the binary and encrypted files ) has spread to at least 74 countries as of Friday 12 May 2017 , reportedly targeting Russia initially , and spreading to telecommunications , shipping , car manufacturers , universities and health care industries , among others .


In late 2016 , versions of the Trojan emerged that contained the card.html phishing page in the assets/www folder . To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys . We also saw that the attack technique bears some resemblance to a previous 2017 Lazarus attack , analyzed by BAE Systems , against targets in Asia .


The page was designed to steal users ’ bank card details : 2017–2018 From early 2017 , the HTML phishing pages bank.html , update.html and extortionist.html started appearing in the assets folder . The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt . WannaCry utilizes EternalBlue by crafting a custom SMB session request with hard-coded values based on the target system .


Also , in some versions of the Trojan the file names were random strings of characters . For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer . Notably , after the first SMB packet sent to the victim 's IP address , WannaCry sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5 .


In 2018 , versions of Rotexy emerged that contacted the C & C using its IP address . During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros . WannaCry ( also known as WCry or WanaCryptor ) malware is a self-propagating ( worm-like ) ransomware that spreads through internal networks and over the public internet by exploiting a vulnerability in Microsoft 's Server Message Block ( SMB ) protocol , MS17-010 .


‘ One-time ’ domains also appeared with names made up of random strings of characters and numbers , combined with the top-level domains .cf , .ga , .gq , .ml , or .tk . The HTA files contained job descriptions and links to job postings on popular employment websites . The WannaCry malware consists of two distinct components , one that provides ransomware functionality and a component used for propagation , which contains functionality to enable SMB exploitation capabilities .


At this time , the Trojan also began actively using different methods of obfuscation . These emails included recruitment-themed lures and links to malicious HTML application ( HTA ) files . WannaCry leverages an exploit , codenamed " EternalBlue " , that was released by the Shadow Brokers on April 14 , 2017 .


For example , the DEX file is packed with garbage strings and/or operations , and contains a key to decipher the main executable file from the APK . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 . WannaCry appends encrypted data files with the .WCRY extension , drops and executes a decryptor tool , and demands $300 or $600 USD ( via Bitcoin ) to decrypt the data .


Latest version ( 2018 ) Let ’ s now return to the present day and a detailed description of the functionality of a current representative of the Rotexy family ( SHA256 : ba4beb97f5d4ba33162f769f43ec8e7d1ae501acdade792a4a577cd6449e1a84 ) . ChopShop1 is a new framework developed by the MITRE Corporation for network-based protocol decoders that enable security professionals to understand actual commands issued by human operators controlling endpoints . In May 2017 , SecureWorks® Counter Threat Unit® ( CTU ) researchers investigated a widespread and opportunistic WCry ( also known as WanaCry , WanaCrypt , and Wana Decrypt0r ) ransomware campaign that impacted many systems around the world .


Application launch When launching for the first time , the Trojan checks if it is being launched in an emulation environment , and in which country it is being launched . Attachments are typically sent as an executable file embedded in a ZIP archive or a password-protected Microsoft Office document . In November 2017 , SecureWorks Counter Threat Unit ( CTU ) researchers investigated a widespread and opportunistic WCry ransomware campaign that impacted many systems around the world .


If the device is located outside Russia or is an emulator , the application displays a stub page : In this case , the Trojan ’ s logs contain records in Russian with grammatical errors and spelling mistakes : If the check is successful , Rotexy registers with GCM and launches SuperService which tracks if the Trojan has device administrator privileges . This blog post analyzes several recent Molerats attacks that deployed PIVY against targets in the Middle East and in the U.S. We also examine additional PIVY attacks that leverage Arabic-language content related to the ongoing crisis in Egypt and the wider Middle East to lure targets into opening malicious files . Microsoft addressed the SMBv1 vulnerabilities in March 2017 with Security Bulletin MS17-010 .


SuperService also tracks its own status and relaunches if stopped . The archive contains an .exe file , sometimes disguised as a Microsoft Word file , a video , or another file format , using the corresponding icon . The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April .


It performs a privilege check once every second ; if unavailable , the Trojan starts requesting them from the user in an infinite loop : If the user agrees and gives the application the requested privileges , another stub page is displayed , and the app hides its icon : If the Trojan detects an attempt to revoke its administrator privileges , it starts periodically switching off the phone screen , trying to stop the user actions . The Palo Alto Networks Unit 42 research team recently came across a series of malicious files which were almost identical to those targeting the Saudi Arabian government previously discussed by MalwareBytes . If the DoublePulsar backdoor does not exist , then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit .


If the privileges are revoked successfully , the Trojan relaunches the cycle of requesting administrator privileges . We found new variants of the Powermud backdoor , a new backdoor ( Backdoor.Powemuddy ) , and custom tools for stealing passwords , creating reverse shells , privilege escalation , and the use of the native Windows cabinet creation tool , makecab.exe , probably for compressing stolen data to be uploaded . WCry uses a combination of the RSA and AES algorithms to encrypt files .


If , for some reason , SuperService does not switch off the screen when there is an attempt to revoke the device administrator privileges , the Trojan tries to intimidate the user : While running , Rotexy tracks the following : switching on and rebooting of the phone ; termination of its operation – in this case , it relaunches ; sending of an SMS by the app – in this case , the phone is switched to silent mode . Analysts in our DeepSight Managed Adversary and Threat Intelligence ( MATI ) team have found a new backdoor , Backdoor.Powemuddy , new variants of Seedworm 's Powermud backdoor ( aka POWERSTATS ) , a GitHub repository used by the group to store their scripts , as well as several post-compromise tools the group uses to exploit victims once they have established a foothold in their network . The campaign 's use of an SMB worm to distribute WCry contributed to the ransomware 's virulence .


C & C communications The default C & C address is hardwired in the Rotexy code : The relative address to which the Trojan will send information from the device is generated in a pseudo-random manner . Like the previous campaigns , these samples again involve a Microsoft Word document embedded with a malicious macro that is capable of executing PowerShell ( PS ) scripts leading to a backdoor payload . Last week Microsoft , working together with Facebook and others in the security community , took strong steps to protect our customers and the internet from ongoing attacks by an advanced persistent threat actor known to us as ZINC , also known as the Lazarus Group .


Depending on the Trojan version , dynamically generated subdomains can also be used . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign . Last week Microsoft , working together with Facebook , took strong steps to protect our customers and the internet from ongoing attacks by the Lazarus Group .


The Trojan stores information about C & C servers and the data harvested from the infected device in a local SQLite database . In May 2018 , Trend Micro found a new sample ( Detected as W2KM_DLOADR.UHAOEEN ) that may be related to this campaign . We concluded that Lazarus Group was responsible for WannaCry , a destructive malware .


First off , the Trojan registers in the administration panel and receives the information it needs to operate from the C & C ( the SMS interception templates and the text that will be displayed on HTML pages ) : Rotexy intercepts all incoming SMSs and processes them according to the templates it received from the C & C . This bait document , or email attachment , appears to be a standard Word document , but is in fact an CVE-2012-0158 exploit , an executable with a double extension , or an executable with an RTLO filename , so it can execute code without the user 's knowledge or consent . We concluded that Lazarus Group was responsible for WannaCry , a destructive attack in May that targeted Microsoft customers .


Also , when an SMS arrives , the Trojan puts the phone into silent mode and switches off the screen so the user doesn ’ t notice that a new SMS has arrived . Taking a step back , as discussed in the Appendix in our initial OilRig blog , Clayslide delivery documents initially open with a worksheet named " Incompatible " that displays content that instructs the user to " Enable Content " to see the contents of the document , which in fact runs the malicious macro and compromises the system . Today , the governments of the United States , United Kingdom , Australia , Canada , New Zealand and Japan have all announced that the government of North Korea is responsible for the activities of ZINC/Lazarus .


When required , the Trojan sends an SMS to the specified phone number with the information it has received from the intercepted message . The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199 . In November 2017 , Secureworks Counter Threat Unit™ ( CTU ) researchers discovered the North Korean cyber threat group , known as Lazarus Group and internally tracked as NICKEL ACADEMY by Secureworks , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


( It is specified in the interception template whether a reply must be sent , and which text should be sent to which address . The vulnerability exists in the old Equation Editor ( EQNEDT32.EXE ) , a component of Microsoft Office that is used to insert and evaluate mathematical formulas . In November 2017 , CTU researchers discovered the North Korean cyber threat group , known as Lazarus Group , had launched a malicious spearphishing campaign using the lure of a job opening for the CFO role at a European-based cryptocurrency company .


) If the application hasn ’ t received instructions about the rules for processing incoming SMSs , it simply saves all SMSs to a local database and uploads them to the C & C . The January 8 attack used a variant of the ThreeDollars delivery document , which we identified as part of the OilRig toolset based on attacks that occurred in August 2017 . Bankshot is designed to persist on a victim 's network for further exploitation ; thus the Advanced Threat Research team believes this operation is intended to gain access to specific financial organizations .


Apart from general information about the device , the Trojan sends a list of all the running processes and installed applications to the C & C . The email contained an attachment named Seminar-Invitation.doc , which is a malicious Microsoft Word document we track as ThreeDollars . CTU researchers assess this as the continuation of activity first observed in 2016 , and it is likely that the campaign is ongoing .


It ’ s possible the threat actors use this list to find running antivirus or banking applications . We also identified another sample of ThreeDollars , created on January 15 , 2017 with the file name strategy preparation.dot . CTU researchers have observed NICKEL ACADEMY ( Lazarus ) copying and pasting job descriptions from online recruitment sites in previous campaigns .


Rotexy will perform further actions after it receives the corresponding commands : START , STOP , RESTART — start , stop , restart SuperService . We had previously observed this author name in use once before , in the very first ThreeDollars document we collected that we had reported on in August 2017 . There are several indicators , which have led CTU researchers to believe with high confidence that NICKEL ACADEMY is behind the current spearphishing campaign .


URL — update C & C address . The June 2017 sample of Clayslide contained the same OfficeServicesStatus.vbs file found in the ISMAgent Clayslide document , but instead of having the payload embedded in the macro as segregated base64 strings that would be concatenated , this variant obtained its payload from multiple cells within the " Incompatible " worksheet . CTU researchers also identified components in the custom C2 protocol being used which they have seen utilized by Nickel Academy ( Lazarus ) previously .


MESSAGE – send SMS containing specified text to a specified number . During this testing , we saw document filenames that contain the C2 we witnessed in the targeted attack above , specifically the filenames XLS-withyourface.xls and XLS-withyourface – test.xls . CTU researchers also identified components in the custom C2 protocol being used ( the ACT in which the malware talks to the Command and Control Servers ) which they have seen utilized by Nickel Academy ( Lazarus ) previously .


UPDATE_PATTERNS – reregister in the administration panel . These samples appeared to have been created by OilRig during their development and testing activities , all of which share many similarities with the delivery document used in the recent OilRig attack against a Middle Eastern government , N56.15.doc ( 7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00 ) that we have also included in Table 1 . Leafminer attempts to infiltrate target networks through various means of intrusion : watering hole websites , vulnerability scans of network services on the internet , and brute-force login attempts .


UNBLOCK – unblock the telephone ( revoke device administrator privileges from the app ) . The attackers sent multiple emails containing macro-enabled XLS files to employees working in the banking sector in the Middle East . The researchers found that there are common elements in the macro and in the first- stage RAT used in this campaign , with former campaigns of the NICKEL ACADEMY ( Lazarus ) threat group .


UPDATE – download APK file from C & C and install it . In the first week of May 2016 , FireEye 's DTI identified a wave of emails containing malicious attachments being sent to multiple banks in the Middle East region . During our investigation , there was a breakthrough discovery that helped connect Leafminer to a number of attacks observed on systems in the Middle East and identify the toolkit used in the group 's efforts of intrusion , lateral movement , and Exfiltration .


This command can be used not just to update the app but to install any other software on the infected device . Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting , again attempting to extract all Word documents . As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the Leafminer .


CONTACTS – send text received from C & C to all user contacts . For example , in September 2016 , Sowbug infiltrated an organization in Asia , deploying the Felismus backdoor on one of its computers , Computer A , using the file name adobecms.exe in CSIDL_WINDOWS\debug . As of early June 2018 , the server hosted 112 files in a subdirectory that could be accessed through a public web shell planted by the attackers .


This is most probably how the application spreads . Symantec has found evidence of Starloader files being named AdobeUpdate.exe , AcrobatUpdate.exe , and INTELUPDATE.EXE among others . The Leafminer 's post-compromise toolkit suggests that Leafminer is looking for email data , files , and database servers on compromised target systems .


CONTACTS_PRO – request unique message text for contacts from the address book . The attackers then began to perform reconnaissance activities on Computer A via cmd.exe , collecting system-related information , such as the OS version , hardware configuration , and network information . Researching the hacker handle MagicCoder results in references to the Iranian hacking forum Ashiyane as well as defacements by the Iranian hacker group Sun Army .


PAGE – contact URL received from C & C using User-Agent value that was also received from C & C or local database . In September 2015 , Kaspersky Lab 's Anti-Targeted Attack Platform discovered anomalous network traffic in a government organization network . Targeted regions included in the list of Leafminer are Saudi Arabia , United Arab Emirates , Qatar , Kuwait , Bahrain , Egypt , Israel , and Afghanistan .


ALLMSG – send C & C all SMSs received and sent by user , as stored in phone memory . Symantec detects this threat as Backdoor.Nidiran . Our investigation of Leafminer started with the discovery of JavaScript code on several compromised websites in the Middle East .


ALLCONTACTS – send all contacts from phone memory to C & C . Attackers have been known to distribute malicious files masquerading as the legitimate iviewers.dll file and then use DLL load hijacking to execute the malicious code and infect the computer . This included the Fuzzbunch framework that was part of an infamous leak of exploits and tools by the Shadow Brokers in April 2017 .


ONLINE – send information about Trojan ’ s current status to C & C : whether it has device administrator privileges , which HTML page is currently displayed , whether screen is on or off , etc . Once exploit has been achieved , Nidiran is delivered through a self-extracting executable that extracts the components to a .tmp folder after it has been executed . Leafminer has developed exploit payloads for this framework ( Table 2 ) that deliver custom malware through attacks against SMB vulnerabilities described by Microsoft .


NEWMSG – write an SMS to the device memory containing the text and sender number sent from C & C . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions . The EternalBlue exploits from the framework received worldwide attention after being used in the ransomware campaigns WannaCry in May and Petya / NotPetya in June 2017 .


CHANGE_GCM_ID – change GCM ID . While there have been several Suckfly campaigns that infected organizations with the group 's custom malware Backdoor.Nidiran , the Indian targets show a greater amount of post-infection activity than targets in other regions . The Leafminer operators use EternalBlue to attempt lateral movement within target networks from compromised staging servers .


BLOCKER_BANKING_START – display phishing HTML page for entry of bank card details . This time , however , TA459 opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Symantec also observed attempts by Leafminer to scan for the Heartbleed vulnerability ( CVE-2014-0160 ) from an attacker-controlled IP address .


BLOCKER_EXTORTIONIST_START – display HTML page of the ransomware . This time , however , attackers opportunistically used spear-phishing emails with a Microsoft Word attachment exploiting the recently patched CVE-2017-0199 to deploy the ZeroT Trojan , which in turn downloaded the PlugX Remote Access Trojan ( RAT ) . Furthermore , the Leafminer arsenal server hosted a Python script to scan for this vulnerability .


BLOCKER_UPDATE_START – display fake HTML page for update . Data from the early part of this year shows that the Taidoor attackers rampantly used malicious.DOC files to exploit a Microsoft Common Controls vulnerability , CVE-2012-0158 . Another intrusion approach used by Leafminer seems a lot less sophisticated than the previously described methods but can be just as effective : using specific hacktools to guess the login passwords for services exposed by a targeted system .


BLOCKER_STOP – block display of all HTML pages . To better understand how the adversary was operating and what other actions they had performed , CTU researchers examined cmd.exe and its supporting processes to uncover additional command line artifacts . Commands found in a readme text that was stored in a ZIP archive together with the hacktool THC Hydra in Leafminer 's tool arsenal represent online dictionary attacks on Microsoft Exchange and Remote Desktop Protocol services of regional government servers in Saudi Arabia .


The C & C role for Rotexy can be filled not only by a web server but also by any device that can send SMSs . In a separate incident , CTU researchers identified a file named s.txt , which is consistent with the output of the Netview host-enumeration tool . Symantec identified two strains of custom malware used by the Leafminer group : Trojan.Imecab and Backdoor.Sorgu .


The Trojan intercepts incoming SMSs and can receive the following commands from them : “ 3458 ” — revoke device administrator privileges from the app ; “ hi ” , “ ask ” — enable and disable mobile internet ; “ privet ” , “ ru ” — enable and disable Wi-Fi ; “ check ” — send text “ install : [ device IMEI ] ” to phone number from which SMS was sent ; “ stop_blocker ” — stop displaying all blocking HTML pages ; “ 393838 ” — change C & C address to that specified in the Thrip was attempting to remotely install a previously unknown piece of malware ( Infostealer.Catchamas ) on computers within the victim 's network . Leafminer is a highly active group , responsible for targeting a range of organizations across the Middle East .


SMS . Catchamas is a custom Trojan designed to steal information from an infected computer and contains additional features designed to avoid detection . Leafminer appears to be based in Iran and seems to be eager to learn from and capitalize on tools and techniques used by more advanced threat actors .


Information about all actions performed by Rotexy is logged in the local database and sent to the C & C . The malicious loader will use dynamic-link library ( DLL ) hijacking — injecting malicious code into a process of a file/application — on sidebar.exe and launch dllhost.exe ( a normal file ) . Leafminer also utilized Process Doppelganging , a detection evasion technique first discussed at the Black Hat EU conference last year .


The server then sends a reply that contains instructions on further actions to be taken . As we have noted in many earlier reports , attackers commonly use decoy files to trick victims into thinking a malicious document is actually legitimate . Dragos has identified Leafminer group targeting access operations in the electric utility sector .


Displaying HTML pages We ’ ll now look at the HTML pages that Rotexy displays and the actions performed with them . The documents attached to spear-phishing e-mails used in both attacks contain code that exploits CVE-2012-0158 , which despite its age remains one of the most common Microsoft Word vulnerabilities being exploited by multiple threat actors . Analysis of RASPITE tactics , techniques , and procedures ( TTPs ) indicate the group has been active in some form since early - to mid-2017 .


The Trojan displays a fake HTML update page ( update.html ) that blocks the device ’ s screen for a long period of time . Even an experienced user can be fooled by downloading a malicious file that is apparently from adobe.com , since the URL and the IP address correspond to Adobe 's legitimate infrastructure . RASPITE targeting includes entities in the US , Middle East , Europe , and East Asia .


The Trojan displays the extortion page ( extortionist.html ) that blocks the device and demands a ransom for unblocking it . According to Deepen , APT6 has been using spear phishing in tandem with malicious PDF and ZIP attachments or links to malware infected websites that contains a malicious SCR file . RASPITE overlaps significantly with Symantec 's Leafminer , which recently released a report on the group 's activity in the Middle East .


The sexually explicit images in this screenshot have been covered with a black box . Bellingcat also reported the domain had been used previously to host potential decoy documents as detailed in VirusTotal here using hxxp://voguextra.com/decoy.doc . RASPITE 's activity to date currently focuses on initial access operations within the electric utility sector .


The Trojan displays a phishing page ( bank.html ) prompting the user to enter their bank card details . We identified an overlap in the domain voguextra.com , which was used by Bahamut within their " Devoted To Humanity " app to host an image file and as C2 server by the PrayTime iOS app mentioned in our first post . This means that the Leafminer group is targeting electric utilities .


This page mimics a legitimate bank form and blocks the device screen until the user enters all the information . While not detected at the time , Microsoft 's antivirus and security products now detect this Barium malicious file and flag the file as " Win32/ShadowPad.A " . While the group has not yet demonstrated an ICS capability , RASPITE 's recent targeting focus and methodology are clear indicators of necessary activity for initial intrusion operations into an IT network to prepare the ACT for later potential ICS events .


It even has its own virtual keyboard that supposedly protects the victim from keyloggers . MXI Player appears to be a version of the Bahamut agent , designed to record the phone calls and collect other information about the user ( com.mxi.videoplay ) . Active since at least 2014 , this actor has long-standing interest in maritime industries , naval defense contractors , and associated research institutions in the United States and Western Europe .


In the areas marked ‘ { text } ’ Rotexy displays the text it receives from the C & C . Like PLEAD , Shrouded Crossbow uses spear-phishing emails with backdoor-laden attachments that utilize the RTLO technique and accompanied by decoy documents . Active since at least 2014 , the Leviathan has long-standing interest in maritime industries , naval defense contractors , and associated research institutions in the United States and Western Europe .


Typically , it is a message saying that the user has received a money transfer , and that they must enter their bank card details so the money can be transferred to their account . The self-extracting RAR writes a legitimate executable , an actor-created DLL called Loader.dll and a file named readme.txt to the filesystem and then executes the legitimate executable . On September 15 and 19 , 2017 , Proofpoint detected and blocked spearphishing emails from this group targeting a US shipbuilding company and a US university research center with military ties .


The entered data is then checked and the last four digits of the bank card number are also checked against the data sent in the C & C command . Leader is Bookworm 's main module and controls all of the activities of the Trojan , but relies on the additional DLLs to provide specific functionality . The attachments exploited CVE-2017-8759 which was discovered and documented only five days prior to the campaign .


The following scenario may play out : according to the templates for processing incoming SMSs , Rotexy intercepts a message from the bank that contains the last four digits of the bank card connected to the phone number . We speculate that other attacks delivering Bookworm were also targeting organizations in Thailand based on the contents of the associated decoys documents , as well as several of the dynamic DNS domain names used to host C2 servers that contain the words " Thai " or " Thailand " . Some of the documents exploited CVE-2017-0199 to deliver the payload .


The Trojan sends these digits to the C & C , which in turn sends a command to display a fake data entry window to check the four digits . Threat actors may use the date string hardcoded into each Bookworm sample as a build identifier . Between August 2 and 4 , the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors .


If the user has provided the details of another card , then the following window is displayed : The application leaves the user with almost no option but to enter the correct card number , as it checks the entered number against the bank card details the cybercriminals received earlier . Due to these changes without a new date string , we believe the date codes are used for campaign tracking rather than a Bookworm build identifier . Between August 2 and 4 , the Leviathan sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors .


When all the necessary card details are entered and have been checked , all the information is uploaded to the C & C . Another decoy slideshow associated with the Bookworm attack campaign contains photos of an event called Bike for Dad 2015 . The Leviathan also occasionally used macro-laden Microsoft Word documents to target other US research and development organizations during this period .


How to unblock the phone Now for some good news : Rotexy doesn ’ t have a very well-designed module for processing commands that arrive in SMSs . If the document was delivered with macros instead of exploits ( CVE-2012-0158 , CVE-2013-3906 or CVE-2014-1761 ) , then the document contained instructions for enabling macros . The period between November 2014 and January 2015 marked one of the earlier instances in which Proofpoint observed persistent exploitation attempts by this actor .


It means the phone can be unblocked in some cases when it has been blocked by one of the above HTML pages . The executable would install the real Ammyy product , but would also launch a file called either AmmyyService.exe or AmmyySvc.exe which contained the malicious payload . The Leviathan , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 .


This is done by sending “ 3458 ” in an SMS to the blocked device – this will revoke the administrator privileges from the Trojan . The second , aptly titled " kontrakt87.doc " , copies a generic telecommunications service contract from MegaFon , a large Russian mobile phone operator . This actor , whose espionage activities primarily focus on targets in the US and Western Europe with military ties , has been active since at least 2014 .


After that it ’ s necessary to send “ stop_blocker ” to the same number – this will disable the display of HTML pages that extort money and block the screen . In addition to built-in functionalities , the operators of Careto can upload additional modules which can perform any malicious task . The campaign is linked to a group of suspected Chinese cyber espionage actors we have tracked since 2013 , dubbed TEMP.Periscope .


Rotexy may start requesting device administrator privileges again in an infinite loop ; in that case , restart the device in safe mode and remove the malicious program . Careto 's Mask campaign we discovered relies on spear-phishing e-mails with links to a malicious website . The Leviathan generally emailed Microsoft Excel documents with malicious macros to US universities with military interests , most frequently related to the Navy .


However , this method may not work if the threat actors react quickly to an attempt to remove the Trojan . Sometimes , the attackers use sub-domains on the exploit websites , to make them seem more legitimate . The current campaign is a sharp escalation of detected activity since summer 2017 .


In that case , you first need to send the text “ 393838 ” in an SMS to the infected device and then repeat all the actions described above ; that text message will change the C & C address to “ : // ” , so the phone will no longer receive commands from the real C & C . We initially became aware of Careto when we observed attempts to exploit a vulnerability in our products to make the malware " invisible " in the system . Since early 2018 , FireEye ( including our FireEye as a Service ( FaaS ) , Mandiant Consulting , and iSIGHT Intelligence teams ) has been tracking an ongoing wave of intrusions targeting engineering and maritime entities , especially those connected to South China Sea issues .


Please note that these unblocking instructions are based on an analysis of the current version of Rotexy and have been tested on it . The scanner was identified as the Acunetix Web Vulnerability Scanner which is a commercial penetration testing tool that is readily available as a 14-day trial . Known targets of the Leviathan have been involved in the maritime industry , and research institutes , academic organizations , and private firms in the United States .


However , it ’ s possible the set of commands may change in future versions of the Trojan . The decoy documents dropped suggest that the targets are likely to be politically or militarily motivated , with subjects such as Intelligence reports and political situations being used as lure documents . Active since at least 2013 , TEMP.Periscope has primarily focused on maritime-related targets across multiple verticals , including engineering firms , shipping and transportation , manufacturing , defense , government offices , and research universities .


Geography of Rotexy attacks According to our data , 98 % of all Rotexy attacks target users in Russia . Lately , Patchwork has been sending multiple RTF files exploiting CVE-2017-8570 . TEMP.Periscope overlaps in targeting , as well as tactics , techniques , and procedures ( TTPs ) , with TEMP.Jumper , a group that also overlaps significantly with public reporting on NanHaiShu .


Indeed , the Trojan explicitly targets Russian-speaking users . The first of which we call ' CONFUCIUS_A ' , a malware family that has links to a series of attacks associated with a backdoor attack method commonly known as SNEEPY ( aka ByeByeShell ) first reported by Rapid7 in 2013 . The actor has conducted operations since at least 2013 in support of China 's naval modernization effort .


There have also been cases of users in Ukraine , Germany , Turkey and several other countries being affected . At first glance CONFUCIUS_B looks very similar to CONFUCIUS_A , and they are also packaged in plain SFX binary files . FireEye is highlighting a Cyber Espionage operation targeting crucial technologies and traditional intelligence targets from a China-nexus state sponsored actor we call APT40 .


Kaspersky Internet Security for Android and the Sberbank Online app securely protect users against attacks by this Trojan . The CONFUCIUS_B executable is disguised as a PowerPoint presentation , using a Right-To-Left-Override ( RTLO ) trick and a false icon . The Leviathan group has specifically targeted engineering , transportation , and the defense industry , especially where these sectors overlap with maritime technologies .


IOCs SHA256 0ca09d4fde9e00c0987de44ae2ad51a01b3c4c2c11606fe8308a083805760ee7 4378f3680ff070a1316663880f47eba54510beaeb2d897e7bbb8d6b45de63f96 76c9d8226ce558c87c81236a9b95112b83c7b546863e29b88fec4dba5c720c0b 7cc2d8d43093c3767c7c73dc2b4daeb96f70a7c455299e0c7824b4210edd6386 We also believe that both clusters of activity have links to attacks with likely Indian origins , the CONFUCIUS_A attacks are linked to the use of SNEEPY/BYEBYESHELL and the CONFUCIUS_B have a loose link to Hangover . We believe APT40 's emphasis on maritime issues and naval technology ultimately support China 's ambition to establish a blue-water navy .


9b2fd7189395b2f34781b499f5cae10ec86aa7ab373fbdc2a14ec4597d4799ba ac216d502233ca0fe51ac2bb64cfaf553d906dc19b7da4c023fec39b000bc0d7 b1ccb5618925c8f0dda8d13efe4a1e1a93d1ceed9e26ec4a388229a28d1f8d5b ba4beb97f5d4ba33162f769f43ec8e7d1ae501acdade792a4a577cd6449e1a84 The two malware families themselves are also very similar , and therefore we think that the shared technique is an indication of a single developer , or development company , behind both CONFUCIUS_A and CONFUCIUS_B . Within a year APT40 was observed masquerading as a UUV manufacturer , and targeting universities engaged in naval research .


ba9f4d3f4eba3fa7dce726150fe402e37359a7f36c07f3932a92bd711436f88c e194268bf682d81fc7dc1e437c53c952ffae55a9d15a1fc020f0219527b7c2ec С & C 2014–2015 : secondby.ru darkclub.net holerole.org googleapis.link 2015–2016 : test2016.ru blackstar.pro synchronize.pw lineout.pw sync-weather.pw The Android version , for instance , can steal SMS messages , accounts , contacts , and files , as well as record audio . APT40 engages in broader regional targeting against traditional intelligence targets , especially organizations with operations in Southeast Asia .


2016 freedns.website streamout.space 2017–2018 : streamout.space sky-sync.pw gms-service.info EventBot : A New Mobile Banking Trojan is Born April 30 , 2020 KEY FINDINGS The Cybereason Nocturnus team is investigating EventBot , a new type of Android mobile malware that emerged around March 2020 . The documents that exploit CVE2017-11882 download another payload — an HTML Application ( HTA ) file toting a malicious Visual Basic ( VBS ) script — from the server , which is executed accordingly by the command-line tool mshta.exe . We assess with moderate confidence that APT40 is a state-sponsored Chinese Cyber Espionage operation .


EventBot is a mobile banking trojan and infostealer that abuses Android ’ s accessibility features to steal user data from financial applications , read user SMS messages , and steal SMS messages to allow the malware to bypass two-factor authentication . According to our statistics , as of the beginning of 2015 this botnet encompassed over 250 000 infected devices worldwide including infecting more than 100 financial institutions with 80% of them from the top 20 list . The actor 's targeting is consistent with Chinese state interests and there are multiple technical artifacts indicating the actor is based in China .


EventBot targets users of over 200 different financial applications , including banking , money transfer services , and crypto-currency wallets . If a bot was installed on a network that was of interest to the hacking group , this bot was then used to upload one of the remote access programs . Analysis of the operational times of the group 's activities indicates that it is probably centered around China Standard TIME ( UTC +8 ) .


Those targeted include applications like Paypal Business , Revolut , Barclays , UniCredit , CapitalOne UK , HSBC UK , Santander UK , TransferWise , Coinbase , paysafecard , and many more . At first look , it pretends to be a Java related application but after a quick analysis , it was obvious this was something more than just a simple Java file . APT40 relies heavily on web shells for an initial foothold into an organization .


It specifically targets financial banking applications across the United States and Europe , including Italy , the UK , Spain , Switzerland , France , and Germany . Contextually relevant emails are sent to specific targets with attached documents that are packed with exploit code and Trojan horse programmes designed to take advantage of vulnerabilities in software installed on the target 's computer . APT40 has been observed leveraging a variety of techniques for initial compromise , including web server exploitation , phishing campaigns delivering publicly available and custom backdoors , and strategic web compromises .


The full list of banking applications targeted is included in the appendix . The authors of that report identify three primary tools used in the campaigns attributed to Hidden Lynx : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit . Depending on placement , a Web shell can provide continued access to victims ' environments , re-infect victim systems , and facilitate lateral movement .


EventBot is particularly interesting because it is in such early stages . The above network shows relationships between three tools used by Hidden Lynx during its VOHO campaign : Trojan.Naid , Backdoor.Moudoor , and Backdoor.Hikit . The group 's capabilities are more than the much discussed CVE-2012-0158 exploits over the past few years .


This brand new malware has real potential to become the next big mobile malware , as it is under constant iterative improvements , abuses a critical operating system feature , and targets financial applications . Symantec during 2012 linked the Elderwood Project to Operation Aurora ; Trojan.Naid and Backdoor.Moudoor were also used in Aurora , by the Elderwood Gang , and by Hidden Lynx . A paper released today by our colleagues at Palo Alto Networks presented a portion of data on this crew under the label " the Lotus Blossom Operation " , likely named for the debug string present in much of the " Elise " codebase since at least 2012 : " d:\lstudio\projects\lotus\… " .


This research gives a rare look into the process improvements malware authors make when optimizing before launch . One e-mail carried a Microsoft PowerPoint file named " thanks.pps " ( VirusTotal ) , the other a Microsoft Word document named " request.docx " . Instead , the Spring Dragon group is known to have employed spearphish exploits , strategic web compromises , and watering holes attack .


By going on the offensive and hunting the attackers , our team was able to unearth the early stages of what may be a very dangerous mobile malware . Around the same time , WildFire also captured an e-mail containing a Word document ( " hello.docx " ) with an identical hash as the earlier Word document , this time sent to a U.S. Government recipient . The group 's spearphish toolset includes PDF exploits , Adobe Flash Player exploits , and the common CVE-2012-0158 Word exploits including those generated from the infamous " Tran Duy Linh " kit .


TABLE OF CONTENTS Security Recommendations Introduction Threat Analysis Common Features Unique Features by Version Malware Under Active Development Suspected Detection Tests by the Threat Actor EventBot Infrastructure Cybereason Mobile Conclusion Indicators of Compromise MITRE ATT & CK for Mobile Breakdown SECURITY RECOMMENDATIONS Keep your mobile device up-to-date with the latest software updates from legitimate sources . The initially-observed " thanks.pps " example tricks the user into running the embedded file named ins8376.exe which loads a payload DLL named mpro324.dll . The Spring Dragon appears to have rolled out a steady mix of exploits against government-related organizations in VN , TW , PH , and other locations over the past few years .


Keep Google Play Protect on . In this case , the file used the software name " Cyberlink " , and a description of " CLMediaLibrary Dynamic Link Library " and listing version 4.19.9.98 . Organizations located in Myanmar and targeted by Spring Dragon have gone unmentioned .


Do not download mobile apps from unofficial or unauthorized sources . This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL , depending on the malware sample . Spring Dragon 's infiltration techniques there were not simply spearphish .


Most legitimate Android apps are available on the Google Play Store . Once BARIUM has established rapport , they spear-phish the victim using a variety of unsophisticated malware installation vectors , including malicious shortcut ( .lnk ) files with hidden payloads , compiled HTML help ( .chm ) files , or Microsoft Office documents containing macros or exploits . The download name was " Zawgyi_Keyboard_L.zip " , and it dropped a " setup.exe " that contained several backdoor components , including an Elise " wincex.dll " ( a42c966e26f3577534d03248551232f3 , detected as Backdoor.Win32.Agent.delp ) .


Always apply critical thinking and consider whether you should give a certain app the permissions it requests . This was the case in two known intrusions in 2015 , where attackers named the implant DLL " ASPNET_FILTER.DLL " to disguise it as the DLL for the ASP.NET ISAPI Filter . While this particular actor effectively used their almost worn out CVE-2012-0158 exploits in the past , Spring Dragon employs more involved and creative intrusive activity as well .


When in doubt , check the APK signature and hash in sources like VirusTotal before installing it on your device . In early 2016 the Callisto Group began sending highly targeted spear phishing emails with malicious attachments that contained , as their final payload , the " Scout " malware tool from the HackingTeam RCS Galileo platform . The well-known threat group called DRAGONFISH or Lotus Blossom are distributing a new form of Elise malware targeting organizations for espionage purposes .


Use mobile threat detection solutions for enhanced security . The malicious attachments purported to be invitations or drafts of the agenda for the conference . The threat actors associated with DRAGONFISH have previously focused their campaigns on targets in Southeast Asia , specifically those located in countries near the South China Sea .


INTRODUCTION For the past few weeks , the Cybereason Nocturnus team has been investigating a new type of Android malware dubbed EventBot , which was first identified in March 2020 . We encountered the first document exploit called " THAM luan - GD - NCKH2.doc " a few days ago , which appears to be leveraging some vulnerabilities patched with MS12-060 . iDefense analysts have identified a campaign likely to be targeting members of— or those with affiliation or interest in—the ASEAN Defence Ministers ' Meeting ( ADMM ) .


This malware appears to be newly developed with code that differs significantly from previously known Android malware . This document , written in Vietnamese , appears to be reviewing and discussing best practices for teaching and researching scientific topics . iDefense analysts have identified a campaign likely to be targeting members of or those with affiliation or interest in the ASEAN Defence Minister 's Meeting ( ADMM ) .


EventBot is under active development and is evolving rapidly ; new versions are released every few days with improvements and new capabilities . Examples as early as 2008 document malware operations against Tibetan non-governmental organizations ( NGOs ) that also targeted Falun Gong and Uyghur groups . iDefense assesses with high confidence that this campaign is associated with the threat group DRAGONFISH ( also known as Lotus Blossom and Spring Dragon ) .


EventBot abuses Android ’ s accessibility feature to access valuable user information , system information , and data stored in other applications . There is the exploit code and malware used to gain access to systems , the infrastructure that provides command and control to the malware operator , and the human elements – developers who create the malware , operators who deploy it , and analysts who extract value from the stolen information . To mitigate the threat of the described campaign , security teams can consider blocking access to the C2 server 103.236.150.14 and , where applicable , ensure that the Microsoft Security Update KB2553204 is installed in order to patch the CVE-2017-11882 vulnerability .


In particular , EventBot can intercept SMS messages and bypass two-factor authentication mechanisms . The operation against the Tibetan Parliamentarians illustrates the continued use of malicious attachments in the form of documents bearing exploits . The actors attempted to exploit CVE-2014-6332 using a slightly modified version of the proof-of-concept ( POC ) code to install a Trojan called Emissary , which is related to the Operation Lotus Blossom campaign .


The Cybereason Nocturnus team has concluded that EventBot is designed to target over 200 different banking and finance applications , the majority of which are European bank and crypto-currency exchange applications . The first attack started in early July with a ShimRatReporter payload . The targeting of this individual suggests the actors are interested in breaching the French Ministry of Foreign Affairs itself or gaining insights into relations between France and Taiwan .


By accessing and stealing this data , Eventbot has the potential to access key business data , including financial data . In their Operation Tropic Trooper report , Trend Micro documented the behaviour and functionality of an espionage toolkit with several design similarities to those observed in the various components of KeyBoy . On November 10 , 2015 , threat actors sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


60 % of devices containing or accessing enterprise data are mobile , and mobile devices tend to include a significant amount of personal and business data , assuming the organization has a bring-your-own-device policy in place . The exploit document carrying this alternate KeyBoy configuration also used a decoy document which was displayed to the user after the exploit launched . On November 10 , 2015 , Lotus Blossom sent a spear-phishing email to an individual at the French Ministry of Foreign Affairs .


Mobile malware is a significant risk for organizations and consumers alike , and must be considered when protecting personal and business data . This technique hides the true C2 server from researchers that do not have access to both the rastls.dll and Sycmentec.config files . Both attachments are malicious Word documents that attempt to exploit the Windows OLE Automation Array Remote Code Execution Vulnerability tracked by CVE-2014-6332 .


EventBot mobile banking applications targetedApplications targeted by EventBot . This file requires the target to attempt to open the .lnk file , which redirects the user to a Windows Scripting Component ( .wsc ) file , hosted on an adversary-controlled microblogging page . Lotus Blossom attempted to exploit CVE-2014-6332 using the POC code available in the wild .


Cybereason Mobile Detecting EventBotCybereason Mobile detecting EventBot . Upon successful exploitation , the attachment will install the trojan known as NetTraveler using a DLL side-loading attack technique . This Trojan is related to the Elise backdoor described in the Operation Lotus Blossom report .


THREAT ANALYSIS Initial Access Though EventBot is not currently on the Google Play Store , we were able to find several icons EventBot is using to masquerade as a legitimate application . Kaspersky Lab 's products detect the Microsoft Office exploits used in the spear-phishing attacks , including Exploit.MSWord.CVE-2010-333 , Exploit.Win32.CVE-2012-0158 . Lotus Blossom was attempting to exploit CVE-2014-6332 to install a new version of the Emissary Trojan , specifically version 5.3 .


We believe that , when it is officially released , it will most likely be uploaded to rogue APK stores and other shady websites , while masquerading as real applications . The files exploit the well-known Microsoft Office vulnerability , CVE-2012-0158 , to execute malicious code in order to take control of the targeted systems . APT threat actors , most likely nation state-sponsored , targeted a diplomat in the French Ministry of Foreign Affairs with a seemingly legitimate invitation to a technology conference in Taiwan .


Icons used for EventBot masqueraded as legitimate with these icons.application . We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester . Additionally , the targeting of a French diplomat based in Taipei , Taiwan aligns with previous targeting by these actors , as does the separate infrastructure .


Malware Capabilities The Cybereason Nocturnus team has been following EventBot since the beginning of March 2020 . For example , Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2 This Bisonal variant used in the latest attack communicates with one of the following hard-coded C2 addresses by using the HTTP POST method on TCP port 443 . The Elise malware used by Lotus Blossom , which was an attack campaign on targets in Southeast Asia .


The team has encountered different versions of the malware over time as it has rapidly evolved . Previous reports have discussed Bisonal malware used in attacks against Japan , South Korea and Russia . Based on the targeting and lures , Unit 42 assesses that the Lotus Blossom actors ' collection requirements include militaries and government agencies in Southeast Asia .


At the time of writing this research , four versions of the EventBot malware were observed : Version 0.0.0.1 , 0.0.0.2 , and 0.3.0.1 and 0.4.0.1 . This particular sample we found targeted an organization in Russia and there is a specific system language check for Cyrillic and no others . In December 2015 , Unit 42 published a blog about a cyber espionage attack using the Emissary Trojan as a payload .


Each version expands the bot ’ s functionality and works to obfuscate the malware against analysis . If it's Cyrillic and the command to the shell is not ‘ipconfig’ , the threat converts the command result text encoding from Cyrillic to UTF-16 . The oldest sample we found was created in 2009 , indicating this tool has been in use for almost seven years .


In this research , we review common features of the malware and examine the improvements the threat actor made in each version . Similar to the Bisonal variant targeting the Russian organization , this sample was also disguised as PDF document . In addition , Emissary appears to against Taiwan or Hong Kong , all of the decoys are written in Traditional Chinese , and they use themes related to the government or military .


COMMON FEATURES Permissions When installed , EventBot requests the following permissions on the device : SYSTEM_ALERT_WINDOW - allow the app to create windows that are shown on top of other apps . The contents of the decoy PDF is a job descriptions with the South Korean Coast Guard . Of note , this is three years earlier than the oldest Elise sample we have found , suggesting this group has been active longer than previously documented .


READ_EXTERNAL_STORAGE - read from external storage . The installed EXE file is almost exactly the same as the DLL version of Bisonal variant used against the Russian organization . In addition , we observed a TTP shift post publication with regards to their malware delivery ; they started using compromised but legitimate domains to serve their malware .


REQUEST_INSTALL_PACKAGES - make a request to install packages . ined in the archive is called DriverInstallerU.exe but its metadata shows that its original name is Interenet Assistant.exe . All of the Emissary we've collected are written in Traditional Chinese , which is used primarily in Taiwan and Hong Kong .


INTERNET - open network sockets . In this sample , however , the module names were changed from actors and characters’ names to car models , namely BMW_x1” , BMW_x2” and up to BMW_x8” . One of the most interesting observations made during this analysis is that the amount of development effort devoted to Emissary significantly increased after we published our Operation Lotus Blossom report in June 2015 , resulting in many new versions of the Emissary Trojan .


REQUEST_IGNORE_BATTERY_OPTIMIZATIONS - whitelist the app to allow it to ignore battery optimizations . wuaupdt.exe is a CMD backdoor , which can receive and execute CMD commands sent from C2 . Lotus Blossom targeted the government , higher education , and high tech companies .


WAKE_LOCK - prevent the processor from sleeping and dimming the screen . Furthermore , it has similar code logic as previous ones wuaupdt.exe in this attack appears in previous Donot attack , and C2 addresses are same to previous ones . Our evidence suggests that malware authors created Emissary as early as 2009 , which suggests that threat actors have relied on this tool as a payload in cyber-espionage attacks for many years .


ACCESS_NETWORK_STATE - allow the app to access information about networks . Other open source and semi-legitimate pen-testing tools like nbtscan and powercat are being used for mapping available resources and lateral movement as well . While it lacks more advanced functionality like screen capturing , it is still able to carry out most tasks desired by threat actors : Exfiltration of files , ability to download and execute additional payloads , and gain remote shell access .


REQUEST_COMPANION_RUN_IN_BACKGROUND - let the app run in the background . As described in the infection flow , one of the first uses of the AutoHotKey scripts is to upload a screenshot from the compromised PC . The timeline in Figure 2 shows that the Emissary Trojan was first created ( version 1.0 ) in May 2009 and quickly received an update that resulted in version 1.1 in June 2009 .


REQUEST_COMPANION_USE_DATA_IN_BACKGROUND - let the app use data in the background . Throughout our investigation , we have found evidence that shows operational similarities between this implant and Gamaredon Group . Between August and November 2015 the malware author creates several new versions of Emissary , specifically 5.0 , 5.1 , 5.3 and 5.4 in a much more rapid succession compared to development process in earlier versions .


RECEIVE_BOOT_COMPLETED - allow the application to launch itself after system boot . The techniques and modules employed by EvilGnome — that is the use of SFX , persistence with task scheduler and the deployment of information stealing tools—remind us of Gamaredon Group’s Windows tools . Version 2.0 received one update in October 2013 before the malware author released version 3.0 in December 2014 .


EventBot uses this permission in order to achieve persistence and run in the background as a service . We can observe that the sample is very recent , created on Thursday , July 4 While this may be coincidental , the out-of-sequence version 3.0 sample was created ten days after we published the Operation Lotus Blossom paper that exposed the Elise Trojan that is closely related to Emissary .


RECEIVE_SMS - allow the application to receive text messages . As can be observed in the illustration above , the makeself script is instructed to run ./setup.sh after unpacking . The Lotus Blossom largely targets military or government , with some cases of higher education and high tech companies .


READ_SMS - allow the application to read text messages . The ShooterAudio module uses PulseAudio to capture audio from the user's microphone . The use of Emissary appears to be focused only on Taiwan and Hong Kong , with regular malware updates to avoid detection and to increase the odds of success .


EventBot permissions EventBot ’ s permissions as seen in the manifest file . makeself.sh is a small shell script that generates a self-extractable compressed tar archive from a directory . The Lotus Blossom actors using Emissary have been active for at least seven years in Southeast Asia .


THE INITIAL INSTALLATION PROCESS Once installed , EventBot prompts the user to give it access to accessibility services . The RAT , however , had a multitude of functionalities (as listed in the table below) such as to download and execute , compress , encrypt , upload , search directories , etc . Magic Hound has primarily targeted organizations in the energy , government , and technology sectors that are either based or have business interests in Saudi Arabia .


Initial request by EventBot Initial request by EventBot to run as a service . In a more recent version of the modified Gh0st RAT malware , Ghost Dragon implemented dynamic packet flags which change the first five bytes of the header in every login request with the controller . Regardless of causation , the rapid development of new versions of Emissary suggests that the malware authors are making frequent modifications to evade detection , which as a corollary suggests the Lotus Blossom are actively using the Emissary Trojan as a payload in attacks .


Once the malware can use accessibility services , it has the ability to operate as a keylogger and can retrieve notifications about other installed applications and content of open windows . One hour later , Bemstour was used against an educational institution in Belgium . Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called " Rocket Kitten " ( AKA Operation Saffron Rose , Ajax Security Team , Operation Woolen-Goldfish ) as well as an older attack campaign called Newscasters .


EventBot ’ s request to use accessibility services . Bemstour is specifically designed to deliver a variant of the DoublePulsar backdoor . In addition to the malware evolution , the actors also shifted from solely spear-phishing targets with attachments to also compromising legitimate websites to host malware .


In more up-to-date versions of Android , EventBot will ask for permissions to run in the background before deleting itself from the launcher . DoublePulsar is then used to inject a secondary payload , which runs in memory only . It is highly likely the Lotus Blossom used spear-phishing attacks containing links to these malicious documents as a delivery mechanism .


EventBot requests permissions to always run in the background . A significantly improved variant of the Bemstour exploit tool was rolled out in September 2016 , when it was used in an attack against an educational institution in Hong Kong . We were ultimately able to identify multiple organizations in the government , energy , and technology sectors targeted by Magic Hound .


DOWNLOAD AND UPDATE THE TARGET CONFIGURATION FILE By analyzing and decoding the HTTP packets in EventBot Version 0.0.0.1 , we can see that EventBot downloads and updates a configuration file with almost 200 different financial application targets . Bemstour was used again in June 2017 in an attack against an organization in Luxembourg . The Magic Hound attacks did not rely on exploit code to compromise targeted systems , instead relying on Excel and Word documents containing malicious macros .


Following is the HTTP response from the C2 server , containing the encrypted configuration : EventBot Encrypted HTTP response returned from the C2 Encrypted HTTP response returned from the C2 . Between June and September 2017 , Bemstour was also used against targets in the Philippines and Vietnam . The MPK bot is not publicly available and had previously been attributed to an adversary group called " Rocket Kitten " which has often been thought to be a state sponsored adversary operating in the Middle East region .


In Version 0.0.0.1 , the communication with the C2 is encrypted using Base64 and RC4 . Development of Bemstour has continued into 2019 . One payload was a Python based open source remote administration tool ( RAT ) called Pupy .


The RC4 key is hardcoded in EventBot . Unlike earlier attacks when Bemstour was delivered using Buckeye's Pirpi backdoor , in this attack Bemstour was delivered to the victim by a different backdoor Trojan (Backdoor.Filensfer) . The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method , specifically attempting to load MagicHound.Rollover .


Upon decryption , we can see that the response from the server is a JSON object of EventBot ’ s configuration , which contains C2 URLs and a targeted applications list . The most recent sample of Bemstour seen by Symantec appears to have been compiled on March 23 , 2019 , eleven days after the zero-day vulnerability was patched by Microsoft . Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES .


Decrypted EventBot configuration Decrypted EventBot configuration returned from the C2 . Filensfer is a family of malware that has been used in targeted attacks since at least 2013 . The loader 's main goal was to run a PowerShell command to execute shellcode .


The configuration file contains a list of financial applications that can be targeted by EventBot . While Symantec has never observed the use of Filensfer alongside any known Buckeye tools , information shared privately by another vendor included evidence of Filensfer being used in conjunction with known Buckeye malware (Backdoor.Pirpi) . To set up persistence , the loader writes a file to " c:\temp\rr.exe " and executes it with specific command line arguments to create auto run registry keys .


This version includes 185 different applications , including official applications of worldwide banks . CVE-2017-0143 was also used by two other exploit tools—EternalRomance and EternalSynergy—that were released as part of the Shadow Brokers leak in April 2017 . The Magic Hound campaign was also discovered using a custom dropper tool , which we have named MagicHound.DropIt .


26 of the targeted applications are from Italy , 25 are from the UK , 6 are from Germany , 5 are from France , and 3 are from Spain . Buckeye's exploit tool , EternalRomance , as well as EternalSynergy , can exploit the CVE-2017-0143 message type confusion vulnerability to perform memory corruption on unpatched victim computers . We have also seen Magic Hound using DropIt as a binder , specifically dropping a legitimate decoy executable along with the malicious executable onto the target host .


However , it also targets applications from Romania , Ireland , India , Austria , Switzerland , Australia , Poland and the USA . this RTF exploits again the CVE-2017_1882 on eqnedt32.exe . We also found a second IRC bot called MPK using the same IP for its C2 server that a Leash sample was hosted on .


In addition to official banking applications , the target list includes 111 other global financial applications for banking and credit card management , money transfers , and cryptocurrency wallets and exchanges . And the dropper execute the iassvcs.exe to make a side loading and make the persistence . The Magic Hound attack campaign is an active and persistent espionage motivated adversary operating in the Middle East region .


Those targeted include Paypal Business , Revolut , Barclays , UniCredit , CapitalOne UK , HSBC UK , Santander UK , TransferWise , Coinbase , paysafecard , and many more . Over the past three years , Filensfer has been deployed against organizations in Luxembourg , Sweden , Italy , the UK , and the U.S . Organizations in the government , energy , and technology sectors have been targeted by Magic Hound , specifically organizations based in or doing business in Saudi Arabia .


The full list of banking applications targeted is included in the appendix . Our analysis of this malware shows that it belongs to Hussarini , also known as Sarhust , a backdoor family that has been used actively in APT attacks targeting countries in the ASEAN region since 2014 . At a high level , Retriever is a .NET downloader that downloads secondary payloads from servers associated with Magic Hound .


ABUSE OF ACCESSIBILITY SERVICES EventBot abuses the accessibility services of Android devices for the majority of its activity . OutExtra.exe is a signed legitimate application from Microsoft named finder.exe . For example , we analyzed a DropIt sample ( SHA256 : cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671 ) that dropped two executables , one of which was saved to " %TEMP%\flash_update.exe " that was a legitimate Flash Player installer .


Accessibility features are typically used to help users with disabilities by giving the device the ability to write into input fields , auto-generate permissions , perform gestures for the user , etc . Today , this malware is still actively being used against the Philippines . M-Trends 2018 can arm security teams with the knowledge they need to defend against today 's most often used cyber attacks , as well as lesser seen and emerging threats .


However , when used maliciously , accessibility features can be used to exploit legitimate services for malicious purposes , like with EventBot . Xagent is the original filename Xagent.exe whereas seems to be the version of the worm . FireEye tracks thousands of threat actors , but pays special attention to state-sponsored attackers who carry out advanced persistent threat ( APT ) attacks .


EventBot uses multiple methods to exploit accessibility events for webinjects and other information stealing purposes . Our technical analysis of the malware used in these attacks showed close ties to BS2005 backdoors from operation Ke3chang , and to a related TidePool malware family discovered by Palo Alto Networks in 2016 that targeted Indian embassies across the globe . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations with investments in Vietnam , foreign governments , journalists , and Vietnamese dissidents .


DATA GATHERING Getting a list of all installed applications : Once EventBot is installed on the target machine , it lists all the applications on the target machine and sends them to the C2 . The malicious actors behind the Okrum malware were focused on the same targets in Slovakia that were previously targeted by Ketrican 2015 backdoors . During a recent campaign , APT32 leveraged social engineering emails with Microsoft ActiveMime file attachments to deliver malicious macros .


Device information : EventBot queries for device information like OS , model , etc , and also sends that to the C2 . We started connecting the dots when we discovered that the Okrum backdoor was used to drop a Ketrican backdoor , freshly compiled in 2017 . Evidence also suggests that APT32 has targeted network security and technology infrastructure corporations with connections to foreign investors .


EventBot infected device to be sent to the C Information gathered about the infected device to be sent to the C2 . In 2017 , the same entities that were affected by the Okrum malware and by the 2015 Ketrican backdoors again became targets of the malicious actors . Since at least 2014 , APT32 , also known as the OceanLotus Group , has targeted foreign corporations foreign governments .


Data encryption : In the initial version of EventBot , the data being exfiltrated is encrypted using Base64 and RC4 . This time , the attackers used new versions of the RoyalDNS malware and a Ketrican 2017 backdoor . FireEye asesses that APT32 actors may be aligned with the national interests of Vietnam .


In later versions , another encryption layer is added using Curve25519 encryption . According to ESET telemetry , Okrum was first detected in December 2016 , and targeted diplomatic missions in Slovakia , Belgium , Chile , Guatemala and Brazil throughout 2017 . APT32 poses a threat to companies doing business or preparing to invest in Vietnam .


All of the most recent versions of EventBot contain a ChaCha20 library that can improve performance when compared to other algorithms like RC4 and AES . According to our telemetry , Okrum was used to target diplomatic missions in Slovakia , Belgium , Chile , Guatemala , and Brazil , with the attackers showing a particular interest in Slovakia . We believe recent activity targeting private interests in Vietnam suggests that APT32 poses a threat to companies doing business or preparing to invest in the country .


This implies that the authors are actively working to optimize EventBot over time . The detection evasion techniques we observed in the Okrum malware include embedding the malicious payload within a legitimate PNG image , employing several anti-emulation and anti-sandbox tricks , as well as making frequent changes in implementation . DROPSHOT is a notable piece of malware used to deliver variants of the TURNEDUP backdoor .


SMS grabbing : EventBot has the ability to parse SMS messages by using the targeted device ’ s SDK version to parse them correctly . According to ClearSky , the suspected Lazarus operatives looked to leverage a vulnerability in outdated WinRAR file-archiving software that hackers have been exploiting since it was disclosed last month . Additionally , there is evidence to suggest APT33 targeted Saudi Arabia .


EventBot parsing of grabbed SMS messages Parsing of grabbed SMS messages . The diagram below illustrates how we believe the actors behind the Sea Turtle campaign used DNS hijacking to achieve their end goals . APT33 often conducts spear-phishing operations using a built-in phishing module .


Webinjects : According to the bot ’ s configuration , if a webinject is set for a given application , it will be executed . If the user enables macro to open the xlsm file , it will then drop the legitimate script engine AutoHotkey along with a malicious script file . Additionally , there is evidence to suggest APT33 targeted Saudi Arabian and Western organizations that provide training , maintenance and support for Saudi Arabia 's military and commercial fleets .


EventBot web injects execution method Web injects execution method by a pre-established configuration . Create a link file in the startup folder for AutoHotkeyU32.exe , allowing the attack to persist even after a system restart . Although we have only observed APT33 use DROPSHOT to deliver TURNEDUP , we have identified multiple DROPSHOT samples in the wild that delivered wiper malware we call SHAPESHIFT .


BOT UPDATES EventBot has a long method called parseCommand that can update EventBot ’ s configuration XML files , located in the shared preferences folder on the device . Such attacks highlight the need for caution before downloading files from unknown sources and enabling macro for files from unknown sources . The SHAPESHIFT wiper is capable of wiping disks and volumes , as well as deleting files .


EventBot Dropped XML configuration files Dropped XML configuration files on the device . Its configuration utilities like Margarita allows the NOC (Network Operation Center) to customize tools based on requirements from 'Fine Dining' questionairies . Ties to SHAPESHIFT suggest that APT33 may engage in destructive operations or shares tools or development resources with an Iranian threat group that conducts destructive operations .


EventBot uses this function to update its C2s , the configuration of webinjects , etc . Honeycomb toolserver receives exfiltrated information from the implant; an operator can also task the implant to execute jobs on the target computer , so the toolserver acts as a C2 (command and control) server for the implant . In a recent attack , APT33 sent spear-phishing emails to workers in the aviation industry .


The following code shows EventBot parsing instructions sent from the C2 . UMBRAGE components cover keyloggers , password collection , webcam capture , data destruction , persistence , privilege escalation , stealth , anti-virus (PSP) avoidance and survey techniques . The HTA files contained job descriptions and links to job postings on popular employment websites .


Parsing of instructions by EventBot Parsing of instructions by the bot from the C2 . 'Improvise' is a toolset for configuration , post-processing , payload setup and execution vector selection for survey/exfiltration tools supporting all major operating systems like Windows (Bartender) , MacOS (JukeBox) and Linux (DanceFloor) . Since at least 2014 , an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran .


UNIQUE FEATURES BY VERSION EventBot Version 0.0.0.1 RC4 and Base64 Packet Encryption EventBot RC4 and Base64 data decryption from the C2 RC4 and Base64 data decryption from the C2 . This sample , similar to other Trochilus samples , was deployed using a DLL sideloading method utilizing three files , uploaded to the same folder on the victim machine as identified in US-CERT advisory TA17-117A last revised on December 20 , 2018 . These emails included recruitment-themed lures and links to malicious HTML Application files .


As mentioned above , EventBot Version 0.0.0.1 sends a JSON object containing the Android package names of all the apps installed on the victim ’ s device alongside additional metadata , including the bot version , botnetID , and the reason this package is sent . The configuration file then loads the Trochilus payload into memory by injecting it into a valid system process . The OilRig group conducts operations primarily in the Middle East , targeting financial , government , energy , chemical , telecommunications and other industries .


For this particular packet , the reason is registration of the bot . Additionally , the same DLL sideloading technique observed in the Visma attack was used , and many of the tools deployed by the APT10 shared naming similarities as well 1.bat , cu.exe , ss.rar , r.exe , pd.exe . APT34 uses a mix of public and non-public tools .


If the connection to the C2 fails , it will continue to retry until it is successful . Most interestingly , Rapid7 observed the use of the Notepad++ updater gup.exe as a legitimate executable to sideload a malicious DLL (libcurl.dll) in order to deploy a variant of the UPPERCUT backdoor also known as ANEL . APT34 often uses compromised accounts to conduct spear-phishing operations .


EventBot Logcat from the infected device Logcat from the infected device . Insikt Group analysis of network metadata to and from the VPN endpoint IPs revealed consistent connectivity to Citrix-hosted infrastructure from all eight VPN endpoint IPs starting on August 17 , 2018 — the same date the first authenticated login to Visma’s network was made using stolen credentials . APT33 leverages a mix of public and non-public tools and often conducts spear-phishing operations using a built-in phishing module from " ALFA TEaM Shell " , a publicly available web shell .


EVENTBOT VERSION 0.0.0.2 Dynamic Library Loading As of Version 0.0.0.2 , EventBot attempts to hide its main functionality from static analysis . KHRAT is a backdoor trojan purported to be used with the China-linked cyberespionage group DragonOK . In July 2017 , FireEye observed APT34 targeting an organization in the Middle East using the POWRUNER PowerShell-based backdoor and the downloader BONDUPDATER .


With Version 0.0.0.1 , there is a dedicated functions class where all main malicious activity happens and can be observed . Rapid7 reviewed malware discovered in the victim’s environment and found implants that used Dropbox as the C2 . POWRUNER was delivered using a malicious RTF file that exploited CVE-2017-0199 .


Instead , in Version 0.0.0.2 , EventBot dynamically loads its main module . The analyzed RTF files share the same object dimension (objw2180\objh300) used to track the RTF weaponizer in our previous report , however , the sample was not exploiting CVE-2017-11882 or CVE-2018-0802 . In November 2017 , APT34 leveraged the Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER less than a week after Microsoft issued a patch .


EventBot loaded library Loaded library as seen in Logcat . After further analysis , it was discovered that the RTF files were exploiting the CVE-2018-0798 vulnerability in Microsoft’s Equation Editor (EQNEDT32) . FireEye has identified APT35 operations dating back to 2014 .


By browsing EventBot ’ s installation path on the device , we can see the library dropped in the app_dex folder . Anomali Researchers were able to identify multiple samples of malicious RTF documents ITW using the same exploit for CVE-2018-0798 . APT35 , also known as the Newscaster Team , is a threat group sponsored by the Iranian government that conducts long term , resource-intensive operations to collect strategic intelligence .


EventBot loaded library The loaded library dropped on the device . The earliest use of the exploit ITW we were able to identify and confirm is a sample (e228045ef57fb8cc1226b62ada7eee9b) dating back to October 2018 (VirusTotal submission of 2018-10-29) with the RTF creation time 2018-10-23 . APT35 typically targets military , diplomatic and government , media , energy , engineering , business services and telecommunications sectors in U.S. and the Middle East .


The code to load the main module dynamically can also be seen statically . Upon decrypting and executing , it drops two additional files wsc_proxy.exe (legitimate Avast executable) and a malicious DLL wsc.dll in the %TEMP% folder . APT35 has historically used unsophisticated tools like those listed below in Figure 3 .


The malicious library is loaded from Eventbot ’ s assets that contain a font file called default.ttf which is actually the hidden library and then decoded using RC4 . However , Beginning on 25 June 2019 , we started observing multiple commodity campaigns Mostly dropping AsyncRAT using the updated RTF weaponizer with the same exploit (CVE-2018-0798) . APT35 typically targets U.S. and the Middle Eastern military , diplomatic and government personnel , organizations in the media , energy and defense industrial base ( DIB ) , and engineering , business services and telecommunications sectors .


EventBot method responsible for the library loading The method responsible for the library loading . In addition , a current ANY.RUN playback of our observed Elise infection is also available . Many of the fake personas utilized by APT35 claimed to be part of news organizations , which led to APT35 being referred to as the Newscaster Team .


EventBot has the ability to update its library or potentially even download a second library when given a command from the C2 . Upon opening of the MS Word document , our embedded file exploits CVE-2017-11882 to drop a malicious fake Norton Security Shell Extension module , 'NavShExt.dll' , which is then injected into iexplore.exe to install the backdoor , begin collection , and activate command and control . Since at least 2013 , the Iranian threat group that FireEye tracks as APT33 has carried out a Cyber Espionage operation to collect information from defense , aerospace and petrochemical organizations .


An updated library name is generated by calculating the md5sum of several device properties , while concatenating the build model twice in case of an update to the library . Moving through the infection process , NetWitness Endpoint detects the initial exploit CVE-2017-1182 in action as the Microsoft Equation Editor , 'EQNEDT32.exe' , scores high for potentially malicious activity . Since at least 2013 , the Iranian threat group FireEye tracks as APT33 has carried out a Cyber Espionage operation to collect information from defense , aerospace and petrochemical organizations .


EventBot Updated library naming convention EventBot New library naming convention . The well-crafted and socially engineered malicious documents then become the ﬁrst stage of a long and mainly ﬁleless infection chain that eventually delivers POWERSTATS , a signature PowerShell backdoor of this threat group . In early 2017 , Mandiant responded to an incident involving APT35 targeting an energy company .


Data Encryption The Curve25519 encryption algorithm was implemented as of EventBot Version 0.0.0.2 . This powerful backdoor can receive commands from the attackers , enabling it to exﬁltrate ﬁles from the system it is running on , execute additional scripts , delete ﬁles , and more . The attacker used a spear-phishing email containing a link to a fake resume hosted on a legitimate website that had been compromised .


This encryption algorithm is an extra security layer for communicating with the C2 , an improvement over the previous version of a plain RC4 encryption . If the macros in SPK KANUN DEĞİŞİKLİĞİ GİB GÖRÜŞÜ.doc” are enabled , an embedded payload is decoded and saved in the %APPDATA% directory with the name CiscoAny.exe” . APT35 also installed BROKEYOLK , a custom backdoor , to maintain persistence on the compromised host .


When reviewing the decrypted packet , it ’ s clear it has the same content as previous versions . INF ﬁles have been used in the past by MuddyWater , although they were launched using Advpack.dll and not IEAdvpack.dll . They then proceeded to log directly into the VPN using the credentials of the compromised user .


EventBot decryption of packets from the C2 Decryption of packets from the C2 using Curve25519 . In addition , by using VBA2Graph , we were able to visualize the VBA call graph in the macros of each document . The resume contained the PupyRAT backdoor , which communicated with known APT35 infrastructure .


EVENTBOT VERSION 0.3.0.1 Additional Assets Based on Country / Region EventBot-23aEventBot Spanish and Italian Images in Spanish and Italian added in version 0.3.0.1 . We assume that RunPow stands for run PowerShell , ” and triggers the PowerShell code embedded inside the .dll file . Once connected to the VPN , APT35 focused on stealing domain credentials from a Microsoft Active Directory Domain Controller to allow them to authenticate to the single-factor VPN and Office 365 instance .


Version 0.3.0.1 includes Italian and Spanish language compatibility within the resources section . The main delivery method of this type of backdoor is spear phishing emails or spam that uses social engineering to manipulate targets into enabling malicious documents . While having access to the organization 's environment , the Magic Hound targeted data related to entities in the Middle East .


Presumably , this was done to make the app seem more credible to targeted users in different countries . This includes Python scripts . Mandiant has previously observed targeted attackers stealing email , but few threat actors have been as successful at this as APT35 .


Grabbing the Screen PIN with Support for Samsung Devices Version 0.3.0.1 added an ~800 line long method called grabScreenPin , which uses accessibility features to track pin code changes in the device ’ s settings . Usually , the Stageless Meterpreter has the Ext_server_stdapi.x64.dll” , Ext_server_extapi.x64.dll” , and Ext_server_espia.x64.dll” extensions . The campaigns delivered PupyRAT , an open-source cross-platform remote access trojan ( RAT ) .


It listens to events like TYPE_VIEW_TEXT_CHANGED . However , Kaspersky Security Network (KSN) records also contain links that victims clicked from the Outlook web client outlook.live.com” as well as attachments arriving through the Outlook desktop application . Ultimately , APT35 had used access to hundreds of mailboxes to read email communications and steal data related to Middle East organizations , which later became victims of destructive attacks .


We suspect the updated PIN is sent to the C2 , most likely to give the malware the option to perform privileged activities on the infected device related to payments , system configuration options , etc . The JavaScript forces visiting web browsers to collect and send (via a POST request) web browser , browser version , country of origin , and IP address data to the attacker controlled server jquerycodedownload.live/check.aspx” . CTU researchers observed likely unsuccessful phishing campaigns being followed by highly targeted spearphishing and social engineering attacks from a threat actor using the name Mia Ash .


EventBot Listening to TYPE_VIEW_TEXT_CHANGED accessibility event Listening to TYPE_VIEW_TEXT_CHANGED accessibility event . We identified two methods to deliver the KerrDown downloader to targets . Further analysis revealed a well-established collection of fake social media profiles that appear intended to build trust and rapport with potential victims .


After collecting the changed PIN code , it is sent back to the C2 . The link to the final payload of KerrDown was still active during the time of analysis and hence we were able to download a copy which turned out to be a variant of Cobalt Strike Beacon . COBALT GYPSY has used spearphishing to target telecommunications , government , defense , oil , and financial services organizations based in or affiliated with the MENA region , identifying individual victims through social media sites .


EventBot Sending the pin code back to the C2 Sending the pin code back to the C2 . While investigating KerrDown we found multiple RAR files containing a variant of the malware . The connections associated with these profiles indicate the threat actor began using the persona to target organizations in April 2016 .


Eventually , the screen PIN preferences will be saved to an additional XML file in the shared preferences folder . The dropped PE file has the distinctive file name 8.t” . Between December 28 , 2016 and January 1 , 2017 , CTU researchers observed a phishing campaign targeting Middle Eastern organizations .


EventBot screenPinPrefs.xml The content of screenPinPrefs.xml . The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware . The macro ran a PowerShell command that attempted to download additional PowerShell loader scripts for PupyRAT , a research and penetration-testing tool that has been used in attacks .


The grabScreenPin method has separate conditioning to handle screen lock events in Samsung devices . The malware starts communicating with the C&C server by sending basic information about the infected machine . The survey contained macros that , once enabled , downloaded PupyRAT .


EventBot screen lock with support for Samsung devices A new method to handle screen lock with support for Samsung devices . The malware basically provides a remote CMD/PowerShell terminal for the attackers , enabling them to execute scripts/commands and receive the results via HTTP requests . CTU researchers determined that the COBALT GYPSY threat group orchestrated this activity due to the tools , techniques , and procedures ( TTPs ) used in both campaigns .


EVENTBOT VERSION 0.4.0.1 Package Name Randomization In this version , the package name is no longer named ‘ com.example.eventbot ’ , which makes it more difficult to track down . This time the document purported to be about the involvement of the Emir of Qatar in funding ISIS , which was seemingly copied from a website critical of Qatar . The Magic Hound has repeatedly used social media to identify and interact with employees at targeted organizations and then used weaponized Excel documents .


EventBot Randomized package name Randomized package name instead of com.example.eventbot . The SDK , named SWAnalytics is integrated into seemingly innocent Android applications published on major 3rd party Chinese app stores such as Tencent MyApp , Wandoujia , Huawei App Store , and Xiaomi App Store . The group has repeatedly used social media , particularly LinkedIn , to identify and interact with employees at targeted organizations , and then used weaponized Excel documents to deliver RATs such as PupyRAT .


ProGuard Obfuscation As with many other Android applications , EventBot is now using obfuscation . After app installation , whenever SWAnalytics senses victims opening up infected applications or rebooting their phones , it silently uploads their entire contacts list to Hangzhou Shun Wang Technologies controlled servers . By compromising a user account that has administrative or elevated access , Magic Hound can quickly access a targeted environment to achieve their objectives .


Both the loader and dropped class are obfuscated using ProGuard , which obfuscates names using alphabet letters . This module monitors a wide range of device activities including application installation / remove / update , phone restart and battery charge . These characteristics suggest that COBALT GYPSY executed the January and February phishing campaigns and that it created the Mia Ash persona .


The code itself is not modified by this type of obfuscation though , making the analysis easier . It turns out that contacts data isn’t the only unusual data SWAnalytics is interested in . CTU researchers have observed multiple COBALT GYPSY campaigns since 2015 and consider it highly likely that the group is associated with Iranian government-directed cyber operations .


EventBot Obfuscated class names Obfuscated class names using letters of the alphabet . With default settings , SWAnalytics will scan through an Android device’s external storage , looking for directory tencent/MobileQQ/WebViewCheck” . The use of the Mia Ash persona demonstrates the creativity and persistence that threat actors employ to compromise targets .


Hidden Configuration Data As mentioned above , EventBot begins using obfuscation . From our first malicious sample encounter back in mid-September until now , we have observed 12 infected applications , the majority of which are in the system utility category . CTU researchers conclude that COBALT GYPSY created the persona to gain unauthorized access to targeted computer networks via social engineering .


Due to this obfuscation , a part of the previously mentioned cfg class is now mapped to c/b/a/a/a or c/a/a/a/a . By listing sub-folders , SWAnalytics is able to infer QQ accounts which have never been used on the device . The persistent use of social media to identify and manipulate victims indicates that COBALT GYPSY successfully achieves its objectives using this tactic .


EventBot C2 URLs C2 URLs and other settings in a nested class . To make this data harvesting operation flexible , SWAnalytics equips the ability to receive and process configuration files from a remote Command-and-Control . COBALT GYPSY 's continued social media use reinforces the importance of recurring social engineering training .


Other configuration data is located elsewhere , and some of it can been seen here : The encrypted library path The output folder on the device for the dropped library The name of the library after it is loaded eventBot name string Version number A string used as an RC4 key , both for decrypting the library and as a part of the network data encryption ( hasn ’ t changed from the previous version ) The C2 URLs A randomized class name using the device ’ s accessibility services EventBot extracted configuration Part of the extracted configuration of the new version Whenever users reboot their device or open up Network Speed Master , SWAnalytics will fetch the latest configuration file from http[:]//mbl[.]shunwang[.]com/cfg/config[.]json” . SecureWorks Counter Threat Unit ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 .


. In order to understand SWAnalytics’ impact , we turned to public download volume data available on Chandashi , one of the app store optimization vendors specialized in Chinese mobile application markets . SecureWorks® Counter Threat Unit™ ( CTU ) researchers analyzed a phishing campaign that targeted a Middle Eastern organization in early January 2017 .


MALWARE UNDER ACTIVE DEVELOPMENT EventBot “ cfg ” class EventBot “ cfg ” class . According to Cheetah Mobile’s follow-up investigation , fraudulent behaviors came from two 3rd party SDKs Batmobi , Duapps integrated inside Cheetah SDK . CTU analysis suggests this activity is related to Iranian threat actors closely aligned with or acting on behalf of the COBALT GYPSY threat group ( formerly labeled Threat Group-2889 ) .


EventBot is in constant development , as seen with the botnetID string above , which shows consecutive numbering across versions . It is likely a new campaign or actor started using Panda Banker since in addition to the previously unseen Japanese targeting , Arbor has not seen any indicator of compromise (IOC) overlaps with previous Panda Banker campaigns . Since early 2014 , an attacker group of Iranian origin has been actively targeting persons of interest by means of malware infection , supported by persistent spear phishing campaigns .


This example is from a later version of EventBot , and in other versions the naming convention is very similar , with bot IDs such as word100 , word101 , word102 , and test2005 , test2006 etc . Webinjects targeting Japan , a country we haven’t seen targeted by Panda Banker before . This cyber-espionage group was dubbed ' Rocket Kitten ' , and remains active as of this writing , with reported attacks as recent as October 2015 .