Input: The first ordinal exported by this dll is located and then called, passing in the configuration and the name of the encrypted file on disk as parameters.


Input: This last dll is the heart of the threat (originally called q5Byo.dll in this instance.


Input: This file contains the true intent of this campaign.


Input: It is designed as a survey tool.

It

a survey tool

is designed

as


Input: The PE file gathers system information including OS version, computer name, user name, user group membership, the process it is running in, locale ID's, as well as system drive and volume information.

The PE file

system information

OS version

computer name

user name

user group membership

the process it is running in

locale ID's

system drive and volume information

gathers


Input: All of this is encrypted and then sent to cloud storage via WebDAV.

All of this

cloud storage

WebDAV

is encrypted

sent

to

via


Input: WebDAV is a communication standard that allows file management over HTTP or HTTPS.


Input: Windows allows WebDAV sessions to be mapped as network resources.


Input: The use of WebDAV as the communication channel is atypical for most malware samples we see.


Input: By using a network resource, the actual web traffic originates from the system itself, and not from the process in which the malware resides.


Input: Additionally, once the resource is established, the malware can transfer files to and from the command and control servers using standard file IO commands.

the malware

files

the command and control servers

standard file IO commands

transfer

to

from

using


Input: All the authentication information for the WebDAV session including the URL, folders, path, user name, and password is stored within this last DLL in another AES-encrypted configuration structure in the binary.


Input: A unique path, username, and password were used for each malware instance we've seen in the wild.


Input: This allows the attackers to uniquely identify every targeted attack and track how successful each phishing campaign is.

the attackers

every targeted attack

identify


Input: Also contained within the configuration structure is information on how to name the survey data on the remote file server.


Input: The binary reads from its configuration a string on how to generate the remote filename, and a list of extensions to use.


Input: An example would be'' 1-7d0-8s'', ['' TIF'','' TAR'','' SIT''] which instructs the binary to generate a filename with 1 to 7 numeric digit characters followed by 0 to 8 ASCII letters with one of the three listed extensions such as'' 664gher.TAR''.


Input: The survey is then uploaded to the server in a specified folder with the generated name.

The survey

the server

a specified folder

the generated name

is then uploaded

to

in

with


Input: Files are compressed using a modified LZMA-compression and encrypted using AES cipher-block-chaining (CBC) before being uploaded to the cloud server.

Files

a modified LZMA-compression

AES cipher-block-chaining (CBC)

the cloud server

are compressed

encrypted

being uploaded

using

using

to


Input: The binary also checks a separate folder on the cloud service designated to contain new configuration information.

The binary

a separate folder on the cloud service designated to contain new configuration information

checks


Input: If such a file is present on the server, the malware downloads the new configuration file then deletes it from the server.

the malware

the new configuration file

it

the server

downloads

deletes

from


Input: The cloud storage provider in every case we have seen was the Swedish company CloudMe.com, which offers free and paid WebDAV cloud storage.


Input: The URI model used by the malware is http: //webdav.cloudme.com/% username% /CloudDrive/ which is a direct reference to file storage.


Input: It must be noted that the CloudMe service is not actively spreading the malicious content; the attackers are only using it for storing their files.


Input: We notified CloudMe.com about the abuse of their services.


Input: Their CEO, Mr. Daniel Arthursson, was none too happy about this, and was very helpful in our further research.


Input: CloudMe has shared a great deal of log information related to this attack.


Input: These indicate that there are many other accounts (over 100) likely related to this attack system.


Input: We have no way of verifying this with absolute certainty, but this is what we regard as a high confidence assumption.


Input: The cloud accounts are not used for one-way communication only.


Input: The malware also checks configured subfolders for updates; and if these are found they will be downloaded, decrypted and used as appropriate.

The malware

configured subfolders

updates

they

checks

be downloaded

for


Input: One such case is the franko7046 account, used against the previously mentioned bank CEO.


Input: In this account there was hidden another encrypted configuration file which the malware downloaded and decrypted.

another encrypted configuration file

the malware

downloaded


Input: This is how we found the depp3353 account.


Input: In this new account there was another surprise waiting for us–a download folder with two new encrypted files, 921.bin and 922.bin.


Input: Once decrypted, these turned out to be PE executables.


Input: The two new executables are plugins-quite similar to each other and obviously compiled on the same setup.


Input: They are lightweight and intended to pull specific survey information from their target.

They

specific survey information

their target

pull

from


Input: Of interest, both of the DLLs originally had the same internal name (78wO13YrJ0cB.dll).


Input: Presumably the same PE sanitization script and parameters were used on both.


Input: None of these plugins contain any means of CnC communication.


Input: Instead, when they are executed they are passed a pointer to a function to use for sending data back home.

they

a pointer to a function

use for sending data back home

are passed

to


Input: Neither are they ever written to disk.


Input: They are executed in memory only, and once they have completed the memory is freed.

They

memory

they have completed

the memory

are executed

is freed

in

once


Input: This makes these modules extremely stealthy, flexible and compatible with multiple toolsets independent of what CnC method is being used.


Input: 921.bin retrieves several datapoints about the infected machine: Domain info; a list of running processes with all loaded modules in each; the list of installed software; and a complete hardware profile of the target machine.

several datapoints

the infected machine

Domain info

a list of running processes with all loaded modules in each

the list of installed software

a complete hardware profile of the target machine

retrieves

about


Input: 922.bin compiles a dirwalk–a complete listing of every file path–of each fixed drive.

a dirwalk–a complete listing of every file path–of each fixed drive

compiles


Input: All of this information is exfiltrated back via the same WebDAV connection.

All of this information

the same WebDAV connection

is exfiltrated

back via


Input: This model makes it possible to do the intrusion in steps, with verification stages in between; and the files will not be easily found on affected computers.


Input: Based on the information gathered from these modules, the attackers appear to move to the next stage of their attack by placing more new components on the WebDAV shares.


Input: Information about these uploads is limited by the fact that we do not have the AES keys to decrypt much of the uploaded data, but we have been able to see some upload patterns.


Input: What we assume to be third-stage plugins appear on the shares as *.bin files of roughly 72kb.


Input: As with other plugins, these are downloaded and deleted from the share in one go.

these

the share

one go

are downloaded

deleted

from

in


Input: However, the next day, another *.bin file of the same size will be uploaded to the share.


Input: This is a pattern that repeats itself over all live accounts.


Input: It seems that because the plugins exist in memory only, they are injected daily to ensure persistence on victim computers.

they

daily

ensure persistence on victim computers

are injected

to


Input: Our theory is that this malware is a more typical datastealer, and we have observed that after this type of file is planted on the account, encrypted data uploads from compromised users increase.

this malware

a more typical datastealer

encrypted data uploads from compromised users

is

increase


Input: Victims of this attack will connect using the Windows WebDAV redirector, and the HTTP request user-agent string will reflect this.

Victims of this attack

the Windows WebDAV redirector

connect

using


Input: For Windows XP this will typically be'' Microsoft-WebDAV-MiniRedir/5.1.2600'', and for Windows 7 a common user-agent is'' Microsoft-WebDAV-MiniRedir/6.1.7601''.


Input: Security researchers–and there are a few of them-connect in a variety of ways; first of all, we see a number of connections that are indistinguishable from the way victims connect.


Input: This happens when researchers use lab machines with live internet access to run the malware.


Input: The only way we can tell these are researchers is because they connect from IP address ranges that are unlikely to be victims; and they also tend to consist of short-lived sessions.


Input: Some researchers set up scheduled tasks to scan the shares for new updates and malware.


Input: We see a few variations of these–one typical configuration is where the requests contain a Python-related user-agent string.


Input: Attackers, on the other hand, don't appear to use Windows.


Input: Common across multiple accounts, multiple IP's, and over time, is that the probable attackers have used a HTTP user-agent of'' davfs2/1.4.6 neon/0.29.6''.

the probable attackers

a HTTP user-agent of'' davfs2/1.4.6 neon/0.29.6''

used


Input: We know these are not researchers, because we can see malware files being uploaded by them: We have a log fragment in which the attackers uploaded a sequential series of updates (from 1746.bin to 1774.bin) within 1.5 hours on Sept 17th, spread over 27 different accounts and using 27 different IP addresses in the process.


Input: The user-agent string shows that attackers likely have used a client based on the open source davfs2 file system for Linux to mount the WebDAV shares.


Input: This client is used when uploading new malware, but also when the attackers scan their shares for new victim updates, in which case the shares are enumerated by requests in a scheduled manner.


Input: The attackers have used a large number of IP addresses to access the shares.


Input: As mentioned above, there is a rotation scheme in place in which a new IP address will be used after a few minutes of access against CloudMe accounts.


Input: These IP's are distributed widely over geographical locations and service providers, with a heavy bias towards South Korean ranges.


Input: At first we thought these IP's belonged to some commercial proxy service, particularly since several such proxy services also offer IP rotation.


Input: However, this turned out to be a wrong assumption.


Input: A superficial examination of the proxy IP addresses that connected to CloudMe showed them to be internet-connected devices of various kinds.


Input: Many were Korean Tera-EP home routers; but there were several other products represented.


Input: It is believed that the attackers were able to compromise these devices based on poor configurations or default credentials.

the attackers

these devices

poor configurations or default credentials

compromise

based on


Input: We were able to do some forensic work on a compromised Tera-EP TE-800 device and discovered another dimension of the attacker's infrastructure.


Input: Under the ramfs mounted partition we found a stripped and statically linked MIPS-el binary named tail-.


Input: Instances of this were also found under the running process list.


Input: tail- serves as a SOCKS proxy for the attackers.

tail-

a SOCKS proxy

the attackers

serves

as

for


Input: Each sample of the binary we were able to acquire was configured with a unique 32byte blowfish key and a small, encrypted section appended to the end of the binary.


Input: Upon execution the binary uses its hardcoded key to decrypt the configuration section and retrieve the listening port to use for incoming connections.

the binary

the listening port

use for incoming connections

retrieve

to


Input: This acts as a management interface.


Input: From here the attackers can request a specific port to be opened as one of the following types: SOCKET, SOCKSS, SOCKAT, SOCKS5, or STATUSPORT.


Input: To prevent anyone else from accessing this service all communication on the management interface is encrypted using the same blowfish key.


Input: This means that the attackers must maintain a list of where each of these implants are installed, as well as what port and key each is configured to use.

the attackers

a list of where each of these implants are installed, as well as what port and key each is configured to use

maintain


Input: This setup makes it difficult to identify embedded devices compromised with this malware by scanning open ports.


Input: In the wild we witnessed the attackers connect to the management port and request SOCKSS connections.


Input: This would open the specified port and wait for configuration data, which consists of a domain name (webdav.cloudme.com), the destination port, and a variable length RC4 key, all of which encrypted using the blowfish key.


Input: Once received the malware would attempt to connect to the domain name on the specified port and would start tunneling all traffic received from the SOCKSS port to the destination and vise-versa.

the malware

the domain name

the specified port

all traffic received from the SOCKSS port

the destination

connect

tunneling

to

on

to


Input: The communication between the attacker and the SOCKSS is encoded using the RC4 key.

The communication between the attacker and the SOCKSS

the RC4 key

is encoded

using


Input: The graphic below illustrates a typical session.


Input: The router proxy network provides another layer of indirection masking the attackers' infrastructure.


Input: However, because we captured traffic through one of these embedded devices we could identify other parts of their operation.


Input: We identified four IP addresses that connected to the proxy malware: This host belongs to a Bulgarian VPS service and would use the router proxy to connect to webdav.cloudme.com.

four IP addresses

the proxy malware

This host

the router proxy

connect to webdav.cloudme.com

connected

use

to

to


Input: This host does all scanning of webdav shares for stolen user data, and also uploads new malware components.

This host

new malware components

uploads


Input: This IP would make connections hourly and poll the status of the router proxy malware.


Input: This machine is most likely used to track which compromised routers are currently available for use.


Input: Traffic from this IP had a very specific purpose: It unlocked routers for proxying in connection with the sending of phishing emails.

It

routers

proxying

the sending of phishing emails

unlocked

for

in connection with


Input: In the wild we observed this IP connect to our router on the malware management port and specify a SOCKSS proxy port to be opened.

this IP

our router

the malware management port

connect

to

on


Input: Immediately after, the newly opened port would be connected to by another IP and used to send phishing emails with malicious attachments.

the newly opened port

another IP

phishing emails with malicious attachments

be connected

send

to


Input: However, later we observed that the Email sender IP at VOLIA vanished and the Unlocker server taking over its role as well.


Input: After a router SOCKSS port was opened by Unlocker, this IP would connect to the opened port and tunnel its email traffic through the router.

this IP

the opened port

its email traffic

the router

connect

tunnel

to

through


Input: Each of these connections used the correct encryption key, so we know that these accesses came from the attackers and not some opportunistic third party.


Input: Mail proxies: Through our router monitoring we identified two mail proxies used by the attackers.

two mail proxies

the attackers

used


Input: We were later notified by Symantec (thanks, guys!) about a third.


Input: These servers were hosted on domains that were registered by the attackers, using domain names clearly meant to look legitimate.


Input: This is the only time we have seen attackers register domains in this investigation.


Input: The mail proxies were: Registrant WHOIS information seems forged: The connections made from the Ukrainian host to the router were interesting.


Input: After being proxied though the router, each of these would authenticate with one of the dedicated mail proxies and send out phishing attacks.

each of these

phishing attacks

send

out


Input: From captured traffic it appears that the mail proxies have SOCKSv5 services running on obscure high ports.


Input: We have documented that the attackers log in to these using apparently randomly generated usernames and passwords, a unique pair for each server.


Input: The mail proxy would then relay the spearphishing mail as seen below.

The mail proxy

the spearphishing mail

seen below

relay

as


Input: This way the attack can be mistaken to come from legitimate businesses and trusted organizations.

the attack

come from legitimate businesses and trusted organizations

be mistaken

to


Input: In some cases the organization from which the phishing email originates would appear to be a known associate to the target.

the organization from which the phishing email originates

be a known associate to the target

appear

to


Input: The email shown above was one of a number of messages sent to targets in the oil industry.

a number of messages

targets in the oil industry

sent

to


Input: Investigating the target email addresses, we saw several of these were found in this public document from the World Petroleum Council, including some addresses that are, at the present time, no longer valid.


Input: And then, the ground shifted again.


Input: One of the spearphishing mails we observed coming through the router network was this one, sent to an address under the gov.py (Government of Paraguay) domain.

One of the spearphishing mails

the router network

an address under the gov.py (Government of Paraguay) domain

coming

sent

through

to


Input: There was no executable attachment in this mail, but instead a link shortened by the URL shortener service bit.ly, with the underlying link pointing to an IP address on a Dutch hosting service.


Input: Clicking that link from a Windows PC only yielded a redirection to the BBC homepages, and using other devices did not give more data.


Input: The bit.ly service does however provide information on the user creating the shortened link, and other links associated with this account.


Input: In this case, the user was named nicolatesla53.


Input: The nicolatesla53 account was created in July 2014.


Input: From Oct 24th to Nov 21st this user created nearly 10000 shortened links–we harvested 9990 unique ones.


Input: Three IP addresses were used for these links: The links themselves were on this format: As far as we were able to tell, there were three main types of actioncode: We have no sample of the actual MMS phishing messages apparently being sent, but we can see the page served when a user clicks a spammed link.


Input: This is just a dialogue box asking for the password presumably included in the initial message, and the next stage likely involves download of malicious content.


Input: We were in the middle of harvesting the servers for data on the various action codes when they all were abruptly taken offline; so our data on which mobile operators are targeted is not complete.


Input: We managed to get 66 of a total of 190.


Input: The ones we know of are shown below.


Input: A full breakdown of mobile operators and related links is included in the appendix.


Input: The composition of links created for the various mobile operators is quite interesting, as one can speculate that they represent amount of actual or planned attacks in different countries.


Input: With the top three operators being Vodafone, T- Mobile and Proximus (Belgacom) it seems these apparent phishing attacks are less focused on the Russian sphere than the previously discussed malware.


Input: This map is not complete, though.


Input: It represents only about 35% (66/190) of all mobile operators targeted and 66% (3152/4781) of all phishing links we managed to harvest.


Input: In addition, some operators like Vodafone are global actors, so the map might show an unfair intensity in their HQ locations.


Input: The rest of the bit.ly links used the action codes 743 or 1024.


Input: And now things really get interesting.


Input: By using mobile device HTTP User-Agents we were able to trigger downloads of malware components from some of these links.


Input: Accessing the link from an Android User-Agent initiated a download of an Android installer package named WhatsAppUpdate.apk.

Accessing the link from an Android User-Agent

a download of an Android installer package named WhatsAppUpdate.apk

initiated


Input: The package we analyzed was 1.2MB in size.


Input: The apparent main purpose of this malware is to record phone call audio.

this malware

phone call audio

record


Input: Recordings are stored as *.mp4 files, and uploaded to the attackers periodically.

Recordings

*.mp4 files

the attackers

periodically

are stored

uploaded

as

to


Input: The malware is able to collect a lot of other information, not all of which is actually used: Through the encrypted C & C protocol, the attackers can issue commands and binary updates to the malware.

The malware

a lot of other information

the encrypted C & C protocol

the attackers

commands and binary updates

the malware

collect

issue

Through

to


Input: It uses a custom DAO/Database scheme which uses accounts belonging to the virtual community Live Journal (livejournal.com) as data stores.


Input: Three such accounts were found hardcoded in the package: The accounts all state that they belong to Iranian users.


Input: This is very likely false.


Input: The text in these posts starts first out in cleartext, but quickly turns into unreadable gibberish.


Input: The HTML source code reveals that the encoded portion is encapsulated in blog-index tags: The three accounts contain different configuration blocks pointing to C & C servers apparently located in Poland, Germany and Russia, respectively.

different configuration blocks

C & C servers apparently located in Poland, Germany and Russia, respectively

pointing

to


Input: Based on registration data and folder configuration we believe these are legitimate but compromised Joomla servers.


Input: And then an unexpected oddity shows up in the Java source: We were also able to download a similar malware sample (BrowserUpdate.apk) from one of the C & C servers.


Input: This sample used different online accounts for its DAO/database functionality, but is otherwise quite similar to the first.


Input: Using an IOS User-Agent triggered the download of a Debian installer package, WhatsAppUpdate.deb, also 1.2Mb in size.

Using an IOS User-Agent

the download of a Debian installer package, WhatsAppUpdate.deb

triggered


Input: This application impersonates a Cydia installer, and can only be installed on a jailbroken phone.

This application

a Cydia installer

impersonates


Input: Once installed, it may collect These data are encrypted and uploaded to an FTP account which is taken from an encrypted configuration file named /usr/bin/cores.

it

These data

an FTP account

collect

are encrypted

uploaded

to


Input: In this particular case, the FTP account is located on a legitimate (if struggling) hosting service in the UK.


Input: In this case, there's another clue: The WhatsAppUpdate project seems derived from an earlier template named SkypeUpdate.


Input: By now, it came as no surprise when we triggered a download with a BlackBerry User-Agent.


Input: The initial download was a Java Applications Descriptor, a text file designed for Over-The-Air installation of Java-based applications.


Input: This JAD file contained the locations of the two Blackberry *.COD binaries which we then could download directly.


Input: The application impersonates a settings utility.

The application

a settings utility

impersonates


Input: This collects: Collected data will be uploaded to a DynDNS domain currently hosted on a US webhosting service.

This

Collected data

a DynDNS domain currently hosted on a US webhosting service

collects

be uploaded

to


Input: Since these COD files are also compiled Java code, they are possible to decompile to original source code.


Input: In a similar fashion to the Android version, we find interesting strings there.


Input: This time they are in Arabic: The earliest sample of Inception-related malware we have been able to obtain, was submitted to us in June 2014.


Input: However, decoy document metadata shows that it was created late May.


Input: The related cloud account was created just before that.


Input: An examination of the other documents associated with the attacks show that they have been created at a steady pace all through summer and autumn 2014 and attacks are still ongoing.


Input: Of interest is also the attackers' activity patterns over the 24h cycle.


Input: The main upload of new components to shares seems to be divided over two high–activity periods: 6:00 -10:00 UTC and 17:00-21:00 UTC.


Input: No uploads were seen between 23:00 and 05:00 UTC.


Input: It is however doubtful how indicative these timeframes are.


Input: To illustrate, we looked into another and more obscure timing factor: The timing of the AES InitVector random seeds.


Input: A random seed is the initial value passed into a pseudo-randomizer function.


Input: The malware uses the random output to create what is known as an InitVector-a starting point for the AES encryption/decryption function.


Input: The code used in some of the DLLs indicate that the attackers tend to use the C time () function to generate random seeds.


Input: This function returns values of granularity down to seconds.


Input: Thus random seeds, and ultimately the InitVectors, are functions of these quite coarse units of time.


Input: The encrypted files uploaded to the WebDAV shares come with their InitVectors stored at the end of the file.

The encrypted files

the WebDAV shares

uploaded

to


Input: Since we know the time window to be within a few days of the upload time we were able to brute force the time values that would generate the corresponding InitVectors.


Input: Thus, we were able to say to the second when the file was created–and most times were identified to be in the range 1500-2200 GMT.


Input: Unfortunately, we had to reject these data.


Input: The file creation times turned out to be hours after the files themselves were uploaded to the WebDAV share.

the files themselves

the WebDAV share

were uploaded

to


Input: Either the attackers' system clock is wrong or a fixed offset is added to the random seed.


Input: Either way, the data can't be trusted; and shows that nothing can be taken at face value.


Input: On at least two occasions during our surveillance of the Inception framework, the malware downloaded something unexpected and wholly different from what we have discussed until now.

the malware

something unexpected and wholly different from what we have discussed until now

downloaded


Input: These files were downloaded as encrypted *.bin files from the accounts carter0648 and frogs6352.

These files

encrypted *.bin files

the accounts carter0648 and frogs6352

were downloaded

as

from


Input: When decrypted, these turned out to be dropper packages containing one dropper executable clearly created for the Inception framework, and one other, very different executable.

dropper packages

one dropper executable clearly created for the Inception framework, and one other, very different executable

containing


Input: This executable, (sccm.exe, md5 dd8790455109497d49c2fa2442cf16f7) is a classical Chinese APT implant.


Input: It is a downloader and remote shell program, designed to connect to a C & C server to interact with the attacker and/or download more malware.

It

a downloader

remote shell program

a C & C server

interact with the attacker

more malware

is

connect

download

to

to


Input: The C & C server in this case is ict32.msname.org.

The C & C server

is


Input: When connecting to this server, sccm.exe issues the following request: This C & C domain is used by many other malwares related to sccm.exe; some of which share obvious connections to the Quarian malware family, a known APT intrusion tool.

connecting

is used

to

this server

sccm.exe

This C & C domain

many other malwares related to sccm.exe


Input: This development was unexpected for several reasons.


Input: First of all, it apparently breaks the strict, obfuscatory operational security built into the Inception framework.


Input: Inception has the capacity to perform all steps needed for scouting out and exfiltrating data without resorting to traditional hosted command & control.

Inception

data

scouting

exfiltrating

out


Input: By using a well-understood APT tool and a known malicious C & C domain name, the attackers permit much clearer attribution.

using

a known malicious C & C domain name

the attackers


Input: Another factor which is out of character is the coding style.


Input: All Inception-related malware is written using Visual Studio 2010.


Input: The downloaded sccm.exe is written using Visual C++ 6; and has a PE header compile date of October 2010.


Input: This date can be forged, and indeed, all Inception-related malware has some level of forgery in the compile dates.


Input: However, the sccm.exe compile date matches the Quarian developer toolset and coding style to a better degree than the other files distributed through Inception.


Input: Then there is the C & C domain used.

the C & C domain

used


Input: According to DomainTools.com the msname.org domain registration timed out September 27th 2014.


Input: It was left inactive and was not renewed until Nov 12th.


Input: This means that the attackers distributed malware that would be out of action for a long time (last distribution of sccm.exe was September 26th).


Input: Because of all this we consider sccm.exe as an unreliable indicator.


Input: It is likely to be a red herring purposefully placed on shares where the attackers have seen signs of access by security researchers.


Input: At one instance the attackers seem to have slipped up.


Input: Instead of using their scheduled task, they apparently did something manually on a WebDAV share.


Input: This is visible because the request came from an apparent attacker IP, but used yet another User-Agent:'' gvfs/1.12.3''.


Input: Gvfs is the virtual filesystem for Gnome desktop.


Input: The action on the account was abnormal as well; an apparent file upload: When WebDAV shares are mapped up as drives by the operating system, any action taken by the attacker follows the same pattern as on the attacker's local drive.


Input: In the case above, it seems the attacker attempted to edit a new document, which by default is given the name'' Untitled document'' in Gnome.


Input: This might indicate that the attacker's operating system language is Spanish.


Input: Of course, Spanish is one of the world's most widespread languages, so one can not infer much from this.


Input: There is even a small possibility that the phenomenon is a pure artifact; for example that a Spanish-speaking researcher connected to the same account using the same Linux-based setup as the attackers.


Input: This attack system shares a number of properties that are somewhat similar with the Red October campaigns detailed by Kaspersky Labs in 2013.


Input: For more information about this see: The'' Red October'' Campaign-An Advanced Cyber Espionage Network Targeting Diplomatic and Government Agencies However, there are also clear differences.


Input: The code is fully rewritten; there appears to be little code overlap, at least in the initial stage malware.


Input: The coding style is different, with different solutions to programmatic problems, different use of exception handling, and different use of C++ classes.


Input: It's hard to believe that the same programmers are responsible for the two code bases.


Input: The Red October malware contained linguistic markers that pointed towards Russian speaking attackers.


Input: No such clues have been found in the Inception- related malware; there is a marked difference in the attention to detail and information leakage.


Input: It is certainly possible that the same people have organized both Inception and Red October, but there are no clear indications to this effect.


Input: The Windows-based malware in this paper generally contains very few noticeable strings apart from what is commonly found in software, and clearly randomized strings.


Input: What exists–like the word'' polymorphed'' in the early DLL versions-is standard English with few discerning features.


Input: This changes a bit when we look at the mobile malware.


Input: In the Android malware we find Hindi comments in the Java source code.


Input: In the Iphone malware we find project paths referencing one'' JohnClerk'', and a few typos like'' conutry''.


Input: In one of the Blackberry binaries we find the string'' GodSaveTheQueen'', a rather blunt hint towards Britain, as well as Arabic log strings.


Input: These and other indicators have led us to conclude that the Inception attackers are setting a new standard for deliberate disinformation and red herrings in a malware espionage operation.


Input: Some clues might have been added by accident, but none of these indicators can be trusted in any way.


Input: Thus we are not going to assume anything about who might be behind these attacks.


Input: The whole Inception setup shows signs of automation and seasoned programming.


Input: The amount of layers used in this scheme to protect the payload of their attack seems excessively paranoid.


Input: Not only is the initial DLL apparently polymorphed using some backend tool–the compile time stamps in the PE header are clearly forged, resources are removed so as not to give away any location information, and import tables are shuffled around, rendering import hashes (aka imphashes) useless.

the initial DLL

some backend tool

polymorphed

using


Input: The names of the files both when dropped and their original names along with the callback directories, paths and mutexes used all seem to be dynamically generated.


Input: The attackers utilize compromised embedded devices–typically routers- on the Internet as well as multiple dedicated hosting providers and VPN services to mask their identity from the cloud storage provider and others.

The attackers

compromised embedded devices–typically routers- on the Internet as well as multiple dedicated hosting providers and VPN services

mask their identity from the cloud storage provider and others

utilize

to


Input: The same router botnet is used as a spreading and management platform for attacks on mobile devices as well.

The same router botnet

a spreading and management platform for attacks on mobile devices

is used

as


Input: This suggests that this a large campaign and we've only seeing the beginning of it.


Input: Initially many of the targets were located in Russia or related to Russian interests, but as the campaign has evolved we have verified targets in countries all over the world.


Input: It is clear that this infrastructure model does not need to be applied solely against a few targets, or even need to be hosted at CloudMe.


Input: The framework is generic, and will work as an attack platform for a multitude of purposes with very little modification.


Input: The attribution indicators point in different directions and can't be given much weight.


Input: These attacks can in theory be the creation of nation states or resourceful private entities-we consider it very unlikely that they are performed by one or just a few individuals.


Input: haarmannsi.cz sanygroup.co.uk ecolines.es blackberry-support.herokuapp.com (DynDNS) The following entities have helped in big and small ways.


Input: Big thanks to all.


Input: We also owe a big debt of gratitude to Ryan W. Smith of Blue Coat who helped us tremendously with the analysis of the mobile malware.


Input: Downloaders, injectors, infostealers Example md5s of files detected with Kaspersky's Virus.Win32.Pioneer.dx and Symantec's Infostealer.Nemim! inf: To ensure only single instance of the module is running, the module verifies if system mutex named «132DF6E» exists.

ensure

only single instance of the module is running

the module


Input: If it exists the module exits, if not the module creates one.


Input: The module implements a method to resist running in virtual environment.

The module

a method

resist running in virtual environment

implements

to


Input: It gets CPU name and identifier from the registry at HKLM\HARDWARE\DESCRIPTION\ System\CentralProcessor\0 and collects IP and MAC addresses of local network adapters.

It

CPU name and identifier

the registry at HKLM\HARDWARE\DESCRIPTION\ System\CentralProcessor\0

IP and MAC addresses of local network adapters

gets

collects

from


Input: After that it compiles a string describing the system in the following format: « C P U:% CPUNAME% < br > Net card:% IP% (% MACADDR%) < br > ».


Input: Next it checks if this string contains one of the following substrings: If any of these strings is found, the module terminates.


Input: After that, there is a hardcoded value of 10, which delays further execution of the module for 10 seconds.


Input: Then the module attempts to delete some other, prob- ably older, components which might be present on the system.

the module

some other, prob- ably older, components which might be present on the system

delete


Input: The list of deleted files includes the following: The next is step is to check if current directory has a file named «U».

check

if current directory has a file named «U»


Input: If not, the module proceeds with network communication routine.


Input: But if this file is found it does some additional checks.


Input: If «U» file is older than 180 days, the module wipes the file.

the module

the file

wipes


Input: If not, it triggers a special variable that makes module dormant and dis- ables further communication with C & C server.

a special variable

module

dormant

makes


Input: After all, if the module is ready and allowed to communicate with C & C server it does that in the following manner.


Input: The module connects to autolace.twilightparadox.com (or automachine. servequake.com) and issues a HTTP GET request with hardcoded UserAgent string: The server response should contain «DEXT87» string which is used to rec- ognize valid response.

The module

autolace.twilightparadox.com (or automachine. servequake.com)

a HTTP GET request

hardcoded UserAgent string

«DEXT87» string

rec- ognize valid response

connects

issues

is used

to

with

to


Input: The malware locates «DEXT87» and reads the data appended to it.


Input: The appended data should be an IP address in plaintext.


Input: This is used a real C & C IP address.


Input: Reading stops when nondigit or dot symbol is found.


Input: Here is an example of shortest possible valid server response: 2.


Input: If the real C & C IP address is not valid the module may try to send identical request again but using a different HTTP path: If the C & C IP address is valid, the module issues another HTTP request: The server response can be one of the following: Where < DATASIZE > is a decimal integer that represents length of < DATA > field in bytes; < DATA > is a binary data separated from < DATASIZE > field by semicolon.

the module

identical request

again

a different HTTP path

the module

another HTTP request

send

issues

using


Input: Please note, that after receiving < DATA >, it is XORed with byte value 0x55 and saved to a disk in a file named «ctfmon.exe» (current directory is used).

it

byte value 0x55

a disk

a file named «ctfmon.exe»

is XORed

saved

with

to

in


Input: Upon successful receiving of the file it is started in a new process.


Input: This module is relatively large (455Kb) and comes as a part of WinRar SFX file that drops and starts the module from% APPDATA% \Microsoft\Display\DmaUp3. exe.

WinRar SFX file

the module

% APPDATA% \Microsoft\Display\DmaUp3. exe

drops

starts

from


Input: The main purpose of the module is to collect various secrets stored on a local system.

the module

various secrets stored on a local system

collect


Input: This module is designed not to run on Windows with system default codepage set to Korean.


Input: From the very beginning this module checks if «bdagent.exe» process is running on current system.

this module

if «bdagent.exe» process is running on current system

checks


Input: Bdagent.exe is a name for BitDefender Antivirus component.


Input: If it is running, it uses simple AV heuristics evasion technique.

it

simple AV heuristics evasion technique

uses


Input: The code starts a thread that simulates keystrokes of ESC keyboard key and then shows a system modal message box.

The code

a thread that simulates keystrokes of ESC keyboard key and then shows a system modal message box

starts


Input: Pushing ESC key closes the modal message box.


Input: Right after that keystroke generation thread is terminated and the module continues normal execution as if «bdagent.exe» was not running.

keystroke generation thread

is terminated


Input: Next the module makes sure only one instance of current code is running by checking if system mutex object named «920111215» exists.

the module

only one instance of current code is running

checking if system mutex object named «920111215» exists

makes sure

by


Input: After that, the mod- ule collects information about current system which includes the following: If the module reveals that current System default codepage is 0412 (Korean) it terminates.

the mod- ule

information about current system which includes the following

collects


Input: There is one interesting specifics in Microsoft IntelliForms which reveals attack- er's interests.


Input: IntelliForms technology keeps login/password information in the registry in encrypted form.


Input: However, there is no clear information about the corre- sponding website which requires given login and password.


Input: The only information Intelliforms offers about the place where given login/password should be used is a hash of the webpage URL.


Input: So far, the attackers can steal logins and pass- words but to understand where they are from they must guess the string which produced given hash.

the attackers

logins and pass- words

steal


Input: They have implemented this logics in the malware.


Input: When IntelliForms information is stolen the malware tries to check the list of known login page URLs to recover the originating webpage address.

IntelliForms information

is stolen


Input: Here is the list of URLs that are checked by the malware: The list of targeted services includes some local services specifically popular in: The module uses several simple XORbased algorithms to encrypt embedded string data.

The module

several simple XORbased algorithms

encrypt embedded string data

uses

to


Input: String encryption/decryption functions use the following keys: The module works with all Firefox versions prior to Mozilla Firefox 12.0.


Input: Depend- ing on version of Firefox, it can read Firefox database directly to dump stored se- crets or utilize one Firefox libraries to access the configuration data.


Input: In addition it makes use of the following Mozilla Firefox libraries depending on Firefox version: When stealing secrets from Firefox and Chrome it uses builtin SQLite library code.

stealing

secrets

Firefox and Chrome

it

from


Input: The module is linked with SQLite version 3.7.5 release candidate 2, release hash ed759d5a9edb3bba5f48f243df47be29e3fe8cd7 dated as 20110128 17:03:50.


Input: After stealing secrets from local system the malware executes some kind of embedded script.

stealing

executes

secrets

local system

the malware

some kind of embedded script

from


Input: It is logging all actions to inform the operator what exactly was executed by this variant of the malware.

It

all actions

inform the operator what exactly was executed by this variant of the malware

is logging

to


Input: The result of this execution is appended to the stolen data and uploaded to the C & C server.

The result of this execution

the C & C server

uploaded

to


Input: The module uploads all collected information to one of the following URLs via POST request: It's the first time we see .pn

The module

all collected information

one of the following URLs

POST request

uploads

to

via


Input: domain used in malware.


Input: This top level country code domain is quite exotic and is assigned to Pitcairn Islands, which is Overseas ter- ritory of the United Kingdom in the Pacific.


Input: As of 2013 estimated population of Pitcairn Islands is only 56 people.


Input: An official .pn


Input: domain costs $100/year from the registry, however .eu.pn


Input: domains seem to be given away for free.


Input: The malware uses fixed UserAgent string: The data is uploaded as a POST request binary in the following format: where < UserId > is hardcoded identifier (i.e.

The data

a POST request binary

the following format

is uploaded

as

in


Input: «user2» in current sample) ; < UniqueMachineId > is a 32 characters long hex string which derived from net- work card MAC address; < EncryptionKey > is symmetrical encryption key used to encrypt < UserId > and < GeneralSysInfo > values.


Input: The malware uses text protocol, which is why potentially binary values of < UserId > and < GeneralSysInfo > are ad- ditionally encoded using Base64 algorithm.


Input: < GeneralSysInfo > field contains only basic information about the system, i.e.


Input: : If the server reply contains a keyword «minmei» it continues sending additional in- formation.

it

additional in- formation

sending


Input: «Minmei» may be a reference to a popular Japanese anime and manga known as «The Super Dimension Fortress Macross».


Input: A quote from Wikipedia: «Born in Yokohama Chinatown, Japan (though she is of partial Chinese descent) as Linn Minmei, Minmay moved in with her uncle Shaochin (少江) and aunt Feic- hun (慧中) on South Ataria Island in hopes of finding the path to fulfill her dream of becoming a star.» The trojan iterates through running processes and looks for security software basing on executable filenames from the list below.

The trojan

running processes

security software basing on executable filenames from the list below

iterates

looks

through

for


Input: If the process is found it keeps a record of the software name using short AV Identifier string from the fol- lowing table of rules The malware uses a trick to evade running on a VMware.

The malware

running on a VMware

evade


Input: First, it checks if cur- rent process is running in WOW64 environment.

it

if cur- rent process is running in WOW64 environment

checks


Input: If yes it does additional port I/O specific to VMWare virtual machine (the VMware hypervisor port: 0x5658; VMware hypervisor magic value: 0x564D5868).


Input: Another method to detect VM en- vironment is to check local network adapter's IP address.

Another method

VM en- vironment

local network adapter's IP address

detect

check


Input: If it belongs to subnet 192.168.100.


Input: * then the malware believes it's running in a VM.


Input: If VM is detected the process instantly terminates.

If

VM is detected

the process

terminates


Input: Next the malware submits collected information to the C & C server using HTTP GET request and the following URL format: http: // < C2DOMAIN > /bin/readi.php? a1=% STEPID% & a2=% HOSTID% & a3=% SYSINFO% & a4=% AVSOFTID%, where% C2DOMAIN% is one of the following C & C domains:% STEPID% is special text string indicating stage of malware operation.

the malware

collected information

the C & C server

HTTP GET request and the following URL format: http: // < C2DOMAIN > /bin/readi.php? a1=% STEPID% & a2=% HOSTID% & a3=% SYSINFO% & a4=% AVSOFTID%, where% C2DOMAIN% is one of the following C & C domains

submits

to

using


Input: This string varies depending on the local system language and may be one of the following:% HOSTID% is a special value generated from local network card MAC address;% SYSINFO% is a string with general system information (please see description above) ;% AVSOFTID% is a string that contains indexes of AV software names in internal table of AV Identifiers (please see the table above).


Input: Igfxext.exe can download a file and drop it to% APPDATA% \microsoft\dis- play\ctfmon.exe (md5= e8bfb82b0dd5cef46116d61f62c25060).

Igfxext.exe

a file

it

% APPDATA% \microsoft\dis- play\ctfmon.exe (md5= e8bfb82b0dd5cef46116d61f62c25060)

download

drop

to


Input: After execution, the downloaded file drops SMAGENT.EXE (md5 0306f9ae- 7786570139f78e78bc940597) to% APPDATA% \MICROSOFT\DISPLAY and ex- ecutes it.

the downloaded file

SMAGENT.EXE (md5 0306f9ae- 7786570139f78e78bc940597)

% APPDATA% \MICROSOFT\DISPLAY

it

drops

ex- ecutes

to


Input: This component is a virus, and is used to selectively infiltrate into other computers via USB or network shares.

This component

other computers

USB

network shares

infiltrate

into

via


Input: A large number of files are detected by Kaspersky Lab scanners as Virus.Win32.


Input: Pioneer.dx.


Input: These files are all legitimate files that have been infected by another Darkhotel component.

These files

another Darkhotel component

been infected


Input: All of these infected files drop a 63kb self injecting compo- nent.

All of these infected files

a 63kb self injecting compo- nent

drop


Input: This malware is 63kb in size.


Input: It is bound to a variety of other software packages that vary in name, but the host package is consistently detected as'' Virus.Win32.


Input: Pioneer.dx''.


Input: The igfxext.exe component is dropped to disk and run.

The igfxext.exe component

disk

is dropped

run

to


Input: It spawns an- other suspended process with its own igfxext.exe image, but decrypts a smaller 32kb executable (cf1319d94f33380622ba000b7d8ad6e9, TrojanDownloader.

It

an- other suspended process

its own igfxext.exe image

spawns

with


Input: Win32.Agent.xwge) from its .data


Input: section in memory with a simple xor 0xbb.


Input: The running process overwrites the igfxext.exe image in the suspended process with this smaller chunk of code.

The running process

the igfxext.exe image

the suspended process

this smaller chunk of code

overwrites

in

with


Input: It then resumes the thread in the new process.


Input: This smaller code section maintains similar functionality to the'' worm'' compo- nent: Host package files detected as'' Virus.Win32.Pioneer.dx'' are infected legitimate files, that do not have any selfpropagation routines.

Host package files detected as'' Virus.Win32.Pioneer.dx''

infected legitimate files

are


Input: It is signed with the familiar'''' digital certificate.


Input: This sample is started by code running within svchost.exe on WinXP SP3.

This sample

code running within svchost.exe on WinXP SP3

is started


Input: It drops a keylogger.

It

a keylogger

drops


Input: The debug path inside: The dropper above maintains, drops and installs this kernel mode keylogger: Likely, it was developed as a part of a midtolate 2009 project: This driver package is built to look like a legitimate low level Microsoft system device.

The dropper above

this kernel mode keylogger

maintains, drops and installs


Input: It is installed as a system kernel driver'' Ndiskpro'' service, described as a'' Microcode Update Device''.

It

a system kernel driver'' Ndiskpro'' service

is installed

as


Input: It is somewhat surprising that there is no rootkit functionality hiding this service: When loaded, the NDISKPRO.SYS driver hooks both INT 0x01 and INT 0xff, and retrieves keystroke data directly from port 0x60, the motherboard keyboard con- troller itself.

loaded

hooks

retrieves

the NDISKPRO.SYS driver

both INT 0x01 and INT 0xff

keystroke data

port 0x60, the motherboard keyboard con- troller itself

directly from


Input: Here we see the local port variables assigned values And here, the ports are directly being read with READPORTUCHAR (0x64) and then READPORTUCHAR (0x60): It buffers, then communicates the data to the running user mode component.


Input: This component then encrypts and writes the retrieved values ondisk to a ran- domly named .tmp, file like ffffz07131101.tmp.

This component

the retrieved values ondisk

a ran- domly named .tmp, file like ffffz07131101.tmp

encrypts

writes

to


Input: This file is located in the same directory as the original dropper, which maintains persistence across reboots with a simple addition to the HKCU run key.

the original dropper

persistence

reboots

a simple addition to the HKCU run key

maintains

across

with


Input: Here is debug output demonstrating this component's data retrieval when the letter'' D'' is repeatedly pressed on the keyboard.


Input: Keyscan make and break codes are'' 0x20'' and'' 0xA0'' and for the key press and key release for the'' D'' key.


Input: The'' 0x1D'' value from port 0x64 that you see below is basically an indication that the output buffer is full and the keyboard is locked, so it is safe for the driver to access the key value in port 0x60: These debug messages and code style are duplicates of what chpie posted in the past.


Input: This keylogger module encrypts and stores gathered data in a log file, as men- tioned previously.

This keylogger module

gathered data

a log file

encrypts

stores

in


Input: Its encryption algorithm is similar to RC4.


Input: Interesting part is that the module randomly generates the key and stores it in an unexpected place: in the middle of the log file name.


Input: Hence, the numeric part of the filename is used as a seed for the pseudorandom number generator.


Input: Rand function is statically linked to insure same results on different computers.


Input: Here is the commented RC4 encryption code:


Input: We believe we're seeing an evolution and development in Iranian-based cyber activity.


Input: In years past, Iranian actors primarily committed politically-motivated website defacement and DDoS attacks.

Iranian actors

DDoS attacks

committed


Input: More recently, however, suspected Iranian actors have destroyed data on thousands of computers with the Shamoon virus, and they have penetrated the Navy Marine Corps Intranet (NMCI), which is used by the U.S. Navy worldwide.

suspected Iranian actors

data

thousands of computers

the Shamoon virus

destroyed

on

with


Input: In this report, we document the activities of the Ajax Security Team, a hacking group believed to be operating from Iran.


Input: Members of this group have accounts on popular Iranian hacker forums such as ashiyane [.


Input: ] org and shabgard [.


Input: ] org, and they have engaged in website defacements under the group name'' AjaxTM'' since 2010.


Input: By 2014, the Ajax Security Team had transitioned from performing defacements (their last defacement was in December 2013) to malware-based espionage, using a methodology consistent with other advanced persistent threat actors in this region.


Input: It is unclear if the Ajax Security Team operates in isolation or if they are a part of a larger coordinated effort.


Input: The Ajax Security Team itself uses malware tools that do not appear to be publicly available.


Input: We have seen this group leverage varied social engineering tactics as a means to lure their targets into infecting themselves with malware.

this group

varied social engineering tactics

their targets

infecting themselves with malware

leverage

lure

into


Input: Although we have not observed the use of exploits as a means to infect victims, members of the Ajax Security Team have previously used publicly available exploit code in web site defacement operations.


Input: In sum, FireEye has recently observed the Ajax Security Team conducting multiple cyber espionage operations against companies in the defense industrial base (DIB) within the Unites States, as well as targeting local Iranian users of anti-censorship technologies that bypass Iran's Internet filtering system.


Input: The transition from patriotic hacking to cyber espionage is not an uncommon phenomenon.


Input: It typically follows an increasing politicization within the hacking community, particularly around geopolitical events.


Input: This is followed by increasing links between the hacking community and the state, particularly military and/or intelligence organizations.


Input: In the late 1990's and early 2000's, a similar transition occurred within the Chinese hacking community.


Input: During that time period, the Chinese hacking community engaged in website defacements and denial of service attacks in conjunction with incidents such as the accidental bombing of the Chinese embassy in Belgrade in 1999, the collision of a U.S. spy plane and a Chinese military plane in 2001, and the Japanese Prime Minister's controversial visit to the Yasukuni shrine in 2005.

the Chinese hacking community

denial of service attacks

engaged

in


Input: Around this time a significant shift in philosophy began to take place.


Input: Members of the Chinese hacking community that participated in such attacks soon found that transitioning to cyber espionage was more rewarding-both in terms of developing a more advanced skill set as well as in monetary remuneration.


Input: One group known as NCPH (Network Crack Program Hacker), whose founding member'' Wicked/Withered Rose'' was a patriotic hacker, made the transition to cyber espionage by founding a'' hacker-for-hire'' group that simultaneously developed an association with the Chinese military.


Input: The group began developing zero-day exploits, rootkits and remote access tools (RATs) -using them in attacks against a variety of targets including the U.S. Department of Defense.


Input: (One of this group's associates,'' whg'', is still active and is believed to have developed one variant of the PlugX/SOGU malware.


Input: ) The rationale behind this transition within the Chinese hacking community is nicely summed up in a message by the'' Honker Union of China'' to its members in 2010: What benefit can hacking a Web page bring our country and the people? It is only a form of emotional catharsis, please do not launch any pointless attacks, the real attack is to fatally damage their network or gain access to their sensitive information.


Input: In Iran, the hacking community appears to be undergoing a similar transformation.


Input: While a variety of Iranian hacker groups had engaged in politically motivated website defacements, the emergence of the'' Iranian Cyber Army'' in 2009 demonstrated'' a concentrated effort to promote the Iranian government's political narrative online''.


Input: They targeted, among others, news organizations, opposition websites and social media.


Input: This marked the beginning of a large- scale cyber offensive against the perceived enemies of the Iranian government.


Input: Foreign news and opposition websites are routinely blocked in Iran, as are the tools that allow users in Iran to bypass these restrictions.


Input: One of the key stakeholders in Iran's Internet censorship program is the Iranian Revolutionary Guard Corps (IRGC), under which the Basij paramilitary organization operates.


Input: The Basij formed the Basij Cyber Council and actively recruits hackers in order to develop both defensive and offensive cyber capabilities.


Input: There is increasing evidence to suggest that the hacker community in Iran is engaged in a transition from politically motivated defacements and denial of service attacks to cyber espionage activities.


Input: This model is consistent with the Basij's recruitment of paramilitary volunteer hackers to'' engage in less complex hacking or infiltration operations'' leaving the more technical operations to entities over which they have increasingly direct control.


Input: As such, the capabilities of threat actors operating from Iran have traditionally been considered limited.


Input: However, the'' Shamoon'' attacks, which wiped computers in Saudi Arabia and Qatar, indicate an improvement in capabilities.

the'' Shamoon'' attacks

computers in Saudi Arabia and Qatar

wiped


Input: And unsurprisingly, Iran has reportedly increased its efforts to improve offensive capabilities after being targeted by Stuxnet and Flame.


Input: We have observed the Ajax Security Team use a variety of vectors to lure targets into installing malicious software and/or revealing login credentials.

the Ajax Security Team

targets

installing malicious software and/or revealing login credentials

lure

into


Input: These attack vectors include sending email, private messages via social media, fake login pages, and the propagation of anti-censorship software that has been infected with malware.

These attack vectors

sending email, private messages via social media, fake login pages, and the propagation of anti-censorship software that has been infected with malware

include


Input: During our investigation, we discovered that these attackers sent targeted emails, as well as private messages through social media.

these attackers

targeted emails, as well as private messages

social media

sent

through


Input: For example, the attackers targeted companies in the DIB using a fake conference page as a lure to trick targets into installing malicious software.

the attackers

companies in the DIB

a fake conference page as a lure to trick targets into installing malicious software

targeted

using


Input: The attackers registered the domain'' aeroconf2014 [.] org'' in order to impersonate the IEEE Aerospace conference-the conference's actual domain is aeroconf.org-and sent out an email with the following information: The email encouraged users to visit a fake conference website owned by the attackers: Upon visiting the website, visitors were notified that they must install'' proxy'' software in order to access it, which is actually malware.

The attackers

the domain'' aeroconf2014 [.] org''

impersonate the IEEE Aerospace conference

an email with the following information

registered

sent

in order to

out


Input: The attackers have also used phishing attacks, in which they set up Web pages to emulate various services that require security credentials.

The attackers

phishing attacks

they

Web pages

emulate various services that require security credentials

used

set up

to


Input: The attackers tailored these login pages for specific targets in the DIB and spoofed a variety of services such as Outlook Web Access and VPN login pages.

The attackers

these login pages

specific targets in the DIB

a variety of services such as Outlook Web Access and VPN login pages

tailored

spoofed

for


Input: If users attempt to login through these fake Web pages, the attackers collect their login credentials.

the attackers

their login credentials

collect


Input: All Internet Service Providers (ISPs) in Iran are required to implement filtering technology that censors access to content which the Iranian government deems unacceptable.


Input: This content includes categories such as pornography and political opposition.


Input: In response to these restrictions, Iranians have been increasingly using software that bypasses such filtering technology.


Input: To counter anti-censorship efforts, Iran has attempted to block the use of certain software tools.


Input: In 2012, researchers found that an anti-censorship tool that is primarily used by Internet users in Iran was bundled with malware and redistributed.

an anti-censorship tool that is primarily used by Internet users in Iran

malware

was bundled

with


Input: Our investigation found that malware-laden versions of legitimate anti-censorship software, such as Psiphon and Ultrasurf, were distributed to users Iran and Persian speaking people around the world.

malware-laden versions of legitimate anti-censorship software, such as Psiphon and Ultrasurf

users Iran and Persian speaking people around the world

were distributed

to


Input: We have observed the Ajax Security Team use a malware family that they identify simply as'Stealer'.


Input: They deliver this malware as a malicious executable (dropper).

They

this malware

a malicious executable (dropper)

deliver

as


Input: The executable is a CAB extractor that drops the implant IntelRS.exe.

The executable

the implant IntelRS.exe

drops


Input: This implant, in turn, drops various other components into C:\Documents and Settings\ {USER} \Application Data\IntelRapidStart\.

This implant

various other components

C:\Documents and Settings\ {USER} \Application Data\IntelRapidStart\

drops

into


Input: The following files are written to disk in this location: The IntelRS.exe is written in .NET

The following files

disk

this location

are written

to

in


Input: and is aptly named'' Stealer'', as it has various data collection modules.

it

various data collection modules

has


Input: It drops and launches AppTransferWiz.dll via the following command: 110 is an ordinal that corresponds to'' StartBypass'' export in AppTransferWiz.dll.

It

AppTransferWiz.dll

the following command

drops

launches

via


Input: Data exfiltration is conducted over FTP by AppTransferWiz.dll, which acts as an FTP client.

Data exfiltration

FTP

AppTransferWiz.dll

is conducted

over


Input: This DLL is written in Delphi.


Input: There is code to exfiltrate data over HTTP POST as well, but it is unused.

code

data

HTTP POST

exfiltrate

over


Input: We also found incomplete code that would perform SFTP and SMTP exfiltration, which could be completed in a future version.

incomplete code

SFTP and SMTP exfiltration

perform


Input: State is maintained between the stealer component IntelRS.exe and the FTP component AppTransferWiz.DLL using a file from the FTP server'' sqlite3.dll'', as well as a global atom'' SQLiteFinish''.


Input: IntelRS.exe waits in an indefinite loop, until AppTransferWiz.DLL defines this state.


Input: Once the state is set, IntelRS.exe proceeds to collect data from various areas in the system as described below: IntelRS.exe loads a Delphi component called DelphiNative.DLL, which implements some additional data theft functionality for the following: The Stealer component uses common techniques to acquire credential data.

IntelRS.exe

data

various areas in the system as described below

IntelRS.exe

a Delphi component called DelphiNative.DLL

some additional data theft functionality

the following

The Stealer component

common techniques

acquire credential data

collect

loads

implements

uses

from

for

to


Input: For instance, it loads vaultcli.DLL and uses various APIs shown below to acquire RDP accounts from the Windows vault.

it

vaultcli.DLL

various APIs shown below

acquire RDP accounts from the Windows vault

loads

uses

to


Input: Harvested data is encrypted and written to disk on the local host.

Harvested data

disk

the local host

is encrypted

written

to

on


Input: The filenames for these encrypted files follow this naming scheme: The {stolen data type} parameter indicates where the data was harvested from (e.g., a Web browser, an instant messenger application, installed proxy software).


Input: Analysis of the malware indicates that the data is encrypted via a Rijndael cipher implementation; more specifically it uses AES which is a specific set of configurations of Rijndael.

the data

a Rijndael cipher implementation

is encrypted

via


Input: It uses a key size of 256 bytes and block size of 128 bytes, which conforms to the FIPS-197 specification of AES-256.


Input: It utilizes the passphrase'HavijeBaba' and a salt of'salam! *% #' as an input to PBKDF2 (Password-Based Key Derivation Function 2) to derive the key and initialization vector for the encryption.


Input: This key derivation implementation in .NET


Input: is done using the Rfc2898DeriveBytes class.


Input: The passphrase and salt are Persian language words.


Input: '' Havij'' means'' carrot'','' Baba'' means'' father'', and'' Salam'' is a common greeting that means'' Peace''.


Input: We identified 17 droppers during this research, including: The 2009 compile time appears to have been forged, while the 2013 compile times may be legitimate.


Input: In some cases, we found an implant but not the parent dropper.


Input: In total, 22 of the 23 implants that we identified during our research had unique compile times ranging from 2013-10-29 until 2014-03-15.


Input: We identified two implants that were both compiled on 2014-3-15 at 23:16.


Input: These compile times appear to be legitimate and coincide with attempted intrusion activity attributed to these attackers.


Input: Many of the malicious executables (droppers) that we collected were bundled with legitimate installers for VPN or proxy software.

Many of the malicious executables (droppers) that we collected

legitimate installers for VPN or proxy software

were bundled

with


Input: Examples include: • 6dc7cc33a3cdcfee6c4edb6c085b869d was bundled with an installer for Ultrasurf Proxy software.

an installer for Ultrasurf Proxy software

was bundled

with


Input: • 3d26442f06b34df3d5921f89bf680ee9 was bundled with an installer for Gerdoovpn virtual private network software.

an installer for Gerdoovpn virtual private network software

was bundled

with


Input: • 3efd971db6fbae08e96535478888cff9 was bundled with an installer for the Psiphon proxy.

an installer for the Psiphon proxy

was bundled

with


Input: • 288c91d6c0197e99b92c06496921bf2f was bundled with an installer for Proxifier software.

an installer for Proxifier software

was bundled

with


Input: These droppers were also designed to visually spoof the appearance of the above applications.

These droppers

the appearance of the above applications

spoof


Input: These droppers contained icons used in the legitimate installers for these programs.

These droppers

icons used in the legitimate installers for these programs

contained


Input: Analysis of the PDB strings seen in the implants indicates that there may be more than one developer working on the source code for the Stealer builder.


Input: The following two PDB paths were seen in the collection of implants that we collected: These strings indicate that the Stealer source code was stored in two different paths but not necessarily on two different computers.


Input: The f:\Projects\ path may be from an external storage device such as a thumb drive.


Input: It is therefore possible that only one person has access to the source code, but keeps a separate repository on an external storage device.


Input: Alternatively, the different file paths could be the result of two different actors storing their source code in two different locations.


Input: In nine of the implants that we collected, we found a consistent portable executable (PE) resource with a SHA256 of 5156aca994ecfcb40458ead8c830cd66469d5f5 a031392898d323a8d7a7f23d3.


Input: This PE resource contains the VSVERSIONINFO.


Input: In layman's terms, this can best be described as the metadata describing the executable file.


Input: This specific PE resource contained the following information: Note the InternalName of'Stealer.exe'.


Input: This is the attackers' name for this malware family.


Input: During our research, we recovered two different tools used by the members of the Ajax Security Team in conjunction with targeted intrusion activities.


Input: The first tool, labeled the'Stealer Builder' was compiled on 2014-04-08.


Input: This compile date may indicate that the group is still active.


Input: Upon executing the'Stealer Builder' the user is presented with an option to load the'Builder' or to'Decrypt' logs generated from a victim and exfiltrated to a command-and-control (CnC) server under the groups' control.

logs

a command-and-control (CnC) server under the groups' control

exfiltrated

to


Input: The Builder option enables an attacker to configure a new Stealer backdoor.

an attacker

a new Stealer backdoor

configure


Input: The user can configure the new backdoor to connect to a specific CnC server with a personalized username and password.

the new backdoor

a specific CnC server

a personalized username and password

connect

to

with


Input: The attacker can bind the backdoor to a legitimate application of his or her choosing, or they can cloak it with an icon designed to make the backdoor appear as though it is a legitimate file.

The attacker

the backdoor

a legitimate application of his or her choosing

they

it

an icon designed to make the backdoor appear as though it is a legitimate file

bind

cloak

to

with


Input: We also noted that the Builder did not allow the attacker to select a new passphrase or salt used to encrypt the stolen data.


Input: The passphrase'HavijeBaba' and a salt of'salam! *% #' are both hardcoded into the builder.


Input: During testing, we observed that backdoors generated by this Stealer Builder had a timestamp of 2013-12-19.


Input: We had one backdoor in our repository with this same timestamp.


Input: This sample (MD5 1823b77b9ee6296a8b997ffb64d32d21) was configured to exfiltrate data to ultrasms [.] ir.

This sample (MD5 1823b77b9ee6296a8b997ffb64d32d21)

data

ultrasms [.] ir

exfiltrate

to


Input: The VSVERSIONINFO PE resource mentioned above (SHA256 5156aca994ecfcb40458ead8c830cd66469d5f5 a031392898d323a8d7a7f23d3) is an artifact of the Stealer builder that we recovered.


Input: The builder generates an executable named IntelRapidStart.


Input: exe.


Input: This executable contains the aforementioned VSVERSIONINFO PE resource.


Input: We also recovered a tool designed to encode plaintext into Base64 encoded text or decode Base64 encoded text into plaintext.


Input: Members of the Ajax Security Team likely this use tool to encode the configuration data seen in RapidStartTech.stl files.


Input: As noted above, the RapidStartTech.stl contains the backdoor's FTP credentials, implant name, decoy name, and screenshot interval, along with boolean settings for startup, keylogger, and screenshot plugins.


Input: Encoding and decoding Base64 data is a straightforward task and the standard Linux operating system offers a number of command line tools to achieve this task.


Input: The presence of a Windows-based GUI tool that simplifies encoding and decoding Base64 data indicates that these tools may have been developed for less adept users.


Input: The CnC infrastructure consists of distinct, but linked, clusters that have targeted both the users of anti-censorship tools in Iran as well as defense contractor companies in the U.S.


Input: The first cluster contains the domain used in the Aerospace Conference attack as well as the domains used in phishing attacks designed to capture user credentials: The website used in the Aerospace Conference attack was aeroconf2014 [.

the domains

phishing attacks

user credentials

used

capture

in


Input: ] org, which is registered to info @usa.gov [.


Input: ] us.


Input: However, historical WHOIS information shows that the domain was registered by keyvan.ajaxtm @gmail [.


Input: ] com-the same domain used to register ajaxtm [.


Input: ] org, the website of the Ajax Security Team.


Input: The same email addresses were used to register variations of domain names associated with popular services provided by companies such as Google, Facebook, Yahoo and LinkedIn.


Input: The second cluster comprises the CnC infrastructure used in the anti-censorship attacks.


Input: The majority of the samples we analyzed connect to intel-update [.] com and update-mirror [.] com, which were registered by james.mateo @aim [.

The majority of the samples we analyzed

intel-update [.] com and update-mirror [.] com

connect

to


Input: ] com.


Input: The domain intel-update [.


Input: ] com resolved to the IP address 88.150.227.197, which also hosted domains registered by osshom @yahoo [.


Input: ] com, many of which are consistent with the pattern of registering domains with associations to Google and Yahoo services.


Input: We also observed crossover with a sample that connected to both intel- update [.] com and ultrasms [.] ir, which was registered by lvlr98 @gmail [.

a sample

both intel- update [.] com and ultrasms [.] ir

connected

to


Input: ] com.


Input: These two clusters are linked by a common IP address (5.9.244.151), which is used by both ns2.


Input: aeroconf2014 [.


Input: ] org and office.windows- essentials [.


Input: ] tk.


Input: A third cluster of activity was found via analysis of 1d4d9f6e6fa1a07cb0a66a9ee06d624a.


Input: This sample is a Stealer variant that connects to the aforementioned intel-update [.] com as well as plugin-adobe [.] com.

This sample

the aforementioned intel-update [.] com as well as plugin-adobe [.] com

connects

to


Input: The domain plugin-adobe [.


Input: ] com resolved to 81.17.28.235.


Input: Other domains seen resolving to IP address nearby include the following: Aside from the sample connecting to plugin- adobe [.] com, we have not discovered any malware connecting to these domains.

the sample

plugin- adobe [.] com

connecting

to


Input: During our investigation, we were able to recover information on 77 victims from one CnC server that we discovered while analyzing malware samples that were disguised as anti-censorship tools.

malware samples

anti-censorship tools

were disguised

as


Input: While analyzing the data from the victims, we found that the majority had either their timezone set to'' Iran Standard Time'' or had their language setting set to Persian: The largest concentration of victims is in Iran, based on the premise that Persian language settings and'' Iran Standard Time'' correlate the victim to be geographically located in Iran.


Input: As such, we believe that attackers disguised malware as anti-censorship tools in order to target the users of such tools inside Iran as well as Iranian dissidents outside the country.

attackers

malware

anti-censorship tools

target the users of such tools inside Iran as well as Iranian dissidents outside the country

disguised

as

in order to


Input: The Ajax Security Team appears to have been formed by personas named'' HUrr! c4nE!'' and'' Cair3x'' in 2010.


Input: Both members were engaged in website defacements prior to the forming of the Ajax Security Team, and both were members of Iranian hacker forums such as ashiyane [.


Input: ] org and shabgard [.


Input: ] org.


Input: Other members include'' 0day'','' Mohammad PK'' and'' Crim3r''.


Input: The Ajax Security Team website at ajaxtm [.


Input: ] org had a Web forum with at least 236 members.


Input: The group published several exploits for content management systems and engaged in defacements.


Input: Initially, the defacements seemed to be motivated by a desire to demonstrate the group's prowess-they even defaced an Iranian government website.


Input: However, the group appears to have become increasingly political.


Input: For example, in a blog post in 2012,'' Cair3x'' announced the targeting of Iran's political opponents.


Input: In 2013, the Ajax Security Team, and'' HUrr! c4nE!'' in particular, took part in'' #OpIsrael'' and'' #OpUSA''.


Input: By early 2014, the Ajax Security Team appears to have dwindled.


Input: There have been no defacements since December 2013.


Input: The website and forum at ajaxtm [.


Input: ] org operated by'' HUrr! c4nE!'', aka'' k3yv4n'', is no longer active.


Input: '' HUrr! c4nE!'' has the most open/documented Internet persona of the Ajax Security Team.


Input: He registered the ajaxtm [.


Input: ] org domain name using the email address keyvan.ajaxtm @gmail [.


Input: ] com.


Input: This was also the email address used to register the domain aerospace2014 [.] org, which was used in spear phishing attacks against companies in the U.S. and is linked with malware activity directed at users of anti-censorship tools in Iran.

the domain aerospace2014 [.] org

spear phishing attacks against companies in the U.S.

was used

in


Input: '' HUrr! c4nE!'' features prominently in all the group's activities and defacements.


Input: Although there has been a decline in public-facing Ajax Security Team activity, this coincides with an increase in malware activity linked to the group's infrastructure.


Input: The increasing politicization of the Ajax Security Team aligns with the timing of their activities against the perceived enemies of Iran.


Input: In addition to attacking companies in the U.S., they have targeted domestic users of anti-censorship technology.


Input: While the objectives of this group are consistent with Iran's efforts at controlling political dissent and expanding offensive cyber capabilities, the relationship between this group and the Iranian government remains inconclusive.


Input: For example, the Ajax Security Team could just be using anti-censorship tools as a lure because they are popular in Iran, in order to engage in activities that would be considered traditional cybercrime.

the Ajax Security Team

anti-censorship tools

a lure

be using

as


Input: In one case,'' HUrr! c4nE!'', using the email address keyvan.ajaxtm @gmail [.


Input: ] com, has been flagged for possible fraud by an online retailer.


Input: While'' HUrr! c4nE!'' is engaged in operations that align with Iran's political objectives, he may also be dabbling in traditional cybercrime.


Input: This indicates that there is a considerable grey area between the cyber espionage capabilities of Iran's hacker groups and any direct Iranian government or military involvement.


Input: On the spectrum of state responsibility, these attacks align with state-encouraged attacks, which are defined as attacks in which: Third parties control and conduct the attack, but the national government encourages them as a matter of policy.


Input: Recruiting hackers through this model allows Iran to influence their activities, and provides the Iranian government plausible deniability, but a lack of direct control also means that the groups may be unpredictable and engage in unsanctioned attacks.


Input: The increased politicization of the Ajax Security Team, and the transition from nuisance defacements to operations against internal dissidents and foreign targets, coincides with moves by Iran aimed at increasing offensive cyber capabilities.


Input: While the relationship between actors such as the Ajax Security Team and the Iranian government is unknown, their activities appear to align with Iranian government political objectives.


Input: The capabilities of the Ajax Security Team remain unclear.


Input: This group uses at least one malware family that is not publicly available.


Input: We have not directly observed the Ajax Security Team use exploits to deliver malware, but it is unclear if they or other Iranian actors are capable of producing or acquiring exploit code.


Input: While the Ajax Security Team's capabilities remain unclear, we know that their current operations have been somewhat successful as measured by the number of victims seen checking into to an Ajax Security Team controlled CnC server.


Input: We believe that if these actors continue the current pace of their operations they will improve their capabilities in the mid-term.


Input: FireEye has invented a purpose-built, virtual machine-based security platform that provides real-time threat protection to enterprises and governments worldwide against the next generation of cyber attacks.


Input: These highly sophisticated cyber attacks easily circumvent traditional signature-based defenses, such as next-generation firewalls, IPS, anti-virus, and gateways.


Input: The FireEye Threat Prevention Platform provides real-time, dynamic threat protection without the use of signatures to protect an organization across the primary threat vectors and across the different stages of an attack life cycle.


Input: The core of the FireEye platform is a virtual execution engine, complemented by dynamic threat intelligence, to identify and block cyber attacks in real time.


Input: FireEye has over 1,500 customers across more than 40 countries, including over 100 of the Fortune 500.


Input: We thank Kenneth Geers and Jen Weedon for their support and analysis on these findings.


Input: by John Scott-Railton and Seth Hardy With the collaboration of Cyber Arabs.


Input: Media coverage: Associated Press, Forbes This report describes a malware attack with circumstantial links to the Islamic State in Iraq and Syria.


Input: In the interest of highlighting a developing threat, this post analyzes the attack and provides a list of Indicators of Compromise.


Input: A Syrian citizen media group critical of Islamic State of Iraq and Syria (ISIS) was recently targeted in a customized digital attack designed to unmask their location.


Input: The Syrian group, Raqqah is being Slaughtered Silently (RSS), focuses its advocacy on documenting human rights abuses by ISIS elements occupying the city of Ar- Raqah.


Input: In response, ISIS forces in the city have reportedly targeted the group with house raids, kidnappings, and an alleged assassination.


Input: The group also faces online threats from ISIS and its supporters, including taunts that ISIS is spying on the group.


Input: Though we are unable to conclusively attribute the attack to ISIS or its supporters, a link to ISIS is plausible.


Input: The malware used in the attack differs substantially from campaigns linked to the Syrian regime, and the attack is focused against a group that is an active target of ISIS forces.


Input: As the Syrian Civil War continues, Syrian citizen journalists and nonviolent activists operate in an increasingly unsafe environment.


Input: The regime has never welcomed their work, and has often targeted them for arrest and detention, and a multi-year hacking campaign (see Pro-Regime/Regime Linked Groups).


Input: Additionally, not all elements of the Syrian opposition have uniformly supported nonviolent activists and citizen journalists.


Input: More recently, in areas like Raqqah, nonviolent activists face a new and exceptionally grave threat: ISIS.


Input: A growing number of reports suggest that ISIS is systematically targeting groups that document atrocities, or that communicate with Western media and aid organizations, sometimes under the pretext of finding'' spies''.


Input: Ar-Raqqah, the city in which the case study is located, is situated in northern Syria and continues to be a key conflict flashpoint of the Syrian Civil War.


Input: In the spring of 2013, Islamists and Free Syrian Army (FSA) fighters took over Ar- Raqqah from regime forces.


Input: As ISIS gained momentum, they consolidated their control over the city, edging out FSA- affiliated groups through attacks, summary executions, and kidnappings against a range of groups, including ethnic and religious minorities.


Input: During 2014, there were a number of reports-many unconfirmed-that ISIS confiscated smartphones and laptops from captured activists.


Input: According to Syrians who experienced these searches and spoke with one of the reports' authors, ISIS sometimes extracts data from confiscated smartphones and laptops to collect information about people and groups they are targeting, as well as to seek evidence of'' un-Islamic'' activities.


Input: As ISIS cements their control of Ar-Raqqah and other territories, reports have emerged recently (though not all of them confirmed) suggesting that elements within ISIS are growing increasingly sophisticated at imposing control and targeting opponents using digital methods.


Input: Reports about ISIS targeting Internet cafés have grown increasingly common, and in some cases reports point to the possible use of keyloggers as well as unspecified'' IP sniffers'' to track behaviour in Internet cafes.


Input: Nonviolent activists and citizen journalists based in Ar-Raqqah have provided the outside world with much of what we know about how ISIS treats the population.


Input: These activists and journalists face mortal danger for their actions, and reports have emerged of their detention and torture at the hands of ISIS.


Input: As ISIS continues to use social media to push the message that it is welcomed by the population of Ar-Raqqah, groups like Raqqah is being Slaughtered Silently (RSS) provide a compelling counter narrative.


Input: RSS hasn't escaped ISIS' notice, and the group has been targeted for kidnappings, house raids, and at least one alleged targeted killing.


Input: At the time of writing, ISIS is allegedly holding several citizen journalists in Ar-Raqqah.


Input: In addition, RSS is targeted online by ISIS supporters with harassment, including threats to the physical safety of its members.


Input: For example, ISIS supporters have claimed that ISIS has established a system of CCTV cameras in Ar-Raqqah to observe residents' movements.


Input: While this claim may be a bluff or exaggeration, at least one ISIS supporter has indicated on social media that this system could be used to look for members of RSS.


Input: This section describes a highly targeted attack sent to an e-mail address belonging to RSS.

a highly targeted attack

an e-mail address belonging to RSS

sent

to


Input: The Citizen Lab analyzed this attack with the consent of RSS, which requested that their name be used in this report.


Input: The attack took the form of an unsolicited e-mail containing a download link to a decoy file.

The attack

the form of an unsolicited e-mail containing a download link to a decoy file

took


Input: The file contained custom malware that profiled the victim's computer and beaconed its IP address to an e-mail account under the attacker's control.

custom malware

the victim's computer

its IP address

an e-mail account under the attacker's control

profiled

beaconed

to


Input: The unsolicited message below was sent to RSS at the end of November 2014 from a Gmail email address.

The unsolicited message below

RSS

the end of November 2014

a Gmail email address

was sent

to

at

from


Input: The message was carefully worded, and contained references specific to the work and interests of RSS.


Input: Thank you for your efforts to deliver a true picture of the reality of life in Raqqah.


Input: As Syrians residing in Canada we are working with media because we believe in the importance of shedding light on the realities of life in Syria, and Raqqah in particular.


Input: We are preparing a lengthy news report on the realities of life in Raqqah.


Input: We are sharing some information with you with the hope that you will correct it in case it contains errors.


Input: We have prepared a map of the city of Raqqah, in addition to a preliminary report.


Input: We hope that you have a look at it with them and inform us of any errors.


Input: We also hope that if you happen to be on Facebook, you could provide us with the account of the person responsible for the campaign, if you don't mind, so that we can communicate with him directly.


Input: You can see a preliminary copy of the report on this linkhttp: //tempsend [DOT] com/ [Redacted] With all respect [Name Redacted] We are unsure why the attacker specifically mentions Canada in the email lure.


Input: However, it is well known that Syria's extensive diaspora (including in Canada) regularly engages in advocacy, sometimes in coordination with groups within Syria.


Input: Thus, the message is not on its face implausible.


Input: However, we note that the attacker also attempts to social engineer the identity of individuals working with RSS, by requesting a personal Facebook page.

the attacker

the identity of individuals working with RSS

social engineer


Input: The custom malware used in this attack infects a user who views the decoy'' slideshow,'' and beacons home with the IP address of the victim's computer and details about his or her system each time the computer restarts.

The custom malware used in this attack

a user who views the decoy'' slideshow,''

home

the IP address of the victim's computer

details about his or her system

time the computer restarts

infects

beacons

with

each


Input: Unlike Syrian regime-linked malware, it contains no Remote Access Trojan (RAT) functionality, suggesting it is intended for identifying and locating a target.

it

a target

identifying and locating


Input: Further, because the malware sends data captured by the malware to an e-mail address, it does not require that the attackers maintain a command-and-control server online.

the malware

data captured by the malware

an e-mail address

sends

to


Input: This functionality would be especially useful to an adversary unsure of whether it can maintain uninterrupted Internet connectivity.


Input: Accessing the link provided in the malicious e-mail sends the user to a .zip


Input: file hosted on file-sharing site tempsend.com.


Input: At the time of writing the file had been downloaded only 10 times This file is a self-extracting archive with an icon intended to suggest to the victim that it is itself a slideshow.


Input: When run, the file opens a slideshow of Google Earth screen captures to the victim, displaying a series of locations in Syria, and highlighting an'' ISIS HQ'' and other images showing the alleged locations of US airstrikes.


Input: Examples of images in the slideshow as follows: When opened, the'' slideshow.zip'' file writes and executes several files:'' AdobeR1.exe'' is malicious, while'' pictures.exe'' is the genuine slideshow displayed to the victim.

When

opened

the'' slideshow.zip'' file

several files

writes

executes


Input: When the slideshow is closed both AdobeR1.exe and pictures.exe are deleted.

When

the slideshow is closed

both AdobeR1.exe and pictures.exe

are deleted


Input: The AdobeR1 file writes a series of executable files that perform information collection and communication functions, including: The program sequence of data collection and sending is somewhat unusual, with each program performing a single task and communicating via markers left in the registry.

The AdobeR1 file

a series of executable files

information collection

communication

The program sequence of data collection and sending

somewhat unusual

markers

the registry

writes

perform

is

left

in


Input: Programs appear to make use of the Visual C++ Runtime Library.


Input: First, the program nvidrv adds itself to autorun: It also creates a series of registry keys that the individual programs use to communicate: Registry keys and programs using them: It then runs GooglUpd, which cleans up the program files if they exist, and runs AdbrRader.

the program nvidrv

itself

autorun

It

a series of registry keys that the individual programs use to communicate

Registry keys

programs

them

It

GooglUpd

the program files

they exist

AdbrRader

adds

creates

using

runs

cleans up

runs

to

if


Input: AdbrRader (communicating through registry key'' 2'') writes the file vgadmysadm.tmp with the name of another registry key'' 2'' with startup info.

AdbrRader

the file vgadmysadm.tmp with the name of another registry key'' 2''

startup info

writes

with


Input: Next, nvidrv runs GoogleUpate, which collects system information and writes it to: Then nvidrv runs nvisdvr (registry key'' 4'') that collects a list of running processes, which are written to: Finally, nvidrv runs svhosts, which tests Internet connectivity by doing a DNS query for windowsupdate.microsoft.com.

nvidrv

svhosts

Internet connectivity

a DNS query for windowsupdate.microsoft.com

runs

tests

doing


Input: It then runs rundl132 if it has not before, by checking whether registry key name'' 6'' is present.

It

it has not before

whether registry key name'' 6'' is present

runs

checking

if


Input: It sets the key to'' 0'' and runs it.

It

the key

'' 0''

it

sets

runs

to


Input: Next,'' rundl132.exe'' performs an HTTP GET request to myexternalip.com and collects the external IP of the infected machine: Next, rundl132 writes: Then rundl132 writes the external IP to: Finally, rundl132 runs AdobeIns, which zips the contents of the win32.tmp folder.

'' rundl132.exe''

an HTTP GET request

myexternalip.com

the external IP of the infected machine

the external IP

AdobeIns

the contents of the win32.tmp folder

performs

collects

writes

runs

zips

to


Input: Program'' AdobeIns.exe'' takes the files written by the other programs and zips them in an encrypted, password- protected file: Data is transmitted by e-mail to an account presumably controlled by the attacker.

Program'' AdobeIns.exe''

them

an encrypted, password- protected file

Data

e-mail

an account presumably controlled by the attacker

zips

is transmitted

in

by

to


Input: AdobeIns connects to an account at the online e-mail provider inbox.com via smtp using hardcoded credentials.

AdobeIns

an account

the online e-mail provider inbox.com

smtp

hardcoded credentials

connects

to

at

via

using


Input: The malware then sends an e-mail to the same inbox containing the text'' Hello'' and with mxtd file attached.

The malware

an e-mail

the same inbox

sends

to


Input: SMTP traffic generated by the malware to inbox.com (with redactions) The malware seen in this case study is unusual as it relies on a half-dozen separate executable files, each with a single task, and each communicating via markers dropped in the Registry.

markers

the Registry

dropped

in


Input: The malware is also interesting because it does not provide remote access, but only sends an e-mail containing the victim's IP address and miscellaneous system information.

The malware

an e-mail containing the victim's IP address and miscellaneous system information

sends