The group has infected organizations based in all regions, as shown in Figures 3 and 4, with the largest numbers in the U.S., followed by the U.K., Spain, France, Brazil, Germany and Italy. Figure 3.


Global geographic distribution of organizations listed on Vice Society leak site.

Vice Society Profiling a Persistent Threat to the Education Sector


The CISA advisory mentions how Vice Society has disproportionately targeted educational institutions in the United States.


Vice Society United States victimology (all leak site victim data).Impacted Industry Verticals Although Vice Society has been in the headlines for targeting educational organizations, they also extort victims in many other industry verticals, as shown in Figure 6, including those supplying critical infrastructure, such as healthcare, government entities and manufacturing.


Industry verticals targeted by Vice Society (leak site data).Leak Site Metric Comparisons


According to analysis of ransomware leak sites, Unit 42 has identified Vice Society as being in the top 10 of the most impactful ransomware gangs of 2022.


We estimate that, since it started operations in 2021, Vice Society has impacted more than 100 organizations in total.


Leak site data suggests that Vice Society has had the highest impact on education organizations this year, with at least 33 educational institutions having been listed on the group’s dedicated ransomware leak site.


This impact is closely followed by ransomware families such as LockBit 2.0 and 3.0, as shown in Figure 7. Figure 7.


Top ransomware families targeting educational institutions in 2022 (leak site data).Unit


Let’s look at some of the data from these incidents.


In Unit 42 IR cases regarding Vice Society, we observed dwell times as high as six days.


Ransom Demands When tracking ransomware group operations, Unit 42 takes note of the initial and final ransom demands made by each ransomware group.


This allows us to better understand how aggressive a particular ransomware gang’s demands might be for particular industry verticals, and to get a general view into the rate at which a particular actor might drive their demands down after negotiations take place.


Final demands after negotiations were as high as $460,000.


The difference between initial demands and final demands could be significant.


We saw decreases as large as 60%.


Vice Society active leak site mirror (Oct. 20).On Oct. 25, the original .onion address became active again.


It was updated to include additional blog sections.


As of early November, the “Our Blog” page showcased one article that highlights the group's notoriety, as shown in Figure 9. Figure 9.


The new “For Victims” page directs victims to the ransom note that is dropped as part of the group’s infection chain.


This is followed by additional instructions in case the victim doesn’t respond to one of the contact emails provided in their ransom note.


Vice Society leak site victims page.


The “For Journalists” page depicts a “Frequently Asked Questions” section to address general questions about the group, as shown in Figure 11. Figure 11.


Vice Society leak site journalists page.


HelloKitty Usage At the start of the group’s observed operations in 2021, Vice Society affiliates used the HelloKitty Ransomware variant as a primary payload in their infection chain.


This variant gets its name from its mutex: HELLOKITTYMutex.


This Linux sample led to the discovery of additional HelloKitty samples for Linux dating back to October 2020.


Similar to ransomware variants like BlackCat, HelloKitty ransomware typically requires a key to execute, to hinder analysis efforts.


In HelloKitty’s case, this key is typically obfuscated with AES 256 encryption.


As mentioned in our previous report detailing emerging ransomware families in 2021, HelloKitty features multiple flags that could be set as command line arguments, which are detailed in Table 1 of the linked report.


ALL YOUR FILES ARE ENCRYPTED !!!


The contact email address provided by the threat actor vary between samples, but the public v-society.official@onionmail[.]org address and the Tor .onion link remain consistent.


Vice Society ransom note using Zeppelin ransomware.


The opportunistic targeting often seen with cybercriminals can put even school districts with robust cybersecurity programs at risk.


K-12 institutions may be seen as particularly lucrative targets due to the amount of sensitive student data accessible through school systems or their managed service providers.


Vice Society and its consistent targeting of the education industry vertical, particularly around the September time frame, serves as a warning that this group has shaped their campaigns to take advantage of the school year in the U.S.


It’s likely they’ll maintain use of these tactics to impact the cyberthreat landscape moving forward, as long as their activities continue to be lucrative for them.


Educational institutions should continue to implement security best practices and be wary of the ongoing threat of ransomware, especially during the start and end of the school year.


In a school environment, there are many educators who can help inform trainings for both staff and students to learn what they need to do to maintain security for everyone in the organization.


They will likely continue leveraging additional ransomware strains in the future, as well as exploiting newly disclosed vulnerabilities.


+65.6983.8730 Japan: +81.50.1790.0200 Tactics, Techniques and Procedures (TTPs)


Unit 42 has observed the following TTPs being used by Vice Society in past incident response engagements involving the group.


The following table illustrates these TTPs according to the MITRE ATT&CK framework.


TA0001 Initial Access T1566 Phishing Vice Society is known to use phishing to gain initial access to victims’ systems.


T1078 Valid Accounts Compromised valid credentials have been used by Vice Society to gain initial access.


T1190 Exploit Public-Facing Applications Internet-facing applications and systems vulnerabilities can be exploited, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), to gain initial access.


TA0002 Execution T1047 Windows Management Instrumentation (WMI) Malicious commands are executed via WMI as a means of “living off the land” and avoiding detection.


Scheduled Task/Job Vice Society is known to execute commands via scheduled tasks/jobs.


Powershell Vice Society utilizes PsExec for execution, persistence and defense evasion.


TA0003 Persistence T1543.003 Modify System Process To maintain access to compromised systems, Vice Society leverages Windows operating functions to execute encrypted PowerShell.


T1547.001 Registry Run Keys/Startup Folder Persistence is maintained after boot/reboot via malicious autostart registry keys.


T1574.002 DLL Side-Loading Vice Society utilizes legitimate programs to side-load the group’s own DLL to execute their payload.


TA0004 Privilege Escalation T1068 Exploitation for Privilege Escalation Software vulnerabilities, such as PrintNightmare (CVE-2021-1675) and (CVE-2021-34527), may be exploited in an attempt to elevate privileges.


T1055 Process Injection Legitimate processes have been corrupted by Vice Society via code injection, as a means to evade defenses.


T1070 Indicator Removal on Host As with many other ransomware groups, Vice Society attempts to clear system, security and application logs on compromised machines.


T1112 Modify Registry Vice Society attempts to disable Windows Defender by modifying the Registry.


T1497 Sandbox Evasion Vice Society attempts to thwart reverse engineering and/or dynamic analysis via various sandbox evasion techniques.


TA0006 Credential Access T1003 OS Credential Dumping Vice Society is known to utilize ntds.dit and comsvcs.dll to extract credentials.


T1003.003 OS Credential Dumping: NTDS Vice Society attempts to “live off the land” by utilizing ntds.dit and ntdsutil.exe to dump Active Directory Database in an effort to obtain credentials.


T1482 Domain Trust Discovery Vice Society has been seen using the attack path reconnaissance tool Bloodhound during the initial stages of their attack before ransomware is deployed.


Remote Services RDP is used by the group for lateral movement.


T1021.002 Remote Services: SMB/Windows Admin Shares SMB shares have been used by Vice Society for lateral movement.


T1080 Taint Shared Content Network drives and other shared storage locations are used by Vice Society to deliver payloads.


T1570 Lateral Tool Transfer Lateral tool transfers have been used to move tools and files from one compromised system to another, including SMB and RDP.


T1041 Exfiltration over C2 Channel Tools such as PowerShell and PsExec are used to exfiltrate data directly to C2 servers.


T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Cloud storage and transfer services such as Mega.nz, Anonfiles.com, File.io, and Sendspace have been used by Vice Society to exfiltrate victim data.


TA0011 Command and Control T1219


TA0040 Impact T1486 Data Encrypted for Impact Vice Society is known for its extortion tactics, encrypting devices and demanding a ransom.


Indicators of Compromise (IoCs) HelloKitty Elf samples featuring Vice Society ransom note header: 643a3121166cd1ee5fc6848f099be7c7c24d36f5922f58052802b91f032a5f0f 754f2022b72da704eb8636610c6d2ffcbdae9e8740555030a07c8c147387a537 78efe6f5a34ba7579cfd8fc551274029920a9086cb713e859f60f97f591a7b04 16a0054a277d8c26beb97850ac3e86dd0736ae6661db912b8782b4eb08cfd36e Zeppelin ransomware with the Vice Society ransom note header: 4a4be110d587421ad50d2b1a38b108fa05f314631066a2e96a1c85cc05814080 307877881957a297e41d75c84e9a965f1cd07ac9d026314dcaff55c4da23d03e faa79c796c27b11c4f007023e50509662eac4bca99a71b26a9122c260abfb3c6 dd89d939c941a53d6188232288a3bd73ba9baf0b4ca6bf6ccca697d9ee42533f 4440763b18d75a0f9de30b1c4c2aeb3f827bc4f5ea9dd1a2aebe7e5b23cfdf94 24efa10a2b51c5fd6e45da6babd4e797d9cae399be98941f950abf7b5e9a4cd7 bafd3434f3ba5bb9685e239762281d4c7504de7e0cfd9d6394e4a85b4882ff5d aa7e2d63fc991990958dfb795a0aed254149f185f403231eaebe35147f4b5ebe 001938ed01bfde6b100927ff8199c65d1bff30381b80b846f2e3fe5a0d2df21d Ab440c4391ea3a01bebbb651c80c27847b58ac928b32d73ed3b19a0b17dd7e75 Contact information: vicesociety@onionmail[.]org v-society.official@onionmail[.]org LarryGold@onionmail[.]org MollyThomson@onionmail[.]org BruceBoyle@onionmail[.]org SylvesterJones@onionmail[.]org brendaevans4454@onionmail[.]org warreinolds77@onionmail[.]org DaltonReed@onionmail[.]org FreddieFerrell@onionmail[.]org lewiselsberry@onionmail[.]org inezeng@onionmail[.]org lonnieguzman@onionmail[.]org thomasmoore@onionmail[.]org Domains: vsociethok6sbprvevl4dlwbqrzyhxcxaqpvcqt5belwvsuxaxsutyad[.]onion Qu5dci2k25x2imgki2dbhcwegqqsqsrjj5d3ugcc5kpsgbtj2psaedqd[.]onion Wavbeudogz6byhnardd2lkp2jafims3j7tj6k6qnywchn2csngvtffqd[.]onion gunyhng6pabzcurl7ipx2pbmjxpvqnu6mxf2h3vdeenam34inj4ndryd[.]onion Additional Resources Threat Brief:


Assessment: Zeppelin Ransomware#StopRansomware: Vice Society | CISADark Web Profile: Vice Society - SOCRadar:registered: Cyber Intelligence Inc.


Michael Gillespie Twitter postUnit 42 ATOM: HelloKittyUNC2447 SOMBRAT and FIVEHANDS Ransomware:


A Sophisticated Financial Threat | Mandiant Get updates from Palo Alto Networks! Sign up to receive the latest news, cyber threat intelligence and research from us


Executive Summary Unit 42 researchers have uncovered a malware distribution campaign that is delivering the LokiBot information stealer via business email compromise (BEC) phishing emails.

Spike in LokiBot Activity During Final Week of 2022


This malware is designed to steal sensitive information from victims' systems, such as passwords and banking information, as well as other sensitive data.


In this blog, we will explain how attackers used an innocent-looking email to lure victims into opening an attachment.


The attachment contained a LokiBot information stealer.


Finally, we will list the various applications from which the malware steals data.


The Appendix of this blog will provide an in-depth description of each data byte in the HTTP based C2 communication, detailing the specific purpose of each byte.


It will also provide a breakdown of how the data byte is structured.


StageLoaderFinal PayloadObfuscationMain


Stealing FeaturePersistenceHTTP C2 CommunicationConclusionIndicators of CompromiseSamplesInfrastructureAdditional ResourcesAppendix Introduction LokiBot (often referred to as Loki-bot or Loki PWS) is notorious information-stealing malware.


It collects sensitive data from web browsers, email clients, FTP servers and crypto wallets.


The malware can also create a backdoor on the infected machine, enabling an attacker to install further malicious software.


First identified in 2015, LokiBot has since been used in multiple security breaches.


Furthermore, the malware is constantly evolving, making it difficult to contain and protect against.


After analyzing its traffic patterns, we identified that it belonged to a LokiBot infection.


After investigating the attack vector delivering this malware and further network traffic activity, we found the original email that included a ZIP file attached, which contained an ISO file.


The ISO file had the final payload.


We have found that this attempt to deliver the LokiBot malware has strong ties to a BEC campaign.


Victims might also notice missing or deleted emails due to unauthorized access to email systems.


When collecting data, we also analyzed additional threat intel data sources such as ThreatFox.


We noticed that LokiBot activity had a relatively small amount of indicators of compromise (IoCs) when we first detected this sample.


During this time, cyberattacks are often more effective as security and other personnel take this time off.


Figure 2 shows LokiBot activity from ThreatFox. Figure 2.


ThreatFox LokiBot monitoring.


Data source: ThreatFox.


In this instance, it is used to deliver the LokiBot malware.


By using this file format, the attackers are trying to bypass malspam detection technologies that usually focus on detecting file types more commonly used in malware infection chains (e.g., EXE and DLL files, MS Office files).


To the victim, the opening process simply looks like a regular directory.


This file is an obfuscated .NET file using process hollowing, which is a code injection technique in which an attacker removes legitimate code from an executable and replaces it with malicious code.


In this case, process hollowing was used to inject a malicious PE file into the legitimate process called aspnet_compiler.exe.


Figure 3 shows some IoCs in the memory of the infected process.


Dumping the PE from the process memory gives us access to the final LokiBot payload.


The infected process that contains IoCs.


Malware authors use this technique to retrieve export functions from loaded libraries using a computed hash.


Figure 4 shows a Python implementation of the API hashing algorithm used in the malware sample.


API hashing algorithm.


Main Stealing Feature The main function of the sample is building two arrays of 101 elements.


The first array is filled with indexes, and the second array is filled with pointers to functions.


These functions are made to steal credentials from different types of applications and services on the Windows operating system: Browsers: Safari, Internet Explorer, Firefox and Chromium-based browsers FTP/SSH apps and clients Backup applications Email applications Notes applications Poker applications Password managers Windows credentials The main function of the malware is looping over these stealer functions to execute them, as shown in Figure 5. Figure 5.


All the credentials collected and extracted from the installed software will then be compressed by the aPLib algorithm and submitted to the C2 server through HTTP protocol using the POST method.


We’ll go into this in more detail in the HTTP C2 Communication section.


Then, it creates and sets a new value for the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.


This value, named as the created folder, is set to the path of the copied executable.


HTTP C2 Communication LokiBot exfiltrates information to the C2 through the HTTP protocol.


It also contains a User-Agent set as “Mozilla/4.08 (Charon; Inferno)”, and the Content-Key, which is a custom HTTP header whose value corresponds to a hash generated out of the HTTP header.


Figure 6 shows a HTTP POST request and its corresponding message body.


This body contains the exfiltrated information, which is highlighted in different colors for each field.


We’ve also included the corresponding offset and size to provide a better visual reference of the data structure used by the malware, and to easily cross-reference each field of interest.


Similar to other information-stealing malware, this threat searches for and exfiltrates the following information: OS architecture Built-in admin Domain host name Hostname Local admin Operating system Screen resolution Username information The exfiltrated data that is unique to this information stealer malware includes the following: Unique key, which is an identifier that includes five randomly generated characters Binary ID, which indicates a domain that is commonly used in LokiBot infections (ckav[.]ru) Mutex value, which consists of a 24-character length string (taken from hashing the machine’s GUID using the MD5 algorithm)


The bot also makes use of different payload types (located at the third and fourth byte of the HTTP body).


These types include the following: Stolen application/credential data (0x27) Get C2 commands from C2 Server (0x28) Exfiltrate keylogger data (0x2B) Other versions of this malware family can use additional payload types depending on the final action including the following: Exfiltrate cryptocurrency wallet (0x26) Exfiltrate files (0x29)


There have been multiple versions of this threat.


The Palo Alto Networks machine learning-based C2 detection solution, as part of Advanced Threat Prevention, detects and stops malicious C2 activity inline.


This ensures that the detection capabilities are always up to date and capable of countering the ever-evolving threats posed by malicious actors.


We would like to extend our gratitude to Doel Santos from Unit 42 and Nina Smith for helping on this investigation.


Palo Alto Networks customers receive protections from and mitigations for LokiBot information stealer C2 communication in the following ways: We have distilled the knowledge we’ve gained from responding to hundreds of BEC incidents into our BEC Readiness Assessment offering, which is designed to help organizations strengthen their processes and technology to mitigate threats like the ones discussed in this blog.


+65.6983.8730 Japan: +81.50.1790.0200 Palo Alto Networks has shared these findings, including file samples and indicators of compromise, with our fellow Cyber Threat Alliance (CTA) members.


Learn more about the Cyber Threat Alliance. Indicators of Compromise Samples ZIP file: 4edd01345f58b9cc04a88ca15d6b82895f44f5b9cb51ad63b809de09029670ac ISO: 8a5a024272361bb1ae12860c033bb52685d7b0ea3bce5fac46439f3f3ad36a84 Loader: 1b574a66c84924886daec4841e1b107258e019aaf6f336329ae8fae7cbd52a34 Infrastructure efvsx[.]gq 188.114.96[.]13 Additional Resources Appendix Field Description Offset Size LokiBot version 0x0 0x2 Payload type 0x2 0x2 BinaryID unicode 0x4 0x2 BinaryID length 0x6 0x4


Hash functions are a crucial primitive in cryptography, and zero-knowledge proof systems often make heavy use of them, for example when computing Merkle tree roots and paths.


[Zcash].


However, even though the security of the Pedersen hash function is well-understood (since it relies on the assumed hardness of the discrete logarithm problem), a few easily-overlooked subtleties in its definition have the potential to invalidate its security guarantees and thus completely break the security of the systems based on it.


We then show how some of the security properties can be broken when the requirements are not met.


The definition and the different attacks are accompanied by a toy example to illustrate the various concepts more concretely.


The Pedersen hash is defined as the linear combination of the points with the encoding of the message chunks: H(M) = H(M1M2 … Mk )


= ⟨M1⟩ ⋅


G1 + ⟨M2⟩ ⋅ G2 + … + ⟨Mk⟩


In practice, the desired output may be a field element, in which case a single coordinate of the resulting point is often used as the hash.


Toy Example:


Pedersen Hash DefinitionWe illustrate the Pedersen Hash function and its security properties and requirements using a toy example, with accompanying code in SageMath.


We select the elliptic curve defined by the curve equation y2 = x3 + x + 42, defined over the finite field of size 127.


The group of points on this curve has order 139, which is prime.


Our toy hash function computes the Pedersen hash as followsH(M) = H(M1 M2) = â¨M1â© â G1 +


â¨M2â© â G2Initially, we restrict our message length to be 12 bits, such that the individual message chunks M1 and M2 are 6 bits each.


Additionally, we need to select an encoding function, mapping 6-bit chunks into a scalar.


As a first attempt, let us simply interpret the 6-bit value as an integer encoded in little-endian bits, resulting in an integer in the range {0, 63}.


# First we pick an elliptic curve with prime order: F = GF(127) E = EllipticCurve(F, [F(1), F(42)]) assert E.order().is_prime() print(f"{E} with order {E.order()}") # Elliptic Curve defined by y^2 = x^3


139 # We pick two generators.


As the curve has prime order, all non-identity points # are generators G1 = E(1, 60) G2 = E(2, 59)


== len(encoded_chunks), "Incompatible lengths" res = E(0) for chunk, generator in zip(encoded_chunks, generators): res += chunk * generator return res def PedersenHash(message, encode_function=IdentityEncode, generators=GENERATORS): """ Computes the Pedersen hash of a message Input: a message Output: the Pedersen Hash of the message Optional: encode_function: the encoding function to break a message into integers generators: elements G ∈ E which generate E """ encoded_message = EncodeMessage(message, encode_function) return GenericPedersenHash(generators, encoded_message) Using the above, the code then showcases how the message ["010101", "000111"] is hashed, resulting in the point (3, 31).


# ============================ # # Example of Pedersen Hash # # ============================ # message =


# M =


[42, 56] H = PedersenHash(message) print(f"Hash of {message} = {H}")


# Hash of ['010101', '000111'] = (3 : 31 : 1) #


We check that the Pedersen hash of the message is equivalent to computing # the linear combination of the generator points and the integers representations # of the message chunks assert H == 42 * G1


+ 56 * G2 Security Properties and Requirements The Pedersen Hash function is collision-resistant for fixed-length input, provided the underlying encoding function is injective.


The first caveat is that the hash function is not collision-resistant for variable-length inputs.


It is also distinguishable from a random oracle and as such this function should not be used as a pseudorandom function (PRF).


A second important aspect is that in order for this hash function to provide the desired security properties (namely, collision-resistance), it is necessary for the underlying encoding function to be injective.


Recall that the property of an injective function is that it maps distinct elements of its domain to distinct elements of its codomain.


In the context of the encoding function ⟨⋅⟩, this means that there are no two different message chunks Mi and Mj that result in the same encoded output, see the illustration below.


The encoding function maps bit strings to scalars.


In the toy example above, we have seen an example of a simple encoding function where the bit strings were interpreted in little-endian as integers and therefore was clearly injective (within the parameters of our example).


But even with the simple encoding function used in the toy example, care should be taken to ensure that the allowed size of the message we hash is bounded.


Indeed, if we allowed larger bit strings to be hashed (such that their encoding is larger than the subgroup order), it would be easy for an attacker to compute collisions.


This is because for any point in the subgroup, multiplication by the subgroup order, call it r, yields the point-at-infinity; that is r ⋅ G = 0.


Thus, multiplying the point G by a scalar a produces the same result as multiplying G by a + k ⋅ r, for any value of k, since (a + k ⋅ r) ⋅ G = a ⋅ G + k ⋅ r ⋅ G = a ⋅ G + k ⋅ 0 = a ⋅ G The example below illustrates how hashing messages larger than the expected size may lead to collisions.


Toy Example: Collisions Since the subgroup order is 139, adding this quantity (or multiples of it) to the scalar factors of the linear combination performed by the Pedersen hash function results in the same hash output.


Notice that the colliding message chunks are larger than 6 bits, further demonstrating that the function is not collision-resistant for variable-length inputs.


H2 = (42 + 139) *


G1 + (56 + 2 * 139)


* G2 assert H == H2 colliding_message =


["10101101", "011100101"] # Ensures encoding colliding_message results in the integers # used explicitly above assert EncodeMessage(colliding_message, IdentityEncode)


Indeed, when using a Weierstrass curve with affine coordinates, the negation of a point P = (x, y) is -P = (x, -y).


Thus, when computing the Pedersen hash and taking only the first coordinate as a result, there is a natural collision, namely the negation of the point.


It is important to ensure that the encoding process followed by the scalar multiplication cannot produce two points that have the same coordinate extracted as output.


Specifically, the discrete logarithm of any generator with respect to another one should not be known, not even to the protocol designers.


Implementers traditionally use hash-to-curve algorithms (a process which does not reveal the discrete logarithm of the output point) and nothing-up-my-sleeve numbers, to prove that the inputs to the hash-to-curve process were selected honestly.


Optimizations In practice, implementations typically use slightly more complex procedures to encode bit strings to scalar.


In doing so, they are able to compute point multiplications in a more efficient way, though special care needs to be taken to ensure the resulting encoding function is injective, as discussed in the previous section.


The simple Pedersen Hash function presented so far can be significantly sped up in the specific contexts used by zero-knowledge proof systems.


Since the generators are fixed (and known ahead of time), a method called windowed scalar multiplication can be used to more efficiently perform the multiplication by pre-computing and storing successive powers of the generators.


For example, assume our scalar is a 6-bit value b = b0b1b2b3b4b5, and we wish to compute the scalar multiplication b ⋅


G. We have b ⋅ G = b0 ⋅ G + 2b1 ⋅ G + 22b2 ⋅ G + 23b3 ⋅ G + 24b4 ⋅ G + 25b5 ⋅ G= (b0 + 2b1 + 22b2) ⋅ G + 23 (b3 + 2b4 + 22b5)


⋅ G Since the quantities in the parentheses can take any value in the {0, 7} range, one can precompute the eight values in the set {0, G, 2 ⋅ G, 3 ⋅ G, …, 7 ⋅ G} and perform a variant of a double-and-add algorithm, where at each step the doubling operation is repeated 3 times, and the adding operation involves adding one element from the pre-computed set.


Pushing the optimizations even further, the Zcash team decided to use a signed version of the windowed-multiplication method.


The encoding function ⟨⋅⟩ defined in the Zcash protocol maps element binary strings of fixed length 3 ⋅ c to a scalar as follows: where in turn, the enc() function maps 3-bit chunks m


= b0 b1 b2 into elements of the range {-4, …, 4} {0} as This choice of using a signed-digit windowed-multiplication method reduces the number of constraints necessary in the arithmetic circuit (since the lookup of the negation of a point can be performed efficiently as negating a point only requires a single constraint).


As discussed above, the security of Pedersen hash is guaranteed provided the encoding scheme is injective.


Using such a signed representation introduces a few subtleties that should be kept in check in order to ensure the collision-resistance of the hash function.


on page 78 of the protocol specifications, see [Zcash]) that the encoding function is indeed injective and thus provides the desired collision-resistance.


They did so by showing that the range of the encoding function ⟨⋅⟩ was a subset of the range , with the group order.


They also ensured that the coordinate extraction procedure couldn’t lead to the issue described above where both a point and its negation could be obtained as the output of the hash procedure, which could be problematic when using the first-coordinate as the hash output.


This is described in Section 5.4.9.4 of the Zcash protocol specification [Zcash], where Lemma 5.4.7 shows that if a given point P = (u, v) is on the curve, then (u, -v) is not on the curve, thereby preventing the potential issue outlined.


Note the importance of restricting 0 in the output range of the encoding function.


If the zero scalar could be obtained, the result of the scalar multiplication would be the point-at-infinity, which could lead to unexpected issues when trying to use that result.


Now that we have a better understanding of the Pedersen hash and its security, let’s look at some of the attacks that apply if one were to overlook some of the requirements described so far.


Vulnerability 1: Non-unique x-coordinate In this first vulnerability example, we show how implementations blindly using the x-coordinate of the hash output could lead to collisions.


Instead of using our toy “identity” encoding, we employ Zcash’s signed-digit encoding, which maps bit strings to a range of positive and negative integers centred around 0.


Recall that on a curve in Weierstrass form, the negation of a point P = (x, y) is -P = (x, -y).


Considering only the x-coordinate, a collision in the hash function output occurs when two messages result in the pair of points only differing in sign.


G1 – ⟨M2⟩ ⋅ G2 Hence, to compute a collision for a message M, we have to find the message M′ such that the encoding of the chunks of M′ correspond to the negation of the respective encoded chunks of M, namely ⟨M1′⟩ = −⟨M1⟩ and ⟨M2′⟩ = −⟨M2⟩. This is straightforward to perform when using Zcash’s encoding scheme, since the third bit of every 3-bit window encoded by the enc() function determines the sign of the output.


Hence, given a message hash H(M), the message M’ crafted by flipping every third bit of M produces a hash output equal to the negation of H(M), which coincide in their x-coordinate.


The code snippet below illustrates this.


# ========================================== # # Vulnerability 1 - Non-unique x-coordinate # # ========================================== # H = ZcashPedersenHash(message) print(f"Zcash's Hash of {message} = {H}") # Zcash's Hash of ['010101', '000111'] = (83 : 83 : 1) colliding_message = ["011100", "001110"] H2 = ZcashPedersenHash(colliding_message) assert H[0] == H2[0] assert message !


It is important to repeat that Zcash’s implementation is not susceptible to this issue due to their curve and coordinate choice.


Using our toy example, let’s see how an adversary could break the collision-resistance of the hash function if they knew the discrete logarithm of one of the generators with respect to the other one.


We know the discrete logarithm of G2 with respect to G1 assert 35 * G1 == G2 message =


[42, 56] encoded_message = EncodeMessage(message, ZcashEncode) print(f"Encoded Message: {encoded_message}") # Encoded Message:


Thus, in order to find a collision, we can simply work in the scalar field and find a solution to the equation ⟨M1⟩


+ 35 ⋅ ⟨M2⟩ ≡ 129 mod 139.


One can see the previous equation holds for ⟨M1⟩ = 17 and ⟨M2⟩ = 31.


Since Zcash’s encoding is injective, one can decode these values and obtain M1 = "000000", M2 = "001100", which collides with the original message, as shown below.


# We need to find a message M' = M1' || M2' such that # <M1'>


+ 35*<M2'> = (-29 -35*63 ) = 129 mod 139 H2 = GenericPedersenHash(GENERATORS, [17, 31]) assert H == H2 H3 = ZcashPedersenHash(["000000", "001100"]) assert H == H3


This shows how important it is that the generators be sampled in such a way that no ones knows the discrete logarithm of one with respect to the other one, not even the hash function designers.


One reason why allowing inputs of different sizes to be hashed may result in collisions is that padding is applied to the inputs prior to encoding them.


Pad to a multiple of 3 bits by appending zero bits, giving ′.


But this padding step may also be implicit, such as when using the “identity” encoding and hashing messages of unexpected lengths.


In that case, the missing or superfluous bits would simply be interpreted as zeros.


We illustrate the issue with our toy example.


In the following code snippet, we see how we can craft a message colliding with msg by trimming or appending zero bits at the end of the message.


["010101", "111000"] colliding_message =


[message[0] + "000", message[1][:3]] print(f"Colliding Message: {colliding_message}")


# Colliding Message:


['010101000', '111'] assert PedersenHash(colliding_message) == PedersenHash(message)


Conclusion While the Pedersen hash function has many desirable advantages due to its simplicity, efficiency in arithmetic circuits, and the known security assumption it relies on, it is also susceptible to many pitfalls.


Specifically, implementations adapting the Zcash approach but on different curves or with different encoding schemes may result in fragile constructions vulnerable to subtle issues, as illustrated in this blog post.


The source code is located at https://github.com/ncc-pbottine/ToyPedersenHash/. Acknowledgements The author would like to thank Kevin Henry, Aleksandar Kircanski and Giacomo Pope of NCC Group’s Cryptography Services team for their diligent review of this post and Daniele Di Benedetto from Horizen Labs for having drawn our attention to some of the interesting problems described in this blog post.


All remaining inaccuracies are the sole responsibility of the author.


References [Zcash]: Daira Hopwood, Sean Bowe, Taylor Hornby, Nathan Wilcox.


Zcash Protocol Specification Version 2022.3.8


URL: https://zips.z.cash/protocol/protocol.pdf.


[CHP91]: David Chaum, Eugène van Heijst, and Birgit Pfitzmann.


URL: https://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.34.8570.


[Ped91]: Pedersen, T.P. Non-Interactive and Information-Theoretic Secure Verifiable Secret Sharing. 1991.


URL:


Specifically, this subset has rapidly weaponized N-day vulnerabilities in common enterprise applications and conducted highly-targeted phishing campaigns to quickly and successfully access environments of interest.

Nationstate threat actor Mint Sandstorm refines tradecraft to attack highvalue targets


This new name is part of the new threat actor naming taxonomy we announced today, designed to keep pace with the evolving and growing threat landscape.


Activity Microsoft tracks as part of the larger Mint Sandstorm group overlaps with public reporting on groups known as APT35, APT42, Charming Kitten, and TA453.


Microsoft assesses that Mint Sandstorm is associated with an intelligence arm of Iran’s military, the Islamic Revolutionary Guard Corps (IRGC), an assessment that has been corroborated by multiple credible sources including Mandiant, Proofpoint, and SecureWorks.


In 2022, the US Department of Treasury sanctioned elements of Mint Sandstorm for past cyberattacks citing sponsorship from the IRGC.


This Mint Sandstorm subgroup is technically and operationally mature, capable of developing bespoke tooling and quickly weaponizing N-day vulnerabilities, and has demonstrated agility in its operational focus, which appears to align with Iran’s national priorities.


Microsoft Threat Intelligence consistently tracks threat actor activity, including Mint Sandstorm and its subgroups, and works across Microsoft Security products and services to build detections into our products that improve protection for customers.


Microsoft is sharing details on these operations to raise awareness on the risks associated with their activity and to empower organizations to harden their attack surfaces against tradecraft commonly used by this Mint Sandstorm subgroup.


Recent operations From late 2021 to mid-2022, this Mint Sandstorm subgroup moved from reconnaissance to direct targeting of US critical infrastructure including seaports, energy companies, transit systems, and a major US utility and gas entity potentially in support of retaliatory destructive cyberattacks.


This targeting was likely in response to Iran’s attribution of cyberattacks that halted maritime traffic at a major Iranian seaport in May 2020, delayed Iranian trains in July 2021, and crashed gas station payment systems throughout Iran in late 2021.


Of note, a senior cybersecurity-focused IRGC official and others close to the Iranian Supreme Leader pinned the attack affecting gas station payment systems on Israel and the United States.


This targeting also coincided with a broader increase in the pace and the scope of cyberattacks attributed to Iranian threat actors, including another Mint Sandstorm subgroup, that Microsoft observed beginning in September 2021.


The increased aggression of Iranian threat actors appeared to correlate with other moves by the Iranian regime under a new national security apparatus, suggesting such groups are less bounded in their operations.


Given the hardline consensus among policymakers in Tehran and sanctions previously levied on Iran’s security organizations, Mint Sandstorm subgroups may be less constrained in carrying out malicious cyber activity.


Rapid adoption of publicly disclosed POCs for initial access and persistence Microsoft has increasingly observed this Mint Sandstorm subgroup adopting publicly disclosed proof-of-concept (POC) code shortly after it is released to exploit vulnerabilities in internet-facing applications.


Until 2023, this subgroup had been slow to adopt exploits for recently-disclosed vulnerabilities with publicly reported POCs, often taking several weeks to successfully weaponize exploits for vulnerabilities like Proxyshell and Log4Shell.


However, beginning in early 2023, Microsoft observed a notable decrease in the time required for this subgroup to adopt and incorporate public POCs.


They later exploited CVE-2022-47986 in Aspera Faspex within five days of the POC being made public on February 2, 2023.


While this subgroup has demonstrated their ability to rapidly incorporate new public POCs into their playbooks, Microsoft has also observed that Mint Sandstorm continues to use older vulnerabilities, especially Log4Shell, to compromise unpatched devices.


After gaining initial access to an organization by exploiting a vulnerability with a public POC, this Mint Sandstorm subgroup deploys a custom PowerShell script designed for discovery.


In some cases, the subgroup does not act on the information they collect, possibly because they assess that a victim does not meet any targeting requirements or because the subgroup wishes to wait and focus on more valuable targets.


In cases where Mint Sandstorm operators continue their pursuit of a given target, Microsoft typically observes one of two possible attack chains.


In this attack chain, the subgroup uses an SSH tunnel for command and control (C2), and the final objective in many cases is theft of the Active Directory database.


If obtained, the Mint Sandstorm subgroup can use the Active Directory database to access credentials for users’ accounts.


In cases where users’ credentials are accessed and the target organization has not reset corresponding passwords, the actors can log in with stolen credentials and masquerade as legitimate users, possibly without attracting attention from defenders.


The actors could also gain access to other systems where individuals may have reused their passwords.


However, in this progression, the operators use webhook.site for C2 and create scheduled tasks for persistence.


These custom malware variants signal an increase in the subgroup’s level of sophistication, as they shift from using publicly available tools and simple scripts to deploying fully custom developed malicious code.


Since 2022,Microsoft has observed this Mint Sandstorm subgroup using two custom implants, detected by Microsoft security products as Drokbk and Soldier, to persist in target environments and deploy additional tools.


Drobkbk and Soldier both use Mint Sandstorm-controlled GitHub repositories to host a domain rotator containing the operators’ C2 domains.


This allows Mint Sandstorm to dynamically update their C2 infrastructure, which may help the operators stay a step ahead of defenders using list-based domain blocking.


Drokbk: Drokbk.exe is a custom .NET implant with two components: an installer, sometimes accessed from a compressed archive on a legitimate file-sharing platform, and a secondary backdoor payload.


Soldier: Soldier is a multistage .NET backdoor with the ability to download and run additional tools and uninstall itself.


Like Drokbk, Soldier C2 infrastructure is stored on a domain rotator on a GitHub repository operated by Mint Sandstorm.


In certain cases, this Mint Sandstorm subgroup has used TTPs outside of these attack chains, notably when they have failed to achieve short-term objectives.


However, in most cases, Mint Sandstorm activity displays one of the above discussed attack chains.


Recipients are typically individuals affiliated with high-profile think tanks or universities in Israel, North America, or Europe with ties to the security and policy communities.


Unlike their initial exploitation of vulnerable internet-facing applications, which is largely indiscriminate and affects organizations across sectors and geographies, activity associated with this campaign was highly targeted and affected fewer than 10 organizations..


The initial emails are most commonly lures designed to social engineer recipients into clicking a OneDrive link hosting a PDF spoofed to resemble information on a topic involving security or policy in the Middle East.


Template injection is an attractive option for adversaries looking to execute malicious code without drawing scrutiny from defenders.


This technique can also be used to persist in a compromised environment if an adversary replaces a default template used by a common application.


In these attacks, Microsoft has observed the Mint Sandstorm subgroup using CharmPower, a custom implant, in attacks that began with targeted phishing campaigns.


Reporting from Checkpoint indicates that at least one version of CharmPower pulls data from a specific text file that contains a hardcoded victim identifier.


While effects vary depending on the operators’ post-intrusion activities, even initial access can enable unauthorized access and facilitate further behaviors that may adversely impact the confidentiality, integrity, and availability of an environment.


As these operators increasingly develop and use sophisticated capabilities, organizations must develop corresponding defenses to harden their attack surfaces and raise costs for these operators.


The current detections, advanced detections, and IOCs in place across our security products are detailed below and shared with the broader security community to help detect and prevent further attacks.


Mitigation and protection guidance The techniques used by this subset of Mint Sandstorm can be mitigated through the following actions:


Hardening internet-facing assets and understanding your perimeter Organizations must identify and secure perimeter systems that attackers might use to access the network.


Vulnerabilities observed in recent campaigns attributed to this Mint Sandstorm subgroup that defenders can identify and mitigate include: IBM Aspera Faspex affected by CVE-2022-47986: Organizations can remediate CVE-2022-47986 by upgrading to Faspex 4.4.2 Patch Level 2 or using Faspex 5.x which does not contain this vulnerability.


More details are available in IBM’s security advisory here.


Zoho ManageEngine affected by CVE-2022-47966:


Patching this vulnerability is useful beyond this specific campaign as several adversaries are exploiting CVE-2022-47966 for initial access.


Apache Log4j2 (aka Log4Shell) (CVE-2021-44228 and CVE-2021-45046): Microsoft’s guidance for organizations using applications vulnerable to Log4Shell exploitation can be found here.


Reducing the attack surface Microsoft 365 Defender customers can also turn on attack surface reduction rules to harden their environments against techniques used by this Mint Sandstorm subgroup.


These rules, which can be configured by all Microsoft Defender Antivirus customers and not just those using the EDR solution, offer significant protection against the tradecraft discussed in this report. Block executable files from running unless they meet a prevalence, age, or trusted list criterion Block Office applications from creating executable content Block process creations originating from PSExec and WMI commands Additionally, in 2022, Microsoft changed the default behavior of Office applications to block macros in files from the internet, further minimizing the attack surface for operators like this subgroup of Mint Sandstorm.


C!dha Microsoft Defender Antivirus detects the Soldier implant as the following malware: Trojan:MSIL/SoldierAudio.A!dha Trojan:MSIL/SoldierAudio.


B!dha Trojan:MSIL/SoldierAudio.C!dha Microsoft Defender Antivirus detects the CharmPower implant as the following malware:


TrojanDownloader:O97M/RooftopMelt.A!dha Microsoft Defender for Endpoint The following Microsoft Defender for Endpoint alerts can indicate associated threat activity: Phosphorus Actor activity detected Hunting queries Microsoft 365 Defender Microsoft 365 Defender customers can run the following query to find related activity in their networks: ManageEngine Suspicious Process Execution. DeviceProcessEvents | where InitiatingProcessFileName hasprefix "java" | where InitiatingProcessFolderPath has @"\manageengine\" or InitiatingProcessFolderPath has @"\ServiceDesk\" | where (FileName in~ ("powershell.exe", "powershell_ise.exe") and (ProcessCommandLine has_any ("whoami", "net user", "net group", "localgroup administrators", "dsquery", "samaccountname=", " echo ", "query session", "adscredentials", "o365accountconfiguration", "-dumpmode", "-ssh", "usoprivate", "usoshared", "Invoke-Expression", "DownloadString", "DownloadFile", "FromBase64String", "System.IO.Compression", "System.


IO.MemoryStream", "iex ", "iex(", "Invoke-WebRequest", "set-MpPreference", "add-MpPreference", "certutil", "bitsadmin") // "csvhost.exe", "ekern.exe", "svhost.exe", ".dmp" or ProcessCommandLine matches regex @"[-/–][Ee^]{1,2}[ncodema^]*\s[A-Za-z0-9+/=]{15,}")) or (FileName =~ "curl.exe" and ProcessCommandLine contains "http") or (FileName =~ "wget.exe" and ProcessCommandLine contains "http") or ProcessCommandLine has_any ("E:jscript", "e:vbscript") or ProcessCommandLine has_all ("localgroup Administrators", "/add") or ProcessCommandLine has_all ("reg add", "DisableAntiSpyware", @"\Microsoft\Windows Defender") or ProcessCommandLine has_all ("reg add", "DisableRestrictedAdmin", @"CurrentControlSet\Control\Lsa") or ProcessCommandLine has_all ("wmic", "process call create") or ProcessCommandLine has_all ("net", "user ", "/add") or ProcessCommandLine has_all ("net1", "user ", "/add") or ProcessCommandLine has_all ("vssadmin", "delete", "shadows") or ProcessCommandLine has_all ("wmic", "delete", "shadowcopy") or ProcessCommandLine has_all ("wbadmin", "delete", "catalog") or (ProcessCommandLine has "lsass" and ProcessCommandLine has_any ("procdump", "tasklist", "findstr")) | where ProcessCommandLine !contains "download.microsoft.com" and ProcessCommandLine !contains "manageengine.com" and ProcessCommandLine !contains "msiexec" Ruby AsperaFaspex Suspicious Process Execution. DeviceProcessEvents | where InitiatingProcessFileName hasprefix "ruby" | where InitiatingProcessFolderPath has @"aspera" | where (FileName in~ ("powershell.exe", "powershell_ise.exe") and (ProcessCommandLine has_any ("whoami", "net user", "net group", "localgroup administrators", "dsquery", "samaccountname=", " echo ", "query session", "adscredentials", "o365accountconfiguration", "-dumpmode", "-ssh", "usoprivate", "usoshared", "Invoke-Expression", "DownloadString", "DownloadFile", "FromBase64String"


, "System.IO.Compression", "System.


DeviceProcessEvents | where FileName =~ "powershell.exe" and ProcessCommandLine hasprefix "-e" | extend SplitString = split(ProcessCommandLine, " ") | mvexpand SS = SplitString | where SS matches regex "^[A-Za-z0-9+/]{50,}[=]{0,2}$" | extend base64_decoded = replace(@'\0', '', make_string(base64_decode_toarray(tostring(SS))))


| where not(base64_decoded has_any(@"software\checker", "set folder to watch")) | where base64_decoded has_all("$hst", "$prt") or base64_decoded has_any("watcher", @"WAt`CH`Er()")


Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytic (a series of analytics all prefixed with “TI map”) to automatically match the indicators mentioned in this blog post with data in their workspace.


If the TI Map analytics are not currently deployed, customers can install the Threat Intelligence solution from the Microsoft Sentinel Content Hub to have the analytics rule deployed in their Sentinel workspace.


More details on the Content Hub can be found here: https://learn.microsoft.com/azure/sentinel/sentinel-solutions-deploy


In addition, Microsoft Sentinel customers can leverage the following content to hunt for and detect related activity in their environments: Log4J solution Potential Impacket Execution Commands executed by WMI on new hosts – potential Impacket Scheduled Task Hidden Remote Task Creation/Update using Schtasks Process Scheduled Task Creation or Update from User Writable Directory Exchange SSRF Autodiscover ProxyShell – Detection Indicators of compromise IndicatorTypeDescriptionSoldier.exeFile nameSoldier backdoorad55b4a40f9e52682d9d4f069914e09c941e8b77ca7b615e9deffccdfbc54145SHA256Soldier backdoor hashDrokbk.exeFile nameDrokbk backdoor64f39b85c1d784df1ca8eb895ac7eaf47bf39acf008ed4ae27a796ac0f841bSHA256Drokbk


backdoor hashsync-system-time[.]cfDomainDrokbk C2 infrastructureupdate-windows-security[.]tkDomainDrokbk C2 infrastructuredns-iprecords[.]tkDomainDrokbk C2 infrastructureuniversityofmhealth[.]bizDomainDrokbk C2 infrastructureoracle-java[.]cfDomainDrokbk C2 infrastructure54.39.202[.]0 IP addressDrokbk C2 infrastructure51.89.135[.]15IP


addressDrokbk C2 infrastructure51.89.169[.]201IP addressDrokbk C2 infrastructure51.89.187[.]222IP


addressDrokbk C2 infrastructureNY.docx.docxFile nameCharmPower lure document used for template injection57cc5e44fd84d98942c45799f367db78adc36a5424b7f8d9319346f945f64a72SHA256NY.docx.docx hashAbraham%20Accords%20Du.[.]docxFile nameCharmPower lure document used for template injection3dcdb0ffebc5ce6691da3d0159b5e811c7aa91f6d8fc204963d2944225b0119dSHA256Abraham%20Accords%20Du.[.]docx hashDocTemplate.dotmFile nameMalicious remote template document used in intrusions involving CharmPower65e48f63f455c94d3bf681acaf115caa6e1e60499362add49ca614458bbc4f85SHA256DocTemplate.dotmDntDocTemp.dotmFile nameMalicious remote template document used in intrusions involving CharmPower444075183ff6cae52ab5b93299eb9841dcd8b0321e3a90fb29260dc12133b6a2 SHA256DntDocTemp.dotm hash0onlyastep0[.]xyzDomainCharmPower C2 infrastructure0readerazone0[.]xyzDomainCharmPower C2 infrastructure0tryamore0[.]xyzDomainCharmPower C2 infrastructure References Iran: Background and U.S. Policy.


Secureworks Apt42: Crooked Charms, Cons, and Compromises.


Proofpoint Treasury Sanctions IRGC-Affiliated Cyber Actors for Roles in Ransomware Activity.


U.S. Department of the Treasury Officials: Israel Linked to a Disruptive Cyberattack on Iranian Port Facility.


Thomson Reuters Iran’s Evolving Approach to Asymmetric Naval Warfare.


The Washington Institute for Near East Policy Hackers breach Iran rail network, disrupt service | Reuters.


Reuters APT35 Exploits Log4J Vulnerability to Distribute New Modular PowerShell Toolkit.


Checkpoint Iran Says Gas Stations Were Target Of Cyberattack To Foment Unrest (iranintl.com) Complaint – Summons – Civil Cover Sheet.pdf (noticeofpleadings.com)


The post Nation-state threat actor Mint Sandstorm refines tradecraft to attack high-value targets appeared first on Microsoft Security Blog.


GuLoader Demystified:

GuLoader Demystified Unraveling its Vectored Exception Handler Approach


Unraveling its Vectored Exception Handler Approach url: https://securitynews.sonicwall.com/xmlpost/guloader-demystified-unraveling-its-vectored-exception-handler-approach/ GuLoader Demystified:


Unraveling its Vectored Exception Handler Approach May 31, 2023 OVERVIEW SonicWall Capture Labs Research team recently observed a new variant of GuLoader (a.k.a Cloudeye).


In latest variant of GuLoader it introduces new ways to raise exceptions that hamper complete analysis process and its execution under controlled environment.


In this blog post, we will discuss Unpacking of GuLoader’s shellcodes.


Deep dive into GuLoader’s custom Vectored Exception Handler.


Writing an IDAPython script to deobfuscate the control flow of shellcode and to make GuLoader’s analysis easy and fast.


INTRODUCTION GuLoader is an advanced downloader first discovered in 2019 and since then it kept evolving, adding new anti-debugging techniques with its every new variant.


It downloads malicious payload including AgentTesla, Azorult and Ramcos RAT etc.


Currently GuLoader is spreading through malspam campaign and packed using NSIS installer.


UNPACKING GULOADER’S SHELLCODE GuLoader’s shellcode is executed after three layers.


We need NSIS variant of 7-zip to extract the NSIS script, as typical installer of 7-zip is unable to extract the NSIS script.


Fig 1.


System.dll is DLL file which exports multiple functions.


An Exported function named as “Call” is called by NSIS script.


This function is responsible to allocate and execute Layer 2 shellcode.


Fig 2.


NSIS script calling Exported function Call.


Call function allocates memory space and copies content of file Hangarer.


Man from offset 0x409 till last byte.


It then calls CallWindowProcW API.


Layer 2: Malware immediately decrypts the third layer which located at offset 0x1c9 in layer 2 and starts its execution.


Fig 3.


Decryption of layer 3.


Layer 3: It is the final GuLoader shellcode.


This shellcode has complex obfuscation, consisting of junk code, indirect function calls, dynamic API resolution, obfuscated arithmetic value calculations, using stack to decrypt strings, fake instructions, anti-debug, anti-vm, anti-analysis, anti-dump, anti-API hook, anti-emulation techniques.


During analysis of this variant, we have identified a significant enhancement in GuLoader’s one of most effective anti-debug technique that it’s custom Vectored Exception Handler.


Also it uses same instructions multiple times in shellcode to make it hard for reverser to perform static and dynamic analysis and to consume lot of time.


GuLoader incorporates various evasions techniques.


Mentioning them below in order in which they are get executed.


Scan the virtual memory for the strings related to analysis tools.


Check QEMU emulator related strings.


Patch DbgBreakPoint and DbgUiRemoteBreakin API used by debuggers.


Uses EnumWindows API to enumerates windows.


Uses NtSetInformationThread API with ThreadHideDebugger(0x11).


Uses MsiEnumProductsA and MsiGetProductInfoA APIs.


An Overview of the Payload’s Execution Sequence Create suspended child process of itself.


In newly created process, it creates a section using genuine file to avoid AVs suspicious scanning.


In this case it was using mshtml.dll. Injects complete main shellcode in child process.


Repeats executing the mentioned evasion techniques one more time.


After successful bypass , it decrypts the c2 URL and download encrypted payload from c2.


Generate the payload decryption key.


In analyzed sample, key length was 0x303 bytes.


Lastly, it starts payload execution using the ZwCreateThreadEx API. Fig 4.


Snippet of Payload decryption function.


All of the above-mentioned evasion techniques and payload execution sequences are already explained in detail in SonicWall Capture Labs Research team’s blog.


NEW ENHANCED ANTI-DEBUG TECHNIQUE


In the below section we will discuss Exception types and implementation.


Writing IDAPython script to restore deobfuscate control flow.


EXCEPTION TYPES & IMPLEMENTATION


EXCEPTION_ACCESS_VIOLATION (code 0xC0000005)


When malware intentionally tries to write to an inaccessible memory address, exception EXCEPTION_ACCESS_VIOLATION is raised.


Here, malware constructs zero by series of arithmetic calculations.


Then it tries to access memory address pointed by it, which raises exception as zero is inaccessible memory address.


EXCEPTION_ACCESS_VIOLATION instructions pattern.


As we can see the constant values and operations (mov, xor, sub) are keeps varying for each exception raised.


EXCEPTION_SINGLE_STEP (code 0x80000004)


The FLAGS register is the status register that contains the current state of a x86 CPU.


The trap flag is 8th bit of FLAGS register.


When the trap flag is set, the system is instructed to single step, it will execute one instruction and then stop.


The x86 processor has no instruction to directly set or reset the trap flag.


Malware uses combination of (PUSHFD/POPFD) instructions to set trap flag.


Pushing the flag register on the stack (PUSHFD) .


Modifying the trap flag bit (uses 0x100)


When malware is running without debugger, when SINGLE_STEP exception is raised and handled by Vectored Exception Handler.


Fig 6. SINGLE_STEP


exception instructions pattern.


However while using debugger, no exception can be seen being raised as trap flag is always gets reset after each debugger event is delivered.


EXCEPTION_BREAKPOINT (code 0x80000003) INT3 instruction (0xCC opcode) is used as software breakpoint in debuggers, that’s why when program is running under debugger, control remains to the debugger after it encounter INT3.


When malware is running without debugger exception EXCEPTION_BREAKPOINT is raised, and control is transferred to the Vectored Exception Handler.


Fig 7.


BREAKPOINT exception instruction patterns.


Now we have understood how exceptions are being raised by malware.


Next will see how malware uses these exceptions to change the control flow at runtime using its custom Vectored Exception Handler. DECODING VECTORED EXCEPTION HANDLER An application can register a function to handle all exceptions for the application.


Vectored handlers are called in the order that they were added.


GuLoader call RtlAddVectoredExceptionHandler API to add its custom Vectored Exception Handler. RtlAddVectoredExceptionHandler accepts two parameters.


Structures of EXCEPTION RECORD & CONTEXT.


As we can see in below image, pointer of structure EXCEPTION_POINTERS is being passed as an argument to Vectored Exception Handler(VEH).


Fig 9.


Pseudocode of Custom Vectored Exception Handler.


When EXCEPTION_ACCESS_VIOLATION and SINGLE_STEP_EXCEPTION exceptions are raised, handler perform following steps: It checks whether memory address being currently accessed is zero or not.


But how handler gets the address of currently accessed memory location?


So it uses ExceptionInformantion[1] member of Exception Record to get this additional information about exception.


Checks if any hardware breakpoints have been set by checking status of the debug registers(DR0 to DR7).


0x6A where Value 2 depicts size of instruction (mov, jg, jne etc.) where exception is raised.


0x6A is byte key to transform EIP.


When EXCEPTION_BREAKPOINT exception is raised, handler perform following steps:


Checks whether hardware breakpoints have been set by checking status of the debug registers(DR0 to DR7).


Scans for applied software breakpoint i.e. CC byte in loop.


If successfully pass the check, it then transforms the EIP to new address using logic Context->Eip += ByteAt(Eip + 1) ^


The python script finds instructions pattern that raise an exception and patch them by jump instruction with transformed EIP offset as a target.


After running the python script in IDA, we get clean, easy to analyze, deobfuscated code of GuLoader’s shellcode.


Fig 11.


Obfuscated code(A), deobfuscated code(B), GuLoader’s entire shellcode graph view(C).


CONCLUSION GuLoader malware introduces new techniques very often which takes much time and efforts of malware analysts to fully analyzed it.


We have completely analyzed GuLoader’s custom Vectored Exception Handler and understood how it works.


We have written python script to defeat GuLoader shellcode control flow obfuscation and saving time and efforts of malware analyst.


IOC’s SHA256 : 55130719554a0b3dcbf971c646e6e668b663b796f4be09816d405cc15a16d7d6 C2 URL : hxxp[:]//lena[.]utf[.]by/wp-content/plugins/f8eb81f6deba45169c3b41c05c4590ad/y/mm/mmd/kdRrHFMqRUIujuOy126[.]bin Final Payload (Azorult stealer): d5af42b118d0597c6b71831f2b2ebc8294eca907481d53939563fce7c0f14767 REFERENCES


[1] https://securitynews.sonicwall.com/xmlpost/guloader-a-fileless-shellcode-based-malware-in-action/ [2] https://learn.microsoft.com/en-us/windows/win32/debug/vectored-exception-handling [3] https://learn.microsoft.com/en-us/windows/win32/api/winnt/ns-winnt-exception_record


APT & Targeted Attacks Pack it Secretly: Earth Preta’s Updated Stealthy Strategies After months of investigation, we found that several undisclosed malware and interesting tools used for exfiltration purposes were being used by Earth Preta.

Pack it Secretly Earth Pretas Updated Stealthy Strategies


By: Vickie Su, Nick Dai, Sunny Lu March 23, 2023Read time: ( words) Save to Folio Subscribe


In our previous research, we disclosed and analyzed a new campaign initiated by the threat actor group Earth Preta (aka Mustang Panda).


In this blog entry, we will introduce and analyze the other tools and malware used by Earth Preta.


Infection chain As we previously mentioned in our past blog entry, the entire attack begins with a spear-phishing email.


After a long-term investigation into the attack routine, we’ve determined that the full infection chain works as follows: Figure 1.


In our previous research, we covered most of the new TTPs and malware during the first stage, arrival vectors.


In the following sections, we focus on the updated arrival vectors and their succeeding stages.


Starting in October and November 2022, we observed that the threat actors began changing their TTPs to deploy the TONEINS, TONESHELL, and PUBLOAD malware, and QMAGENT malware.


We believe that the threat actors are employing these new techniques to avoid detection.


Trojan.Win32.TONEINS Based on our earlier observation, the TONEINS and TONESHELL malware were downloaded from the Google Drive link embedded in the body of an email.


To bypass email-scanning services and email gateway solutions, the Google Drive link has now been embedded in a lure document.


The files can then be extracted inside via the password provided in the document.


By using this technique, the malicious actor behind the attack can successfully bypass scanning services.


A lure document (allegedly concerning the government-related Myanmar Sustainable Development Plan) embedded with a Google Drive link and a password For the new arrival vector, the whole infection flow has been changed to the procedure shown in Figure 3.


The infection flow for these is similar to the arrival vector type C in our previous report, with the only difference being that the fake .docx files have XOR-encrypted content to prevent detection.


For example, ~$Evidence information.docx is a file disguising itself as an Office Open XML document.


As such, it seems harmless and can even be opened by using decompression software such as 7-Zip.


The TONEINS malware, libcef.dll, will decrypt this file with a single byte in XOR operations, find the PE header, and drop the payload to the specified path.


A PE file is revealed after decrypting the frData member in the last ZIPFILECECORD structure.


The decryption function of TONEINS The succeeding behaviors of the infection flow are generally the same as those in our previous analysis, where we provide more details.


Trojan.Win32.PUBLOAD In more recent cases, the malware PUBLOAD was also being delivered through Google Drive links embedded in decoy documents.


In contrast to the previous PUBLOAD variant, it prepends an HTTP header with a legitimate-looking host name to the packets.


We believe that the threat actors are trying to conceal malicious data among normal traffic.


We were able to successfully retrieve the payload from a live C&C server and were therefore able to continue our analysis.


C&C traffic of the PUBLOAD HTTP variant Once the payload is received, it will check if the first three magic bytes are 17 03 03 and if the following two bytes are the size of payload.


It will then decrypt the encrypted payload with the predefined RC4 key 78 5A 12 4D 75 14 14 11 6C 02 71 15 5A 73 05 08 70 14 65 3B 64 42 22 23 20 00 00 00 00 00 00 00, which is the same as the one used in the PUBLOAD loader.


%d! 0x30 CmdWrite error : %d 0x20 - Table 2.


Debug string in PUBLOAD In summary, we think that the new TONESHELL and PUBLOAD archives have been evolving and now have something in common.


For example, both of them are now being placed in decoy documents (such as Google Drive links) in order to bypass antivirus scanning.


Discovery Once the threat actors obtain access to the victim’s environment, they can start inspecting the environment via the following commands: net user net user <username> net user <username>


/DOMAIN Privilege escalation In this campaign, we discovered several tools used for UAC bypass in Windows 10.


We will go into detail for each of them.


HackTool.


Win 32.ABPASS HackTool.Win32.ABPASS is a tool used to bypass UAC in Windows 10.


Based on our analysis, it reuses codes from the function ucmShellRegModMethod3, which is from a famous open-source project called UACME.


A report from Sophos introduces this tool.


￼ This tool accepts an argument, and the following data is written into registry: Registry Key Name Value HKEY_USERS\<SID>-1001_Classes\aaabbb32\shell\open\command (Default)


Registry keys changed by ABPASS


In turn, the behavior of ms-settings is redirected to the custom defined ProgID aaabbb32.


Finally, fodhelper.exe or computerDefaults.exe will be executed to trigger the ms-settings protocol.


Win 32.CCPASS HackTool.


Win32.CCPASS is another tool that is also used for Windows 10 UAC bypass and similarly reuses codes from the function ucmMsStoreProtocolMethod in the project UACME.


Code similarities in CCPASS and ucmMsStoreProtocolMethod It works in a similar way to ABPASS.


However, unlike ABPASS, it hijacks the ms-windows-store protocol.


The hack tool CCPASS works as follows: It disables the application association toasts for the protocol ms-windows-store.


It creates a new Shell in the registry.


To hide this window, the tool explicitly adds new entries to HKCU\Software\Microsoft\Windows\CurrentVersion\ApplicationAssociationToasts to disable all toasts related to the protocol ms-windows-store.


An example of the application association toast Figure 16.


Hiding application association toasts via the registry Once this is done, the tool starts to alter the shell command of ms-windows-store and finally triggers it using WSReset.exe.


SilentCleanup In Windows 10, there is a native Windows service called “SilentCleanup.”


This service has the highest privileges that can be abused for Windows 10 UAC bypass.


Normally, this service is intended for running %windir%\system32\cleanmgr.exe.


However, the environment variable %windir% can be hijacked and changed to any path to achieve privilege escalation.


Malicious commands abusing the SilentCleanup service We observed that the threat actors used this technique to execute c:\users\public\1.exe.


Lateral movement In this stage, we observed certain malware such as HIUPAN and ACNSHELL (initially introduced and analyzed by Mandiant and Sophos) being used to install themselves to removable disks and create a reverse shell.


USB Worm: Worm.


We found a pair of malware comprised of a USB worm and a reverse shell —includin g a USB worm and a reverse shell (detected as Worm.Win32.HIUPAN and Backdoor.Win32.ACNSHELL, respectively,) — being used to spreadfor spreading themselves over removable drives., which we detected as Worm.Win32.HIUPAN and Backdoor.Win32.ACNSHELL.


This These malware wereas detailed and introducedpreviously discussed in the reports published by Mandiant and Sophos.


G:\project\APT\U盘劫持\new\shellcode\Release\shellcode.pdb The string U盘劫持 means “U disk hijacking,” where “U disk” refers to removable drives.


If it is not installed, it installs itself to %programdata% and then sets the registry run key for persistence.


Finally, the ACNSHELL malware rzlog4cpp.dll is sideloaded.


For example, the group used certutil.exe to download the legitimate WinRAR binary as rar1.exe from the server 103[.]159[.]132[.]91. Figure 19.


The certutil.exe program downloads the WinRAR binary We also observed that the threat actors used PowerShell to download multiple malware and archives from the server 103[.]159[.]132[.]181 for future use. Figure 20.


PowerShell downloading malware In certain instances, they even leveraged the WinRAR binary installed on the victim hosts to decompress all the malware.


Decompressing malware with the installed WinRAR binary Although we found several logs involving multiple pieces of dropped malware, we only managed to retrieve a few of them.


Among all our collected samples, we will introduce the most noteworthy ones.


Backdoor.


Win32.CLEXEC The file name of the backdoor CLEXEC is SensorAware.dll.


This is a simple backdoor that is capable of executing commands and clearing event logs.


Win32.COOLCLIENT The backdoor COOLCLIENT was first introduced in a report from Sophos; the sample mentioned in the report was compiled in 2021.


In our case, the COOLCLIENT sample we analyzed had a more recent compilation time in 2022, and while it provides the same functionalities, it has the added capability to open a decoy document (work.pdf) when the current process name has “.pdf” or “.jpg” file extensions.


It contains also possesses the ability to reduce debug strings (less OutputDebugStrings calls).


Furthermore, COOLCLIENT applies obfuscation techniques that we discuss in later sections. Figure 23.


Execution flow of COOLCLIENT The arguments of COOLCLIENT provide the following capabilities: install.


There are three conditions different ways to decide the method of installation for COOLCLIENT, detailed here: It installs itself by creating an InstallSvc service called InstallSvc which will trigger “googleupdate.exe work”..


It sets up a run key for via the command C:\ProgramData\GoogleUpdate\googleupdate.exe work for persistence. work.


The malware will continue to read and decrypt goopdate.ja and inject it into winver.exe for the next-stage payload (COOLCLIENT), which contains malicious behaviors.


passuac.


The malware will check if the process avp.exe exists.


If avp.exe doesn’t exist, UAC bypass will be executed via the CMSTPLUA COM interface.


If avp.exe exists, UAC bypass will be executed via the AppInfo RPC service.


UAC Bypass via the AppInfo RPC service Based on the class name used in COOLCLIENT, we learned thaAccording to our analysis, it reads the encrypted configuration filecan expand the C&C server via time.sig., an encrypted configuration.


It is also able to communicate through different network protocols such as UDP (User Datagram Protocol) and TCP (Transmission Control Protocol).


Based on some internal strings and the APIs used by Earth Preta, the functionalities of this backdoor can be inferred as follows: Send portmap Build connection Read file Delete file Keystrokes and windows monitoring Backdoor.


However, this backdoor has an anti-debugging technique, which will check if the running processes have the strings dbg.exe or olly. Figure 27.


TROCLIENT anti-debugging technique.


Figure 28 shows the whole execution flow of TROCLIENT. Figure 28.


Execution flow of TROCLIENT The arguments of TROCLIENT provide the following capabilities: install.


There are two waysto determine the method of installation for TROCLIENT, detailed here: It installs itself by creating aservice called InstallSvc which will trigger “C:\programdata\netsky\netsky.exe online”.


online: It will read the next stage payloads, free.plg and main.plg, and inject them into dllhost.exe. passuac:


If it does not, UAC bypass is executed via the CMSTPLUA COM interface.


The capabilities of three different arguments This backdoor provides the following capabilities: Read file Delete file Monitor keystrokes and windows There are several similarities and differences between COOLCLIENT and TROCLIENT, as Table 3 shows.


Argument/Behaviors COOLCLIENT TROCLIENT install Creates a service named InstallSvc ✓ ✓ Executes itself with passuac ✓ ✓ Sets Run Key with “work/online” ✓ ✓ passuac AppInfo RPC ✓ CMSTPLUA COM ✓ ✓ Token manipulation ✓ work/online Send portmap ✓ Connect to C&C ✓ ✓ File operations ✓ ✓ Keylogging ✓ ✓ Table 3.


Comparison of COOLCLIENT and TROCLIENT


After further investigation, we even found some previously unseen pieces of malware that were used to collect data in a custom-made file format.


WinRAR and curl According to some of our monitoring logs, the threat actors abused the installed WinRAR binary and the uploaded curl executable to exfiltrate the files (Figure 30 shows the executed command).


Note that the executable log.log is a legitimate curl binary.


All the exfiltrated data was collected and sent back to the threat actor-controlled FTP (File Transfer Protocol) server.


FTP servers with stolen documents HackTool.


Win32.NUPAKAGE Apart from well-known legitimate tools, the threat actors also crafted highly customized tools used for exfiltration.


We named this malware “NUPAKAGE," a name derived from its unique PDB string, D:\Project\NEW_PACKAGE_FILE\Release\NEW_PACKAGE_FILE.pdb.


It seems that the threat actors are continuously updating this tool to provide more flexibility and lower the possibility of detection, including adding more command-line arguments and obfuscation mechanisms.


By default, it only collects documents, including the files with the following extensions: .doc .docx .xls .xlsx .ppt .pptx .pdf


It avoids collecting documents with file names starting with “$” or “~” since these types of documents are usually either temporary files generated by the system or PE files pretending to be decoy documents (as we discussed in the arrival vectors section).


The usage of this tool is as follows: malware.exe passcode start end chunk -s extension_A extension_B … Argument Name Format Example Value Description passcode String comeon A unique code to execute it start String 2022-01-01


The start range of the exfiltrated file’s modification timestamp end String 2022-12-31


The end range of the exfiltrated file’s modification timestamp chunk Integer 4096 Splits the generated data in chunks by the specified size (MB) -s String File extensions to be collected; optional Table 5.


As Figure 32 shows, it first checks if the passcode exists.


If not, the malware execution procedure will terminate.


In our collection, we observed different passcodes in each malware. Figure 32.


Passcode check routine in NUPAKAGE SHA256 Passcode 634977a24e8fb2e3e82a0cddfe8d007375d387415eb131cce74ca03e0e93565f notebook c835577f1ddf66a957dd0f92599f45cb67e7f3ea4e073a98df962fc3d9a3fbe0 comeon 2937580b16e70f82e27cfbc3524c2661340b8814794cc15cb0d534f5312db0e0 update c2f5a12ebaeb39d4861e4c3b35253e68e6d5dc78f8598d74bc85db21aeb504e8 comeon Table 4.


Passcodes in NUPAKAGE After execution, NUPAKAGE will drop two files, xxx.zip and xxx.z.


The file xxx.zip is a logging file with a fake ZIP header prepended at offset 0x0 and taking up the first 0x100 bytes.


Starting from the offset 0x100, the logging strings are encrypted with a single byte in XOR operations as shown Figure 33.


The original logging file (top), with plain text revealed in the decrypted logging file (bottom) Taking one of the execution results as an example, much of the information of the exfiltrated data is saved, including the original file path, the original file size, and the compressed file size.


For security researchers, this logging file also helps reveal how much data is exfiltrated and provides information on the impact scope.


[+] Program ready!


[+] FILE ORIGINAL PATH: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf [+] FILE PATH SIZE: 198 [+] FILE ORIGINAL SIZE: 186837


186837 [+] FILE COMPRESSED SIZE: 183734 ...


[*] File or folder access denied!


The file with a .z extension is a blob of exfiltrated data within a self-defined file format.


To separate the file blobs, it puts a unique byte sequence at the end of each, 55 55 55 55 AA AA AA AA FF FF FF FF 99 99 99 99.


Figure 34.


Self-defined format in the file with the .z extension generated by NUPAKAGE Table 5.


Self-defined format description in the file with the .z extension generated by NUPAKAGE It’s also worth mentioning that in the more recent versions of NUPAKAGE, an increasing number of obfuscations are being adopted to thwart static analysis.


Junk codes in more recent versions of NUPAKAGE HackTool.


Win32.ZPAKAGE ZPAKAGE is another example of custom malware used for packing files; it also works similarly to NUPAKAGE.


It also needs a passcode to ensure that it is being used as intended.


Figure 36.


An example of a ZPAKAGE password ZPAKAGE also supports command-line arguments, but it possesses less functions than NUPAKAGE.


Arguments supported by ZPAKAGE ZPAKAGE also shows similar behaviors to NUPAKAGE.


For instance, it also avoids files with names starting with “$” or “~”.


The file with a .z extension is the exfiltrated data blob and the file with a .zip extension is the logging file.


In the generated file with a .z extension, the exfiltrated files will be compressed by the zlib algorithm to minimize the file size.


It also defines a Boolean field “type” for storage, whether a file is compressed or not.


If a file is compressed and its file size is less than the original one, the type will be 1.


Regardless of whether the file content is compressed or not, it will be encrypted in XOR operations with a specific string, qwerasdf.


For example, we found a TONEINS sample (SHA256: 8b98e8669d1ba49b66c07199638ae6012adf7d5d93c1ca3bf31d6329506da58a) on VirusTotal that can’t be linked to any other file in the “Relations” tab.


However, we observed two files that have been opened in the “Behaviors” tab with the file names ~$Evidence information.docx and ~$List of terrorist personnel at the border.docx.


As mentioned in the arrival vectors section, the next stage payloads are normally embedded in the fake document files.


Opened files of TONEINS sample Figure 39 shows the search results for the query “List of terrorist personnel at the border” on VirusTotal.


The first file is the TONEINS DLL sample that we mentioned earlier in this section, while the second file is a benign executable file originally named adobe_licensing_wf_helper.exe, which was apparently uploaded to VirusTotal with the file name List of terrorist personnel at the border.exe.


Search result for the string List of terrorist personnel at the border on VirusTotal Figure 40.


, there is a Google Drive link and a password.


The content itself is related to the Government of the Republic of the Union of Myanmar, and is written in Burmese.


Letter Head.docx Upon checking the download link, we discovered that it was the same password-protected archive file that we found on VirusTotal earlier.


Screenshot of the Google Drive link The new arrival vector flow is similar to the one we introduced in the arrival vector section: Victims will receive and interact with a decoy document containing a Google Drive link and a corresponding password instead of an archive download link embedded in the email.


As for why the password-protected archive has the execution parent, upon checking the sandbox execution behaviors of Letter Head.docx on VirusTotal, we discovered that the VirusTotal sandbox will select any link embedded in the document.


This leads to the opening of an Internet Explorer window with the file download prompt.


This sample can then be used for hunting this campaign.


The dropped files of Letter Head.docx on VirusTotal To find additional password-protected archives and documents embedded with a Google Drive link, we tried to use the following query:


Figure 46.


Connecting the Dots During our investigation, we observed some data points that connect to the same personnel.


In addition, the GitHub repository named “YanNaingOo0072022,” mentioned in Avast’s December 2022 report,￼hosted multiple pieces of malware, including TONESHELL.


We also observed that the obfuscation methods have similarities among the different malwares.


Figure 48.


Windows users in 38[.]54[.]33[.]228 While hunting samples related to this campaign, we came across a tweet about Cobalt Strike posted in April 2021.


At first glance, Cobalt Strike was used in a manner similar to this campaign, including the use of DLL sideloading, the use of a Google Drive link for delivery, and the creation of a schedule task.


A tweet about Cobalt Strike The infection flow is as follows: The archive file is delivered through a Google Drive link, which contains a legitimate EXE file, a malicious DLL file, and a decoy document written in Burmese.


Once the malicious DLL is sideloaded, it will drop the legitimate EXE file and the malicious DLL file, which are embedded in the resource section of the DLL file.


In this sample, the string By:Taozongjie is being used as the event name.


Special string in the sample In one TONEINS sample (SHA256: 7436f75911561434153d899100916d3888500b1737ca6036e41e0f65a8a68707), we also observed the string taozongjie, which was being used for an event name.


Create event taozongjie in TONEINS In another TONESHELL sample (SHA256: d950d7d9402dcf014d6e77d30ddd81f994b70f7b0c6931ff1e705abe122a481a), there are some insignificant export functions, which will appear via message boxes, with the strings Tao or zhang!.


Even though the names of these two strings are not spelled exactly same way as taozongjie, their spellings are still similar.


GitHub user “YanNaingOo0072022” The GitHub user “YanNaingOo0072022” was mentioned in both an Avast and an ESET report.


The user’s repositories host various malware, including the latest versions of TONEINS, TONESHELL, and a new tool, QMAGENT, which is ESET named MQsTTang”.


Among these, “View2015” and “View2016” were empty.


The archive files in this repository are all the same but have different file names.


We believe that these files were meant for different victims.


The 1226 repository Upon unarchiving the compressed file, we found two files with the fake extension “.doc” containing one-byte XOR encrypted sections.


Both share the same file structure (a PE payload hidden in a DOCX file) as the one we referred to in the arrival vectors section.


These files ended up being the TONEINS and TONESHELL malware.


Figure 56.


The files inside the archive 14 The file Documents members of delegation diplomatic from Germany.


Exe, found in the Documents.rar archive, is a novel malware that communicates over the MQTT protocol.


In March 2023, ESET published a detailed technical report on this backdoor, which it named “MQsTTang.”


This backdoor is unique because it communicates to its C&C servers over the MQTT protocol, which is commonly used in internet-of-things (IoT) devices.


The ee repository Conclusion Over the past year, security researchers have been discovering and analyzing Earth Preta’s campaigns and toolsets.


We were able to attribute some of these to Earth Preta based on similarities among the TTPs, the malware being used, and the timeline of the campaigns.


Instead of attaching malicious archives or Google Drive links to an email, they now embed the download link in another decoy document and add a password to the archive.


Based on our observations, Earth Preta tends to hide malicious payloads in fake files, disguising them as legitimate ones — a technique that has been proven effective for avoiding detection.


Meanwhile, they developed customized toolsets designed to collect confidential documents in the exfiltration stage.


Overall, we believe that Earth Preta is a capable and organized threat actor that is continuously honing its TTPs, strengthening its development capabilities, and building a versatile arsenal of tools and malware.


To help prevent potential threats such as the one posed by advanced persistent threat (APT) groups, we suggest that organizations conduct phishing awareness training for their employees and partners to stress the importance of caution when opening emails, particularly those messages from unfamiliar senders or with unknown subjects.


To assist organizations in protecting themselves against sophisticated threats, we recommend adopting a comprehensive security strategy that employs advanced technologies capable of identifying and halting such threats across multiple channels, including endpoints, servers, networks, and email communications.


Indicators of Compromise (IOCs)


MITRE ATT&CK Tactic ID Name Resource Development T1583.004 Acquire Infrastructure: Server T1587.001 Develop Capabilities: Malware T1585.002 Establish Accounts: Email Accounts T1588.002 Obtain Capabilities: Tool T1608.001 Stage Capabilities:


Scheduled Task/Job: Scheduled Task Privilege Escalation T1068 Exploitation for Privilege Escalation T1134 Access Token Manipulation Defense Evasion T1140 Deobfuscate/Decode Files or Information T1036.005 Masquerading: Match Legitimate Name or Location Lateral Movement T1091 Replication Through Removable Media Command and Control T1071.001 Application Layer Protocol: Web Protocols T1573.001 Encrypted Channel:


Symmetric Cryptography T1104 Multi-Stage Channels T1095 Non-Application Layer Protocol Exfiltration T1048 Exfiltration Over Alternative Protocol Authors Vickie Su Threats Analyst Nick Dai Sr. Threat Researcher Sunny Lu Threats Analyst


In part 1 of this series, we warmed up and aligned with basic computing terminologies.

Malware Reverse Engineering for Beginners  Part 2


All of these tools and techniques are very important for reversing malware samples.


As reverse engineers, we need to be familiar with them and be able to identify and understand them.


This blog will cover key concepts and examples regarding how malware is packed, obfuscated, delivered, and executed on the endpoint.


Here’s what we’ll cover: Basic terms that explain how malware is delivered to endpoints.


A deep dive on packers – what they are, how they work and how to identify packed samples.


Following the technical information, we will demonstrate two hands-on analyses of packed malware.


Basic Terminology for Reverse Engineers to Know An executable file can conceal its true code through either encryption or compression.


When the file is executed, some initial code usually called a stub, decrypts or decompresses the real code so it can be executed.


What’s a Packer? Packers are often used to compress the payload so it will take less space on disk.


While packers can be used for legitimate purposes, malware developers utilize packers to make the malicious payload smaller and avoid detection based on static malware analysis techniques.


Examples: UPX is an open-source packing algorithm.


Andromeda is a custom packer that makes reverse-engineering more difficult.


What’s a Crypter?


To avoid detection by these tools, malware developers can use crypters.


A crypter encrypts the payload, so it will be harder for signature-based and standard anti-viruses to detect the malicious payload.


Examples: PEUNION EXECryptor What’s a Protector?


For most threat actors, one of the goals they want to achieve is to evade detection, and if the malware is detected then make the analysis process harder for researchers.


That’s where protectors come into the picture – they offer many features that can make static and dynamic analysis tedious and time-consuming.


Having said that, legitimate organizations can use protectors to protect their software from being cracked and manipulated.


Usually, protectors will encrypt the payload, remove and obfuscate imports, implement anti-debugging and anti-reversing techniques, and much more. Examples: Themida Enigma Protector VMProtect What’s a Loader?


Packed malware samples are compressed and stored inside the final executable, which will extract and execute the malware.


On the other hand, there are loaders that serve as the first stage of the attack, the payload of the malware can be part of the loader’s file or it can be downloaded from a remote location (by the loader, also known as a Downloader).


Bazarloader delivers all sorts of threats, from spam to ransomware like Conti or Ryuk.


In many cases, malware is delivered by tools that implement some (or all) of the functionalities of packers, crypters, protects, and loaders –- all to make the analysis harder.


Deep Dive Into How Packers Work and Detection


Now let’s focus on packers, how they work, how to identify packed files, and how to extract the packed payload that can contain malicious code.


How do packers work?


The packed file contains three main components: packed content, a new PE header, and a stub, as seen in the image below: Packed sample view.


The stub is a small part of code that implements the decompression (and decryption) of the originally packed file.


A new PE header is prepended to the packed file or modifies the existing header so it will be a valid executable.


Static detection When data is being compressed or encrypted, the output is not structured and resembles more random data, resulting in high entropy.


In information theory, entropy is a measure of disorder/randomness.


The calculation is done using logarithm with base 2, also known as Shannon entropy, the result is in units of bits, hence the range of entropy level for binary files is 0 to 8.


We can check the entropy of the file sections, and if one of them has a value of 7 or higher, there is a high probability that the file is packed.


Packers may change the final payload’s section names, as seen in the screenshot below.


But in most cases, malware authors will rename the sections to more commonly used names that will not give away the fact that the file is packed.


Multiple tools can be used to detect indicators of a sample being packed: PEstudio, DiE (Detect it Easy), CFF explorer, and more.


There are many examples and tutorials that use these tools, so we will show another free tool that can be handy in this and later stages: radare2.


When a file has a low number of imports, it strongly indicates that it contains another component that is dropped/loaded.


However, malware developers can add “dummy” imports to mislead researchers.


Viewing the imports for a packed file; full analysis results here.


Reverse Engineering Example: Static Unpacking of UPX Packed Samples


Let’s take a look at a sample with MD5 5598febfbf00839c9f7047d9fe3205e3.


The section names of the files contain the UPX string, as seen in the screenshot below: We can use the UPX command line utility to extract the packed payload.


The command to decompress a packed file is as follows: upx -d <packed>


You can run the command on the sample and verify that the extracted file has MD5 6d13f5d287fd735a9bbc261aafb49006.


Let’s look at API calls and debuggers.


To make all of these actions, the program must use system calls because these actions require interaction with the kernel.


The memory is automatically initialized to zero.


One of the arguments is dwSize – that’s the size in bytes.


VirtualProtect changes the permissions of the given virtual address.


When malware wants to grant write or execute permissions flNewProtect argument will be set to PAGE_EXECUTE_READWRITE (0x40) or PAGE_EXECUTE_READ (0x20).


RtlDecompressBuffer decompresses the provided buffer.


CreateProcessInternalW creates a new process.


In the context of malware execution, it can create a new threat with the malicious unpacked payload.


We can look for these system calls in the list of imported functions.


For instance, we will not see them in the imported function list, and they not even be part of the strings in the sample.


In this case, the function and the corresponding library are dynamically loaded at runtime – also known as explicit linking.


In this case, dynamic debugging can be very helpful – debuggers like x64dbg let you put a breakpoint on function calls, even if the function is not imported.


The breakpoint will be triggered if the system call is executed.


Debugger A debugger is a powerful tool that allows developers and researchers to follow and control the execution of a program.


When debugging an executable, you can view the registers, stack, and memory and see how each instruction affects the stored data.


Debugging malware can reveal code executed only in runtime (meaning that you will not see it in standard static analysis).


Different debuggers can be used to debug Windows executables and DLLs: OllyDbg – not maintained anymore Windbg – powerful kernel-mode and user-mode debugger created by Microsoft.


x64dbg – reliable and user-friendly.


The main difference between these debuggers is the implementation, which may result in certain behaviors, but for the most part, it’s up to you to choose which debugger you prefer.


There are more tools for debugging (and analyzing) .NET


executables and other Windows executables, but that’s not covered in this blog.


Reverse Engineering Example:


CobaltStrike and Locky.


Make sure to run (and debug) the following examples in an isolated Windows virtual machine.


The video shows generation of a Cobalt Strike payload, analysis of the assembly, dynamic execution of the stager to fetch payload, scanning the endpoint for in memory genetic analysis, and parsing the Beacon configuration.


The analysis of the Locky ransomware is covered in the section below.


Reverse engineering tools that will be used in these analyses:


Windows virtual machine x32 debugger Radare2 Command line commands: file, strings, shasum


In this example, we will inspect a packed sample of Locky ransomware.


We will use radare2.


As seen in the screenshot below, the .rdata section has an entropy level higher than 7, and it’s very unusual for this section to have randomized data.


The output contains lots of strings that look like a random collection of characters.


Dynamic analysis We will use the API calls we covered in the previous section.


Put breakpoints on VirtualAlloc and VirtualProtect.


bp VirtualAlloc bp VirtualProtect Now, let’s run the file.


It will first stop at the entrypoint, we will hit F9 (continue until next breakpoint – BP), and we will get to the first call to VirtualAlloc.


As seen in the screenshot below, the BP stopped on the call to VirtualAlloc, which is in the Kernel32.dll, and in the stack view (right low corner) we can see the arguments passed to the function.


We can see that the required allocated space is relatively small, so it’s probably not called by the unpacking routine.


So we will continue running the program – hit F9 again.


It might take a few more hits on the call to VirtualAlloc before we get to a call with the size 0xF41D.


At this point, we want to see where VirtualAlloc was called and what will be stored in the allocated spaces.


We will hit right-click and follow in the dump.


The memory is zeroed out


but if we follow the execution of the code (hitting F8 several times), we will see that the memory contains some values, but they look random.


Continue running the program until VirtualAlloc is called with the size: 0x17400 – which is even bigger than the previously allocated buffer.


Then again, hit “run to user code,” or “execute till return” and follow EAX in the dump and step through the use code until you see the allocated memory filled with data that looks like this: The dump contains the unpacked executable – we can identify it by the 0x4D5A (MZ) magic.


The MD5 of the extracted payload is e96dad009437ca774035ffd73708bd3e.


Locky ransomware malware.


Mazal tov!


You have successfully extracted the Locky payload.


Automating Unpacking for Every File Learning the foundations of reverse engineering is important if it is a skill that you are trying to develop in your career.


But for many security teams, even at large companies, you may not have the time to manually unpack and reverse engineer files on a regular basis.


Since reverse engineering can be time intensive, you’ll want to only use manual methods for tasks like unpacking after you’ve exhausted your other tools and options.


Don’t have the time or skills for reverse engineering the volume of packed and obfuscated files your SOC team handles?


Intezer’s automated alert triage and response process collects files from your endpoint security solution (like CrowdStrike, Microsoft Defender, or SentinelOne) to identify packed files, extract the payload, and then respond autonomously or with the results Intezer provides for remediation.


To see how Intezer handles reverse engineering tasks for every alert, book a demo here.


The post Malware Reverse Engineering for Beginners – Part 2 appeared first on Intezer.


Recently, the Eclypsium platform began detecting suspected backdoor-like behavior within Gigabyte systems in the wild.

Supply Chain Risk from Gigabyte App Center Backdoor  Eclypsium  Supply Chain Security for the Modern Enterprise


Our follow-up analysis discovered that firmware in Gigabyte systems is dropping and executing a Windows native executable during the system startup process, and this executable then downloads and executes additional payloads insecurely.


It uses the same techniques as other OEM backdoor-like features like Computrace backdoor (a.k.a. LoJack DoubleAgent) abused by threat actors and even firmware implants such as Sednit LoJax, MosaicRegressor, Vector-EDK.


Subsequent analysis showed that this same code is present in hundreds of models of Gigabyte PCs.