Input: Immediately following the header is the type-specific (as indicated by the dwPayloadType field) payload data.


Input: Note that the dwXORKey value is NOT encoded with the XOR value, but rather is the value that is used for encoding the header and payload.


Input: Each DLL includes a hardcoded, default configuration.


Input: At the time that the RAT functionality activates, the DLL will drop the current configuration to disk.


Input: If the configuration file already exists, then the RAT will use the file version of the configuration over the default configuration.


Input: The configuration data structure (seen below) doubles as a current state record for some aspects of the communication subsystem of the DLL.


Input: When stored on disk, the configuration is preceded by a GUID value (16 bytes) that represents the unique identifier for the specific infection.


Input: The configuration is XOR encoded using the first 4 bytes (as a DWORD) of the GUID.


Input: In order to provide some level of stealth, the RAT will install a rootkit on 32-bit versions of Windows.

the RAT

a rootkit

32-bit versions of Windows

install

on


Input: The DLL contains a device driver image embedded within an encoded buffer which the RAT functionality code will extract to the% TEMP% directory (after XOR'ing the buffer with 0x76).


Input: To activate the rootkit, the RAT functionality code creates a service with the driver in the% TEMP% directory as the executable for the service.

the RAT functionality code

a service

the driver in the% TEMP% directory as the executable for the service

creates

with


Input: The RAT functionality code then activates the service and opens a handle to device driver's interface (e.g.

The RAT functionality code

the service

activates


Input: \Globals\HTTPS).


Input: With the handle open to the rootkit driver, the RAT functionality code deletes the service in order to reduce the visible footprint of the new driver.

the RAT functionality code

the service

reduce the visible footprint of the new driver

deletes

in order to


Input: To further reduce the footprint of the driver, the RAT functionality code also uses the cloaking functionality of the rootkit to hide the DLL's PID, any references to the GUID {4AE26357-79A3-466D-A6D9- FC38BFB67DEA}, the DLL's service names (e.g.'' NetDDESrv'' and'' Network DDE Service'') and the service entry as well.

the RAT functionality code

the DLL's PID

the DLL's service names (e.g.'' NetDDESrv'' and'' Network DDE Service'') and the service entry as well

hide


Input: Additionally, the code also attempts to hide a service named'' Hitx''.

the code

a service named'' Hitx''

hide


Input: In addition to the main Hikit malware, there are at least two examples of support programs that belong to the Hikit family.


Input: Samples b04de6c417b6f8836e3f2d8822be2e68f4f9722b and 7c4da9deff3e5c7611b9e1bd67d0e74aa7d2d0f6 are examples of Gen 1.0 and Gen 1.2 operator consoles.


Input: The console is a text based application that takes a Gen 1.0 or Gen 1.2 infection's IP address and proceeds to connect and authenticate with the infected server.

The console

the infected server

connect and authenticate

with


Input: Once connected, the operator has the basic Hikit functionalities available to them via commands such as file and shell.

the operator

the basic Hikit functionalities available to them

commands such as file and shell

has

via


Input: Detecting Hikit variants on disk and in memory is possible using the following YARA signature developed by Symantec: Detecting nominal Gen 1.2 and later network activity is problematic given the nature of the communication structure.


Input: The encrypted nature of the nominal Gen 1.2 and later network traffic makes a signature difficult.


Input: Snort signature 30948 may detect some Hikit based network traffic for only Gen 1.0 and Gen 1.1.


Input: From a system objects perspective, Gen 2 samples produce up to three named events.

Gen 2 samples

three named events

produce

up to


Input: The event names change per infection, but have a common format.


Input: The following three strings represent the known mutex strings for Gen 2 samples: where the% s format variable is replaced with a UUID value string specific to the infected machine.