Input: IsOne is the group that claimed responsibility for the June 2012 attack on the website of South Korean newspaper JoongAng Ilbo.


Input: The attack included an attempt to wipe JoongAng Ilbo's servers as well as a defacement depicting a laughing cat.


Input: Despite efforts to wipe the target's servers, the target only suffered defacement and temporary downtime.


Input: Although the groups have a similar name and both use a cat theme, it is unclear whether a CTF team known as'' The Cat is Number 1'' and IsOne are the same actors.


Input: '' The Cat is Number 1'' members claim to hail from North Korea, but there is no hard evidence linking team members to the region.


Input: Again, it seems that the actors responsible for the attack borrowed the moniker of another group.


Input: According to South Korea's National Police Agency, the attack on JoongAng Ilbo shares characteristics with previous attacks attributed to North Korean actors.


Input: An investigation conducted by the agency's Cyber Terror Response Center found that the actors targeting JoongAng Ilbo used two North Korean servers and 17 servers in 10 other countries.


Input: One server maintained a constant connection to an IP address belonging to Joson Telecommunication Company, which is affiliated with North Korea's Ministry of Posts and Telecommunications.


Input: Investigators found that one of the servers used in the attack on JoongAng Ilbo was also used in the March 2011 DDoS attacks on South Korean critical infrastructure sites and the April 2011 attack on Nyongyup Bank.


Input: Known tactics, techniques and procedures Targets The Kimsuky malware, which targeted South Korean think tanks, is loosely attributed to an actor referred to as Kimsukyang.


Input: Little is known about the actor or group responsible for the malware.


Input: However, the following email addresses are associated with the Kimsuky operation: The email address iop110112 @hotmail.com was registered using the alias'' kimsukyang'', and rsh1213 @hotmail.com was registered using the alias'' Kim asdfa''.


Input: Kaspersky found that the Kimsuky operation used 10 IP addresses in two Chinese provinces that border North Korea: Jilin and Liaoning.


Input: Known tactics, techniques and procedures Targets The New Romantic Cyber Army Team also took credit for the March 20, 2013 attacks.


Input: McAfee suspected New Romantic Cyber Army Team were responsible for Operation Troy and the resulting March 20, 2013 attacks due to the group's'' frequent use of Roman and classical terms in their code.


Input: '' It is unknown whether Hastati is an alternate name for the group or whether Hastati is an individual actor within the group.


Input: It is interesting to note that the malware associated with these actors uses the strings'' HASTATI'' and'' PRINCIPES'' to overwrite the MBR.


Input: The name Hastati likely refers to a class of infantrymen of the early Roman Republic.


Input: The Hastati were less experienced soldiers who fought on the frontlines with spears and swords.


Input: Principes likely refers to more experienced Roman soldiers who fought on the second line of battle.


Input: Known tactics, techniques and procedures Targets HP researchers had previously analyzed samples of the DarkSeoul dropper, and findings were published in our annual HP Cyber Risk Report 2013.


Input: Analysis of this malware is included in Appendix C. Analysis of additional malware used in these campaigns produced no new findings and only corroborated what was found by external security researchers.


Input: These publicly available analyses have been cited throughout the report.


Input: Some of the malware samples were no longer publicly available.


Input: However, CrowdStrike obtained these missing samples before they disappeared from the wild and conducted thorough analysis, which was released in their subscription-only reports.


Input: While we can not divulge detailed information from those reports, an overview of the findings is provided below.


Input: The majority of the malware used in cyber incidents attributed to North Korea were variations of three types of malware: dropper, wiper, and IRC remote access trojan (RAT).


Input: CrowdStrike's attribution of this malware to North Korean actors stemmed from two primary factors: Korean language characters found in the binaries and the propensity to specifically target South Korean entities.


Input: Dropper samples consistently targeted AhnLab Policy Center as a propagation method.


Input: This information is corroborated in a Black Hat Asia 2014 presentation by Fortinet researcher Kyle Yang.


Input: CrowdStrike's report also briefly noted the use of an update server vector.


Input: Yang analyzed the malware's update config metadata and matched its format to the AhnLab Policy Center.


Input: To test its payload, Yang set up a server/client and executed the update through the server.


Input: As Yang had predicted, it wiped the client.


Input: While the method for initial compromise of the update server is not noted in detail, CrowdStrike's report cites'' collateral information'' that suggests targeted email attacks were used to gain initial entry, and policy servers were then compromised.

targeted email attacks

gain initial entry

policy servers

were used

were then compromised

to


Input: The upload server vector included a time-based logic bomb that allowed the wiper to target a large number of systems, on a set time and date, with full permissions on all of the targeted systems.

the wiper

a large number of systems

a set time and date

full permissions on all of the targeted systems

target

on

with


Input: According to CrowdStrike, the wiper malware was dropped on the systems as AgentBase.exe.

the wiper malware

the systems

AgentBase.exe

was dropped

on

as


Input: The wiper used the Windows utility'taskkill' to kill the processes pasvc.exe and clisvc.exe, which are the main processes for the Ahnlab and Hauri antivirus applications.

The wiper

the processes pasvc.exe and clisvc.exe

kill


Input: The wiper then performed system reconnaissance, gathering drive information and operating system version.

The wiper

system reconnaissance

drive information and operating system version

performed

gathering


Input: Depending on the OS used, the wiper recursively deleted files on the file system, deleting the Windows folder last.

the wiper

files on the file system

the Windows folder

deleted

deleting


Input: It then overwrote the MBR with the strings'' HASTATI'','' PRINCPES'','' PRINCIPES'', or'' PR! NCPES''.

It

the MBR

the strings'' HASTATI'','' PRINCPES'','' PRINCIPES'', or'' PR! NCPES''

overwrote

with


Input: While there are several variants of the wiper, all seem to have been used on the same date.


Input: It is unclear why multiple wiper variants with slightly differing behavior were used for the same campaign.


Input: One possible explanation is that multiple variants were used to minimize the operational damage to the mission in the case of an early detection of one of the variants.


Input: For example, if one wiper variant was compromised or detected by antivirus or IDS signatures, the other variants may have differed enough to remain undetected, still resulting in mission success.


Input: According to CrowdStrike, a third malware component downloaded an IRC RAT from various compromised websites.

a third malware component

an IRC RAT

various compromised websites

downloaded

from


Input: This RAT is detected by Symantec as Backdoor.Prioxer.

This RAT

Symantec

Backdoor.Prioxer

is detected

as


Input: Prioxer has been linked to other 2011 attacks on South Korea.


Input: It is unclear whether these downloaders were pushed out in the same update server vector as the wipers.


Input: However, the two malware types both use the same packer'Jokra' and both contain the strings'' HASTATI'' and'' PRINCPES''.


Input: Based on the information above, we have identified strategic challenges that impact the development of North Korea's cyber warfare capabilities.


Input: We have also noted relevant implications: • The North Korean regime strictly controls all Internet infrastructure, meaning cyber activity by dissidents or autonomous hacker groups are very unlikely.


Input: In other words, any cyber attacks originating in North Korea can be assumed to be state sponsored.


Input: For this reason, according to defectors, the regime's cyber operators do not typically launch attacks directly from within North Korea.


Input: Instead, many regime-sponsored attacks are launched from cells based in China, U.S., South Asia, Europe, and even South Korea.


Input: • North Korea has a limited number of outgoing connections.


Input: For this reason, there is a low probability of DDoS originating from within.


Input: However, this does not preclude the use of botnets with a local C2 server or the use of networks in third-party nations to launch attacks.


Input: As seen in the July 2009 attacks on South Korean and U.S. targets, North Korea has leveraged networks in countries such as Austria, Georgia, Germany, and even South Korea and the U.S., in order to launch cyber attacks.


Input: North Korea will likely be forced to rely on third parties for quite some time, due to its lack of sufficient infrastructure for launching large-scale CNO.


Input: • Several outward facing websites are hosted in China and other countries.


Input: This implies two possibilities: that North Korea's infrastructure can not handle a heavy incoming traffic load or that the regime wants to separate the propaganda crafted for an outside target audience from internally-focused propaganda.


Input: This arrangement seems unlikely to change in the foreseeable future.


Input: • North Korea is known to have unstable power supplies, which limits scalability of the regime's current CNO capabilities.


Input: This is another reason why expansion of CNO capabilities using the nation's own infrastructure seems unlikely in the foreseeable future.


Input: • North Korea is known to have monetary deficiencies, which further limit expansion of infrastructure and CNO capabilities, at least without third-party aid.


Input: North Korea continues to rely heavily on China for sustainment.


Input: • Although we see few instances of overt cyber operations, that North Korea reportedly spends so much of its limited resources on training and equipping cyber operators speaks volumes.


Input: The human element of the regime's cyber war program, at least, has potential.


Input: • Sanctions against North Korea and export laws prohibit the sale of certain technologies to the regime.


Input: In other words, in order to obtain the technology needed for a cyber warfare program, the regime must improvise.


Input: North Korea must develop its own technology, manufacture technology using plans obtained via industrial espionage, or rely on third parties to procure it for them.


Input: However, the regime has historically failed in its attempts of large-scale production of electronic components.


Input: At present, North Korea relies on China to provide much of its network hardware, including servers and routers.


Input: It is unlikely that North Korea will compromise on its nuclear program, meaning sanctions will likely be longstanding, and the regime will have to continue to rely on third parties to procure technology.


Input: Cyber incidents attributed to North Korean actors seem to follow distinct patterns:  According to reports by other researchers, the conventions and C2 structure used by North Korean cyber actors show continuity and consistency over time.


Input:  The majority of the incidents attributed to North Korean actors consistently used wiper malware.


Input:  Several of the incidents included defacements, with a different group taking credit each time.


Input: Additionally, little information or attack history was found about any of the groups, aside from information acknowledged in this report.


Input: These factors seem to indicate that a single group may have been responsible for several attacks over time, using different group names as a false flag.


Input:  On more than one occasion, the malware included provisions to disable security software made by South Korean security company AhnLab.


Input: This detail strengthens the case that the malware was written or modified to specifically target South Korean machines.


Input:  The attacks followed an explicit pattern: most were around the time of U.S.–South Korean joint military exercises, while the others fell on a significant date or were in response to political events.


Input:  The primary targets were South Korean and U.S. entities.


Input: While these nations are traditionally targeted by the regime, it is also possible that South Korean entities are quick to attribute any attack on their infrastructure to North Korean actors.


Input: In fact, in some cases, South Korean reports were the only source of attribution.


Input: Does North Korea have sufficient cyber infrastructure and cyber warfare capabilities to harm the U.S. and its allies? While North Korea's cyber warfare capabilities pale in comparison to those of wealthier nations, the regime has made significant progress in developing its infrastructure and in establishing cyber operations.


Input: The rate of this progress warrants a closer look at North Korea's motivations, TTPs, and capabilities.


Input: As noted above, North Korea views the U.S. and South Korea as its primary adversaries.


Input: The U.S. and South Korea are high-tech nations with economies that depend heavily on technology.


Input: In contrast, North Korea does not have a high tech culture.


Input: For these reasons, we should not overestimate the regime's advanced cyber capability, yet we should never underestimate the potential impact of North Korea utilizing less advanced, quick-and-dirty tactics like DDoS to cripple their high-tech targets.


Input: Both government and corporate entities are susceptible to being targeted by North Korean cyber attacks.


Input: North Korean juche ideology places the survival of the regime as its primary goal, and any perceived threat to the regime may be targeted.


Input: Several attacks on U.S. and South Korean government, financial, and critical infrastructure entities have been attributed to North Korean origins.. These attacks were often preceded by or occurred in conjunction with North Korea voicing negative sentiments about the targeted entities.


Input: As we saw with Iranian cyber actors in HPSR Security Briefing Episode 11, state sponsored cyber actors often launch an attack in response to a political trigger.


Input: The same pattern seems to apply to pro-North Korean cyber actors, who have launched attacks to coincide with U.S.


Input: Independence Day and the anniversary of the start of the Korean War, as well as propaganda and cyber attacks in response to joint military exercises between the U.S. and South Korea.


Input: As shown by North Korea's past behavior (which is consistent with their doctrine), they are easily'' pushed into a corner''.


Input: At the slightest perceived threat, the regime responds with saber-rattling and peacocking.


Input: The regime is extremely defensive and will, in turn, flex its muscles to show the world how capable it is, even if this is an inaccurate display of their overall capabilities.


Input: The regime fears losing its control and the nation's culture to the ever-growing threat of outside influence, as is evidenced in the regime's reaction to the comedy film'' The Interview''.


Input: The regime has represented itself to its citizens as a powerful and capable entity and has used this status to control the populace.


Input: For this reason, the regime's leaders are forced to continually demonstrate this strength and power, or an illusion thereof, both domestically and globally, in order to maintain the status needed to ensure continued suppression of the population.


Input: This show of power may require that the regime takes chances and stretches beyond its abilities at times, but in the spirit of juche and songun, the regime will continue this façade, fearful of losing the image its leaders have worked so hard to maintain.


Input: North Korean cyber operations are not generally observed originating from home field IP address space, so geo-IP based blocking of traffic originating from those net-blocks is ineffective.


Input: Given that North Korea has capable and technically trained forces and will demonstrate their power when they feel provoked, western entities should consciously avoid promoting ideas or doctrine that is blatantly slanderous to the regime.


Input: Encouraging such ideas could cause those entities to become a focal point for North Korean cyber attacks.


Input: Due to the fact that North Korean infrastructure is aging and its resources are not able to keep up with the rest of the world, entities with interesting R & D or IP (intellectual property)-especially military in nature–could become targets of interest for North Korea.


Input: Interest in defense-related IP and R & D could also stem from North Korea's relationship with China.


Input: In the Chinese business culture, taking another entity's IP or R & D is not stealing–it is accepted as business as usual.


Input: It is possible that North Korea, if under Chinese influence, would adopt the same attitude, given the regime's limited capacity for homegrown innovation.


Input: Known DPRK targets have been limited primarily to South Korean and U.S. organizations and government entities.


Input: For these targets, prudent measures should include: The dropper component that we examined was distributed as a UPX-packed binary.


Input: When executed it creates the following files in the affected user's% Temp% directory: After determining the location of user profile directories on the affected computer, the malware searches these directories for configuration files and directories that may be associated with the connection manager clients mRemote and SecureCRT.

the malware

these directories

configuration files and directories that may be associated with the connection manager clients mRemote and SecureCRT

searches

for


Input: • mRemote-an open source tool for centrally managing remote server connections using a GUI (Kevin Kline, 2008).


Input: This tool is no longer being actively developed or supported.


Input: • SecureCRT-a commercial SSH and Telnet client by VanDyke Software.


Input: If an mRemote installation is located, the dropper reads the configuration file and checks if there's a NODE that is defined with'' Username=root'','' Protocol=SSH'', and a password that is not blank.

the dropper

the configuration file

reads


Input: If those conditions are satisfied it extracts the information.

it

the information

extracts


Input: The password is decrypted after being extracted.


Input: If a SecureCRT installation is located, the dropper extracts information from sessions that have Username=root, Protocol=SSH and a saved password.

the dropper

information

sessions that have Username=root, Protocol=SSH and a saved password

extracts

from


Input: If these conditions are satisfied, the username, hostname, port, and password are extracted.


Input: The password is then decrypted.


Input: After extracting these connection and server details, the dropper uses the previously dropped alg.

the dropper


Input: exe and conime.exe to attempt to connect remote servers, upload and run the bash script ~pr1.tmp.

connect

upload

run

remote servers

the bash script ~pr1.tmp


Input: The bash script initially checks which UNIX it is running on (of HP-UX, SunOS, Linux, or AIX) and then attempts to wipe the /kernel, /usr /etc and /home directories, thus rendering the machine inoperative.

The bash script

UNIX

the /kernel, /usr /etc and /home directories

the machine inoperative

checks

wipe

rendering


Input: When the AgentBase.exe component is executed, it first attempts to stop the following processes, presumably in order to evade detection: It then enumerates all physical drives and overwrites the first 512 bytes with the string:'' princpes'', effectively destroying the MBR (master boot record) of the affected drive.

the AgentBase.exe component

it

the following processes

detection

It

all physical drives

the first 512 bytes

the string:'' princpes''

the MBR (master boot record) of the affected drive

is executed

stop

evade

enumerates

overwrites

destroying

with


Input: It continues to look for removable and fixed drives, locates the root directory on these drives, and then attempts to delete all files and folders in this directory.

It

removable and fixed drives

the root directory on these drives

all files and folders in this directory

look

locates

delete

for


Input: Finally, the affected computer is shut down and rebooted, although if the wiping mechanisms were successful then the machine will not be able to boot.

the affected computer

is shut down and rebooted


Input: After taking a look at recent Korplug (PlugX) detections, we identified two larger scale campaigns employing this well-known Remote Access Trojan.

two larger scale campaigns

this well-known Remote Access Trojan

employing


Input: This blog gives an overview of the first one, related to Afghanistan & Tajikistan.


Input: The other campaign, where the targets were a number of high-profile organizations in Russia, will be the subject of Anton Cherepanov's presentation at the ZeroNights security conference in Moscow this week.


Input: Sometimes malware used in various attacks is unique enough to identify related incidents, which makes tracking individual botnets simpler.


Input: An example is the BlackEnergy Lite variant (also known as BlackEnergy 3) used by a group of attackers (that was then given the name Quedagh, or Sandworm) against targets in Ukraine and other countries.


Input: BlackEnergy Lite is clearly distinguishable from the numerous binaries of the more common BlackEnergy 2 also circulating in-the-wild.


Input: In other cases, attackers use more common tools for accomplishing their criminal goals.


Input: For example, the Korplug RAT (a.k.a .PlugX) is a well-known toolkit associated with Chinese APT groups and used in a large number of targeted attacks since 2012.

the Korplug RAT (a.k.a .PlugX)

a large number of targeted attacks

used

in

since


Input: For the past several weeks we have taken a closer look at a great number of detections of this malware in many unrelated incidents.


Input: Among these, we were able to discover several successful infections where the employed Korplug samples were connecting to the same C & C domain.

the employed Korplug samples

the same C & C domain

were connecting

to


Input: Other Korplug samples were connecting to a different domain name resolving to the same IPs as notebookhk.net: Taking these C & Cs as a starting point, we were able to locate a number of victims infected through various exploit-laden spear-phishing documents and cunningly-named archives.

Other Korplug samples

a different domain name resolving to the same IPs as notebookhk.net

were connecting

to


Input: A table with a selection of RTF documents and RAR self-extracting archives with a .SCR


Input: extension is shown below: Some of the above-mentioned files also contained decoy documents: In all of the cases, three binary files were dropped (apart from decoy documents) that led to the Korplug trojan being loading into memory.

Some of the above-mentioned files

decoy documents

three binary files

the Korplug trojan

memory

contained

were dropped

being loading

into


Input: The Korplug RAT is known to use this side-loading trick by abusing legitimate digitally signed executables and is a way to stay under the radar, since a trusted application with a valid signature among startup items is less likely to raise suspicion.

The Korplug RAT

this side-loading trick

the radar

use

stay

under


Input: The maliciously crafted documents are RTF files that successfully exploit the CVE-2012-0158 vulnerability in Microsoft Word.

The maliciously crafted documents

the CVE-2012-0158 vulnerability in Microsoft Word

exploit


Input: The image below shows the beginning of the CVE-2012-0158 shellcode in ASCII encoding within the document (the opcodes 60, 55, 8bec disassemble to pusha; push ebp; mov ebp, esp).


Input: Interestingly, though, the documents also contain the newer CVE-2014-1761 exploit that was extensively used in targeted attacks carried out by a number other malware families this year (including BlackEnergy, Sednit, MiniDuke, and others).


Input: However, this exploit is not implemented correctly due to a wrong file offset in the 1st stage shellcode.


Input: Below we see the disassembly of the 1st stage shellcode where it checks the presence of the tag'' p! 11'' marking the beginning of the 2nd stage shellcode and loads it into memory.


Input: Even though the tag and 2nd stage shellcode is present in the RTF, it's at a different offset, and thus never is loaded.


Input: Sophos' Gabor Szappanos gives a possible explanation how these malformed samples may have come into existence.


Input: ESET LiveGrid telemetry indicates that the attacks against these targets have been going on since at least June 2014 and continue through today.


Input: We were able to pinpoint the targets to residents of the following countries: From the topics of the files used to spread the malware, as well as from the affected targets, it appears that the attackers are interested in gathering intelligence related to Afghan, Tajik and Russian military and diplomatic subjects.


Input: Interestingly, most of the affected victims have another thing in common–a number of other RATs, file stealing trojans or keyloggers were detected on their systems on top of the Korplug RAT detection.


Input: One of these'alternative RATs' was connecting to a domain also used by the Korplug samples.

One of these'alternative RATs'

a domain also used by the Korplug samples

was connecting

to


Input: Since the functionality of these tools was partly overlapping with that of Korplug, it left us wondering whether the attackers were just experimenting with different RATs or were they supplementing some functionality that they were unable to accomplish.


Input: Additional information about two malware families that were most often found accompanying Korplug infections is given below.


Input: A curious Remote Access Trojan, as research points to a Chinese connection but the commands it listens to are in Spanish (translation in English): The malware can manage processes and services on the infected machine, transfer files to and from the C & C server, run shell commands, and so on.

The malware

processes and services on the infected machine

files

the C & C server

shell commands

manage

transfer

run

to

from


Input: It is written in Delphi and connects to www.dicemention.com.

It

connects

to


Input: Some samples contain a digital signature by'' Nanning weiwu Technology co., ltd''.


Input: This malware, written in C, and contains several functions for harvesting files off the victim's hard drive according to criteria set in the configuration file.

This malware

files

the victim's hard drive

criteria set in the configuration file

harvesting

off

according to


Input: Apart from doing a recursive sweep of all logical fixed and remote drives, it also continually monitors any attached removable media or network shares by listening to DBTDEVICEARRIVAL events.

doing

monitors

a recursive sweep of all logical fixed and remote drives

it

attached removable media

network shares

listening to DBTDEVICEARRIVAL events

by


Input: In addition to collecting files, the malware attempts to gather saved passwords, history of visited URLs, account information and proxy information from the following applications: The C & C domains used by this malware are: Some samples of this file stealer detected in these campaigns also contain the signature by'' Nanning weiwu Technology co., ltd''–another indicator that the infections are related.

collecting

gather

detected

files

the malware

saved passwords

history of visited URLs

account information

proxy information

the following applications

Some samples of this file stealer

these campaigns

from

in


Input: APT3 (also known as UPS), the actors responsible for Operation Clandestine Fox has quietly continued to send waves of spearphishing messages over the past few months.

the actors responsible for Operation Clandestine Fox

waves of spearphishing messages

the past few months

send

over


Input: This actor initiated their most recent campaign on November 19, 2014 targeting multiple organizations.


Input: The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113.


Input: CVE-2014-6332 was disclosed publicly on 2014-11-11 and is a Windows OLE Automation Array Remote Code Execution vulnerability.

a Windows OLE Automation Array Remote Code Execution vulnerability

is


Input: CVE-2014- 4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14.

CVE-2014- 4113

a privilege escalation vulnerability

is


Input: The use of CVE-2014-6332 is notable, as it demonstrates that multiple classes of actors, both criminal and APT alike, have now incorporated this exploit into their toolkits.


Input: Further, the use of both of these two known vulnerabilities in tandem is notable for APT3.


Input: This actor is historically known for leveraging zero- day vulnerabilities in widespread but infrequent phishing campaigns.


Input: The use of known exploits and more frequent attacks may indicate both a shift in strategy and operational tempo for this group.


Input: The body of the message is below: One Month's Free Membership for The PLAYBOY ClUB 1080P HD VIDEOS 100,000 PHOTOS 4,000 MODELS Nude Celebrities, Playmates, Cybergirls & More! Click hxxp: //join.playboysplus.com/signup/ To Get a Free Plus Member Now & Never Miss Another Update.


Input: Your Member referrals must remain active.


Input: If anyone getting'' Promotion not available'' for 1 month free membership, you might get the issue up to 48 hrs once your membership is expired and make sure to Clear out cookies or use another browser or use another PC.


Input: The webpage contained both CVE-2014-6332 exploit code and a VBScript that invoked PowerShell on the affected users' system to download the below payload: The CVE-2014-6332 exploit code seen in this incident is derived from the code published at http: //www.exploit-db.com/exploits/35230/, which has also been incorporated in the Metasploit project.

a VBScript

the below payload

download


Input: After the exploit or script executes, the system downloads install.exe, which has the following metadata: The file install.exe attempts to write two files (doc.exe and test.exe) to the hard-coded path'' C: \Users\Public'', which fails on Windows XP because that path is not present by default.

the system

install.exe

The file install.exe

two files (doc.exe and test.exe)

the hard-coded path'' C: \Users\Public''

downloads

write

to


Input: The first dropped file, doc.exe, contains the CVE-2014-4113 exploit and then attempts to execute test.exe with the elevated privileges.

The first dropped file, doc.exe

the CVE-2014-4113 exploit

test.exe

the elevated privileges

contains

execute

with


Input: These files have the following metadata: These payload files also have interesting PDB debug strings.


Input: The most interesting PDB string is the'' 4113.pdb,'' which appears to reference CVE-2014-4113.


Input: This CVE is a local kernel vulnerability that, with successful exploitation, would give any user SYSTEM access on the machine.

This CVE

any user

SYSTEM access on the machine

give


Input: The malware component, test.exe, uses the Windows command'' cmd.exe'' /C whoami'' to verify it is running with the elevated privileges of'' System'' and creates persistence by creating the following scheduled task: When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913.

The malware component, test.exe

the Windows command'' cmd.exe'' /C whoami''

verify it is running with the elevated privileges of'' System''

persistence

creating the following scheduled task

the malware

a SOCKS5 connection

TCP port 1913

uses

creates

establishes

to

by

to

using


Input: The malware sends the SOCKS5 connection request'' 05 01 00'' and verifies the server response starts with'' 05 00''.

The malware

the SOCKS5 connection request'' 05 01 00''

the server response starts with'' 05 00''

sends

verifies


Input: The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command'' 05 01 00 01 c0 b8 3c e5 00 51'' and verifies that the first two bytes from the server are'' 05 00'' (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order).

The malware

a connection to 192.184.60.229 on TCP port 81

the command'' 05 01 00 01 c0 b8 3c e5 00 51''

the first two bytes from the server are'' 05 00''

requests

verifies

using

that


Input: Once the connection to the server is established, the malware expects a message containing at least three bytes from the server.

Once

the connection to the server is established

the malware

a message containing at least three bytes from the server

expects


Input: These first three bytes are the command identifier.


Input: The following commands are supported by the malware: On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment.

spearphishing messages containing a compressed executable attachment

sending

out


Input: The deflated exe was a variant of the same downloader described above and connected to 198.55.115.71 over port 1913 via SOCKS5 proxy.

The deflated exe

a variant of the same downloader described above

port 1913

SOCKS5 proxy

was

connected

to

over

via


Input: The secondary payload in that case was detected as Backdoor.APT.CookieCutter (aka Pirpi) and also named newnotepad.exe (MD5 8849538ef1c3471640230605c2623c67) and connected to the known APT3 domains: The 192.184.60.229 IP address seen in this current campaign also hosts securitywap [.

The secondary payload

Backdoor.APT.CookieCutter (aka Pirpi)

the known APT3 domains

was detected

connected

as

to


Input: ] com–another known domain referenced in our Operation Clandestine Fox blog.


Input: In addition, the join.playboysplus [.


Input: ] com exploit and payload delivery site resolves to 104.151.248.173.


Input: This IP has hosted other domains used by APT3 in past campaigns: As we discussed in our previous blog detailing previous APT3 activity, the walterclean [.] com served as a Plugx/Kaba command and control server.

the walterclean [.] com

a Plugx/Kaba command and control server

served

as


Input: Although APT3 is well known for employing zero-day exploits in their attacks, recent activity has demonstrated that they will also attack targets with known exploits or social engineering.

they

targets

known exploits or social engineering

attack

with


Input: Since Operation Clandestine Fox, we have observed this actor execute multiple attacks that did not rely on zero-day exploits.


Input: The combination of this sustained operational tempo and lack of zero-day exploits may indicate that this group has changed strategy and has decided to attack more frequently and does not have steady access to zero-day exploit code.


Input: No matter the strategy, this actor has shown an ability to operate successfully.


Input: IOCs for this threat can be found here.


Input: JustSystems has issued an update to its Ichitaro product line (Japanese office suite software), plugging a zero-day vulnerability.


Input: This vulnerability is being actively exploited in the wild to specifically target Japanese organizations.


Input: The exploit is sent to the targeted organizations through emails with a malicious Ichitaro document file attached, which Symantec products detect as Bloodhound.Exploit.557.

The exploit

the targeted organizations

emails with a malicious Ichitaro document file attached

is sent

to

through


Input: Payloads from the exploit may include Backdoor.Emdivi, Backdoor.Korplug, and Backdoor.ZXshell; however, all payloads aim to steal confidential information from the compromised computer.

Payloads from the exploit

Backdoor.Emdivi, Backdoor.Korplug, and Backdoor.ZXshell

all payloads

confidential information

the compromised computer

include

steal

from


Input: The content of the emails vary depending on the business interest of the targeted recipient's organization; however, all are about recent political events associated with Japan.


Input: Opening the malicious attachment with Ichitaro will drop the payload and display the document.

Opening the malicious attachment with Ichitaro

the payload

drop


Input: Often such exploitation attempts crash and then relaunch the document viewer to open a clean document in order to trick users into believing it is legitimate.


Input: In this particular attack, opening the document and dropping the payload are done without crashing Ichitaro and, as such, users have no visual indications as to what is really happening in the background.


Input: As Security Response previously discussed, unpatched vulnerabilities being exploited is nothing new for Ichitaro.


Input: However, during our investigation of this Ichitaro zero-day attack, we discovered that the attack was in fact part of an ongoing cyberespionage campaign specifically targeting various Japanese organizations.


Input: Symantec has named this attack campaign CloudyOmega.


Input: In this campaign, variants of Backdoor.Emdivi are persistently used as a payload.

variants of Backdoor.Emdivi

a payload

are persistently used

as


Input: All attacks arrive on the target computers as an attachment to email messages.

All attacks

the target computers

an attachment to email messages

arrive

on

as


Input: Mostly the attachments are in a simple executable format with a fake icon.

the attachments

a simple executable format

a fake icon

are

in

with


Input: However, some of the files exploit software vulnerabilities, and the aforementioned vulnerability in Ichitaro software is only one of them.


Input: This group's primary goal is to steal confidential information from targeted organizations.

This group

confidential information

targeted organizations

steal

from


Input: This blog provides insights into the history of the attack campaign, infection methods, malware payload, and the group carrying out the attacks.


Input: The first attack of the campaign can be traced back to at least 2011.


Input: Figure 1 shows the targeted sectors and the number of attacks carried out each year.


Input: The perpetrators were very cautious launching attacks in the early years with attacks beginning in earnest in 2014.


Input: By far, the public sector in Japan is the most targeted sector hit by Operation CloudyOmega.


Input: This provides some clue as to who the attack group is.


Input: Email is the predominant infection vector used in this campaign.


Input: Figure 2 is an example of an email used in recent attacks prior to those exploiting the Ichitaro zero-day vulnerability.


Input: The emails include password-protected .zip files containing the malware.

The emails

password-protected .zip files containing the malware

include


Input: Ironically, the attackers follow security best practices by indicating in the first email that the password will be sent to the recipient in a separate email.


Input: This is merely to trick the recipient into believing the email is from a legitimate and trustworthy source.

This

the recipient

believing the email is from a legitimate and trustworthy source

trick

into


Input: The body of the email is very short and claims the attachment includes a medical receipt.


Input: The email also requests that the recipient open the attachment on a Windows computer.

The email

the recipient open the attachment on a Windows computer

requests

that


Input: The file in the attachment has a Microsoft Word icon but, as indicated within Windows Explorer, it is an executable file.


Input: The malicious payload is Backdoor.Emdivi, a threat that opens a back door on the compromised computer.

The malicious payload

Backdoor.Emdivi

a threat

a back door

the compromised computer

is

opens

on


Input: The malware is exclusively used in the CloudyOmega attack campaign and first appeared in 2011 when it was used in an attack against a Japanese chemical company.


Input: Emdivi allows the remote attacker executing the commands to send the results back to the command-and-control (C & C) server through HTTP.

the remote attacker

the commands

the results

the command-and-control (C & C) server

HTTP

executing

send

back to

through


Input: Each Emdivi variant has a unique version number and belongs to one of two types: Type S and Type T.


Input: The unique version number is not only a clear sign that Emdivi is systematically managed, but it also acts as an encryption key.


Input: The malware adds extra words to the version number and then, based on this, generates a hash, which it uses as an encryption key.

The malware

a hash

it

an encryption key

generates

uses

as


Input: Both Emdivi Type S and Type T share the following functionality: Type T is primarily used in Operation CloudyOmega, has been in constant development since the campaign was first launched in 2011, and is written in the C++ programing language.


Input: Type T employs techniques to protect itself from security vendors or network administrators.

Type T

techniques

protect itself from security vendors or network administrators

employs

to


Input: Important parts of Type T, such as the C & C server address it contacts and its protection mechanisms, are encrypted.

Important parts of Type T, such as the C & C server address it contacts and its protection mechanisms

are encrypted


Input: Type T also detects the presence of automatic analysis systems or debuggers, such as the following: Type S, on the other hand, was used only twice in the attack campaign.

Type T

the presence of automatic analysis systems

debuggers

detects


Input: Type S is a .NET

Type S


Input: application based on the same source code and shared C & C infrastructure as Type T.

based

on

and shared C & C infrastructure as Type T


Input: However, protection mechanisms and encryption, essential features for threat survival, are not present in Type S. One interesting trait of Type S is that it uses Japanese sentences that seem to be randomly taken from the internet to change the file hash.


Input: For instance, in the example shown in Figure 4, it uses a sentence talking about the special theory of relativity.


Input: Once infected, Emdivi connects to hardcoded C & C servers using the HTTP protocol.

Emdivi

hardcoded C & C servers

the HTTP protocol

connects

to

using


Input: So far, a total of 50 unique domains have been identified from 58 Emdivi variants.


Input: Almost all websites used as C & C servers are compromised Japanese websites ranging from sites belonging to small businesses to personal blogs.


Input: We discovered that 40 out of the 50 compromised websites, spread across 13 IP addresses, are hosted on a single cloud-hosting service based in Japan.


Input: The compromised sites are hosted on various pieces of web server software, such as Apache and Microsoft Internet Information Services (IIS), and are on different website platforms.


Input: This indicates that the sites were not compromised through a vulnerability in a single software product or website platform.


Input: Instead, the attacker somehow penetrated the cloud service itself and turned the websites into C & C servers for Backdoor.Emdivi.

the attacker

the websites

C & C servers for Backdoor.Emdivi

turned

into


Input: The compromised cloud hosting company has been notified but, at the time of writing, has not replied.


Input: Symantec offers two IPS signatures that detect and block network communication between infected computers and the Emdivi C & C server: During our research, multiple samples related to this attack campaign were identified and allowed us to connect the dots, as it were, when it came to CloudyOmega's connections to other attack groups.


Input: In August 2012, the CloudyOmega attackers exploited the zero-day Adobe Flash Player and AIR'copyRawDataTo ()' Integer Overflow Vulnerability (CVE-2012-5054) in an attack against a high-profile organization in Japan.


Input: The attackers sent a Microsoft Word file containing a maliciously crafted SWF file that exploited the vulnerability.

The attackers

a Microsoft Word file containing a maliciously crafted SWF file that exploited the vulnerability

sent


Input: Once successfully exploited, the file installed Backdoor.Emdivi.

the file

Backdoor.Emdivi

installed


Input: As CVE- 2012-5054 was publicly disclosed in the same month, the attack utilized what was, at the time, a zero-day exploit.


Input: Interestingly, the Flash file that was used in an Emdivi attack in 2012 and the one used in the LadyBoyle attack in 2013 look very similar.


Input: Figure 6 shows the malformed SWF file executing LadyBoyle () code that attempts to exploit the Adobe Flash Player CVE-2013-0634 Remote Memory Corruption Vulnerability (CVE-2013-0634).


Input: The Flash file seems to have been created using the same framework used by the CloudyOmega group, but with a different exploit.


Input: Both attacks use a .doc


Input: file containing an Adobe Flash zero-day exploit that is used to install a back door.

an Adobe Flash zero-day exploit

a back door

install


Input: No other evidence connects these two different campaigns; however, as described previously in Symantec Security Response's Elderwood blog, it is strongly believed that a single parent organization has broken into a number of subgroups that each target a particular industry.


Input: In terms of the latest attack on Ichitaro, we collected a dozen samples of JTD files, all of which are exactly the same except for their payload.


Input: The parent organization, it would seem, supplied the zero-day exploit to the different subgroups as part of an attack toolkit and each group launched a separate attack using their chosen malware.


Input: This is why three different payloads (Backdoor.Emdivi, Backdoor.Korplug, and Backdoor.ZXshell) were observed in the latest zero-day attack.


Input: Operation CloudyOmega was launched by an attack group that has communication channels with other notorious attack groups including Hidden Lynx and the group responsible for LadyBoyle.


Input: CloudyOmega has been in operation since 2011 and is persistent in targeting Japanese organizations.


Input: With the latest attack employing a zero-day vulnerability, there is no indication that the group will stop their activities anytime soon.


Input: Symantec Security Response will be keeping a close eye on the CloudyOmega group.


Input: It is highly recommended that customers using Ichitaro products apply any patches as soon as possible.


Input: Symantec offers the following protection against attacks associated with Operation CloudyOmega:


Input: As the pro-democracy movement in Hong Kong has continued, we've been watching for indications of confrontation taking place in cyberspace.


Input: Protests began in September and have continued to escalate.


Input: In recent weeks, attackers have launched a series of Distributed Denial of Service attacks (DDoS) against websites promoting democracy in Hong Kong.

attackers

a series of Distributed Denial of Service attacks (DDoS)

websites promoting democracy in Hong Kong

launched

against


Input: According to the Wall Street Journal, websites belonging to Next Media's Apple Daily publication have suffered from an ongoing DDoS attack that'' brought down its email system for hours''.

websites belonging to Next Media's Apple Daily publication

an ongoing DDoS attack that'' brought down its email system for hours''

suffered

from


Input: According to other reports, Next Media's network has suffered a'' total failure'' as a result of these attacks.

Next Media's network

a'' total failure''

these attacks

suffered

as a result of


Input: Additionally, at least one member of the popular online forum HKGolden was arrested for posting messages encouraging support for the OccupyCentral Pro Democracy movement.


Input: The use of DDoS attacks as a political tool during times of conflict is not new; patriotic hacktivist groups frequently use them as a means to stifle political activity of which they disapprove.


Input: The question of state sponsorship (or at least tacit approval) in online crackdowns is often up for debate and ambiguous from a technical evidence and tradecraft perspective.


Input: In this case, however, we've discovered an overlap in the tools and infrastructure used by China-based advanced persistent threat (APT) actors and the DDoS attack activity.


Input: We believe that these DDoS attacks are linked to previously observed APT activity, including Operation Poisoned Hurricane.


Input: This correlation sheds light on the potential relationships, symbiosis and tool sharing between patriotic hacker activities designed to disrupt anti-government activists in China, and the APT activity we consistently see that is more IP theft and espionage-focused.


Input: FireEye has identified a number of binaries coded to receive instructions from a set of command and control (C2) servers instructing participating bots to attack Next Media-owned websites and the HKGolden forum.

a number of binaries

instructions

a set of command and control (C2) servers

participating bots

attack Next Media-owned websites and the HKGolden forum

receive

instructing

from

to


Input: Next Media is a large media company in Hong Kong and the HkGolden forum has been used as a platform to organize pro-democracy protests.


Input: Each sample we identified is signed with digital certificates that have also been used by APT actors to sign binaries in previous intrusion operations: These binaries are W32 Cabinet self-extracting files that drop a variant of an older DDoS tool known as KernelBot.

These binaries

a variant of an older DDoS tool known as KernelBot

drop


Input: All of the samples we identified have the'' NewVersion'' value of 20140926.


Input: Structurally, all of these samples are similar in that they drop three files: The KernelBot implants receive targeting instructions from C2 servers hard-coded directly into the sample.

they

three files

The KernelBot implants

targeting instructions

C2 servers hard-coded directly into the sample

drop

receive

from


Input: For example, c3d6450075d618b1edba17ee723eb3ca drops a KernelBot variant that connects to both www.sapporo-digital-photoclub [.] com and wakayamasatei [.] com.

a KernelBot variant

both www.sapporo-digital-photoclub [.] com and wakayamasatei [.] com

drops

connects

to


Input: The full list of C2 servers we identified is as follows: On Oct. 21, the control server at wakayamasatei [.


Input: ] com responded with the following encoded configuration file: This configuration file can be decoded by stripping the leading and trailing @$@characters.


Input: At this point, a simple base64 and XOR decode will reveal the plaintext configuration.


Input: The following snippet of python code can be used to decode this command: FireEye has observed two different single-byte XOR keys used to encode configuration files issued by the DDOS C2 servers in this campaign.

two different single-byte XOR keys

configuration files issued by the DDOS C2 servers in this campaign

encode


Input: The two different keys are 0x2A or 0x7E.


Input: The encoded configuration file shown above decodes to: During the course of our research, we've observed more than 30 different unique configuration files issued by the C2 servers listed above.

more than 30 different unique configuration files

the C2 servers listed above

issued


Input: These configurations issued commands to attack the following domains and IPs: All of the above IPs host Next Media or Apple daily websites, with the exception of 58.64.139.10 and 124.217.214.149.

These configurations

commands to attack the following domains and IPs

issued


Input: The IP 58.64.139.10 has hosted hkgolden [.


Input: ] com–the domain for the HKGolden forum mentioned above.


Input: For approximately 14 hours between October 23rd and 24th, the attackers pushed a configuration update to four controls servers that instructed bots under their control to flood 124.217.214.149 with UDP traffic.

the attackers

a configuration update

four controls servers

bots under their control

UDP traffic

pushed

instructed

flood

to

with


Input: The IP 124.217.214.149 hosted the attacker controlled domain p.java-sec [.


Input: ] com.


Input: On Oct. 23, 2014, two of the active controls began instructing participating bots to cease attacks.

two of the active controls

participating bots

cease attacks

instructing

to


Input: By Oct. 24, 2014, all five of the known active control servers were issuing commands to cease the attacks.

all five of the known active control servers

commands

cease the attacks

were issuing

to


Input: It should come as no surprise that hkgolden [.


Input: ] com, nextmedia [.


Input: ] com, and appledaily.com [.


Input: ] hk websites are now or previously have been blocked by the Great Firewall of China–indicating that the PRC has found the content hosted on these sites objectionable.


Input: The most direct connection between these DDoS attacks and previous APT activity is the use of the QTI International and CallTogether code signing certificates, which we have seen in malware attributed to APT activity.


Input: The QTI International digital certificate has been previously used to sign binaries used in APT activity including Operation Poisoned Hurricane.


Input: Specifically, 17bc9d2a640da75db6cbb66e5898feb1 is a PlugX variant signed by the QTI International certificate.


Input: This PlugX variant connected to a Google Code project at code.google [.] com/p/udom/, where it decoded a command that configured its C2 server.

This PlugX variant

a Google Code project at code.google [.] com/p/udom/

it

a command that configured its C2 server

connected

decoded

to


Input: The sample 0b54ae49fd5a841970b98a078968cb6b was signed with the QTI International certificate as well.


Input: This sample was first observed during a drive-by attack in June 2014, and was downloaded from java-se [.


Input: ] com/jp.jpg.


Input: This sample is detected as Backdoor.APT.Preshin and connected to luxscena [.] com for C2.

This sample

Backdoor.APT.Preshin

luxscena [.] com

is detected

connected

as

to

for


Input: The QTI International certificate was also used to sign e2a4b96cce9de4fb126cfd5f5c73c3ed.


Input: We detect this payload as Backdoor.APT.PISCES and it used hk.java-se [.] com for C2.

We

this payload

Backdoor.APT.PISCES

it

hk.java-se [.] com

detect

used

as

for


Input: The java-se [.


Input: ] com website was previously used in other attacks targeting the pro-democracy movement in Hong Kong.


Input: We first observed the presence of malicious javascript inserted into Hong Kong Association for Democracy and People's Livelihood on June 26, 2014, which appeared as the following: More recently, as noted by Claudio Guarnieri, the website of the Democratic Party of Hong Kong was seen hosting a redirect to the same malicious javascript.


Input: The CallTogether certificate has been used to sign ecf21054ab515946a812d1aa5c408ca5.


Input: We also detect this payload as Backdoor.APT.PISCES and observed it connect to u.java-se [.] com.

We

this payload

Backdoor.APT.PISCES

it

u.java-se [.] com

detect

connect

as

to


Input: Both of these certificates are valid but can be detected and blocked via the following Yara signatures: These ongoing DDoS attacks and previous APT intrusion activity both target the hkgolden [.] com website.

These ongoing DDoS attacks

the hkgolden [.] com website

target


Input: As noted above, this site has been targeted with a DDoS attack by a KernelBot network.

this site

a DDoS attack

a KernelBot network

been targeted

with


Input: We also found that the hkgolden [.


Input: ] com website was compromised on Sept. 5, 2014 and had a redirect to a malicious javascript again hosted at another jave-se [.


Input: ] com host, which appeared as follows: Finally, as noted above the IP 124.217.214.149 was seen hosting the domain p.java-sec [.


Input: ] com between Oct. 25, 2014 and Oct. 27, 2014.


Input: As Brandon Dixon noted here, the java-sec [.


Input: ] com domain is linked to the java- se [.


Input: ] com by shared hosting history at the following IP address: It is unclear why these actors would attack an IP address they were actively using.


Input: It's possible that the attackers wanted to test their botnet's capability by attacking an IP they were using to gather statistics on the size of the attack.


Input: It is also possible that the attackers simply made a mistake and accidentally issued commands to attack their own infrastructure.


Input: On Oct. 24, 2014, after attacking their own infrastructure, the attackers issued new instructions to their botnet that ceased all attacks.

the attackers

new instructions

their botnet

issued

to


Input: While not conclusive, the evidence presented above shows a link between confirmed APT activity and ongoing DDoS attacks that appear to be designed to silence the Pro Democracy movement in Hong Kong.


Input: The evidence does not conclusively prove that the same actors responsible for the DDoS attacks are also behind the observed intrusion activity discussed above–such as Operation Poisoned Hurricane.


Input: Rather, the evidence may indicate that a common quartermaster supports both the DDoS attacks and ongoing intrusion activity.


Input: In either scenario, there is a clear connection between the intrusion activity documented in Operation Poisoned Hurricane and the DDOS attacks documented here.


Input: While the tactics of these activities are very different from a technical perspective, each supports distinct political objectives.


Input: Operation Poisoned Hurricane's objective appeared to have in part been IP theft possibly for economic gain or other competitive advantages.


Input: In the DDOS attacks, the objective was to silence free speech and suppress the pro democracy movement in Hong Kong.


Input: The Chinese government is the entity most likely to be interested in achieving both of these objectives.


Input: This entry was posted in Threat Intelligence, Threat Research and tagged advanced malware, Cybersecurity, malware, zero-day by Ned Moran, Mike Oppenheim and Mike Scott.


Input: Bookmark the permalink.


Input: On September 24 2014, FireEye observed a new strategic web compromise (SWC) campaign that we believe is targeting non-profit organizations and non-governmental organizations (NGO) by hosting iframes on legitimate websites.


Input: The compromised websites contained an iframe to direct site visitors to a threat actor-controlled IP address that dropped a Poison Ivy remote access tool (RAT) onto victims' systems.

an iframe

site visitors

a threat actor-controlled IP address

a Poison Ivy remote access tool (RAT)

victims' systems

direct

dropped

to

onto


Input: FireEye has not yet attributed this activity though we have identified links to the Sunshop Digital Quartermaster, a collective of malware authors that supports multiple China-based advanced persistent threat (APT) groups.


Input: FireEye previously established detection measures for this threat activity, ensuring our clients were prepared for these intrusion attempts well in advance of threat actor implementation.


Input: On September 24, FireEye observed SWCs, likely conducted by a unitary threat group based on shared infrastructure and tools, on at least three different websites: an international non-profit organization that focuses on environmental advocacy, and two different NGOs that promote democracy and human rights.


Input: The group was able to compromise these websites and insert malicious iframes.

The group

these websites

malicious iframes

compromise

insert


Input: Figure 1 displays one of the iframes.


Input: The threat group obfuscated the iframe on two of the compromised websites.

The threat group

the iframe

two of the compromised websites

obfuscated

on


Input: The iframes on these websites directed visitors to Java exploits hosted at 103.27.108.45.

The iframes on these websites

visitors

Java exploits hosted at 103.27.108.45

directed

to


Input: In turn, these exploits downloaded and decoded a payload hosted at: hxxp: //103.27.108.45/img/js.php.

these exploits

a payload hosted at: hxxp: //103.27.108.45/img/js.php

downloaded


Input: A GET request to this URI returned the following content: The'bin' param shown in Figure 2 is decoded from ASCII into hex by the Java exploit.


Input: Once decoded, FireEye identified the payload as a Poison Ivy variant.


Input: It had the following properties: The backdoor also contained the below versioning info embedded in the RTVERSION of one of the PE resources: This versioning info attempted to masquerade as a Google Chrome file.

This versioning info

a Google Chrome file

masquerade

as


Input: However, the malware author misspelled multiple words when attempting to put in versioning information for this particular build.


Input: The Poison Ivy implant had the following configuration properties: The C2 domain quakegoogle.servequake [.] com resolved to 115.126.62.100 at the time of the SWCs.

The C2 domain quakegoogle.servequake [.] com

the time of the SWCs

resolved

to

at


Input: Other domains resolving to the same IP include the following: Between August 30, 2014 and September 16, 2014 we also observed SOGU (aka Kaba) callback traffic sent to assign.ddnsking.com over port 443.

SOGU (aka Kaba) callback traffic

assign.ddnsking.com

port 443

sent

to

over


Input: The Poison Ivy backdoor also had a RTMANIFEST PE resource with a SHA256 fingerprint of 82a98c88d3dd57a6ebc0fe7167a86875ed52ebddc6374ad640407efec01b1393.


Input: This same RTMANIFEST resource was documented in our previous Sunshop Digital Quartermaster report.


Input: FireEye previously identified this specific RTMANIFEST as the'Sunshop Manifest,' and we have observed this same manifest resource used in 86 other samples.


Input: As we stated in the Quartermaster report, we believe this shared resource is an artifact of a builder toolkit made available to a number of China- based APT groups.


Input: This activity represents a new SWC campaign.


Input: We suspect threat actors are leveraging their access to compromised websites belonging to NGOs and non-profits to target other organizations in the same industries.


Input: These websites are often visited by organization employees and other organizations in the same industries, allowing threat actors to move laterally within already compromised networks or gain access to new networks.


Input: While FireEye has not attributed this activity to a specific threat group, we frequently observe China-based threat actors target non-profits and NGOs, and we suspect that they seek to monitor activity within their borders that may lead to domestic unrest or embarrass the Chinese government.


Input: For example, in 2013, FireEye observed China-based threat actors steal grant applications and activity reports specifically related to an international NGO's China-based activities.


Input: We suspects threat actors sought to monitor these programs and involved individuals.


Input: The three organizations whose websites are hosting the malicious iframes have China-based operations.


Input: FireEye is releasing information on this campaign to allow organizations to investigate and prepare for this activity in their networks.


Input: We believe non-profits and NGOs remain at elevated risk of intrusion and should be especially wary of attempts to compromise their networks using SWC.


Input: Threat actors may use SWCs to achieve this goal, but FireEye does not discount the possibility that threat actors will use other means at their disposal, including phishing.


Input: Based on past threat actor activity in this industry, FireEye expects threat actors are motivated to steal programmatic data and monitor organizations' programs in specific countries.


Input: If China-based threat actors are behind the observed campaign, FireEye expects that organizations with operations in China are high-priority targets.


Input: FireEye currently has detection measures in place that should allow users of FireEye products to detect this SWC activity.


Input: It is also likely that other industries or organizations were affected by this SWC activity, since these sites are public facing and frequently visited.


Input: Special thanks to Google's Billy Leonard for providing additional information and research.


Input: Thanks to the following authors for their contributions: Mike Oppenheim, Ned Moran, and Steve Stone.


Input: This entry was posted in Threat Intelligence, Threat Research by Sarah Engle and Ben Withnell.


Input: Bookmark the permalink.


Input: Hikit consists of at least two generations of malware that provides basic RAT functionality.

at least two generations of malware

basic RAT functionality

provides


Input: The first generation of Hikit (referred to as'' Gen 1'') operates as a server and requires an externally exposed network interface in order for an attacker to access the victim machine.

The first generation of Hikit (referred to as'' Gen 1'')

a server

an attacker

the victim machine

operates

access

as


Input: The second generation of Hikit (referred to as'' Gen 2'') uses the more traditional client model and beacons out to an attacker's C2 server.

The second generation of Hikit (referred to as'' Gen 2'')

an attacker's C2 server

beacons

out to


Input: While the communication models shifted dramatically between Gen 1 and Gen 2, both generations of Hikit retain the same basic RAT function consisting of remote command shell, file management, network proxy and port forwarding.

both generations of Hikit

the same basic RAT function consisting of remote command shell, file management, network proxy and port forwarding

retain


Input: Both Gen 1 and Gen 2 sub-families of Hikit consist of a main DLL (referred to as'' the DLL'') that contains the RAT functionality; a kernel driver (referred to as'' the Driver'') with Gen 2 also employs an additional component: a loader executable.

a main DLL (referred to as'' the DLL'')

the RAT functionality

contains


Input: The driver component of Gen 1 and Gen 2 are drastically different in their operation and intent.


Input: For the Gen 1 sub-family of Hikit, the driver acts as a NDIS (network) driver that is responsible for interfacing the DLL to the network while preventing a direct WinSock interface from occurring.


Input: The Gen 1 Driver listens to network traffic arriving at the local network interface and waits for a specific trigger string.

The Gen 1 Driver

network traffic arriving at the local network interface

listens

to


Input: The trigger string varies by Driver and DLL sample.


Input: The Gen 2 Driver is a simpler system driver that acts as a rootkit to hide processes, registry keys and network connections associated with Gen 2 activity on the victim's system.

The Gen 2 Driver

processes, registry keys and network connections associated with Gen 2 activity on the victim's system

hide


Input: Gen 2 uses a standard client-server malware model meaning that the malware no longer requires a direct Internet-facing network card, no longer uses a network driver for networking, and provides the ability to network multiple Gen 2 samples behind a firewall with greater ease (from the attacker's perspective).


Input: The Gen 2 sub-family, however, no longer employs network stealth provided by the Gen 1 network driver which exposes the C2 server addresses to analysts.


Input: Each of the Hikit generations contains multiple sub-generations as the author (s) of Hikit have evolved their code over time.


Input: There is a noticeable steep improvement over the code base of Gen 1 Hikit family during its 2011 development period.


Input: The Gen 2 sub-generations share a similar improvement scale between late 2011 and late 2013.


Input: The earliest known Hikit sample dates back to 31 March 2011.


Input: Known as the Gen 1.0 sub-generation of Hikit Gen 1, the first known sample of Hikit deviated from the later traditional Gen 1 model.


Input: The Gen 1.0 sample was a standalone executable whereas subsequent Gen 1 sub-generations use a DLL running as a service.


Input: The Gen 1.0 sample is clearly a work-in-progress.


Input: The Gen 1.0 sample, while different than subsequent sub-generations, does still rely on the Driver component and for the most part the structure of the code does not differ much going forward into the Gen 1 evolution.


Input: Less than three weeks after Gen 1.0, the author (s) of Hikit move into Gen 1.1.


Input: The notable change is that the Hikit model of using a DLL and driver, which has remained until present day, comes into being.


Input: The code matures slightly between Gen 1.0 and Gen 1.1 but the functionality does not change.


Input: Both Gen 1.0 and Gen 1.1 use plaintext data transmissions.


Input: Development appears to halt on Gen 1 for 4 months between 20 June 2011 and 23 October 2011 based on a lack of available samples found.


Input: During this time the development of Hikit appears to change locations.


Input: Gen 1 samples have Program Database (PDB) file strings that identify the file path of the Hikit source code.


Input: For Gen 1.0 and Gen 1.1 samples, the file path of the Hikit source code is consistently h: \JmVodServer\hikit.


Input: Starting with Gen 1.2, the file path switches to e: \SourceCode\hikitnew.


Input: It is at this time that the functionality of Hikit Gen 1 begins to mature.


Input: In Gen 1.2, the communication between the infected machine and the attacker is encrypted using an XOR mask.

the communication between the infected machine and the attacker

an XOR mask

is encrypted

using


Input: A more subtle change is the renaming of the'' socks5'' command to simply'' proxy'' within the code.


Input: The code within Hikit begins to mature but the overall functionality does not expand beyond the original set of commands found in Gen 1.0.


Input: The other remarkable change within the Gen 1.1 to Gen 1.2 development is the way in which the session handshake trigger operates.


Input: In Gen 1.0 and Gen 1.1, the DLL instructs the Driver to listen for a specific string (typically a HTTP request string) and responds with another string.


Input: In Gen 1.2, the Driver has a hardcoded trigger string (a specific HTTP request string) and the DLL instructs the Driver to inspect a specific HTTP header field for a specific hexadecimal value.


Input: This moves Gen 1.2 into more of a username/password authentication scheme whereas previous sub-generations could potentially be accessed by accidental HTTP requests.


Input: At the same time, the Driver responds with a specific value with in the Etag HTTP header field.


Input: This places Gen 1.2 into a more stealth position as a random, non-HTTP compliant response from Gen 1.0 and Gen 1.1 samples is more obvious than a legitimate HTTP response with a specially crafted Etag header.


Input: Gen 1.2's development cycle appears to exist between 23 October 2011 and 2 November 2011 with several new samples being found on the Internet having legitimate compile times during this time window.


Input: There is, however, evidence that the development of Hikit Gen 1 and Gen 2 overlap by several months.


Input: The earliest Gen 2 sample known to exist dates to 28 August 2011, two months before the first known Gen 1.2 sample.


Input: The last known Gen 1.2 sample, and by extension, the last known Gen 1 sample, dates to 9 April 2012.


Input: The first known Gen 2 sub-generation, Gen 2.0 Alpha, much like Gen 1.0, represents an early development version of the Gen 2 Hikit sub-family.


Input: Gen 2.0 Alpha is a stand-alone Windows console executable that can run as a service executable.


Input: Gen 2.0 Alpha supports the same commands as Gen 1.2 with an additional command that returns the infection's configuration information.


Input: On 9 February 2012 the first known sample for Gen 2.0 Beta is compiled by the developer (s) of Hikit.


Input: Also a stand-alone console executable like Gen 2.0 Alpha, the Gen 2.0 Beta code changes internally without providing significant functionality improvements with the exception of now the executable uses a device driver to hide network, file, and registry artifacts related to its operation.


Input: Both Gen 2.0 Alpha and Gen 2.0 Beta still retain PDB file path information within their binaries.


Input: During the development phase of Gen 2.0 Alpha, development of the Gen 2.0 Alpha variants changes locations.


Input: First version of the Gen 2.0 Alpha malware, from 28 August 2011, has the PDB path located in H: \JmVodServer\Matrixnew2 whereas the file path for later Gen 2.0 Alpha and Gen 2.0 Beta binaries has the PDB path in E: \SourceCode\Matrixnew which suggests that the source code for both Gen 1 and Gen 2 existed on the same machine and moved at roughly the same time.


Input: This may indicate either a single developer or a team (or set of teams) with shared resources.


Input: The first known Gen 2.1 binary has a compile date of 17 April 2012.


Input: Gen 2.1 represents the first Gen 2 sub-generation to use an executable-based loader, DLL and driver model, a model that all subsequent Gen 2 sub-generations employ.


Input: The functionality of the Gen 2.1 sub-generation is the same as the previous generations with no new commands being introduced.


Input: Gen 2.1 is the first sub-generation in the Gen 2 sub-family to introduce 64-bit binaries.


Input: The Gen 2.2 sub-generation appears to have begun on 20 July 2012.


Input: Gen 2.2 is notable for altering where the configuration information of the RAT is stored and using both DLL-based and executable- based loaders.


Input: Also notable is the fact that the sub-generation spans a significant amount of time with intermittent periods of development.


Input: The bulk of the Gen 2.2 samples that have the tell-tale marks of being the product of a builder have a compile date of 26 July 2013, a full year after the first known Gen 2.2 sample.


Input: Between 21 July 2012 and 20 February 2013, there are no known Gen 2.2 binaries.


Input: The two 20 July 2012 samples have different compile times indicating they were not the product of a builder but rather unique compilations.


Input: Between 21 February 2013 and 27 February 2013, there are 4 unique compilation dates for the DLL component with 7 unique, known Gen 2.2 DLLs.


Input: The bulk of Gen 2.2 samples have a compile date of 26 July 2013.


Input: There are approximately 25 known Gen 2.2 DLLs with the 26 July 2013 compile date.


Input: The Gen 2.2 sub-generation appears to exist through at least 19 September 2013.


Input: The last known Gen 2 sub-generation, Gen 2.3, began on 12 December 2013.


Input: Gen 2.3 is notable for its use of a legitimate SSL certificate as part of the handshake between the infected machine and the attacker's C2.


Input: The DLL will send a legitimate SSL certificate as a means to disrupt heuristic IDS sensors that look for encrypted traffic.

The DLL

a legitimate SSL certificate

a means to disrupt heuristic IDS sensors that look for encrypted traffic

send

as


Input: Another interesting aspect of the Gen 2.3 sub-generation is that there is no longer a marker to designate the beginning of the embedded configuration.


Input: Gen 2.1 and Gen 2.2 uses a specific string to indicate the beginning of the embedded configuration presumably in order to allow the builder to locate the configuration space when constructing a new configuration for the binaries.


Input: Gen 2.3, however, uses a specific location instead, requiring the builder to calculate the specific location using the PE/COFF header of the binary.


Input: Also, while Gen 2.1 and Gen 2.2 retain the configuration within the DLL component, Gen 2.3 stores the configuration within the loader component.


Input: This allows the attackers to configure the loader without having to update the DLL.


Input: The evolution of Hikit is a long and drawn out series of small, incremental development changes.


Input: The important take away from the evolution of Hikit is that the developers for Gen 1 appear to have changed in late 2011 and development of Gen 2 has a several month overlap with the development and usage of Gen 1.


Input: The following table provides a quick reference to the generational (and sub-generational) designations of Hikit.


Input: The Driver component for Hikit varies based on the specific Hikit sub-family (Gen 1 or Gen 2).


Input: As such it is necessary to describe each in the context of its specific sub-family.


Input: The Driver component of Gen 1 Hikit variants provides the interface between the victim's network interface card (NIC) and the DLL.


Input: The Driver is a NDIS (network) driver that integrates into the victim's network stack.


Input: The Driver intercepts any and all network communication that traverses the Windows network stack and potentially removes the data from the network stack under very specific conditions.

The Driver

any and all network communication that traverses the Windows network stack

intercepts


Input: When the Driver removes data from the network stack, the Driver stores the removed data in local buffers for the Gen 1 DLL to query against.


Input: The purpose of this behavior is to allow the DLL to interact with the network without utilizes the WinSock API which could potentially reveal the presence of Hikit.

the DLL

the network

utilizes the WinSock API which could potentially reveal the presence of Hikit

interact

with

without


Input: In order to interact with the Driver, the DLL uses the function The Driver will remove data from the network stack only if a new channel is being established.


Input: A new channel occurs when the Driver detects a trigger string.


Input: The trigger string is typically a short form HTTP request with the following trigger strings found in the wild: Up to and including Gen 1.1 Drivers required the DLL to specify the trigger string in addition to the authentication value whereas Gen 1.2 Drivers had the trigger strings hardcoded.


Input: In Gen 1.2, whenever the Driver detects a trigger string, the Driver inspects the rest of the data received for the authentication value.


Input: If the token follows the trigger string (there is no specific limitation on how far from the trigger string the password token must be), then the Driver generates a new channel that the DLL will use as the conduit between the DLL and the client.


Input: The Driver appears to be based off the NDIS example source code PassThru.


Input: More specifically, the author (s) of the Driver appear to have used the modified version of the PassThru example, PassThruEx, by James Antognini and Thomas Devine from a 2003 blog post.


Input: The Gen 2 sub-family, beginning with Gen 2.0 Beta, employs a Windows device driver ('' the Driver'') to hide aspects of the DLL's functionality from normal system processes.

The Gen 2 sub-family, beginning with Gen 2.0 Beta

a Windows device driver ('' the Driver'')

hide aspects of the DLL's functionality from normal system processes

employs

to


Input: The Driver is a relatively straightforward piece of software.


Input: It does not attempt to obfuscate its functionality from static analysis and it hooks a minimum number of kernel API functions in order to hide different pieces of information.

it

a minimum number of kernel API functions

hide different pieces of information

hooks

in order to


Input: The Driver is based primarily on the open source Agony rootkit and it has evidence of some portions of the code coming directly from a Chinese blog.


Input: The Driver expose an IOCTL interface that supports the following OIDs: The Driver is capable of hiding processes (by PID, not name), system modules, services, network connections, listening ports, directories (and by extension, files), as well as registry keys and values.

The Driver

processes

system modules

services

network connections

listening ports

directories

files

registry keys and values

hiding


Input: In order to hide these items, the Driver hooks various Windows Kernel API calls.

In order to

hide these items

the Driver

various Windows Kernel API calls

hooks


Input: The following table maps the items the Driver can hide to the API function that the Driver hooks: In order to hide services, the Driver will access the memory of the services.exe process, locate the linked list of services and remove the service entry that the Driver wishes to hide.

the items

the Driver

the API function

the Driver

services

the Driver

the memory of the services.exe process

the service entry that the Driver wishes to hide

hide

hooks

hide

access

remove


Input: This is a surprisingly invasive method to obfuscate a process.

obfuscate

a process


Input: Upon activation, the Driver will expose its interface by calling IoCreateDevice with the name \Device\agony (for Gen 2.0 Beta samples), \Device\HTTPS (for Gen 2.1 samples), \Device\advcachemgr (for Gen 2.2 samples) or \Device\diskdump (for Gen 2.3 samples).

the Driver

IoCreateDevice

the name \Device\agony (for Gen 2.0 Beta samples), \Device\HTTPS (for Gen 2.1 samples), \Device\advcachemgr (for Gen 2.2 samples) or \Device\diskdump (for Gen 2.3 samples)

calling

with


Input: The Driver also creates a symbolic link to the device using the same name but under the \DosDevices\ tree.

The Driver

a symbolic link

the device

the same name but under the \DosDevices\ tree

creates

to

using


Input: For reasons unknown, the authors of the Driver used code from a Chinese blog that details how to hide network connections on Windows Vista and later decided to keep the example IP address within the code.


Input: The Hikit family has supported roughly the same set of commands since the first known samples of Gen 1.0.

The Hikit family

roughly the same set of commands

the first known samples of Gen 1.0

supported

since


Input: Gen 2.0 introduced a single command to provide insight into an infected machine's Hikit configuration (something that is not necessary for Gen 1 variants since they are server-based).


Input: The RAT supports the following commands: The shell command activates a remote shell on the victim's computer.

The RAT

the following commands

The shell command

a remote shell

the victim's computer

supports

activates

on


Input: The remote shell function uses the standard pipe redirection method for interfacing a network application (in this case, the DLL) to a hidden command shell.


Input: The file command provides an attacker with a variety of disk access options such as listing directories, changing the current directory, and uploading and downloading files.

The file command

directories

files

listing

uploading

downloading


Input: The connect function provides the functionality to allow one Hikit DLL to interface with another DLL of a similar version.


Input: The use of this functionality can best be illustrated by considering the fact that the Gen 1 Driver requires an exposed network interface in order for an external attacker to access the Gen 1's RAT function.


Input: This would prohibit lateral movement within a victim's network as the bulk of any organization's network infrastructure is not directly exposed to the Internet.


Input: By using the connect command, an attacker can instruct the externally exposed Gen 1 DLL to route traffic to a Gen 1 DLL that is behind the firewall, effectively making the externally exposed Gen 1 DLL a local router for Hikit traffic.


Input: The proxy (or socks5) command allows an attacker to utilize a Hikit-infected machine as a proxy.

an attacker

a Hikit-infected machine

a proxy

utilize

as


Input: Gen 2 samples rely on a configuration in order to know where the C2 server exists along with other operational aspects such as the name of its service and operational times.

Gen 2 samples

a configuration

know where the C2 server exists

rely

on

in order to


Input: This information is important for the attacker to have access to in order to determine if any aspect of the configuration is out of date (thus requiring a new variant of the Gen 2 binary to be configured and deployed).


Input: The information command returns to the attacker the complete configuration and current state of the Gen 2 malware.


Input: As the name implies, the exit command causes the DLL to discontinue the current connection.


Input: With the Gen 1 sub-family using a server model and the Gen 2 sub-family using the client model, understanding how each of the DLL components of the sub-families works is best done, as with the Driver above, in the context of the specific sub-family.


Input: As noted previously in this report, the Gen 1 sub-family has several sub-generations but overall the functionality of the Gen 1 sub-family has remained constant.


Input: With the exception of Gen 1.0, the functionality of Gen 1 comes from the DLL component (Gen 1.0 uses a stand-alone executable to achieve the same results).


Input: The DLL operates as a service, requiring an attacker is install the DLL as a service at some point prior to activation.

an attacker

the DLL

a service

some point prior to activation

is install

as

at


Input: The DLL contains only two exports: DllEntryPoint and DllRegisterServer.


Input: Ultimately, both exports generate a new thread of the same function ('' mainThread'').

both exports

a new thread of the same function ('' mainThread'')

generate


Input: The difference between the two exports is that DllRegisterServer can take an optional command line argument of the letter'' u'' which will instruct the main thread to uninstall the Gen 1 system from a victim's computer.

the main thread

the Gen 1 system

a victim's computer

uninstall

from


Input: If the uninstall argument exists, mainThread will simply remove the Driver from the victim's machine and terminate.

mainThread

the Driver

the victim's machine

remove

from


Input: The authors of Gen 1 used freely available source code found online for their removal function.


Input: When the DLL activates, either by a call to DllEntryPoint or by calling DllRegisterServer without the u parameter, mainThread begins by verifying the version of the Driver installed on the victim's machine.

calling

DllRegisterServer

the u parameter

without


Input: This requires sending OID 0x12C850 to the Driver and comparing the resulting 32-bit value with the required driver version.


Input: If the version is incorrect (i.e.


Input: it doesn't match the specified version), the DLL installs the version of the Driver found within the DLL's resource section (under the BIN resource tree).

the DLL

the version of the Driver found within the DLL's resource section (under the BIN resource tree)

installs


Input: With the Driver version verified (or forcibly corrected by installing the appropriate Driver), the DLL will instruct the Driver to use a specified string (for Gen 1.0 and Gen 1.1 samples) or a DWORD (for Gen 1.2 samples) as the acknowledgment value to send to a connecting client who requests the appropriate URL.

installing

the appropriate Driver


Input: The DLL again checks the version of the Driver and, in some versions of the DLL, will print a message indicating the version of the Driver installed and report the'' Transate version'' (the word translate is misspelled within the binary).


Input: It appears that the Driver and the communication protocol version do not necessarily have to match exactly, allowing the possibility that the Driver and the DLL could be compiled at separate times.


Input: If the Driver version is less than the'' Transate'' version (indicating that the Driver is a version too old to support the necessary communication protocols), the DLL will, in some version of the DLL, print out a line to the screen indicating the DRIVERMINVERSION required along with the current Driver version.


Input: Following this, the DLL will then attempt to install the correct version of the Driver prior to terminating.

the DLL

the correct version of the Driver

terminating

install

prior to


Input: It is unclear why this code exists given that the DLL will check the Driver version and correct the Driver if necessary prior to reaching the portion of the code that reports the DRIVERMINVERSION.


Input: It is possible that the second Driver version check is a last ditch effort to ensure the correct Driver is installed.

the second Driver version check

the correct Driver is installed

ensure


Input: The DLL enters an infinite loop where the DLL waits for the Driver to report a new channel exists.


Input: A channel represents an established connection between the Driver and an external party that has provided the proper initial request and, for Gen 1.2 variants, provided the proper authentication value.


Input: When the Driver establishes a new channel, the DLL generates a runtime data structure before generating a new thread ('' HikitThreadFunc'') which will service any request coming from the new channel.

the DLL

a new thread ('' HikitThreadFunc'') which will service any request coming from the new channel

generating


Input: This allows the DLL to service multiple channels at one time.


Input: The HikitThreadFunc function is, at its core, a simple wait and respond loop.


Input: The function begins by transmitting a Hikit command prompt to the client (Hikit >) before settling into an infinite loop of The communication scheme between the DLL and the client consists of a 20 to 24 byte header (for Gen 1.0 and Gen 1.1) or a 28 byte header (for Gen 1.2) followed by an optional payload.


Input: The format of the Gen 1.0 and Gen 1.1 header is as follows: While the Gen 1.2 header is: For Gen 1.0 and Gen 1.1 samples, the magic field contains the string'' ..


Input: '' (two dots followed by a space then two more dots).


Input: Whereas the key field in Gen 1.2 samples contains a 32-bit value that represents the XOR key for the remainder of the PacketHeader and any additional payload data.


Input: The XOR scheme works on 32-bit chunks of data where each 32-bit chunk of data is XOR'd against the key value.


Input: Version checking is important in all Gen 1 variants.


Input: The dwHikitVersion field allows the client and the DLL to ensure that they have a compatible communication scheme in place prior to executing commands.

The dwHikitVersion field

the client and the DLL

ensure that they have a compatible communication scheme in place

executing commands

allows

to

prior to


Input: Gen 1 samples have a particular interest in the victim's locale language preferences.


Input: While it is typical for most RATs that provide remote shells to simply pass data unfiltered from client to server and server to client without regard to code pages, Gen 1 samples take special care to record the code page and locale information in each and every packet header that traverses the divide between client and server and server and client.


Input: This could indicate that the authors of Gen 1 understood from an early stage in the development of Gen 1 that they would be attacking computer systems with different locales and code pages.


Input: The Gen 2 sub-family, like Gen 1.2, uses a DLL for the core of its RAT functionality.

The Gen 2 sub-family

a DLL

the core of its RAT functionality

uses

for


Input: In order for the DLL to load, Gen 2 (starting with Gen 2.1) uses a loader application (referred to simply as'' the Loader'').

In order for

the DLL to load

Gen 2

a loader application

uses


Input: The Loader comes in the form of a standard executable image or a DLL image.


Input: Despite the different models, both variants of the Loader load the embedded DLL in the exact same way.

both variants of the Loader

the embedded DLL

the exact same way

load

in


Input: The only difference between the executable and DLL versions of the Loader comes in how they handle the initialization of the embedded DLL.


Input: Figure 1 provides a side by side comparison of the startup routines for the executable and DLL Loaders.


Input: Both versions of the Loader begin by loading the embedded DLL from the Loader's resources (item 102 under the Group Icons resource tree), decrypting and decompressing the image into memory, then manually loading the DLL into memory using a custom loading routine.

Both versions of the Loader

the embedded DLL

the Loader's resources

the DLL

memory

a custom loading routine

loading

loading

from

into

using


Input: The function LoadEmbeddedImage, as seen in part in Figure 2, is responsible for this operation.


Input: The Loader obfuscates many strings by using a simple XOR encoding scheme.


Input: Decryption of encoded strings consists of taking the first value of the string as the XOR key, XOR'ing all subsequent bytes until the result of the XOR returns 0.


Input: The decoding of the encoded strings is handled by the DecodeString function.


Input: The Loader stores the embedded DLL within a Group Icon resource within a legitimate icon image.


Input: In order to locate the embedded DLL, LoadEmbeddedImage will use the DecodeString function to decrypt the delimiter string (which is typically zzzzzzzzzz or yyyyyyyyyy) and then search the icon's resource memory for the delimiter string.


Input: Once located, LoadEmbeddedImage will use the first 12 bytes immediately after the string as the information structure about the embedded DLL.


Input: The structure (seen below) defines the size of the embedded DLL within the icon's resource memory, the size of the DLL after it is decompressed and a 4-byte XOR key that LoadEmbeddedImage must use to decode the embedded DLL prior to decompression.


Input: LoadEmbeddedImage copies the compressed embedded DLL into a newly allocated heap buffer and then calls the function decodeBuffer (using the EncodingKey value) to decrypt the embedded DLL.

LoadEmbeddedImage

the compressed embedded DLL

a newly allocated heap buffer

the function decodeBuffer (using the EncodingKey value)

decrypt the embedded DLL

copies

calls

into

to


Input: Another heap buffer is allocated with a size equal to the value of dwImageSizeDecompressed.


Input: The decompression buffer along with the now decoded compressed buffer are given to lzodecompress which decompresses the compressed image using the LZO1X algorithm.


Input: With the embedded DLL now decompressed into a heap buffer, LoadEmbeddedImage calls ImageLoaderData: :LoadDll to manually load the DLL into memory.

LoadEmbeddedImage

ImageLoaderData: :LoadDll

the DLL

memory

calls

load

into


Input: ImageLoaderData: :LoadDll interprets the PE/COFF header of the DLL image, loads the image into the appropriate memory configuration, performs the necessary relocation operations, and calls the DllMain (DLL's entry point) function.

ImageLoaderData: :LoadDll

the image

the appropriate memory configuration

the DllMain (DLL's entry point) function

loads

calls

into


Input: After loading the embedded DLL image into memory, the Loader will either call the DLL's StartServer or MatrixMain function depending on the type of Loader.

loading

call

the embedded DLL image

memory

the Loader

the DLL's StartServer or MatrixMain function

into


Input: The standalone Loaders use the MatrixMain function while the DLL Loaders will call the StartServer function.

The standalone Loaders

the MatrixMain function

the DLL Loaders

the StartServer function

use

call


Input: The Loaders, upon unloading, will call the StopServer function in order to shut down the embedded DLL.

The Loaders

unloading

the StopServer function

shut down the embedded DLL

upon

in order to

call


Input: The Gen 2 DLL exposes five exported functions (besides the DllEntryPoint/DllMain).


Input: MatrixMain and StartServer both ultimately generate a new thread (using the POSIX API function beginthreadex instead of the more common CreateThread) that contains the main loop of the Gen 2 RAT functionality.

MatrixMain and StartServer

a new thread

the POSIX API function beginthreadex

the more common CreateThread

generate

using

instead of


Input: MatrixMain, however, has added functionality.


Input: The prototype for MatrixMain is as follows: where Arguments parameter can be: If the i parameter is given, the DLL will install itself as a service on the victim's machine.

the DLL

itself

a service

the victim's machine

install

as

on


Input: The DLL will create a new service (e.g.

The DLL

a new service

create


Input: '' Network DDE Service'') and assign itself as the executable for the service.


Input: The DLL's RAT functionality provides basic features such as network port forwarding (proxying), file transfer, and remote command shell.

The DLL's RAT functionality

remote command shell

provides


Input: The RAT functionality provides an attacker with the ability to establish a phantom network within a victim's infrastructure by having individual instances of Gen 2 DLL listen for incoming connections on local ports (presumably, NAT'd ports) and accept commands from the inbound connection.

individual instances of Gen 2 DLL

incoming connections

local ports

commands

the inbound connection

listen

accept

for

on

from


Input: This allows an attacker to establish several Gen2 infections within a victim's infrastructure and if outbound connectivity is prohibited for any of the infected machines, the attacker can route commands to the pseudo-isolated infections through accessible infected machines providing a high level of persistence to the malware.

providing

a high level of persistence

the malware

to


Input: Each Gen 2 infection can support up to 10 listening ports.

Each Gen 2 infection

10 listening ports

support

up to


Input: The communication between the Gen 2 malware and the C2 (or other Gen 2 malware, in the case of the internal routing functionality) is encrypted using a simple DWORD XOR scheme.

The communication between the Gen 2 malware and the C2

a simple DWORD XOR scheme

is encrypted

using


Input: Each communication burst (either between the malware and the C2 or the malware and neighboring malware) begins with a 24-byte header identical to the header found in Gen 1.2.