kills and disables services for Windows Firewall, Windows Security Center, and Windows Defender.


kills security tools like Wireshark that are running.


Lateral movement can be done with  through net use commands to connect to the on remote systems.


launched a scheduled task to gain persistence using the schtasks /create /sc command.


launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.


launches a script to delete their original decoy file to cover tracks.


launches a shell to execute commands on the victim’s machine.


leveraged a compiled HTML file that contained a command to download and run an executable.


leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.


leveraged a watering hole to serve up malicious code.


leveraged PowerShell to download and execute additional scripts for execution.


leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.


leveraged several compromised universities as proxies to obscure its origin.


leveraged the DDE protocol to deliver their malware.


leveraged the tool LaZagne for retrieving login and password information.


leverages a custom packer to obfuscate its functionality.


leverages cmd.exe to perform discovery techniques.


leverages legitimate social networking sites and cloud platforms (Twitter, Yandex, and Mediafire) for command and control communications.


leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.


leverages valid accounts after gaining credentials for use within the victim domain.


leverages vulnerable versions of Flash to perform execution.


likely obtained a list of hosts in the victim environment.


listed remote shared drives that were accessible from a victim.


lists the directories for Desktop, program files, and the user’s recently accessed files.


loads malicious shellcode and executes it in memory.


logs key strokes for configured processes and sends them back to the C2 server.


logs the keystrokes on the targeted system.


looks for specific files and file types.


lower disable security settings by changing Registry keys.


lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.


maintains access to victim environments by using  to access  as well as establishing a backup RDP tunnel by using .


makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.


makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.


malicious spearphishing payloads are executed as .  has also used  during and.


malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution.  has also used WMIC during and post compromise cleanup activities.


malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.


malware attempts to determine the installed version of .NET by querying the Registry.


malware can create a .lnk file and add a Registry Run key to establish persistence.


malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.


malware can decode contents from a payload that was Base64 encoded and write the contents to a file.


malware can download additional files from C2 servers.


malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.


malware can use a SOAP Web service to communicate with its C2 server.


malware can use process hollowing to inject one of its trojans into another process.


malware communicates with its C2 server via HTTPS.


malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.


malware deletes files in various ways, including "suicide scripts" to delete malware binaries from the victim.  also uses secure file deletion to delete files from the victim. Additionally,  malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine.


malware encrypts C2 traffic using RC4 with a hard-coded key.


malware gathers data from the local victim system.


malware gathers passwords from multiple sources, including Windows Credential Vault, Internet Explorer, Firefox, Chrome, and Outlook.


malware gathers system information via Windows Management Instrumentation (WMI).


malware gathers the Address Resolution Protocol (ARP) table from the victim.


malware gathers the registered user and primary owner name via WMI.


malware gathers the victim's local IP address, MAC address, and external IP address.


malware has communicated with C2 servers over port 6667 (for IRC) and port 8080.


malware has communicated with its C2 server over ports 4443 and 3543.


malware has created scheduled tasks to establish persistence.


malware has obtained the victim username and sent it to the C2 server.


malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.


malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.


malware has used Registry Run keys to establish persistence.


malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another  malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.


malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.


malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.


malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server.


malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server. A  malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.


malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.


malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers. Another  malware sample also performs exfiltration over the C2 channel.


malware installs itself as a service to provide persistence and SYSTEM privileges.


malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.


malware names itself "svchost.exe," which is the name of the Windows shared service host program.


malware RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2. Additionally,  malware RoyalDNS has used DNS for C2.


malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.


malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.


malware SierraCharlie uses RDP for propagation.


Malware used by  attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).


Malware used by  can run commands on the command-line interface.


Malware used by  is capable of capturing keystrokes.


Malware used by  is capable of remotely deleting files from victims.


malware uses Caracachs encryption to encrypt C2 payloads.


malware uses cmd.exe to execute commands on victims.


malware uses multiple types of encryption and encoding in its malware files, including AES, Caracachs, RC4, basic XOR with constant 0xA7, and other techniques.


malware uses PowerShell and WMI to script data collection and command execution on the victim.


malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.


malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.


malware xxmm contains a UAC bypass tool for privilege escalation.


manipulated .lnk files to gather user credentials in conjunction with .


Many  samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.


Many  samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.


Many strings in  are obfuscated with a XOR algorithm.


may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.


may be used to exfiltrate data separate from the main command and control protocol.


may be used to find credentials in the Windows Registry.


may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.


may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.


may collect active network connections by running netstat -an on a victim.


may collect information about running processes.


may collect information about the system by running hostname and systeminfo on a victim.


may collect information the victim's anti-virus software.


may collect network configuration data by running ipconfig /all on a victim.


may collect permission group information by running net group /domain or a series of other commands on a victim.


may create a file containing the results of the command cmd.exe /c ipconfig /all.


may create a file containing the results of the command cmd.exe /c net user {Username}.


may create a temporary user on the system named “Lost_{Unique Identifier}.”


may create a temporary user on the system named “Lost_{Unique Identifier}” with the password “pond~!@6”{Unique Identifier}.”


may enumerate user directories on a victim.


may gather a list of running processes by running tasklist /v.


may have used the  malware to move onto air-gapped networks.  targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.


may save itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service.


may store RC4 encrypted configuration information in the Windows Registry.


may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.


may use net view /domain to display hostnames of available systems on a network.


may use  to add local firewall rule exceptions.


may use WMI when collecting information about a victim.


Microsoft Sysinternals  is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.


mimics a legitimate Russian program called USB Disk Security.


mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.


modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.


modifies the %regrun% Registry to point itself to an autostart mechanism.


modifies the time of a file as specified by the control server.


modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.


modules are written in and executed via .


Modules can be pushed to and executed by  that copy data to a staging area, compress it, and XOR encrypt it.


monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.


monitors USB devices and copies files with certain extensions to
a predefined directory.


Most of the strings in  are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.


Most  samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.


Most strings in  are encrypted using 3DES and XOR and reversed.


MSGET downloader uses a dead drop resolver to access malicious payloads.


named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\microsoft\security.


network loader encrypts C2 traffic with RSA and RC6.


network traffic can communicate over a raw socket.


network traffic communicates over common ports like 80, 443, or 1433.


Newer variants of  will encode C2 communications with a custom system.


New services created by  are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".


obfuscated scripts that were used on victim machines.


obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR.


obfuscates C2 communication using a 1-byte XOR with the key 0xBE.


obfuscates C2 traffic with variable 4-byte XOR keys.


obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.


obfuscates files or information to help evade defensive measures.


obfuscates internal strings and unpacks them at startup.


obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.


obfuscates strings using a custom stream cipher.


obtained OS version and hardware configuration from a victim.


obtains additional code to execute on the victim's machine.


obtains a list of running processes on the victim.


obtains a list of running processes through WMI querying and the ps command.


obtains and saves information about victim network interfaces and addresses.


obtains application windows titles and then determines which windows to perform  on.


obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.


obtains the current user's security identifier.


obtains the IP address from the victim’s machine.


obtains the number of removable drives from the victim.


obtains the system time and will only activate if it is greater than a preset date.


obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.


obtains the victim computer name and encrypts the information to send over its C2 channel.


obtains the victim username and encrypts the information to send over its C2 channel.


Once a removable media device is inserted back into the first victim,  collects data from it that was exfiltrated from a second victim.


Once  has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.


One persistence mechanism used by  is to register itself as a scheduled task.


One persistence mechanism used by  is to register itself as a Windows service.


One variant of  creates a new service using either a hard-coded or randomly generated name.


One variant of  uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.


One variant of  uses HTTP and HTTPS for C2.


One version of  consists of VBScript and PowerShell scripts. The malware also uses batch scripting.


One version of  uses a PowerShell script.


opens a backdoor on TCP ports 6868 and 7777.


opens a remote shell to execute commands on the infected system.


opens the Windows Firewall to modify incoming connections.


parses the export tables of system DLLs to locate and call various Windows API functions.


Part of 's operation involved using  modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.


Password stealer and NTLM stealer modules in  harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.  has also executed  for further victim penetration.


payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.


payloads download additional files from the C2 server.


performed a watering hole attack on forbes.com in 2014 to compromise targets.


performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.


performs a reflective DLL injection using a given pid.


performs BIOS modification and can download and execute a file as well as protect itself from removal.


performs data exfiltration is accomplished through the following command-line command: from <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt.


performs data exfiltration over the control server channel using a custom protocol.


performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.


performs local network connection discovery using netstat.


performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode .


performs multiple process injections to hijack system processes and execute malicious code.


performs operating system information discovery using systeminfo.


performs service discovery using net start commands.


performs several anti-VM and sandbox checks on the victim's machine.


performs the tasklist command to list running processes.


performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.  performs a separate injection of its communication module into an Internet accessible process through which it performs C2.


performs timestomping of a CAB file it creates.


probes the system to check for sandbox/virtualized environments and other antimalware processes.


provides access to the system via SSH or any other protocol that uses PAM to authenticate.


provides access to the Windows Registry, which can be used to gather information.


provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet


provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet


provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.


puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.


queries Registry keys in preparation for setting Run keys to achieve persistence.


queries several Registry keys to identify hard disk partitions to overwrite.


queries the Registry for specific keys for potential privilege escalation and proxy information.


queries the Registry to determine the correct Startup path to use for persistence.


ran a command to compile an archive of file types of interest from the victim user's directories.


ran genuinely-signed executables from Symantec and McAfee which loaded a malicious DLL called rastls.dll.


recursively generates a list of files within a directory and sends them back to the control server.


registers itself as a service by adding several Registry keys.


registers itself as a service on the victim’s machine to run as a standalone process.


registers itself under a Registry Run key with the name "USB Disk Security."


relays traffic between a C2 server and a victim.


removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.


removes logs from /var/logs and /Library/logs.


renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.


replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.


reports window names along with keylogger information to provide application context.


Rundll32.exe is used as a way of executing  at the command-line.


runs cmd.exe /c and sends the output to its C2.


runs ipconfig /all and collects the domain name.


runs its core DLL file using rundll32.exe.


runs tasklist to obtain running processes.


runs tests to determine the privilege level of the compromised user.


runs the command: net start >> %TEMP%\info.dat on a victim.


runs the command net user on a victim.  also runs tests to determine the privilege level of the compromised user.


runs the ifconfig command to obtain the IP address from the victim’s machine.


runs the net view /domain and net view commands.


runs the whoami and query user commands.


samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32.


samples have been signed with a code-signing certificates.


samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.


samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.


samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.


samples were timestomped by the authors by setting the PE timestamps to all zero values.  also has a built-in command to modify file times.


saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .


saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service.


saves itself with a leading "." so that it's hidden from users by default.


scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).


scans processes on all victim systems in the environment and uses automated scripts to pull back the results.


scans the C-class subnet of the IPs on the victim's interfaces.


schedules the execution one of its modules by creating a new scheduler task.


scripts save memory dump data into a specific directory on hosts in the victim environment.


searches attached and mounted drives for file extensions and keywords that match a predefined list.


searches for certain Registry keys to be configured before executing the payload.


searches for files created within a certain timeframe and whose file extension matches a predefined list.


searches for files named logins.json to parse for credentials and also looks for credentials stored from browsers.


searches for files on attached removable drives based on a predefined list of file extensions every five seconds.


searches for files on local drives based on a predefined list of file extensions.


searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by .


searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.


searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.


searches for network drives and removable media and duplicates itself onto them.


searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.


searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, *.ppt, *.xls, *.docx, *.pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.


searches the local system and gathers data.


searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip


searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).


searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.


SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.


sends an OS version identifier in its beacons.


sends emails to victims with a malicious executable disguised as a document or spreadsheet displaying a fake icon.


sends images to users that are embedded with shellcode and obfuscates strings and payloads.


sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.


sent malicious attachments to victims over email, including an Excel spreadsheet containing macros to download Pupy.


sent shortened URL links over email to victims. The URLs linked to Word documents with malicious macros that execute PowerShells scripts to download Pupy.


sent spear phishing emails containing links to .hta files.


sent spearphishing emails containing malicious Microsoft Office attachments.


sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.


service-based DLL implant can execute a downloaded file with parameters specified using CreateProcessAsUser.


service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.


sets a WH_CBT Windows hook to collect information on process creation.


sets a WH_CBT Windows hook to search for and capture files on the victim.


sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.


Several  backdoors achieved persistence by adding a Run key.


Several  malware families are capable of downloading and executing binaries from its C2 server.


Several  malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by  also collects disk space information and sends it to its C2 server.


Several  malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another  malware sample XORs C2 traffic.  malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, evading SSL man-in-the-middle decryption attacks.


Several  malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.


Several  malware samples use a common function to identify target files by their extension.  malware families can also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.


Several  tools encode data with base64 when posting it to a C2 server.


shellcode decrypts and decompresses its RC4-encrypted payload.


side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.


Some  malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes commonly used ports such as 443, 53, 80, 25, and 8080.


Some  malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes uncommonly used ports such as 995, 1816, 465, 1521, 3306, and many others.


Some  malware uses multiple channels for C2, such as RomeoWhiskey-Two, which consists of a RAT channel that parses data in datagram form and a Proxy channel that forms virtual point-to-point sessions.


Some resources in  are encrypted with a simple XOR operation or encoded with Base64.


Some  samples contain a publicly available Web browser password recovery tool.


Some  samples have a module to extract email from Microsoft Exchange servers using compromised credentials.


Some  samples have a module to use pass the ticket with Kerberos for authentication.


Some  samples install themselves as services for persistence by calling WinExec with the net start argument.


Some  samples use a custom encryption method for C2 traffic using AES, base64 encoding, and multiple keys.


Some  samples use AES to encrypt C2 traffic.


Some  samples use cmd.exe to delete temporary files.


Some  samples were signed with a stolen digital certificate.


Some strings in are obfuscated with XOR x56.


Some  variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.


Some variants of  achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.


Some variants of  use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll"


Some variants of  use SSL to communicate with C2 servers.


Some  variants use ports 8080 and 8000 for C2.


Some  variants use SSL to encrypt C2 communications.


Some  versions have an embedded DLL known as MockDll that uses  and regsvr32 to execute another payload.


Some  versions have an embedded DLL known as MockDll that uses process hollowing and  to execute another payload.


Some versions of  have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.


spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.


spearphished victims via Facebook and Whatsapp.


spear phishing campaigns have included malicious Word documents with DDE execution.


specifically looks for Domain Admins, Power Users, and the Administrators groups within the domain and locally


splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.


stages command output and collected data in files before exfiltration.


stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.


steals credentials from compromised hosts. 's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by  include ones associated with The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, Internet Explorer, Microsoft Outlook, WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).


steals credentials stored in Web browsers by querying the sqlite database and leveraging the Windows Vault mechanism.


steals files based on an extension list if a USB drive is connected to the system.


steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.


steals user files from local hard drives with file extensions that match a predefined list.


steals user files from network shared drives with file extensions and keywords that match a predefined list.


stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.


stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname] and modifies Registry keys under HKCR\CLSID\...\InprocServer32with a path to the launcher.


stores information gathered from the endpoint in a file named 1.hwp.


stores output from command execution in a .dat file in the %TEMP% directory.


stores the encoded configuration file in the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentContorlSet\Control\WMI\Security.


supports execution from the command-line.


supports file encryption (AES with the key "lolomycin2017").


surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands.


surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, and in the Program Files directory.


surveys a system upon check-in to discover information in the Windows Registry with the reg query command.


surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, and net config commands.


surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.


surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands.


surveys a system upon check-in to discover the system time by using the net time command.


takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.


terminates anti-malware processes if they’re found running on the system.


The 's Information Gathering Tool (IGT) includes PowerShell components.


The "SCOUT" variant of  achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.


The "tDiscoverer" variant of  establishes a C2 channel by downloading resources from Web services like Twitter and GitHub.  binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.


The "Uploader" variant of  visits a hard-coded server over HTTP/S to download the images  uses to receive commands.


The "ZR" variant of  will check to see if known host-based firewalls are installed on the infected systems.  will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.


The  3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.


The  backdoor compresses communications using the standard Zlib compression library.


The  C2 channel uses an 11-byte XOR algorithm to hide data.


The  C2 channel uses HTTP POST requests.


The C2 server response to a beacon sent by a variant of  contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of  use various XOR operations to encrypt C2 data.


The  client has been signed by fake and invalid digital certificates.


The  command and control protocol's data stream can be encrypted with AES-CBC.


The  component KillDisk is capable of deleting Windows Event Logs.


The  crimeware toolkit has refined its detection of sandbox analysis environments by inspecting the process list and Registry.


The discovery modules used with  can collect information on accounts and permissions.


The discovery modules used with  can collect information on network connections.


The discovery modules used with  can collect information on process details.


The  dropper can delete itself from the victim. Another  variant has the capability to delete specified files.


The  dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main  component.


The  dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.


The  dropper uses a function to obfuscate the name of functions and other parts of the malware.


The  dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.


The executable version of  has a module to log keystrokes.


The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by  as a name for malware.


The  group has been known to compress data before exfiltration.


The  group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate. Some malware that has been used by  also uses steganography to hide communication in PNG image files.


The  group is known to utilize WMI for lateral movement.


The initial beacon packet for  contains the operating system version and file system of the victim.


The initial beacon packet for  contains the operating system version of the victim.


The  installer loads a DLL using rundll32.


The  loader implements itself with the name Security Support Provider, a legitimate Windows function. Various  .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare.  also disguised malicious modules using similar filenames as custom network encryption software on victims.


The  malware communicates through the use of events in Google Calendar.


The  malware communicates to its command server using HTTP with an encrypted payload.


The  malware platform can use ICMP to communicate between infected computers.


The  malware platform can use Windows admin shares to move laterally.


The net accounts and net accounts /domain commands with  can be used to obtain password policy information.


The net time command can be used in  to determine the local or remote system time.


The net user username \password and net user username \password \domain commands in  can be used to create a local or domain account respectively.


The OsInfo function in  collects a running process list.


The OsInfo function in  collects the current running username.


The  payload is stored in a hidden directory at /Users/Shared/.local/kextd.


The payload of  is encrypted with simple XOR with a rotating key. The  configuration file has been encrypted with RC4 keys.


The reconnaissance modules used with  can collect information on network configuration.


There is a variant of  that uses a PowerShell script instead of the traditional PE form.


The Ritsol backdoor trojan used by  can download files onto a compromised host from a remote location.


The  uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.


To establish persistence,  adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.


To establish persistence,  identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.


tools attempt to spoof anti-virus processes as a means of self-defense.


tools contained an application to check performance of USB flash drives.


Traffic traversing the  network will be forwarded to multiple nodes before exiting the  network and continuing on to its intended destination.


transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.


transfers files from the compromised host via HTTP or HTTPS to a C2 server.


tries to add a Registry Run key under the name "Windows Update" to establish persistence.


tries to add a scheduled task to establish persistence.


TRINITY malware used by  identifies payment card track data on the victim and then copies it to a local file in a subdirectory of C:\Windows\. Once the malware collects the data,  actors compressed data and moved it to another staging system before exfiltration.


typically use ping and  to enumerate systems.


uploads files and secondary payloads to the victim's machine.


used a cloud-based remote access software called LogMeIn for their attacks.


used a cron job for persistence on Mac devices.


used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.


used a rootkit to modify typical server functionality.


used a SharePoint enumeration and data dumping tool known as spwebmember.


used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.


used Base64 to obfuscate commands and the payload.


used batch scripts to enumerate network information, including information about trusts, zones, and the domain.


used batch scripts to enumerate users in the victim environment.


used cmd.exe to launch commands on the victim’s machine.


used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.


used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.


used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.


used RDP to move laterally in victim networks.


used Regsvr32 to bypass application whitelisting techniques.


used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.


used SMTP as a communication channel in various implants, initially using self-registered Google Mail accounts and later compromised email servers of its victims. Later implants such as  use a blend of HTTP and other legitimate channels, depending on module configuration.


used spearphishing emails with malicious Microsoft Word attachments to infect victims.


used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.


used sticky-keys to obtain unauthenticated, privileged console access.


used the Ammyy Admin tool as well as TeamViewer for remote access.


used the Plink command-line utility to create SSH tunnels to C2 servers.


used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.


used  to download payloads, run a reverse shell, and execute malware on the victim's machine.


used  to launch an authentication window for users to enter their credentials.


used various social media channels to spearphish victims.


used VBS and JavaScript scripts to help perform tasks on the victim's machine.


used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.


use HTTPS for all command and control communication methods.


uses 's malleable C2 functionality to blend in with network traffic.


uses a backup communication method with an HTTP beacon.


uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.


uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.


uses a batch file to kill a security program task and then attempts to remove itself.


uses a batch file to load a DLL into the svchost.exe process.


uses a command-line interface to interact with systems.


uses a copy of tor2web proxy for HTTPS communications.


uses a custom binary protocol for C2 communications.


uses a custom binary protocol to beacon back to its C2 server. It has also used XOR for encrypting communications.


uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.


uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols.


uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.


uses a custom DNS tunneling protocol for C2.


uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.


uses a custom encryption algorithm on data sent back to the C2 server over HTTP.


uses a customized XOR algorithm to encrypt C2 communications.


uses a custom UDP protocol to communicate.


uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.


uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.


uses AES to encrypt certain information sent over its C2 channel.


uses AES to encrypt network communication.


uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.


uses a keylogger and steals clipboard contents from victims.


uses a keylogger plugin to gather keystrokes.


uses a keylogger to capture keystrokes and location of where the user is typing.


uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.


uses a large list of C2 servers that it cycles through until a successful connection is established.


uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.


uses a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.


uses a module to execute Mimikatz with PowerShell to perform .


uses a module to receive a notification every time a USB mass storage device is inserted into a victim.


uses  and other Active Directory utilities to enumerate hosts.


uses a Port 22 malware variant to modify several Registry keys.


uses a PowerShell script to launch shellcode that retrieves an additional payload.


uses AppleScript to create a login item for persistence.


uses a simple one-byte XOR method to obfuscate values in the malware.


uses a specific port of 443 and can also use ports 53 and 80 for C2. One  variant uses HTTP over port 443 to connect to its C2 server.


uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.


uses a variation of the XOR cipher to encrypt files before exfiltration.


uses a virus that propagates by infecting executables stored on shared drives.


uses a WMI event subscription to establish persistence.


uses Base64 encoding for communication in the message body of an HTTP request.


uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.


uses character replacement,  environment variables, and XOR encoding to obfuscate code.


uses cmd.exe and /bin/bash to execute commands on the victim’s machine.


uses cmd.exe to execute commands for discovery.


uses cmd.exe to execute commands on the victim’s machine.


uses cmd.exe to execute scripts and commands on the victim’s machine.


uses cmd.exe to run commands for enumerating the host.


uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.


uses COM hijacking as a method of persistence.


uses commands such as netsh advfirewall firewall to discover local firewall settings.


uses commands such as netsh interface show to discover network interface settings.


uses credential dumpers such as  and  to extract cached credentials from Windows systems.


uses custom base64 encoding to obfuscate HTTP traffic.


uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.


uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.


uses DLL side-loading to load malicious programs.


uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended desitnation.


uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.


uses FakeTLS to communicate with its C2 server.


uses fake Transport Layer Security (TLS) to communicate with its C2 server, encoding data with RC4 encryption.


uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.


uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.


uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.


uses HTTP, HTTPS, FTP, and FTPS to communicate with the C2 server.  can also act as a webserver and listen for inbound HTTP requests through an exposed API.


uses HTTP and HTTPS for command and control.


uses HTTP and HTTPS to communicate with the C2 server.


uses HTTP as a transport to communicate with its command server.


uses HTTP for command and control communication.


uses HTTP for communication to the control servers.


uses HTTP for communication with the C2 server.


uses HTTP over SSL to communicate commands with the control server.


uses HTTP POST requests with data formatted using a custom protocol.


uses HTTPS, HTTP, and DNS for C2 communications.


uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.


uses HTTP TCP port 80 and HTTPS TCP port 443 for communications.


uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.


uses ipconfig /all and route PRINT to identify network adapter and interface information.


uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, and CVE-2015-1641.


uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server. It has also obfuscated its C2 traffic as normal traffic to sites such as Github.


uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.


uses mshta.exe to load its program and files.


uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.


uses multiple techniques to obfuscate strings, including XOR.


uses netstat -ano to search for specific IP address ranges.


uses Pastebin to store its real C2 addresses.


uses Port Numbers 443 and 80 for the C2 server.


uses ports 447 and 8082 for C2 communications.


uses PowerShell to add a Registry Run key in order to establish persistence.


uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.


uses public sites such as github.com and sendspace.com to upload files and then download them to victim computers.


uses Putty and VNC for lateral movement.


uses RC4 and Base64 to obfuscate strings.


uses RC4 encryption to obfuscate HTTP traffic.


uses RC4 to encrypt the message body of HTTP content.


uses RDP to tunnel traffic from a victim environment.


uses reflective DLL injection to inject the malicious library and execute the RAT.


uses reg add to add a Registry Run key for persistence.


uses remote services such as VPN, Citrix, or OWA to persist in an environment.


uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.


uses rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.


uses Rundll32 for executing the dropper program.


uses rundll32 to call an exported function.


uses Rundll32 to ensure only a single instance of itself is running at once.


uses rundll32 within  entries to execute malicious DLLs.


uses run keys for persistence on Windows


uses scheduled tasks typically named "Watchmon Service" for persistence.


uses scripts to enumerate IP ranges on the victim network.  has also issued the command net view /domain to a  implant to gather information about remote systems on the network.


uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.


uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.


uses single-byte XOR obfuscation to obfuscate many of its files.


uses SSL/TLS and RC4 to encrypt traffic.


uses SSL to encrypt its communication with its C2 server.


uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).


uses svchost.exe to execute a malicious DLL included in a new service group.


uses tasklist /v to check running processes.


uses the API call ShellExecuteW for execution.


uses the Camellia cipher to encrypt communications.


uses the certutil command to decode a payload file.


uses the command line and rundll32.exe to execute.


uses the command-line interface to execute arbitrary commands.


uses the command prompt to execute commands on the victim's machine.


uses the command reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”.


uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2.  also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.


uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the  malware.


uses the Dropbox cloud storage service for command and control.


uses the email platform, Naver, for C2 communications, leveraging SMTP.


uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\.


uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation.


uses the ipconfig /all command to gather the victim’s IP address.


uses the keychaindump project to read securityd memory.


uses the Microsoft  utility to list processes running on systems.


uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.


uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.


uses the tasklist to view running processes on the victim’s machine.


uses the Windows API call, CreateProcessW(), to manage execution flow.


uses  to clean up the environment and attempt to prevent detection.


uses  to execute a payload or commands on a remote host.


uses  to inject shellcode into PowerShell.


uses Twitter as a backup C2 method. It also has a module designed to post messages to the Russian VKontakte social media site.


uses variations of a simple XOR encryption routine for C&C communications.


uses various WMI queries to check if the sample is running in a sandbox.


uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.


uses Web shells on publicly accessible Web servers to access victim networks.


uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.


uses WMI to check for anti-virus software installed on the system.


uses WMI to perform discovery techniques.


uses XOR with random keys for its communications.


uses ZPP, a .NET console program, to compress files with ZIP.


variants can add malicious DLL modules as new services.


variants can use ports 443, 8443, and 8080 for communications.


variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe, as well as by adding a new service named OfficeUpdateService.


variants have communicated with C2 servers over HTTP and HTTPS.


Variants of  achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% (C:\WINDOWS\ntshrui.dll).


Variants of  encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.


Variants of  have added Run Registry keys to establish persistence.


Variants of  have used rundll32.exe in Registry values added to establish persistence.


variants reported on in 2014 and 2015 used a simple XOR cipher for C2.


Various implementations of  communicate with C2 over HTTP, SMTP, and POP3.


Various  malware enumerates logged-on users.


version of  adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.


versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."


was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.


was distributed through a compromised update to a Tor client with a coin miner payload.


was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.


was likely obfuscated using Invoke-Obfuscation.


When a document is found matching one of the extensions in the configuration,  uploads it to the C2 server.


When it first starts,  crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.


When it first starts,  crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.


will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.


will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.  will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2. Adversaries can also use  to establish an RDP connection with a controller over TCP/7519.


will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.


will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."


will identify Microsoft Office documents on the victim's computer.


will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).


will sleep until after a date/time value loaded from a .dat file has passed. This allows the RAT to remain dormant until a set date, which could allow a means to regain access if other parts of the actors' toolset are removed from a victim.


will timestomp any files or payloads placed on a target machine to help them blend in.


will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS instead if the DES decoding fails.


writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.


writes multiple outputs to a TMP file using the >> method.


’s installer is obfuscated with a custom crypter to obfuscate the installer.


’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC.


’s LSADUMP::DCSync, KERBEROS::Golden, and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.


From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS


We believe this access was abused, for example, by inserting malicious scripts in the country’s official websites in order to conduct watering hole attacks


This targeting of third party organizations to attack further targets is a risky move on the attackers’ part, as it potentially reveals their activity within the compromised third party organizations to the new target (those receiving the malicious documents  Making sense of MuddyWater When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East, we were somewhat confused as the previous public reporting had attributed these attacks to FIN7


Online news outlets and general websites were breached and weaponized as a vehicle for watering hole attacks


The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp, which differs from the Zebrocy downloader delivered in the February 2018 attacks


Like many threat groups, TG-3390 conducts strategic web compromises (SWCs), also known as watering hole attacks, on websites associated with the target organization's vertical or demographic to increase the likelihood of finding victims with relevant information


Threat actors compromise a website used by their target demographic (e.g., compromising a website specializing in oil and gas industry news when targeting the energy vertical)


The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell


This indicates that a human operative was executing commands on a command line style interface, rather than an automated or GUI process


Although MURKYTOP is primarily a command-line reconnaissance tool, it can also be used for lateral movement


After decryption, these 34 commands are plain text with parameters that are space delimited much like a command line


The command and parameter names are hashed before being compared by the binary, making it difficult to recover the original names of commands and parameters


These commands are also executed when the loadconfig command is issued


The loadconfig and state commands are executed during initialization, effectively creating the configuration file if it does not exist and writing the state command to it


Glimpse’s Agent Control Panel showing the interface actors would use to send commands The actor clicks the command to view the results in a popup window named “Result Viewer”


This script relays commands and output between the controller and the system


RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool


These are in-line with the targeting of the victims witnessed by the attackers using Conmie


Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan


Figure 3: ALFA TEaM Shell v2-Fake Mail (Default) Figure 4 shows an example email containing the default values the shell


Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands


Though this is unsophisticated, a remote shell does provide a highly flexible and powerful means of remote access in the hands of a skilled attacker


!CMD  Trojan executes a command prompt command


The Trojan will save the output of the command to %TEMP%\win<random number>.txt and send the contents to the C2 server or “The length of Cmd result file is ziro!” if the command was unsuccessful


The Visual Basic macro uses the following command line:  cmd /c expand %TEMP%\setup.cab -F:* %TEMP% && cd /d %TEMP% && del /f /q setup.cab && uacme.exe  The control server credential information contained in the CAB files is different:   Decoded credential data contained in another ipnet.ini


Remote Shell:  The function above is seen throughout many of the binaries in the Mirage family and is executed when a command is sent from the C&C


It is responsible for executing commands in cmd.exe (later down in the functions, not seen in the screenshot, it looks for cmd.exe and executes it using CreateProcessA)


This ID is sent to the CnC with each request for commands to execute


Supported commands “upload“, “screenshot“, “Excel“, “Outlook“, “risk“, “reboot“, “shutdown“, “clean“


Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal:   Figure 28. Commands used for downloading and executing, and running a command in terminal   Figure 29. Commands used in uploading and downloading file Figure 30


cmd.exe /C choice /C Y /N /D Y /T 2 & Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin


Otherwise, the Trojan will attempt to parse the response for a command, specifically by splitting the decode response on <> and treating the text to the left of the <> string as the command the text to the right as the command arguments


The malware basically provides a remote CMD/PowerShell terminal for the attackers, enabling them to execute scripts/commands and receive the results via HTTP requests


Execute noninteractive commands on multiple hosts at once


Open interactive python shells with auto-completion on the all-in-memory remote python interpreter


Remote shells on Unix & Windows clients have a real tty with all keyboard signals working just like an SSH shell


Figure 1: SpeakUp’s Victim Distribution  Figure 2: SpeakUp’s propagation rate per day Infection Vector The initial infection vector is targeting the recently reported vulnerability in ThinkPHP and uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor


Figure 6: SpeakUp receives additional commands to execute, this time in plain text


Command execution Command execution can create havoc for victim if the malware developer decides to execute commands in the victim’s device


MURKYTOP: a command-line reconnaissance tool


The summit is the latest in a line of signs of diplomatic outreach from North Korea, following the Panmunjom Declaration for Peace, Prosperity and Unification of the Korean Peninsula between South Korea and North Korea on April 27, 2018


The starred commands are undocumented commands


Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell


UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe


This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system


Figure 2: Sofacy Fysbis capability related leakage through strings Figure 2 shows interactive status / feedback strings that can give a defender an initial profile of capabilities


For comparison, if we were to inspect Fysbis “RemoteShell” associated strings in one of the stripped variants, we would only see the following:  Figure 3: Sofacy Fysbis stripped binary string references to RemoteShell capability Compare this with what is available from the non-stripped variant:  Figure 4: Sofacy Fysbis non-stripped binary strings referenes to RemoteShell capability Little static analysis gifts like these can help to speed defender enumeration of capabilities and – more importantly – further contribute to correlation and detection across related samples


That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload


Messages are encrypted using AES with a static key


Evidence also supports the hypothesis that there is a encryption plugin for victim files (see below)


Destructive dstr command in BE2 config file Also, on some machines, documents were encrypted, but no related plugin could be found


It is prepended to the encrypted and encoded message


The headers are XOR encrypted with <hdrXORKey1> and <hdrXORKey2> combined and reversed


Build Tool Most of CARBANAK’s strings are encrypted in order to make analysis more difficult


Tool Type Internal Name Industry Name   Backdoor Poison Frog BONDUPDATER   Backdoor Glimpse Updated BONDUPDATER   Webshell HyperShell TwoFace loader   Webshell HighShell TwoFace payload   Webshell Minion TwoFace payload variant   DNS Hijacking Toolkit webmask Related to DNSpionage     Table 1


The HyperShell and HighShell webshells are variants of what we track as TwoFace, with HyperShell being related to the TwoFace loader and HighShell being related to the TwoFace payload, as we reported in July 2017


Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data


Configuration Config.ini is the file where the malware stores its encrypted configuration data


While performing the analysis on the delivery documents using the .sct file AppLocker bypass, we noticed the C# payload was functionally similar to the original RogueRobin payload


Figure 3 Targeted lure content In one of the documents, the victim is presented with what appears to be an obfuscated document with the NATO EOD seal and text alluding to the targeted nation state


WindowsDefender.ini – The Base64 encoded and obfuscated PowerShell script


Figure 3: The first step of decryption will perform XOR on one byte using the previous adjacent byte, starting from the last byte and excluding the first byte  Figure 4: The second step uses RC4, using the first 0x20 bytes from the result of the first step as the RC4 key  Figure 5: Encrypted (Top) and decrypted (bottom) configuration file It is also important to note that while the loader component and the configuration file are located in the same directory (%windows%\system32), the encrypted backdoor is located in a different directory (%Program Files%\Common Files\System\ado)


All strings used by the Trojan are encrypted with the XOR algorithm


Next, the buffer is encrypted using the RC4 algorithm with the 50-byte key (also stored in the backdoor’s body)


11 bytes of this buffer are encrypted with the XOR algorithm as follows: i = 0 while ( 1 ) {   crypted_buffer = (_BYTE *)this_->crypted_buffer;   if ( i gt;= this-gt;crypted_buffer_size - 4 ) // this-gt;crypted_buffer_size == 15     break;   ++i;   crypted_buffer[i + 4] ^= crypted_buffer[i & 3];  The generated buffer in encoded using the BASE64 alphabet, where the last two characters are replaced with “-” and “_”


Next, to the beginning of the BASE64 string a random BASE64 string with the length of 5 characters is added


The first 11 bytes of the received buffer are encrypted with the XOR algorithm


Once it is encrypted using the XOR algorithm, the buffer is encoded with BASE64


These redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer


Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES


Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related


Specifically, the following GitHub repositories appear to be controlled by the MuddyWater threat actor(s):  [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/ArabicBrowserFont.exe   [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/FontArabic.exe     9b5e36bb7518a9e333c31d09b589102f89e3425571dd434820ab3c437dc4e0d9 (and several others)  Downloads payload from: hxxps://raw.githubusercontent[.]com/ReactDeveloper2017/react/master/src/test/test.js    Interestingly, both profiles were populated with forked repositories to give them an air of legitimacy as shown in figure 2


The domain names differed but the script adheres to the same logic (including the logic function).” The DNSMessenger malware is an obfuscated and customized version of the popular DNS_TXT_PWNAGE.ps1 script available on GitHub and is also referred to by FireEye as POWERSOURCE


Malicious obfuscated VBA code is executed when the macro is first enabled


In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code


There are two forms of encrypted strings: an RSA256-encrypted string, and custom base64-encoded and RSA256-encrypted string


At face value, this current variant of OopsIE has a vast majority of its strings obfuscated, which can be deobfuscated by splitting the strings using the hyphen as a delimiter, treating each split value as an integer, subtracting one from each integer and converting each into a character


This tool was originally intended to aid defenders in simulating obfuscated PowerShell commands to better their defenses


Invoke-Obfuscation calls the variable obfuscation technique used by the actors to obfuscate this script Random Case + {} + Ticks, which changes all variables in the script to have randomly cased characters, to be surrounded in curly braces and to include the tick (`) character, which is ignored in by PowerShell


By applying two specific obfuscation techniques within Invoke-Obfuscation, we were able to create an obfuscated PowerShell script that was very similar to the QUADAGENT payloads delivered in the attacks discussed in this blog


All the strings and settings were encrypted and obfuscated


The configuration and strings are encrypted using 3DES and Base64 encoding


The shellcode is not encrypted but is obfuscated


Decrypting the Configuration As previously mentioned, the real configuration data is stored in the first stage shellcode but it is not stored in cleartext, but encrypted and compressed


The configuration data is encrypted with the same algorithm described previously by JPCert but using a different XOR value


The configuration blob is encoded using a simple single-byte XOR scheme


KopiLuwak In November 2016, Kaspersky Lab observed a new round of weaponized macro documents that dropped a new, heavily obfuscated Javascript payload that we named KopiLuwak (one of the rarest and most expensive types of coffee in the world)


Figure 3: no detections for SpeakUp in Virus Total In an attempt to endure the investigation process by security researchers, the second stage payload was encoded with salted base64


Some strings are obfuscated with XOR x56


These files are stored within an 217kb encrypted cab file in the dropper’s resources under the name “A”


The cab file was encrypted and decrypted using a simple xor cipher with a rotating 16 byte key: \x36\x11\xdd\x08\xac\x4b\x72\xf8\x51\x04\x68\x2e\x3e\x38\x64\x32


This is encrypted by RC4, using the key {0xb5, 0x78, 0x62, 0x52, 0x98, 0x3e, 0x24, 0xd7, 0x3b, 0xc6, 0xee, 0x7c, 0xb9, 0xed, 0x91, 0x62}


We’ve identified two such files: settings.db sdfg3d.db Here’s how such a database file appears:  These are BASE64 encoded and use the same RC4 encryption key as the malware configuration


The CARROTBAT malware family is a somewhat unique dropper and while it supports various types of decoy documents, and employs rudimentary command obfuscation, it should be made clear that it is not sophisticated


HttpBrowser's executable code may be obfuscated through structured exception handling and return-oriented programming


All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks


Figure 7: The same de-obfuscated code as Figure 2 The only other script content of the blog-page[.]html is an empty script section


PlayList.vbs contains the obfuscated codes, which it executes after decrypting the obfuscations.


Once executed, Vcrodat loads an encrypted payload on to the victim’s computer.


The JavaScript is heavily obfuscated. The first variable—a—is an array of obfuscated values


This shellcode is decrypted in memory through EQENDT32.EXE


The encrypted file contains a config file of 0x78 bytes. The data is decrypted with an 0xD9 XOR operation.


The actors have made some small changes, such as altering the variable names to avoid Yara detection


To operate and evade standard analysis tools, most of the functions are hashed


The encryption/decryption routine (refer to Figure 5) can be summarized as follows:      Figure 5: Encryption/ Decryption Function  Generate an array of integers from 0x00 to 0xff Scrambles the state of the table using the given key Encrypts or decrypts a string using the scrambled table from (b)


Version 2 Rather than using the host ID as the key, this version uses a random XOR key between 32 and 64 bytes in length that is generated for each session


A build tool is likely being used by these attackers that allows the operator to configure details such as C2 addresses, C2 encryption keys, and a campaign code


After applying this decryption algorithm, we are presented with the following data: h=HOSTNAME-PC&f=mission.ini&c=& The response made by the C2 server uses the same RC4 key for encryption


The BONDUPDATER script, which was named based on the hard-coded string “B007”, uses a custom DGA algorithm to generate subdomains for communication with the C2 server


Figure 9: Example Network Communication In the example, the POWRUNER client sends a random GET request to the C2 server and the C2 server sends the random number (99999999990) as a response


The structure of each of these outbound DNS requests is as follows: <system ID>-<job ID>-<offset in data><more data flag>-<random length of base64 encoded data between 30 and 42 characters>.<c2 domain> The payload will look for different responses to these outbound queries depending on the type of DNS request that the payload uses to communicate with the C2


The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie


<encoded system data>.<same random number between 100000 and 999999 above>.<c2 name>   After obtaining a session ID and pre-shared key, the PowerShell script will continue to communicate with its C2 server to obtain data to treat as a command


Instead, it immediately issues a query to resolve the following domain, which embeds the session ID value to transmit it to the C2:   <encoded session id>.<same random number between 100000 and 999999>.<c2 domain name>   To transmit the data via the DNS tunneling, the C2 server will respond to the above query with an IPv6 address that contains the number of DNS queries the payload must issue to obtain the entirety of the data from subsequent IPv6 answers


The script will send the specified number of DNS queries using the following format, each of which the C2 will respond with an IPv6 address that the script will treat as a string of data:   www.<sequence number>.<same random number between 100000 and 999999>.<c2 domain name>   The payload will treat the data provided by the C2 as a message, which will have the following structure:   hello<char uuid[35]><char type[1]><data>   The message will start with the string hello followed by a 35-character UUID string


Neither this new domain nor the IP it resolves to have been observed in the past, indicating that the sample in Table 3 may be associated with a newer campaign


Table 4: URL parameters Additionally, the command string is hashed using the same RGPH hashing algorithm as before


In one instance, a log file recovered from an open indexed server revealed that an IP address (112.66.188.28) located in Hainan, China had been used to administer the command and control node that was communicating with malware on victim machines


APT40 used MURKYSHELL at a compromised victim organization to port scan IP addresses and conduct network enumeration


In order to decide which domain xparis() holds, a variable pingadori() uses the radador() function to randomize the domain


Instructions within guide.txt explaining how to carry out DNS hijacking attack In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to


Note that IP addresses can be reallocated


Backdoor.Pirpi also collects information about the target’s local network, including the domain controller and workstations


Examining historical IP resolutions revealed a common IP between the active nameservers, 107.175.75[.]123


This IP is of particular interest as historical domain resolutions of this IP revealed that it had resolved to the domain hotmai1l[.]com in the past as well, which was a domain we had previously identified as having a high likelihood of association with DarkHydrus infrastructure


This IP also belongs to the same service provider and class B network range as another IP we had associated with DarkHydrus, 107.175.150[.]113 which specifically resolved to a domain name containing a victim organization’s name


After the second DLL is loaded into memory, the first DLL overwrites the IP address for the control server, effectively changing the address the malware will communicate with


FBI has high confidence that HIDDEN COBRA actors are using the IP addresses for further network exploitation.This alert includes technical indicators related to specific North Korean government cyber operations and provides suggested response actions to those indicators, recommended mitigation techniques, and information on reporting incidents to the U.S


DHS and FBI recommend that network administrators review the IP addresses, file hashes, network signatures, and YARA rules provided, and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization.When reviewing network perimeter logs for the IP addresses, organizations may find numerous instances of these IP addresses attempting to connect to their systems


The IP address in the lateral movement techniques was substituted with the local machine IP address to achieve code execution on the system


When we analyzed the email headers, we determined that the email was sent from an SMTP server using an IP associated with the Yonsei University network


text=  from=  ai= ags=  oe= aq= btnG=  oprnd=  ai= utm=  channel=  The page address in the domain of the command and control server is chosen randomly from the list


Analysis of their configurations show that the C2 servers used both fully-qualified domain names and IP addresses


The code will gather some information about the system, specifically the local IP address, MAC address, and the external IP address of the system


Similar to Reaver as posted by Palo Alto, it gets the IP or domain of the C&C server, the port, name of the binary, a sleep timer, and what Palo Alto calls a “campaign identifier.” Technical Details At this moment, we were unable to retrieve the original infection vector and other information regarding what other tools the APT15 group is using to attack their targets


Victim system reconnaissance The code then tries to obtain the victim’s public IP via “https://api.ipify.org/”


If the first resolved domain IP address starts with 24.125.X.X, then it is set to 1


It is unknown what these domains may have been used for but based on the similarity of domain spoofing and sharing an IP, they are likely part of the adversary infrastructure


Inspecting the class C network for 185.162.235.0/24 shows us that another IP on the same network resolves to an OilRig domain, msoffice-cdn[.]com which we identified in August 2017


The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command "05 01 00 01 c0 b8 3c e5 00 51" and verifies that the first two bytes from the server are "05 00" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order)


The chinapolicyanalysis.org domain was used as the sender address, as well as the hosting location of the malicious RTF document


The mericcs.org domain was used as the sender address, as well as the hosting location of the malicious RTF document


The structure of the domain mimics the Mercator Institute for China Studies (MERICS), whose actual domain is merics.org


Network Indicators     Hostname IP Address Notes   mailcenter.support 221.121.138.139 Domain used to for sending spear phishes and user tracking


chinapolicyanalysis.org 185.130.212.168 Domain used for spear phish sender e-mail address and to host malicious documents


fprii.net 185.130.212.254 Domain used for spear phish sender e-mail address and to host malicious documents


mericcs.org 221.121.138.141 Domain used for spear phish sender e-mail address and to host malicious documents


In February 2018, several KHRAT associated domains began resolving to the IP address 89.46.222[.]97


One of these domains, facebook-apps[.]com, was identified in one of the malware samples associated with this IP address


The diagram in Figure 1 shows the samples, domains, IP addresses and e-mail addresses that we identified during our investigation (See Appendix B for more detail on these.) There is a clear split between Cluster A and Cluster B, with no infrastructure overlap between the two


One of the first steps that several Mosquito installer packages performed after writing and running this local_update js file was to export all local host’s WiFi profiles (settings and passwords) to %APPDATA%\<profile>.xml with a command line call: cmd.exe /c netsh wlan export profile key=clear folder="%APPDATA%" They then gather more network information with a call to ipconfig and arp -a


hxxp://www.sanjosemaristas[.]com/app/index.php?{A01BA0AD-9BB3-4F38-B76B-A00AD11CBAAA}, providing the current network adapter’s service name GUID


In Figure 9, below, red indicates targeted IP addresses, malware, registrant information, and domains associated with the targeted attack campaign while blue indicates criminal attack IP addresses, malware used, registrant information, and domains:  Figure 9


(Source: Dell SecureWorks) As shown in Figure 10, the unpacked JavaScript code reveals an iframe pointing to an IP address that is hosting the exploit


It is a preferred platform within data centers and the cloud for businesses, as well as an ongoing favorite when it comes to a majority of Internet-facing web and application servers


Furthermore, this group has routinely identified and exploited vulnerable web servers of targeted organizations to install web shells, such as ANTAK and ASPXSPY, and used stolen legitimate credentials to compromise externally facing Outlook Web Access (OWA) resources


Attack Lifecycle  Initial Compromise APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation, phishing campaigns delivering publicly available and custom backdoors, and strategic web compromises


Web shells are heavily relied on for nearly all stages of the attack lifecycle


Internal web servers are often not configured with the same security controls as public-facing counterparts, making them more vulnerable to exploitation by APT40 and similarly sophisticated groups


Maintain Presence APT40 primarily uses backdoors, including web shells, to maintain presence within a victim environment


APT40 strongly favors web shells for maintaining presence, especially publicly available tools


OwaAuth — This web shell and credential stealer deployed to Microsoft Exchange servers is installed as an ISAPI filter


(Source: SecureWorks)  China Chopper web shell — This web-based executable script communicates with a full-featured user interface to allow threat actors to transfer and create files, open a command terminal, and interact with database servers


(Source: SecureWorks) In multiple instances, CTU researchers observed artifacts from unsuccessful attempts to create a web shell on web-accessible JBOSS-based service desk software, followed by use of a functional shell to gain access to the environment


(Source: SecureWorks) Reentry attempt After BRONZE UNION was evicted from a compromised environment, which involved blocking the group's known infrastructure, CTU researchers observed the group attempting to reconnect to its OWA web shells and a backup web shell it had deployed during the intrusion


To report an intrusion and request resources for incident response or technical assistance, you are encouraged to contact DHS NCCIC (NCCICCustomerService@hq.dhs.gov or 888-282-0870), the FBI through a local field office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).Protect Against SQL Injection and Other Attacks on Web ServicesTo protect against code injections and other attacks, system operators should routinely evaluate known and published vulnerabilities, periodically perform software updates and technology refreshes, and audit external-facing systems for known web application vulnerabilities


They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector.Use and configure available firewalls to block attacks.Take steps to secure Windows systems, such as installing and configuring Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) and Microsoft AppLocker.Monitor and remove any unauthorized code present in any www directories.Disable, discontinue, or disallow the use of Internet Control Message Protocol (ICMP) and Simple Network Management Protocol (SNMP) as much as possible.Remove unnecessary HTTP verbs from web servers


Typical web servers and applications only require GET, POST, and HEAD.Where possible, minimize server fingerprinting by configuring web servers to avoid responding with banners identifying the server software and version number.Secure both the operating system and the application.Update and patch production servers regularly.Disable potentially harmful SQL-stored procedure calls.Sanitize and validate input to ensure that it is properly typed and does not contain escaped code.Consider using type-safe stored procedures and prepared statements.Audit transaction logs regularly for suspicious activity.Perform penetration testing on web services.Ensure error messages are generic and do not expose too much information.Permissions, Privileges, and Access ControlsSystem operators should take the following steps to limit permissions, privileges, and access controls.Reduce privileges to only those needed for a user’s duties.Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services


Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell


Audit ISAPI filters and search for web shells on Microsoft Exchange servers


(Source: Dell SecureWorks) Passwords, like "admin-na-google123!@#" shown in Figure 4, are required to interact with the web shell


TG-3390 has used additional web shells containing similarly formatted passwords


However, the OwaAuth web shell password contains the victim organization's name


More information about the OwaAuth web shell is available in Appendix C


ASPXTool — A modified version of the ASPXSpy web shell (see Figure 6)


The OwaAuth web shell is likely created with a builder, given that the PE compile time of the binary does not change between instances and the configuration fields are padded to a specific size


The adversaries modify publicly available tools such as ASPXSpy to remove identifying characteristics that network defenders use to identify web shells


TG-3390 actors have deployed the OwaAuth web shell to Exchange servers, disguising it as an ISAPI filter


They then identify the Exchange server and attempt to install the OwaAuth web shell


If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells


(Source: Dell SecureWorks) To facilitate lateral movement, the adversaries deploy ASPXTool web shells to internally accessible systems running IIS


Mapping of TG-3390's interactions with web shells during an intrusion responded to by CTU researchers


Each web shell instance is configured to contain SP, Key, and Log variables


The stylecs.aspx webshell provides fairly significant functionality, as its developer wrote this webshell in JScript that ultimately runs any supplied JScript code provided to it within the HTTP request..


The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain: “Gmail -” “Yahoo – login” “Sign In -” “Outlook.com -“ MPK will attempt to parse these window titles to identify the associated email address and record these to the log file using the following format: ///////////// Mail Find <email address> /////////// If the Trojan does not find the window titles associated with Gmail, Yahoo or Outlook, it saves the title to the “Save.tmp” file in the following format: +++++++++++++ Window= <window title> +++++++++++++ The major difference between the IRC variant and non-IRC variant of MPK is the C2 protocol used


Offset Description   0x0 Victim GUID (8C8CEED9-4326-448B-919E-249EEC0238A3)   0x25 Victim IP Address (192.168.180.154)   0x45 Command (0x66660001)   0x49 Length of payload (0x2f – 47)   0x4d Field 1 – Windows major version (0x6 – Windows Vista+)   0x51 Field 2 – Windows minor version (0x1 – Windows 7)   0x55 Field 3 – Unknown (0x20)   0x59 Payload (default flag:4/2/2018 1:01:33 AM)    Table 5 – Beacon structure for PLAINTEE


Linux malware detection and prevention is not prevalent at this time, but Palo Alto Networks customers are protected through our next-generation security platform:  IPS signature 14917 deployed to identify and prevent command and control activity The C2 domains and files mentioned in this report are blocked in our Threat Prevention product


The organization managed to discover what scripts were hosted on the server before BE/SandWorm gang deleted them, and unfortunately couldn’t restore them after they were deleted


For example, at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network


After running within the %TEMP% path, Comnie will delete the original file


KEYS Deletes the file named by tempPath + “ky” file so as not to upload anything


HDS Deletes the file created by the HD command to reverse the effect


DEL-TEMP Deletes all files in the “AppData/Local/Temp” path


Overwrite a file with all zeros and mark it for deletion on reboot  Wiping files with zeros and marking it for deletion on reboot.   Delete files using the DeleteFile() API Load an arbitrary library into its process space


The SHAPESHIFT malware is capable of wiping disks, erasing volumes and deleting files, depending on its configuration


Appendix Malware Family Descriptions    Malware Family  Description  Availability    DROPSHOT  Dropper that has been observed dropping and launching the TURNEDUP backdoor, as well as the SHAPESHIFT wiper malware  Non-Public    NANOCORE  Publicly available remote access Trojan (RAT) available for purchase


The message sent to the C2 will be “file is deleted.” if successful or “file is not deleted.” if unsuccessful


The dropped executable (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9) contains the compressed FELIXROOT dropper component in the Portable Executable (PE) binary overlay section


The dropper will delete itself at the end of the process


After this file is copied, the original ‘Update.~tmp’ file is deleted


boom! Deletes GID.bin, ShwDoc.VBS and ShwDoc.srv files, as well as the scheduled task whose name a GUID stored in the GID.bin file


Also, the x command will delete the generated registry key and the Office365DCOMCheck/SystemDiskClean scheduled task


This system configuration file (in.sys) will drop a backdoor installer (UserInstall.exe) then delete itself


This version of the campaign made malicious use of unins000.exe, a process that belongs to the Brazilian information security company GAS Tecnologia, to gather personal information undetected


The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group


This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities


The data above contains the hostname (‘HOSTNAME-PC’) of the victim machine, as well as an instruction


To obtain a job, the Trojan builds a subdomain that has the following structure and issues a DNS query to the C2 server: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c The generated subdomain is then subjected to a number-to-character substitution function that is the inverse of the Table 4, which effectively converts all the digits in the subdomain into characters


Once the second DLL is executed, it gathers information about the victim system’s setup, such as operating system version, and driver and processor information


One computer that was infected with both Cadelspy and Remexi was a system that ran a SIM card editing application