Task2.test

Low	O
-	O
profile	O
information	O
-	O
stealing	O
Trojan	O
is	O
used	O
only	O
against	O
high-	O
value	O
targets	O
.	O
	
Symantec	O
has	O
uncovered	O
an	O
elusive	O
Trojan	O
used	O
by	O
the	O
cyberespionage	O
group	O
behind	O
the	O
€	O
œDuke	O
€	O
​	O
family	O
of	O
malware	O
.	O
	
Seaduke	O
(	O
detected	O
by	O
Symantec	O
as	O
Trojan	O
.	O
Seaduke	O
)	O
is	O
a	O
low	O
-	O
profile	O
information-	O
stealing	O
Trojan	O
which	O
appears	O
to	O
be	O
reserved	O
for	O
attacks	O
against	O
a	O
small	O
number	O
of	O
high	O
-	O
value	O
targets	O
.	O
	
Seaduke	O
has	O
been	O
used	O
in	O
attacks	O
against	O
a	O
number	O
of	O
major	O
,	O
government	O
-	O
level	O
targets	O
.	O
	
The	O
malware	O
hides	O
behind	O
numerous	O
layers	O
of	O
encryption	O
and	O
obfuscation	O
and	O
is	O
capable	O
of	O
quietly	O
stealing	O
and	O
exfiltrating	O
sensitive	O
information	O
such	O
as	O
email	O
from	O
the	O
victim	O
€	O
™s	O
computer	O
.	O
	
Seaduke	O
has	O
a	O
highly	O
configurable	O
framework	O
and	O
Symantec	O
has	O
already	O
found	O
hundreds	O
of	O
different	O
configurations	O
on	O
compromised	O
networks	O
.	O
	
Its	O
creators	O
are	O
likely	O
to	O
have	O
spent	O
a	O
considerable	O
amount	O
of	O
time	O
and	O
resources	O
in	O
preparing	O
these	O
attacks	O
and	O
the	O
malware	O
has	O
been	O
deployed	O
against	O
a	O
number	O
of	O
high	O
-	O
level	O
government	O
targets	O
.	O
	
While	O
the	O
Duke	O
group	O
began	O
to	O
distribute	O
Cozyduke	O
in	O
an	O
increasingly	O
aggressive	O
manner	O
,	O
Seaduke	O
installations	O
were	O
reserved	O
only	O
for	O
select	O
targets	O
.	O
	
Seaduke	O
victims	O
are	O
generally	O
first	O
infected	O
with	O
Cozyduke	O
and	O
,	O
if	B-Modifier
the	O
computer	B-Entity
appears	I-Entity
to	I-Entity
be	I-Entity
a	I-Entity
target	I-Entity
of	I-Entity
interest	I-Entity
,	O
the	B-Entity
operators	I-Entity
will	O
install	B-Action
Seaduke	B-Entity
.	O
	
The	O
group	O
behind	O
Seaduke	O
is	O
a	O
cyberespionage	O
operation	O
that	O
is	O
responsible	O
for	O
a	O
series	O
of	O
attacks	O
against	O
high	O
-	O
profile	O
individuals	O
and	O
organizations	O
in	O
government	O
,	O
international	O
policy	O
and	O
private	O
research	O
in	O
the	O
United	O
States	O
and	O
Europe	O
.	O
	
It	O
has	O
a	O
range	O
of	O
malware	O
tools	O
at	O
its	O
disposal	O
,	O
known	O
as	O
the	O
Dukes	O
,	O
including	O
Cozyduke	O
(	O
Trojan	O
.	O
Cozer	O
)	O
,	O
Miniduke	O
(	O
Backdoor	O
.	O
Miniduke	O
)	O
and	O
Cosmicduke	O
(	O
Backdoor	O
.	O
Tinybaron	O
)	O
.	O
	
News	O
of	O
the	O
Duke	O
group	O
first	O
emerged	O
in	O
March	O
and	O
April	O
of	O
2015	O
,	O
when	O
reports	O
detailing	O
attacks	O
involving	O
a	O
sophisticated	O
threat	O
actor	O
variously	O
called	O
Office	O
Monkeys	O
,	O
EuroAPT	O
,	O
Cozy	O
Bear	O
,	O
and	O
Cozyduke	O
were	O
published	O
.	O
	
Symantec	O
believes	O
that	O
this	O
group	O
has	O
a	O
history	O
of	O
compromising	O
governmental	O
and	O
diplomatic	O
organizations	O
since	O
at	O
least	O
2010	O
.	O
	
The	O
group	O
began	O
its	O
current	O
campaign	O
as	O
early	O
as	O
March	O
2014	O
,	O
when	O
Trojan	O
.	O
Cozer	O
(	O
aka	O
Cozyduke	O
)	O
was	O
identified	O
on	O
the	O
network	O
of	O
a	O
private	O
research	O
institute	O
in	O
Washington	O
,	O
D.C.	O
	
In	O
the	O
months	O
that	O
followed	O
,	O
the	B-Entity
Duke	I-Entity
group	I-Entity
began	O
to	O
target	B-Action
victims	B-Entity
with	B-Modifier
€	O
œOffice	B-Entity
Monkeys	I-Entity
€	I-Entity
​-	I-Entity
and	I-Entity
€	I-Entity
œeFax	I-Entity
€	I-Entity
​-themed	I-Entity
emails	I-Entity
,	I-Entity
booby	I-Entity
-	I-Entity
trapped	I-Entity
with	I-Entity
a	I-Entity
Cozyduke	I-Entity
payload	I-Entity
.	O
	
These	O
tactics	O
were	O
atypical	O
of	O
a	O
cyberespionage	O
group	O
.	O
	
It	O
€	O
™s	O
quite	O
likely	O
these	O
themes	O
were	O
deliberately	O
chosen	O
to	O
act	O
as	O
a	O
smokescreen	O
,	O
hiding	O
the	O
true	O
intent	O
of	O
the	O
adversary	O
.	O
	
The	O
Duke	O
group	O
has	O
mounted	O
an	O
extended	O
campaign	O
targeting	O
high	O
-	O
profile	O
networks	O
over	O
extended	O
periods	O
,	O
something	O
which	O
is	O
far	O
beyond	O
the	O
reach	O
of	O
the	O
majority	O
of	O
threat	O
actors	O
.	O
	
Its	O
capabilities	O
include	O
.	O
	
Attack	O
infrastructure	O
leveraging	O
hundreds	O
of	O
compromised	O
websites	O
Rapidly	O
developed	O
malware	O
frameworks	O
in	O
concurrent	O
use	O
Sophisticated	O
operators	O
with	O
fine	O
-	O
tuned	O
computer	O
network	O
exploitation	O
(	O
CNE	O
)	O
skills	O
Although	O
Cozyduke	O
activity	O
was	O
first	O
identified	O
in	O
March	O
2014	O
,	O
it	O
wasn	O
€	O
™t	O
until	O
July	O
that	O
the	O
group	O
managed	O
to	O
successfully	O
compromise	O
high	O
-	O
profile	O
government	O
networks	O
.	O
	
Cozyduke	O
was	O
used	O
throughout	O
these	O
attacks	O
to	O
harvest	O
and	O
exfiltrate	O
sensitive	O
information	O
to	O
the	O
attackers	O
.	O
	
In	O
parallel	O
,	O
the	O
Duke	O
group	O
was	O
also	O
installing	O
separate	O
malware	O
onto	O
these	O
networks	O
,	O
namely	O
Backdoor	O
.	O
Miniduke	O
and	O
the	O
more	O
elusive	O
Trojan	O
.	O
Seaduke	O
.	O
	
It	O
could	O
use	O
these	O
payloads	O
to	O
exploit	O
networks	O
on	O
multiple	O
fronts	O
and	O
providing	O
it	O
with	O
additional	O
persistence	O
mechanisms	O
.	O
	
In	O
July	O
of	O
2014	O
,	O
the	B-Entity
group	I-Entity
instructed	B-Action
Cozyduke	O
-	B-Entity
infected	I-Entity
computers	I-Entity
to	B-Modifier
install	O
Backdoor	B-Entity
.	I-Entity
Miniduke	I-Entity
onto	I-Entity
a	I-Entity
compromised	I-Entity
network	I-Entity
.	O
	
Miniduke	O
has	O
been	O
the	O
group	O
€	O
™s	O
tool	O
of	O
choice	O
for	O
a	O
number	O
of	O
years	O
in	O
espionage	O
operations	O
predominantly	O
targeting	O
government	O
and	O
diplomatic	O
entities	O
in	O
Eastern	O
Europe	O
and	O
ex	O
-	O
Soviet	O
states	O
.	O
	
€	O
œNemesis	O
Gemina	O
€	O
​	O
appears	O
to	O
be	O
the	O
internal	O
name	O
for	O
the	O
framework	O
used	O
by	O
the	O
group	O
to	O
identify	O
the	O
project	O
,	O
previously	O
reported	O
by	O
Kaspersky	O
.	O
	
The	O
following	O
debug	O
string	O
was	O
present	O
in	O
the	O
sample	O
used	O
in	O
these	O
attacks	O
.	O
	
C:\Projects\nemesis	O
-	O
gemina\nemesis\bin\carriers\ezlzma_x86_exe.pdb	O
This	O
project	O
name	O
has	O
been	O
seen	O
in	O
Backdoor	O
.	O
Tinybaron	O
(	O
aka	O
Cosmicduke	O
)	O
samples	O
,	O
which	O
Symantec	O
also	O
attributes	O
to	O
the	O
Duke	O
group	O
.	O
	
This	O
deployment	O
of	O
Miniduke	O
and	O
the	O
technical	O
similarities	O
with	O
Cozyduke	O
provided	O
strong	O
indicators	O
as	O
to	O
who	O
was	O
behind	O
the	O
attacks	O
.	O
	
The	O
Seaduke	O
payload	O
These	O
attacks	O
were	O
already	O
well	O
underway	O
when	O
another	O
group	O
began	O
to	O
deploy	O
a	O
previously	O
unknown	O
piece	O
of	O
malware	O
.	O
	
In	O
October	O
2014	O
,	O
the	O
Seaduke	O
payload	O
began	O
to	O
appear	O
within	O
target	O
networks	O
.	O
	
Although	O
Seaduke	O
was	O
developed	O
in	O
Python	O
,	O
the	O
overall	O
framework	O
bears	O
a	O
striking	O
resemblance	O
to	O
Cozyduke	O
in	O
terms	O
of	O
operation	O
.	O
	
It	O
€	O
™s	O
unclear	O
why	O
the	O
attackers	O
waited	O
until	O
October	O
to	O
deploy	O
Seaduke	O
.	O
	
Was	O
it	O
reserved	O
for	O
a	O
more	O
specific	O
attack	O
?	O
Was	O
part	O
of	O
their	O
cover	O
blown	O
,	O
necessitating	O
the	O
use	O
of	O
an	O
alternative	O
framework	O
?	O
The	O
Seaduke	O
framework	O
was	O
designed	O
to	O
be	O
highly	O
configurable	O
.	O
	
Hundreds	O
of	O
reconfigurations	O
were	O
identified	O
on	O
compromised	O
networks	O
.	O
	
The	O
communication	O
protocol	O
employed	O
had	O
many	O
layers	O
of	O
encryption	O
and	O
obfuscation	O
,	O
using	O
over	O
200	O
compromised	O
web	O
servers	O
for	O
command	O
and	O
control	O
.	O
	
Seaduke	O
required	O
a	O
significant	O
investment	O
of	O
time	O
and	O
resources	O
in	O
the	O
preparatory	O
and	O
operational	O
phases	O
of	O
the	O
attack	O
.	O
	
The	O
attackers	B-Entity
control	B-Action
Cozyduke	B-Entity
via	B-Modifier
compromised	O
websites	B-Entity
,	O
issuing	O
instructions	O
to	O
infected	O
machines	O
by	O
uploading	O
€	O
œtasks	O
€	O
​	O
to	O
a	O
database	O
file	O
.	O
	
Cozyduke	B-Entity
will	O
periodically	O
contact	B-Action
these	O
websites	B-Entity
to	B-Modifier
retrieve	O
task	B-Entity
information	I-Entity
to	I-Entity
be	I-Entity
executed	I-Entity
on	I-Entity
the	I-Entity
local	I-Entity
machine	I-Entity
.	O
	
One	O
such	O
task	O
(	O
an	O
encoded	O
PowerShell	O
script	O
)	O
instructed	O
Cozyduke	B-Entity
to	O
download	B-Action
and	O
execute	B-Action
Seaduke	B-Entity
from	B-Modifier
a	O
compromised	B-Entity
website	I-Entity
.	O
	
Seaduke	O
operation	O
The	O
attackers	O
can	O
operate	O
Seaduke	O
in	O
a	O
broadly	O
similar	O
fashion	O
to	O
Cozyduke	O
.	O
	
The	O
Seaduke	O
control	O
infrastructure	O
is	O
essentially	O
distinct	O
,	O
opening	O
up	O
the	O
possibility	O
of	O
sub	O
-	O
teams	O
concurrently	O
exploiting	O
the	O
target	O
network	O
.	O
	
Unlike	O
Cozyduke	O
,	O
Seaduke	B-Entity
operators	I-Entity
upload	B-Action
€	O
œtask	O
€	O
​	O
files	B-Entity
directly	O
to	B-Modifier
the	O
command-	B-Entity
and	I-Entity
-	I-Entity
control	I-Entity
(	I-Entity
C&C	I-Entity
)	I-Entity
server	I-Entity
;	O
there	O
is	O
no	O
database	O
as	O
such	O
present	O
.	O
	
Seaduke	O
securely	O
communicates	O
with	O
the	O
C&C	O
server	O
over	O
HTTP	O
/	O
HTTPS	O
beneath	O
layers	O
of	O
encoding	O
(	O
Base64	O
)	O
and	O
encryption	O
(	O
RC4	O
,	O
AES	O
)	O
.	O
	
To	O
an	O
untrained	O
eye	O
,	O
the	O
communications	O
look	O
fairly	O
benign	O
,	O
no	O
doubt	O
an	O
effort	O
to	O
stay	O
under	O
the	O
radar	O
on	O
compromised	O
networks	O
.	O
	
Seaduke	O
has	O
many	O
inbuilt	O
commands	O
which	O
are	O
available	O
to	O
the	O
attackers	O
.	O
	
They	B-Entity
have	O
the	O
ability	O
to	O
retrieve	B-Action
detailed	O
bot	B-Entity
/	I-Entity
system	I-Entity
information	I-Entity
,	O
update	B-Action
bot	O
configuration	B-Entity
,	O
upload	B-Action
files	B-Entity
,	O
download	B-Action
files	B-Entity
,	O
and	O
self-	B-Action
delete	I-Action
the	O
malware	B-Entity
from	B-Modifier
the	O
system	B-Entity
.	O
	
The	O
self	O
-	O
delete	O
function	O
is	O
interestingly	O
called	O
€	O
œseppuku	O
€	O
​.	O
	
This	O
is	O
a	O
form	O
of	O
Japanese	O
ritual	O
suicide	O
.	O
	
The	O
attackers	O
have	O
also	O
developed	O
a	O
number	O
of	O
additional	O
payloads	O
.	O
	
Operators	O
can	O
push	O
these	O
payloads	O
onto	O
infected	O
machines	O
for	O
very	O
specific	O
attacks	O
.	O
	
What	O
next	O
?	O
The	O
Duke	O
group	O
has	O
brought	O
its	O
operational	O
capability	O
to	O
the	O
next	O
level	O
.	O
	
Its	O
attacks	O
have	O
been	O
so	O
bold	O
and	O
aggressive	O
,	O
that	O
a	O
huge	O
amount	O
of	O
attention	O
has	O
been	O
drawn	O
to	O
it	O
,	O
yet	O
it	O
appears	O
to	O
be	O
unperturbed	O
.	O
	
Its	O
success	O
at	O
compromising	O
such	O
high	O
-	O
profile	O
targets	O
has	O
no	O
doubt	O
added	O
a	O
few	O
feathers	O
to	O
its	O
cap	O
.	O
	
Even	O
the	O
developers	O
reveled	O
in	O
this	O
fact	O
,	O
naming	O
one	O
of	O
Seaduke	O
€	O
™s	O
functions	O
€	O
œforkmeiamfamous	O
€	O
​.	O
	
While	O
the	O
group	O
is	O
currently	O
keeping	O
a	O
lower	O
profile	O
,	O
there	O
€	O
™s	O
no	O
doubt	O
it	O
will	O
reappear	O
.	O
	
Some	O
tools	O
may	O
have	O
to	O
be	O
abandoned	O
,	O
some	O
reworked	O
and	O
others	O
built	O
completely	O
from	O
scratch	O
.	O
	
This	O
attack	O
group	O
is	O
in	O
it	O
for	O
the	O
long	O
haul	O
.	O
	
Over	O
the	O
past	O
several	O
months	O
an	O
increasing	O
number	O
of	O
strategic	O
web	O
compromises	O
(	O
"	O
wateringholes	O
"	O
)	O
have	O
been	O
discovered	O
on	O
websites	O
in	O
Hong	O
Kong	O
.	O
	
This	O
rise	O
in	O
activity	O
coincides	O
with	O
the	O
Occupy	O
Central	O
protests	O
.	O
	
In	O
this	O
post	O
we	O
will	O
talk	O
about	O
a	O
single	O
attack	O
,	O
whilst	O
not	O
trying	O
to	O
distract	O
attention	O
from	O
the	O
vast	O
number	O
of	O
attacks	O
and	O
subsequent	O
compromises	O
that	O
remain	O
persistent	O
in	O
Hong	O
Kong	O
.	O
	
Whilst	O
going	O
about	O
our	O
daily	O
business	O
we	O
were	O
alerted	O
to	O
a	O
website	O
that	O
began	O
serving	O
a	O
malicious	O
payload	O
alongside	O
its	O
usual	O
web	O
page	O
.	O
	
The	O
initial	O
investigation	O
revealed	O
that	O
the	O
attack	O
and	O
associated	O
payloads	O
are	O
part	O
of	O
an	O
ongoing	O
attack	O
campaign	O
by	O
an	O
Advanced	O
Persistent	O
Threat	O
group	O
that	O
is	O
known	O
to	O
target	O
various	O
sectors	O
of	O
industry	O
and	O
Government	O
in	O
Hong	O
Kong	O
.	O
	
In	O
this	O
instance	O
we	O
have	O
chosen	O
to	O
obfuscate	O
details	O
of	O
the	O
compromised	O
website	O
to	O
protect	O
the	O
identity	O
of	O
the	O
victim	O
.	O
	
This	O
website	O
belongs	O
to	O
a	O
private	O
educational	O
institution	O
who	O
,	O
since	O
being	O
notified	O
about	O
the	O
compromise	O
,	O
has	O
removed	O
the	O
malicious	O
executable	O
and	O
remediated	O
the	O
compromised	O
of	O
their	O
server	O
,	O
thus	O
breaking	O
a	O
crucial	O
link	O
in	O
the	O
chain	O
of	O
this	O
attack	O
.	O
	
The	O
website	O
in	O
question	O
was	O
implanted	O
with	O
some	O
HTML	O
code	O
that	O
simply	O
reaches	O
out	O
to	O
a	O
secondary	O
website	O
and	O
downloads	O
malware	O
.	O
	
Whilst	O
this	O
in	O
itself	O
is	O
not	O
interesting	O
the	O
methodology	O
used	O
to	O
obfuscate	O
code	O
and	O
evade	O
detection	O
are	O
.	O
	
The	O
underlying	O
code	O
in	O
the	O
first	O
page	O
that	O
loads	O
exploits	O
a	O
vulnerability	O
in	O
Internet	O
Explorer	O
(	O
CVE-2014	O
-	O
6332	O
)	O
and	O
runs	O
several	O
scripts	O
,	O
each	O
with	O
support	O
for	O
different	O
operating	O
systems	O
and	O
methods	O
of	O
downloading	O
and	O
executing	O
a	O
file	O
from	O
a	O
website	O
.	O
	
The	O
first	O
script	O
is	O
obfuscated	O
Visual	O
Basic	O
Script	O
(	O
"	O
VBS	O
"	O
)	O
By	O
decoding	O
this	O
we	O
can	O
see	O
the	O
true	O
intentions	O
of	O
the	O
script	O
–	O
which	O
opens	O
a	O
whole	O
new	O
can	O
of	O
worms	O
.	O
	
This	O
code	O
is	O
extremely	O
interesting	O
because	O
not	O
only	O
does	O
it	O
contain	O
VBScript	O
but	O
also	O
contains	O
PowerShell	O
script	O
.	O
	
Once	O
running	O
it	B-Entity
uses	O
an	O
elaborate	O
way	O
to	O
detect	B-Action
the	O
operating	B-Entity
system	I-Entity
version	I-Entity
and	O
then	O
selects	O
whether	O
to	O
use	O
VBScript	O
or	O
Powershell	O
based	O
on	O
the	O
result	O
;	O
VBScript	O
for	O
Windows	O
XP	O
and	O
Powershell	O
for	O
newer	O
versions	O
of	O
Windows	O
.	O
	
The	O
Powershell	O
script	O
is	O
compressed	O
and	O
Base64	O
encoded	O
.	O
	
By	O
decoding	O
this	O
script	O
we	O
can	O
determine	O
its	O
nature	O
As	O
you	O
can	O
see	O
this	B-Entity
powershell	I-Entity
script	I-Entity
simply	O
extracts	B-Action
another	O
VBScript	B-Entity
and	O
executes	B-Action
it	B-Entity
.	O
	
The	O
VBScript	O
then	O
downloads	O
the	O
first	O
binary	O
payload	O
into	O
the	O
user	O
's	O
temporary	O
directory	O
and	O
names	O
it	O
'	O
plug.exe	O
'	O
.	O
	
If	O
the	O
operating	O
system	O
version	O
is	O
too	O
old	O
to	O
support	O
Powershell	O
then	O
the	O
script	O
will	O
attempt	O
to	O
use	O
VBScript	O
.	O
	
This	O
VBScript	B-Entity
downloads	B-Action
the	O
primary	B-Entity
payload	I-Entity
to	B-Modifier
the	O
temporary	B-Entity
directory	I-Entity
and	O
names	B-Action
it	B-Entity
"	O
z1.exe	O
"	O
.	O
	
The	O
first	B-Entity
binary	I-Entity
payload	I-Entity
that	O
lands	O
on	O
the	O
system	O
is	O
relatively	O
simple	O
and	O
serves	O
as	O
a	O
method	O
of	O
yet	O
again	O
detecting	B-Action
the	O
operating	B-Entity
system	I-Entity
version	I-Entity
and	O
where	B-Entity
to	I-Entity
drop	I-Entity
a	I-Entity
secondary	I-Entity
payload	I-Entity
file	I-Entity
.	O
	
Whilst	O
this	B-Entity
binary	I-Entity
is	O
not	O
complicated	O
by	O
nature	O
it	O
has	O
been	O
designed	O
to	O
masquerade	B-Action
as	B-Modifier
a	O
legitimate	B-Entity
application	I-Entity
and	O
contains	B-Action
functionality	O
to	B-Entity
evade	I-Entity
anti	I-Entity
-	I-Entity
virus	I-Entity
.	O
	
This	O
malware	O
implant	O
is	O
commonly	O
detected	O
by	O
anti-	O
virus	O
as	O
Swisyn	O
.	O
	
Upon	O
running	O
this	B-Entity
malware	I-Entity
determines	B-Action
the	O
operating	B-Entity
system	I-Entity
version	I-Entity
,	O
but	O
only	O
delineating	O
between	O
Windows	O
XP	O
,	O
Visa	O
and	O
above	O
.	O
	
It	O
appears	O
that	O
this	O
functionality	O
is	O
included	O
because	O
the	O
secondary	O
payload	O
comes	O
in	O
both	O
32bit	O
and	O
64bit	O
versions	O
.	O
	
Both	O
of	O
these	O
second	O
stage	O
payloads	O
are	O
obfuscated	O
but	O
decoded	O
with	O
a	O
simple	O
bitwise	O
operation	O
as	O
per	O
below	O
In	O
this	O
scenario	O
,	O
the	O
secondary	O
payloads	O
can	O
be	O
decoded	O
using	O
a	O
simple	O
subtraction	O
of	O
3	O
followed	O
by	O
an	O
XOR	O
of	O
3	O
from	O
each	O
byte	O
.	O
	
This	O
file	O
is	O
then	O
written	O
to	O
%	O
User%\Application	O
Data\Microsoft	O
in	O
a	O
newly	O
created	O
folder	O
name	O
'	O
wuauclt	O
'	O
.	O
	
The	O
filename	O
depends	O
on	O
the	O
operating	O
system	O
version	O
,	O
for	O
Windows	O
XP	O
it	O
is	O
"	O
clbcatq.dll	O
"	O
,	O
for	O
Windows	O
Vista	O
and	O
above	O
it	O
is	O
"	O
profapi.dll	O
"	O
.	O
	
Once	O
this	O
file	O
has	O
been	O
written	O
to	O
disk	O
a	O
file	O
from	O
the	O
Windows	O
System32	O
folder	O
is	O
copied	O
into	O
the	O
directory	O
.	O
	
This	O
file	O
,	O
named	O
'	O
wuauclt.exe	O
'	O
,	O
is	O
the	O
Windows	O
update	O
client	O
interface	O
and	O
it	O
a	O
standard	O
windows	O
file	O
.	O
	
By	O
executing	O
this	O
file	O
in	O
a	O
specific	O
manner	O
it	B-Entity
will	O
load	B-Action
the	O
freshly	B-Entity
dropped	I-Entity
DLL	I-Entity
file	I-Entity
–	O
affectively	O
this	O
is	O
known	O
as	O
DLL	O
hijacking	O
.	O
	
Following	O
this	O
action	O
another	B-Entity
file	I-Entity
,	O
named	O
'	O
wuauclt.dat	O
'	O
,	O
is	O
written	B-Action
on	O
to	B-Modifier
the	O
disk	B-Entity
under	B-Modifier
the	O
same	B-Entity
directory	I-Entity
.	O
	
This	O
file	O
is	O
encoded	O
and	O
not	O
decoded	O
at	O
this	O
stage	O
of	O
the	O
attack	O
.	O
	
To	B-Modifier
complete	O
the	B-Entity
file	I-Entity
drop	I-Entity
wuauclt.exe	B-Entity
is	O
executed	B-Action
.	O
	
The	O
64bit	O
version	O
of	O
this	O
dropper	O
is	O
vastly	O
similar	O
in	O
functionality	O
although	O
it	O
offers	O
slightly	O
more	O
efficiency	O
in	O
the	O
code	O
.	O
	
The	O
decoding	O
routine	O
is	O
more	O
simplified	O
than	O
its	O
32bit	O
counterpart	O
and	O
the	O
decoding	O
key	O
is	O
hardcoded	O
The	O
following	O
pseudo	O
-	O
code	O
can	O
decode	O
both	O
32bit	O
and	O
64bit	O
versions	O
of	O
the	O
DLL	O
stored	O
in	O
'	O
wuauclt.dat	O
'	O
Not	O
to	O
dwell	O
on	O
a	O
dropper	O
,	O
let	O
's	O
move	O
on	O
to	O
the	O
second	O
stage	O
malware	O
.	O
	
The	O
malware	O
second	O
stage	O
is	O
now	O
loaded	O
and	O
running	O
.	O
	
Interestingly	O
,	O
this	O
payload	O
is	O
also	O
detected	O
by	O
anti	O
-	O
virus	O
as	O
Swisyn	O
.	O
	
This	O
DLL	O
is	O
again	O
fairly	O
simple	O
and	O
acts	O
as	O
a	O
secondary	O
dropper	O
.	O
	
It	B-Entity
primarily	O
serves	O
as	O
a	O
method	O
of	O
decoding	O
one	O
of	O
the	O
files	O
dropped	O
by	O
the	O
previous	O
malware	O
stage	O
and	O
creating	O
a	O
method	O
to	O
start	B-Action
the	O
malware	B-Entity
on	B-Modifier
system	O
boot	B-Entity
-	I-Entity
up	I-Entity
or	I-Entity
user	I-Entity
login	I-Entity
.	O
	
In	O
order	O
to	O
do	O
this	O
the	O
malware	O
firstly	O
decodes	O
a	O
file	O
that	O
was	O
dropped	O
by	O
the	O
previous	O
stage	O
–	O
in	O
this	O
case	O
it	O
is	O
"	O
wuauclt.dat	O
"	O
.	O
	
The	O
decoding	O
routine	O
is	O
again	O
overly	O
complex	O
but	O
ultimately	O
amounts	O
to	O
a	O
simple	O
subtraction	O
and	O
XOR	O
,	O
again	O
both	O
of	O
these	O
operations	O
are	O
performed	O
by	O
the	O
number	O
3	O
,	O
thus	O
each	O
byte	O
is	O
subtracted	O
by	O
3	O
and	O
then	O
XOR'd	O
with	O
3	O
Once	O
this	B-Entity
file	I-Entity
has	O
been	O
decoded	O
it	B-Entity
is	O
loaded	B-Action
into	B-Modifier
memory	B-Entity
and	O
executed	B-Action
.	O
	
This	O
file	O
,	O
once	O
decoded	O
is	O
the	O
third	O
and	O
final	O
payload	O
.	O
	
The	O
method	B-Entity
of	I-Entity
leaving	I-Entity
the	I-Entity
encoded	I-Entity
file	I-Entity
on	I-Entity
disk	I-Entity
and	I-Entity
only	I-Entity
decoding	I-Entity
it	I-Entity
in	I-Entity
memory	I-Entity
is	O
to	O
thwart	B-Action
poorly	O
configured	B-Entity
anti	I-Entity
-	I-Entity
virus	I-Entity
or	I-Entity
disk	I-Entity
surface	I-Entity
heuristic	I-Entity
scanners	I-Entity
.	O
	
Finally	O
to	O
wrap	O
up	O
,	O
an	O
entry	O
is	O
created	O
in	O
the	O
registry	O
named	O
'	O
wuauclt	O
'	O
is	O
created	O
under	O
'	O
HKCU\Software\Microsoft\Windows\Current	O
Version\Run	O
'	O
to	O
ensure	O
that	O
this	O
file	O
is	O
executed	O
upon	O
user	O
-	O
login	O
.	O
	
Finally	O
we	O
are	O
left	O
with	O
a	O
full	O
payload	O
.	O
	
Unsurprisingly	O
the	O
3rd	O
and	O
final	O
stage	O
of	O
this	O
part	O
of	O
the	O
attack	O
is	O
a	O
fully	O
fledged	O
RAT	O
(	O
Remote	O
Administration	O
Tool	O
)	O
,	O
which	O
is	O
detected	O
by	O
anti	O
-	O
virus	O
as	O
PCClient	O
.	O
	
This	O
RAT	O
allows	O
the	B-Entity
attacker	I-Entity
to	O
control	B-Action
the	O
infected	B-Entity
workstation	I-Entity
and	O
perform	O
a	O
vast	O
array	O
of	O
administrative	O
functions	O
such	O
as	O
.	O
	
A	O
high	O
-	O
level	O
view	O
of	O
the	O
command	O
structure	O
gives	O
us	O
an	O
idea	O
as	O
to	O
how	O
simple	O
this	O
functionality	O
can	O
seem	O
,	O
but	O
does	O
not	O
turn	O
away	O
from	O
how	O
damaging	O
the	O
affects	O
can	O
be	O
.	O
	
Once	O
the	B-Entity
RAT	I-Entity
has	O
been	O
loaded	O
on	O
the	O
infected	O
machine	O
it	B-Entity
begins	O
calling	B-Action
out	I-Action
to	B-Modifier
the	O
command	B-Entity
and	I-Entity
control	I-Entity
server	I-Entity
(	O
"	O
phoning	O
home	O
"	O
)	O
and	O
waits	B-Action
for	B-Modifier
the	O
attackers	B-Entity
to	B-Modifier
issue	O
one	B-Entity
of	I-Entity
the	I-Entity
above	I-Entity
commands	I-Entity
to	I-Entity
the	I-Entity
victim	I-Entity
.	O
	
As	O
we	O
usually	O
see	O
with	O
APT	O
attacks	O
the	O
malware	O
controllers	O
use	O
a	O
specific	O
ID	O
to	O
code	O
their	O
attack	O
campaign	O
,	O
which	O
in	O
this	O
case	O
is	O
'	O
C00BBB	O
'	O
.	O
	
Information	O
about	B-Entity
the	I-Entity
victim	I-Entity
system	I-Entity
is	O
collected	B-Action
and	O
posted	B-Action
off	I-Action
to	B-Modifier
the	O
command	B-Entity
and	I-Entity
control	I-Entity
server	I-Entity
.	O
	
This	O
information	O
gives	O
the	O
attacker	O
a	O
brief	O
description	O
about	O
the	O
machine	O
.	O
	
The	O
information	O
consists	O
of	O
.	O
	
This	O
information	B-Entity
is	O
encoded	B-Action
using	B-Modifier
a	O
simple	B-Entity
bitwise	I-Entity
operation	I-Entity
and	O
then	O
sent	B-Action
to	B-Modifier
the	O
command	B-Entity
and	I-Entity
control	I-Entity
server	I-Entity
.	O
	
For	O
example	O
.	O
	
Unencoded	O
data	O
Encoded	O
data	O
44	O
45	O
4C	O
4C	O
2D	O
31	O
37	O
38	O
DELL-178	O
BA	O
B9	O
B2	O
B2	O
51	O
4D	O
47	O
46	O
QMGF	O
44	O
33	O
43	O
00	O
00	O
00	O
00	O
00	O
D3C	O
.....	O
	
BA	O
4B	O
BB	O
7E	O
7E	O
7E	O
7E	O
7E	O
K	O
~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
35	O
31	O
32	O
4D	O
42	O
00	O
00	O
00	O
512	O
MB	O
...	O
	
49	O
4D	O
4C	O
B1	O
BC	O
7E	O
7E	O
7E	O
IML	O
~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
57	O
69	O
6E	O
20	O
58	O
50	O
20	O
53	O
Win	O
XP	O
S	O
A7	O
95	O
90	O
5E	O
A6	O
AE	O
5E	O
AB	O
••^	O
^	O
50	O
33	O
20	O
28	O
42	O
75	O
69	O
6C	O
P3	O
(	O
Buil	O
AE	O
4B	O
5E	O
56	O
BC	O
89	O
95	O
92	O
K^V	O
‰•	O
'	O
64	O
20	O
32	O
36	O
30	O
30	O
29	O
00	O
d	O
2600	O
)	O
.	O
	
9A	O
5E	O
4C	O
48	O
4E	O
4E	O
55	O
7E	O
š^LHNNU~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
00	O
........	O
	
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
7E	O
~~~~~~~~	O
43	O
30	O
30	O
42	O
42	O
42	O
00	O
00	O
C00BBB	O
..	O
	
BB	O
4E	O
4E	O
BC	O
BC	O
BC	O
7E	O
7E	O
NN	O
~~	O
Whilst	O
this	O
may	O
seem	O
to	O
make	O
the	O
data	O
harder	O
to	O
recover	O
it	O
actually	O
makes	O
detection	O
of	O
the	O
traffic	O
easier	O
.	O
	
To	O
decode	O
the	O
traffic	O
a	O
simple	O
calculation	O
can	O
be	O
performed	O
by	O
reversing	O
the	O
encoding	O
operations	O
.	O
	
In	O
this	O
case	O
the	O
malware	O
simply	O
increases	O
the	O
initial	O
encoding	O
key	O
by	O
1	O
,	O
then	O
adds	O
this	O
value	O
to	O
each	O
byte	O
in	O
the	O
buffer	O
and	O
finally	O
XOR	O
's	O
each	O
byte	O
.	O
	
Once	O
again	O
,	O
the	O
following	O
pseudo	O
-	O
code	O
can	O
decode	O
this	O
data	O
During	O
in	O
the	O
investigation	O
we	O
performed	O
analysis	O
of	O
the	O
infrastructure	O
that	O
this	O
malware	O
communicates	O
with	O
.	O
	
On	O
this	O
occasion	O
we	O
have	O
not	O
been	O
able	O
to	O
gain	O
physical	O
access	O
to	O
the	O
command	O
and	O
control	O
server	O
as	O
it	O
is	O
legitimate	O
,	O
but	O
compromised	O
production	O
infrastructure	O
.	O
	
The	O
graph	O
below	O
shows	O
the	O
flow	O
in	O
which	O
various	O
parts	O
of	O
the	O
attack	O
are	O
loaded	O
and	O
how	O
they	O
chain	O
together	O
.	O
	
This	O
attack	O
can	O
be	O
detected	O
and/or	O
mitigated	O
at	O
each	O
stage	O
.	O
	
In	O
order	O
to	O
help	O
organisations	O
protect	O
themselves	O
we	O
have	O
created	O
a	O
number	O
of	O
network	O
IDS	O
rules	O
and	O
disk	O
-	O
scan	O
rules	O
that	O
can	O
be	O
used	O
with	O
Snort	O
and	O
Yara	O
.	O
	
Rules	O
are	O
provided	O
in	O
a	O
best	O
-	O
effort	O
basis	O
and	O
we	O
can	O
not	O
vouch	O
for	O
their	O
efficiency	O
in	O
your	O
environment	O
.	O
	
Wateringhole	O
code	O
Encoded	O
version	O
of	O
PcClient	O
PcClient	O
malware	O
beaconing	O
alert	O
tcp	O
$	O
HOME_NET	O
any	O
-	O
>	O
$	O
EXTERNAL_NET	O
[	O
80,443	O
]	O
(	O
msg:"MALWARE	O
–	O
DTL	O
ID	O
12012015	O
-	O
PcClient	O
beacon	O
"	O
;	O
flow	O
:	O
established	O
,	O
to_server	O
;	O
content:"|BB	O
4E	O
4E	O
BC	O
BC	O
BC	O
7E	O
7E|	O
"	O
;	O
nocase	O
;	O
offset:160	O
;	O
depth:8	O
;	O
classtype	O
:	O
trojan	O
-	O
activty	O
;	O
sid	O
:	O
YOUR_SID	O
;	O
rev:20122014	O
;	O
)	O
Malware	O
domain	O
alert	O
udp	O
$	O
HOME_NET	O
any	O
-	O
>	O
$	O
EXTERNAL_NET	O
53	O
(	O
msg:"MALWARE	O
-	O
DTL	O
ID	O
12012015	O
-	O
C2	O
Domain	O
"	O
;	O
content:"|06|aoemvp|03|com	O
"	O
;	O
classtype	O
:	O
trojan	O
-	O
activity	O
;	O
sid	O
:	O
YOUR_SID	O
;	O
rev	O
:	O
20122014	O
;	O
)	O
C2	O
server	O
IP	O
#	O
1	O
alert	O
ip	O
$	O
HOME_NET	O
any	O
<	O
>	O
45.64.74.101	O
any	O
(	O
msg:"MALWARE	O
-	O
DTL	O
ID	O
12012015	O
–	O
C2	O
IP	O
Address	O
"	O
;	O
classtype	O
:	O
trojan	O
-	O
activity	O
;	O
sid	O
:	O
YOUR_SID	O
;	O
rev	O
:	O
20122014	O
;	O
)	O
C2	O
server	O
IP	O
#	O
2	O
alert	O
ip	O
$	O
HOME_NET	O
any	O
<	O
>	O
103.229.127.104	O
any	O
(	O
msg:"MALWARE	O
-	O
DTL	O
ID	O
12012015	O
-	O
C2	O
IP	O
Address	O
"	O
;	O
classtype	O
:	O
trojan	O
-	O
activity	O
;	O
sid	O
:	O
YOUR_SID	O
;	O
rev	O
:	O
20122014	O
;	O
)	O
The	O
following	O
artefacts	O
were	O
found	O
during	O
the	O
investigation	O
MD5s	O
Network	O
artefacts	O
a6a18c846e5179259eba9de238f67e41	O
c.aoemvp.com	O
55f84d88d84c221437cd23cdbc541d2e	O
aoemvp.com	O
a6a18c846e5179259eba9de238f67e41	O
lim.kiu@hotmail.com	O
279ef79f904476ba0f9f44c87358bb1f	O
45.64.74.101	O
42b76c0503a6bf21f1ea86e0b14d67ea	O
103.229.127.104	O
cff25fe24a90ef63eaa168c07008c2bb	O
ad17eff26994df824be36db246c8fb6a	O
f66b64ef984ac46ac7395358059979bc	O
efd9dc39682312d6576468f5c0eb6236	O
For	O
all	O
questions	O
relating	O
to	O
the	O
publication	O
or	O
specifics	O
in	O
this	O
document	O
please	O
contact	O
us	O
via	O
one	O
of	O
the	O
following	O
methods	O
.	O
	
Twitter	O
:	O
@dragonthreatlab	O
Website	O
:	O
http://dragonthreat.blogspot.hk	O
Email	O
:	O
dragonthreatlabs@gmail.com	O
Kind	O
regards	O
,	O
Dan	O
Dragon	O
Threat	O
Labs	O
	
Energetic	O
Bear	O
/	O
Crouching	O
Yeti	O
is	O
an	O
actor	O
involved	O
in	O
several	O
advanced	O
persistent	O
threat	O
(	O
APT	O
)	O
campaigns	O
that	O
have	O
been	O
active	O
going	O
back	O
to	O
at	O
least	O
the	O
end	O
of	O
2010	O
.	O
	
Targeted	O
sectors	O
include	O
.	O
	
Most	O
of	O
the	O
victims	O
we	O
identified	O
fall	O
into	O
the	O
industrial	O
/	O
machinery	O
building	O
sector	O
,	O
indicating	O
this	O
is	O
of	O
special	O
interest	O
.	O
	
To	O
infect	O
the	O
victims	O
,	O
the	O
attackers	O
rely	O
on	O
three	O
methods	O
.	O
	
During	O
the	O
attacks	O
,	O
the	O
Crouching	O
Yeti	O
uses	O
several	O
malware	O
/	O
Trojans	O
,	O
which	O
exclusively	O
infect	O
Windows	O
systems	O
.	O
	
For	B-Modifier
command	O
and	B-Entity
control	I-Entity
,	O
these	O
connect	B-Action
to	B-Modifier
a	O
large	B-Entity
network	I-Entity
of	I-Entity
hacked	I-Entity
websites	I-Entity
.	O
	
These	O
sites	B-Entity
host	O
malware	O
modules	O
,	O
victim	O
information	O
and	O
issue	B-Action
commands	B-Entity
to	B-Modifier
infected	O
systems	B-Entity
.	O
	
The	O
dozens	O
of	O
known	O
Yeti	O
exploit	O
sites	O
and	O
their	O
referrer	O
sites	O
were	O
legitimate	O
,	O
compromised	O
sites	O
.	O
	
They	O
ran	O
vulnerable	O
content	O
management	O
systems	O
or	O
vulnerable	O
web	O
applications	O
.	O
	
None	O
of	O
the	O
exploits	O
used	O
to	O
compromise	O
the	O
servers	O
were	O
known	O
to	O
be	O
zero	O
-	O
day	O
.	O
	
None	O
of	O
the	O
client	O
side	O
exploits	O
re	O
-	O
used	O
from	O
the	O
open	O
source	O
metasploit	O
framework	O
were	O
zero	O
-	O
day	O
.	O
	
Overall	O
,	O
we	O
observed	O
about	O
2,800	O
victims	O
worldwide	O
,	O
the	O
most	O
prevalent	O
attack	O
tool	O
being	O
the	O
Havex	O
Trojan	O
.	O
	
We	O
believe	O
this	O
group	O
is	O
highly	O
determined	O
and	O
focused	O
on	O
a	O
very	O
specific	O
industrial	O
sector	O
of	O
vital	O
interest	O
.	O
	
It	O
uses	O
a	O
variety	O
of	O
ways	O
to	O
infect	O
its	O
victims	O
and	O
exfiltrate	O
strategic	O
information	O
.	O
	
The	O
analyzed	O
data	O
seems	O
to	O
suggest	O
the	O
following	O
points	O
.	O
	
This	O
report	O
provides	O
technical	O
details	O
on	O
how	O
they	O
perform	O
their	O
operations	O
.	O
	
This	O
section	O
analyzes	O
all	O
the	O
aspects	O
we	O
could	O
find	O
about	O
how	O
this	O
actor	O
performs	O
its	O
campaigns	O
.	O
	
The	O
Crouching	O
Yeti	O
actor	O
performed	O
a	O
massive	O
surveillance	O
operation	O
targeting	O
strategic	O
victims	O
,	O
many	O
of	O
them	O
in	O
the	O
industrial	O
/	O
manufacturing	O
sector	O
.	O
	
There	O
were	O
different	O
ways	O
of	O
delivering	O
of	O
its	O
malware	O
including	O
waterholing	O
,	O
spearphishing	O
and	O
adding	O
malware	O
to	O
legitimate	O
installers	O
.	O
	
Once	O
the	O
victims	O
were	O
infected	O
,	O
Crouching	B-Entity
Yeti	I-Entity
selected	B-Action
different	O
RATs	B-Entity
for	B-Modifier
its	O
operations	B-Entity
.	O
	
These	O
RATs	B-Entity
communicated	B-Action
with	B-Modifier
Command	O
and	B-Entity
Control	I-Entity
servers	I-Entity
on	I-Entity
compromised	I-Entity
servers	I-Entity
around	I-Entity
the	I-Entity
world	I-Entity
,	O
using	B-Modifier
a	O
simple	B-Entity
PHP	I-Entity
backend	I-Entity
.	O
	
We	O
were	O
able	O
to	O
identify	O
several	O
victims	O
,	O
including	O
high	O
-	O
profile	O
ones	O
and	O
dozens	O
of	O
domains	O
used	O
in	O
the	O
campaign	O
.	O
	
As	O
far	O
as	O
we	O
know	O
the	O
group	O
behind	O
Crouching	O
Yeti	O
delivers	O
its	O
malware	O
using	O
at	O
least	O
three	O
different	O
methods	O
.	O
	
The	O
first	O
method	O
uses	O
a	O
legitimate	O
software	O
installer	O
repackaged	O
to	O
contain	O
the	O
malicious	O
DLL	O
.	O
	
Such	O
modified	B-Entity
self	I-Entity
-	I-Entity
extracting	I-Entity
archives	I-Entity
could	O
have	O
been	O
uploaded	O
directly	O
to	O
a	O
compromised	O
server	O
,	O
replacing	O
the	O
original	O
file	O
,	O
or	O
sent	B-Action
to	B-Modifier
the	O
victim	B-Entity
by	B-Modifier
email	B-Entity
.	O
	
One	O
example	O
of	O
this	O
method	O
was	O
a	B-Entity
hijacked	I-Entity
SwissRanger	I-Entity
camera	I-Entity
driver	I-Entity
(	O
libMesaSR	O
version	O
1.0.14.706	O
)	O
that	O
was	O
used	O
to	O
drop	B-Action
the	O
Sysmain	B-Entity
backdoor	I-Entity
to	O
.	O
	
%	O
APPDATA%\sydmain.dll	O
and	O
set	B-Action
the	O
Run	B-Entity
registry	I-Entity
value	I-Entity
to	B-Modifier
load	O
malicious	B-Entity
DLL	I-Entity
upon	I-Entity
next	I-Entity
system	I-Entity
startup	I-Entity
.	O
	
In	O
a	O
similar	O
manner	O
,	O
as	O
early	O
as	O
January	O
2014	O
,	O
Havex	B-Entity
version	I-Entity
038	I-Entity
appears	O
to	O
have	O
been	B-Action
dropped	O
by	B-Modifier
a	O
legitimate	B-Entity
~40	I-Entity
MB	I-Entity
software	I-Entity
installer	I-Entity
from	I-Entity
the	I-Entity
eWon	I-Entity
web	I-Entity
site	I-Entity
.	O
	
hxxp://www.ewon.biz	O
/	O
software	O
/	O
eCatcher	O
/	O
eCatcherSetup.exe	O
"	O
eWon	O
"	O
is	O
a	O
Belgian	O
producer	O
of	O
SCADA	O
and	O
industrial	O
network	O
equipment	O
,	O
which	O
helps	O
define	O
this	O
attack	O
method	O
as	O
a	O
watering	O
hole	O
attack	O
.	O
	
"	O
Breaking	O
the	O
barrier	O
between	O
industrial	O
applications	O
and	O
IT	O
standards	O
,	O
the	O
mission	O
of	O
eWON	O
is	O
to	O
connect	O
industrial	O
machines	O
securely	O
to	O
the	O
Internet	O
,	O
enabling	O
easy	O
remote	O
access	O
and	O
gathering	O
all	O
types	O
of	O
technical	O
data	O
originating	O
from	O
industrial	O
machines	O
...	O
Connecting	O
machines	O
across	O
the	O
Internet	O
is	O
our	O
mission	O
.	O
"	O
Sometimes	O
,	O
the	B-Entity
Havex	I-Entity
loader	I-Entity
was	O
dropped	B-Action
from	B-Modifier
"	O
eCatcherSetup_v4.exe	B-Entity
"	I-Entity
,	O
so	O
it	O
seems	O
that	O
the	O
site	O
operators	O
may	O
have	O
removed	O
a	O
previous	O
file	O
and	O
the	O
attackers	O
replaced	O
it	O
with	O
their	O
trojanized	O
installer	O
,	O
and	O
so	O
on	O
.	O
	
Likely	O
,	O
the	O
attackers	O
gained	O
access	O
to	O
eWon	O
's	O
ftp	O
site	O
and	O
replaced	O
the	O
legitimate	O
file	O
with	O
one	O
that	O
is	O
bound	O
with	O
the	O
Havex	O
dropper	O
several	O
times	O
.	O
	
Another	O
example	O
that	O
involves	O
a	O
hijacked	O
application	O
from	O
a	O
PLC	O
-	O
related	O
vendor	O
is	O
a	O
Trojanized	O
mbCHECK	O
installer	O
which	O
replaced	O
the	O
original	O
legitimate	O
version	O
freely	O
downloadable	O
from	O
the	O
vendor	O
's	O
website	O
.	O
	
The	O
legitimate	O
version	O
can	O
be	O
downloaded	O
for	O
free	O
from	O
the	O
vendor	O
's	O
website	O
.	O
	
The	O
vendor	O
-	O
MB	O
Connect	O
Line	O
-	O
is	O
a	O
company	O
which	O
specializes	O
in	O
software	O
for	O
remote	O
maintenance	O
of	O
PLC	O
systems	O
:	O
MB	O
Connect	O
Line	O
GmbH(hxxp://www.mbconnectline.com	O
/	O
index.php	O
/	O
en/	O
)	O
.	O
	
In	O
this	O
case	O
,	O
the	O
dropped	O
DLL	O
was	O
Havex	O
version	O
043	O
.	O
	
The	O
second	O
method	O
relies	O
on	O
a	B-Entity
malicious	I-Entity
XDP	I-Entity
file	I-Entity
containing	I-Entity
the	I-Entity
PDF	I-Entity
/	I-Entity
SWF	I-Entity
exploit	I-Entity
(	O
CVE-2011-	O
0611	O
)	O
and	O
was	O
most	O
probably	O
used	B-Action
in	B-Modifier
spear	O
-	B-Entity
phishing	I-Entity
attacks	I-Entity
.	O
	
This	O
exploit	O
drops	O
the	O
Havex	O
loader	O
DLL	O
,	O
which	O
is	O
stored	O
in	O
an	O
encrypted	O
form	O
in	O
the	O
XDP	O
file	O
.	O
	
The	O
exploit	O
is	O
delivered	O
as	O
an	O
XDP	O
file	O
(	O
XML	O
Data	O
Package	O
)	O
which	O
is	O
actually	O
a	O
PDF	O
file	O
packaged	O
within	O
an	O
XML	O
container	O
.	O
	
This	O
is	O
a	O
known	O
the	O
PDF	O
obfuscation	O
method	O
and	O
serves	B-Action
as	B-Modifier
an	O
additional	B-Entity
anti	I-Entity
-	I-Entity
detection	I-Entity
layer	I-Entity
.	O
	
The	O
XDP	O
file	O
contains	O
an	O
SWF	O
exploit	O
and	O
two	O
files	O
(	O
encrypted	O
with	O
XOR	O
)	O
stored	O
in	O
the	O
invalid	O
section	O
of	O
the	O
PDF	O
.	O
	
One	O
of	O
the	O
files	O
is	O
Havex	O
DLL	O
(	O
version	O
038	O
)	O
,	O
the	O
other	O
is	O
a	O
small	O
JAR	O
file	O
which	O
is	O
used	O
to	O
copy	O
and	O
run	O
the	O
DLL	O
by	O
executing	O
the	O
following	O
command	O
.	O
	
cmd	O
/c	O
copy	O
<	O
fname_passed_as_param	O
>	O
%	O
TEMP%\\explore.dll	O
/y	O
&	O
rundll32.exe	O
%	O
TEMP%\\explore.dll	O
,	O
RunDllEntry	O
SWF	O
executes	O
the	O
action	O
script	O
,	O
which	O
contains	O
another	O
SWF	O
file	O
which	O
in	O
turn	O
uses	O
the	O
CVE-	O
2011	O
-	O
0611	O
vulnerability	O
to	O
run	O
the	O
shellcode	O
.	O
	
The	O
shellcode	O
then	O
looks	O
for	O
a	O
specific	O
signature	O
in	O
the	O
memory	O
(	O
which	O
signs	O
the	O
start	O
of	O
encrypted	O
DLL	O
)	O
,	O
decrypts	O
and	O
loads	O
it	O
.	O
	
Finally	O
,	O
this	O
actor	O
actively	O
compromises	O
legitimate	O
websites	O
for	O
watering	O
hole	O
attacks	O
.	O
	
These	O
hacked	O
websites	O
in	O
turn	O
redirect	O
to	O
malicious	O
JAR	O
or	O
html	O
files	O
hosted	O
on	O
other	O
sites	O
maintained	O
by	O
the	O
group	O
(	O
exploiting	O
CVE-2013	O
-	O
2465	O
,	O
CVE-2013	O
-	O
1347	O
,	O
and	O
CVE-2012	O
-	O
1723	O
in	O
Java	O
6	O
,	O
Java	O
7	O
,	O
IE	O
7	O
and	O
IE	O
8)	O
,	O
which	O
then	O
drop	O
the	O
Havex	O
loader	O
,	O
the	O
Karagany	O
backdoor	O
and	O
helper	O
tools	O
.	O
	
These	O
sites	O
run	O
an	O
exploit	O
kit	O
known	O
as	O
"	O
LightsOut	O
"	O
.	O
	
It	O
appears	O
that	O
the	O
"	O
LightsOut	O
"	O
exploit	O
kit	O
is	O
exclusively	O
used	O
by	O
Energetic	O
Bear	O
/	O
Crouching	O
Yeti	O
.	O
	
From	O
the	O
dozens	O
of	O
Yeti	O
exploit	O
sites	O
we	O
reviewed	O
,	O
the	O
malicious	O
code	O
was	O
nothing	O
more	O
than	O
slightly	O
modified	O
metasploit	O
java	O
exploits	O
delivering	O
the	O
Havex	O
loader	O
.	O
	
Some	O
sort	O
of	O
internal	O
review	O
must	O
have	O
pushed	O
them	O
towards	O
the	O
LightsOut	O
EK	O
.	O
	
KSN	O
data	O
records	O
help	O
provide	O
a	O
list	O
of	O
Crouching	O
Yeti	O
related	O
exploit	O
delivery	O
from	O
dozens	O
of	O
these	O
sites	O
.	O
	
In	O
earlier	O
cases	O
(	O
July	O
2013	O
)	O
,	O
successful	O
Java	O
exploitation	O
served	O
from	O
nahoonservices.com	O
would	O
cascade	O
into	O
more	O
Yeti	O
components	O
planted	O
on	O
victim	O
systems	O
.	O
	
The	O
java	O
exploit	O
downloaded	O
Karagany	O
backdoors	O
,	O
which	O
in	O
turn	O
downloaded	O
stealers	O
from	O
91.203.6.71	O
.	O
	
Ksn	O
data	O
recorded	O
at	O
least	O
20	O
victim	O
sites	O
that	O
were	O
compromised	O
and	O
injected	O
with	O
Yeti	O
iframes	O
,	O
redirecting	O
hundreds	O
of	O
visitors	O
to	O
compromised	O
Yeti	O
exploit	O
sites	O
.	O
	
Most	O
of	O
these	O
redirector	O
sites	O
were	O
owned	O
by	O
western	O
and	O
Eastern	O
European	O
power	O
players	O
,	O
investors	O
,	O
legal	O
advisors	O
and	O
advocates	O
,	O
and	O
European	O
and	O
US	O
industrial	O
IT	O
equipment	O
makers	O
.	O
	
The	O
compromised	O
sites	O
hosting	O
the	O
LightsOut	O
Exploit	O
Kit	O
were	O
fairly	O
trafficked	O
,	O
legitimate	O
sites	O
.	O
	
Their	O
content	O
varies	O
widely	O
,	O
from	O
California	O
winemakers	O
to	O
Cuban	O
travel	O
agencies	O
and	O
Iranian	O
general	O
interest	O
/	O
religious	O
inspiration	O
sites	O
.	O
	
Finally	O
,	O
other	O
second	O
stage	O
tools	O
were	O
simply	O
retrieved	O
by	O
the	O
downloaders	O
over	O
http	O
from	O
various	O
servers	O
.	O
	
Some	O
of	O
these	O
Yeti	O
sites	O
,	O
like	O
kinoporno.org	O
,	O
served	O
both	O
Havex	O
and	O
these	O
tools	O
.	O
	
KSN	O
events	O
recorded	O
the	O
sites	O
serving	O
Windows	O
Credential	O
Editor	O
and	O
custom	O
credential	O
and	O
document	O
stealing	O
tools	O
.	O
	
The	O
Crouching	O
Yeti	O
group	O
has	O
different	O
tools	O
of	O
choice	O
for	O
their	O
operations	O
.	O
	
This	O
section	O
describes	O
them	O
from	O
a	O
technical	O
perspective	O
.	O
	
The	O
main	O
functionality	O
of	O
this	O
component	O
is	O
to	O
download	B-Action
and	O
load	B-Action
additional	O
DLL	B-Entity
modules	I-Entity
into	B-Modifier
the	O
memory	B-Entity
.	O
	
These	O
are	O
stored	O
on	O
compromised	B-Entity
websites	I-Entity
that	O
act	B-Action
as	B-Modifier
C&C	O
servers	B-Entity
.	O
	
In	O
order	O
to	O
do	O
that	O
,	O
the	B-Entity
malware	I-Entity
injects	B-Action
itself	B-Entity
into	B-Modifier
the	O
EXPLORER.EXE	B-Entity
process	I-Entity
,	O
sends	B-Action
a	O
GET	B-Entity
/	I-Entity
POST	I-Entity
request	I-Entity
to	B-Modifier
the	O
PHP	B-Entity
script	I-Entity
on	I-Entity
the	I-Entity
compromised	I-Entity
website	I-Entity
,	O
then	O
reads	B-Action
the	O
HTML	B-Entity
document	I-Entity
returned	I-Entity
by	I-Entity
the	I-Entity
script	I-Entity
,	O
looking	O
for	O
a	O
base64	O
encrypted	O
data	O
between	O
the	O
two	O
"	O
havex	O
"	O
strings	O
in	O
the	O
comment	O
tag	O
<	O
!	O
--havexhavex--	O
>	O
and	O
writes	O
this	O
data	O
it	O
to	O
a	O
%	O
TEMP%\<tmp>.xmd	O
file	O
(	O
filename	O
is	O
generated	O
by	O
GetTempFilename	O
function	O
)	O
.	O
	
In	O
the	O
meantime	O
,	O
another	O
routine	O
is	O
constantly	O
checking	O
the	O
%	O
TEMP%	O
folder	O
for	O
all	O
*	O
.xmd	O
files	O
.	O
	
For	O
each	O
file	O
it	O
finds	O
,	O
it	O
decompresses	O
the	O
content	O
,	O
decrypts	O
(	O
if	O
encrypted	O
)	O
and	O
loads	B-Action
into	B-Modifier
the	O
memory	B-Entity
as	B-Modifier
the	O
DLL	B-Entity
.	O
	
In	O
order	O
to	O
run	B-Action
on	B-Modifier
each	O
system	B-Entity
boot	I-Entity
,	O
malware	B-Entity
copies	B-Action
itself	B-Entity
to	O
:	O
<	O
path>\TMPprovider0XX.dll	O
and	O
creates	B-Action
the	O
autorun	B-Entity
registry	I-Entity
key	I-Entity
.	O
	
All	O
samples	O
of	O
this	O
component	O
contain	O
a	O
statically	O
linked	O
bzip2	O
library	O
.	O
	
Versions	O
>	O
=	O
01B	O
also	O
contain	O
an	O
RSAeuro	O
library	O
,	O
used	O
to	O
encrypt	O
log	O
files	O
and	O
decrypt	O
downloadable	O
modules	O
.	O
	
Public	O
keys	O
for	O
encryption	O
are	O
hardcoded	O
in	O
the	O
binary	O
and/or	O
stored	O
in	O
the	O
configuration	O
section	O
.	O
	
In	O
some	O
cases	O
,	O
these	B-Entity
keys	I-Entity
are	O
written	B-Action
to	B-Modifier
the	O
registry	B-Entity
values	I-Entity
.	O
	
In	O
total	O
,	O
we	O
identified	O
124	O
different	O
samples	O
of	O
Havex	O
loaders	O
,	O
belonging	O
to	O
27	O
different	O
versions	O
.	O
	
As	O
of	O
June	O
2014	O
,	O
the	O
latest	O
version	O
number	O
we	O
have	O
is	O
044	O
.	O
	
The	O
URL	O
addresses	O
of	O
the	O
C&C	O
servers	O
(	O
which	O
are	O
indeed	O
compromised	O
websites	O
)	O
are	O
either	O
hardcoded	O
in	O
the	O
binary	O
,	O
or	O
-	O
in	O
versions	O
=	O
>	O
038	O
-	O
specified	O
in	O
the	O
configuration	O
section	O
inside	O
the	O
ICT	O
resource	O
.	O
	
This	O
resource	O
is	O
compressed	O
with	O
bzip2	O
and	O
encrypted	O
with	O
XOR	O
.	O
	
There	O
are	O
usually	O
2	O
-	O
4	O
URLs	O
per	O
binary	O
,	O
different	O
for	O
each	O
malware	O
version	O
and	O
sometimes	O
also	O
different	O
between	O
samples	O
of	O
the	O
same	O
version	O
.	O
	
Malware	B-Entity
sends	B-Action
a	O
GET	B-Entity
request	I-Entity
(	O
versions	O
<	O
017	O
)	O
or	O
POST	B-Entity
request	I-Entity
to	B-Modifier
the	O
first	B-Entity
available	I-Entity
URL	I-Entity
.	O
	
The	O
request	O
contents	O
depends	O
on	O
the	O
malware	O
version	O
and	O
it	O
may	O
include	O
such	O
information	O
as	O
unique	O
bot	O
i	O
d	O
,	O
malware	O
version	O
number	O
,	O
OS	O
version	O
number	O
,	O
and	O
some	O
other	O
data	O
from	O
configuration	O
,	O
as	O
well	O
as	O
the	O
harvested	O
information	O
logged	O
into	O
the	O
*	O
.yls	O
file	O
(	O
if	O
any	O
)	O
.	O
	
Then	O
the	O
malware	O
searches	O
the	O
HTML	O
code	O
of	O
each	O
returned	O
page	O
for	O
havex	O
markers	O
and	O
saves	O
the	O
data	O
between	O
the	O
markers	O
into	O
a	O
temporary	O
file	O
.	O
	
These	O
modules	O
are	O
hosted	O
between	O
the	O
havex	O
markers	O
in	O
the	O
HTML	O
code	O
of	O
compromised	O
websites	O
.	O
	
The	O
module	O
code	O
is	O
usually	O
XORed	O
with	O
"	O
1312312	O
"	O
then	O
compressed	O
with	O
BZIP2	O
and	O
finally	O
base64	O
encoded	O
.	O
	
Once	O
downloaded	O
into	O
the	O
%	O
TEMP%\*.xmd	O
file	O
by	O
the	O
main	O
Havex	O
DLL	O
,	O
the	O
code	O
is	O
decoded	O
,	O
decompressed	O
,	O
saved	O
into	O
the	O
temporary	O
DLL	O
file	O
and	O
loaded	O
into	O
the	O
memory	O
.	O
	
The	O
modules	O
perform	O
a	O
variety	O
of	O
different	O
actions	O
,	O
including	O
collecting	B-Action
information	B-Entity
about	B-Modifier
the	O
victim	B-Entity
's	I-Entity
system	I-Entity
and	I-Entity
other	I-Entity
machines	I-Entity
in	I-Entity
the	I-Entity
local	I-Entity
network	I-Entity
,	O
harvesting	B-Action
passwords	B-Entity
,	O
listing	B-Action
documents	B-Entity
,	O
etc	O
.	O
	
In	O
order	O
to	O
do	O
that	O
,	O
some	O
of	O
the	O
modules	O
make	O
use	O
of	O
additional	O
3rd	O
stage	O
3rd	O
party	O
executables	O
.	O
	
Each	O
module	O
contains	O
configuration	O
information	O
stored	O
in	O
an	O
encrypted	O
and	O
compressed	O
form	O
inside	O
a	O
resource	O
.	O
	
Configuration	O
data	O
includes	O
29-byte	O
UID	O
(	O
unique	O
ID	O
)	O
,	O
a	O
1024-bit	O
RSA	O
Public	O
key	O
(	O
base64	O
encoded	O
)	O
and	O
other	O
necessary	O
info	O
(	O
like	O
file	O
paths	O
,	O
etc	O
.	O
)	O
.	O
	
All	O
harvested	O
data	O
is	O
compressed	O
,	O
encrypted	O
and	O
written	O
into	O
the	O
%	O
TEMP%\*.yls	O
files	O
,	O
which	O
are	O
then	O
sent	O
to	O
the	O
C&C	O
by	O
the	O
main	O
Havex	O
/	O
Sysmain	O
module	O
.	O
	
The	O
"	O
yls	O
"	O
files	O
are	O
encrypted	O
with	O
the	O
3DES	O
crypto	O
algorithm	O
using	O
a	O
random	O
192-bit	O
key	O
(	O
168	O
bit	O
effective	O
)	O
.	O
	
The	O
3DES	O
key	O
is	O
encrypted	O
using	O
the	O
public	O
RSA	O
1024	O
key	O
and	O
therefore	O
never	O
transferred	O
in	O
plain	O
text	O
to	O
attackers	O
.	O
	
In	O
-	O
depth	O
analysis	O
of	O
the	O
cryptography	O
used	O
by	O
log	O
files	O
is	O
presented	O
in	O
Appendix	O
2	O
This	B-Entity
module	I-Entity
is	O
designed	O
to	O
collect	B-Action
detailed	O
data	B-Entity
about	I-Entity
the	I-Entity
OPC	I-Entity
servers	I-Entity
running	I-Entity
in	I-Entity
the	I-Entity
local	I-Entity
network	I-Entity
and	O
save	B-Action
them	B-Entity
to	B-Modifier
a	O
%	B-Entity
TEMP%\{rand}.yls	I-Entity
file	I-Entity
.	O
	
To	O
query	O
the	O
OPC	O
servers	O
,	O
it	O
uses	O
the	O
following	O
interfaces	O
.	O
	
This	O
module	B-Entity
collects	B-Action
basic	O
information	B-Entity
about	I-Entity
the	I-Entity
system	I-Entity
it	I-Entity
's	I-Entity
running	I-Entity
on	I-Entity
,	O
and	O
saves	B-Action
it	B-Entity
to	B-Modifier
the	O
%	B-Entity
TEMP%\{rand}.yls	I-Entity
file	I-Entity
.	O
	
Harvested	O
data	O
includes	O
.	O
	
This	O
module	O
collects	O
contact	O
details	O
stored	O
in	O
all	O
outlook.nk2	O
files	O
and	O
writes	O
them	O
to	O
the	O
%	O
TEMP%\{rand}.yls	O
file	O
.	O
	
Outlook.nk2	O
is	O
the	O
file	O
where	O
Outlook	O
(	O
version	O
since	O
2007	O
)	O
keeps	O
contact	O
details	O
in	O
order	O
to	O
use	O
them	O
with	O
the	O
AutoComplete	O
feature	O
.	O
	
This	O
module	B-Entity
uses	O
the	O
embedded	O
BrowserPasswordDecryptor	O
2.0	O
tool	O
(	O
hxxp://securityxploded.com	O
/	O
browser	O
-	O
password	O
-	O
decryptor.php	O
)	O
to	O
dump	B-Action
login	O
credentials	B-Entity
stored	I-Entity
by	I-Entity
the	I-Entity
password	I-Entity
managers	I-Entity
of	I-Entity
various	I-Entity
browsers	I-Entity
.	O
	
Decrypted	O
passwords	B-Entity
are	O
saved	B-Action
into	B-Modifier
the	O
%	B-Entity
TEMP%\~tmp1237.txt	I-Entity
file	I-Entity
,	O
which	O
is	O
then	O
copied	B-Action
by	O
the	B-Entity
parent	I-Entity
module	I-Entity
into	B-Modifier
an	O
encrypted	B-Entity
*	I-Entity
.tmp.yls	I-Entity
file	I-Entity
.	O
	
List	O
of	O
browsers	O
supported	O
by	O
the	O
tool	O
(	O
from	O
the	O
product	O
's	O
website	O
)	O
.	O
	
This	O
module	B-Entity
is	O
designed	O
to	O
scan	B-Action
the	O
local	B-Entity
network	I-Entity
and	O
look	O
for	O
all	O
hosts	O
listening	O
on	O
ports	O
related	O
to	O
OPC	O
/	O
SCADA	O
software	O
.	O
	
Information	O
about	B-Entity
these	I-Entity
hosts	I-Entity
is	O
then	O
saved	B-Action
to	B-Modifier
the	O
%	B-Entity
TEMP%\~tracedscn.yls	I-Entity
file	I-Entity
.	O
	
In	O
-	O
depth	O
analysis	O
of	O
the	O
Havex	O
loader	O
and	O
its	O
related	O
modules	O
is	O
presented	O
in	O
Appendix	O
2	O
.	O
	
This	O
component	O
is	O
a	O
simple	O
downloader	O
with	O
a	O
functionality	O
similar	O
to	O
the	O
Havex	O
component	O
.	O
	
It	B-Entity
sends	B-Action
requests	B-Entity
to	B-Modifier
the	O
PHP	B-Entity
script	I-Entity
at	I-Entity
the	I-Entity
C&C	I-Entity
(	O
compromised	O
website	O
)	O
and	O
looks	O
for	O
specific	O
data	O
in	O
the	O
returned	O
HTML	O
code	O
.	O
	
It	O
writes	O
the	O
data	O
(	O
some	O
ASCII	O
strings	O
)	O
from	O
between	O
<	O
I6></I6	O
>	O
tags	O
to	O
the	O
file	O
in	O
%	O
TEMP%\Low\~task.tmp	O
and	O
the	O
data	O
(	O
binary	O
data	O
XORed	O
with	O
0x0A	O
)	O
from	O
between	O
<	O
B6></B6	O
>	O
tags	O
into	O
the	O
%	O
TEMP%\Low\~ldXXXX.TMP	O
file	O
.	O
	
Then	O
it	O
decrypts	O
the	O
ldXXXX.TMP	O
file	O
and	O
loads	O
it	O
into	O
memory	O
.	O
	
Based	O
on	O
the	O
compilation	O
times	O
,	O
we	O
may	O
assume	O
that	O
this	B-Entity
loader	I-Entity
was	O
used	O
to	O
download	B-Action
and	O
run	B-Action
modules	B-Entity
before	O
it	O
was	O
replaced	O
by	O
Havex	O
.	O
	
The	O
Ddex	O
loader	O
is	O
analyzed	O
in	O
more	O
detail	O
in	O
Appendix	O
4	O
.	O
	
This	O
malware	O
can	O
be	O
described	O
as	O
a	O
classical	O
RAT	O
(	O
Remote	O
Access	O
Trojan	O
)	O
,	O
since	O
it	B-Entity
gives	B-Action
the	O
attacker	B-Entity
a	O
wide	B-Entity
range	I-Entity
of	I-Entity
opportunities	I-Entity
to	I-Entity
control	I-Entity
and	I-Entity
interact	I-Entity
with	I-Entity
the	I-Entity
victim	I-Entity
machine	I-Entity
.	O
	
The	O
autonomous	B-Entity
part	I-Entity
of	I-Entity
Sysmain	I-Entity
installs	O
and	O
registers	B-Action
itself	B-Entity
to	B-Modifier
be	O
persistent	B-Entity
in	I-Entity
the	I-Entity
system	I-Entity
.	O
	
Then	O
it	B-Entity
gathers	B-Action
general	O
information	B-Entity
about	I-Entity
the	I-Entity
victim	I-Entity
system	I-Entity
,	O
like	O
When	O
ready	O
,	O
this	B-Entity
data	I-Entity
is	O
submitted	B-Action
to	B-Modifier
one	O
of	B-Entity
the	I-Entity
C&C	I-Entity
-	I-Entity
servers	I-Entity
.	O
	
After	O
that	O
,	O
it	B-Entity
checks	B-Action
periodically	O
for	B-Modifier
new	O
commands	B-Entity
from	I-Entity
C&C	I-Entity
(	O
pulling	O
via	O
HTTP	O
)	O
.	O
	
With	O
a	O
set	O
of	O
11	O
commands	O
,	O
the	O
malware	O
is	O
able	O
to	O
.	O
	
There	O
are	O
also	O
commands	O
used	O
for	O
maintenance	O
purposes	O
.	O
	
Among	O
others	O
,	O
there	O
are	O
commands	O
to	O
change	B-Action
the	O
pubkey	B-Entity
for	I-Entity
C&C	I-Entity
-	I-Entity
communication	I-Entity
or	O
delete	B-Action
its	O
traces	B-Entity
in	I-Entity
the	I-Entity
registry	I-Entity
.	O
	
It	B-Entity
receives	B-Action
its	O
commands	B-Entity
from	B-Modifier
one	O
of	B-Entity
four	I-Entity
static	I-Entity
command	I-Entity
-	I-Entity
and	I-Entity
-	I-Entity
control	I-Entity
servers	I-Entity
.	O
	
Every	O
variant	O
of	O
this	O
malware	O
has	O
its	O
own	O
set	O
of	O
servers	O
.	O
	
As	O
usual	O
,	O
the	O
attackers	O
are	O
using	O
webservers	O
-	O
most	O
likely	O
compromised	O
ones	O
-	O
as	O
part	O
of	O
their	O
C&C	O
-	O
infrastructure	O
.	O
	
To	O
communicate	O
with	O
the	O
C&C	O
-	O
server	O
,	O
the	O
Trojan	O
makes	O
use	O
of	O
asymmetric	O
encryption	O
with	O
a	O
hardcoded	O
pair	O
of	O
private	O
and	O
public	O
keys	O
.	O
	
Another	O
public	O
key	O
is	O
used	O
to	O
encrypt	O
files	O
,	O
which	O
are	O
collected	O
in	O
a	O
local	O
dropzone	O
on	O
the	O
victim	O
's	O
file	O
system	O
.	O
	
The	O
files	O
in	O
that	O
dropzone	O
will	O
be	O
submitted	O
to	O
the	O
attacker	O
later	O
,	O
all	O
in	O
one	O
go	O
.	O
	
Appendix	O
3	O
provides	O
in	O
-	O
depth	O
analysis	O
of	O
the	O
Sysmain	O
backdoor	O
.	O
	
This	O
component	O
is	O
written	O
in	O
.NET	O
and	O
is	O
very	O
similar	O
to	O
The	O
Sysmain	O
backdoor	O
.	O
	
The	O
settings	O
of	O
the	O
RAT	O
are	O
stored	O
in	O
the	O
registry	O
as	O
BASE64	O
encoded	O
values	O
.	O
	
The	O
RAT	B-Entity
gets	B-Action
its	O
commands	B-Entity
by	O
sending	B-Action
a	O
request	B-Entity
to	I-Entity
a	I-Entity
PHP	I-Entity
script	I-Entity
on	I-Entity
the	I-Entity
C&C	I-Entity
(	O
compromised	O
server	O
)	O
as	O
usual	O
,	O
and	O
looks	O
for	O
specific	O
data	O
in	O
the	O
returned	O
HTML	O
code	O
.	O
	
The	O
data	O
in	O
this	O
case	O
is	O
stored	O
between	O
the	O
havexhavex	O
tags	O
,	O
it	O
is	O
then	O
decrypted	O
and	O
decoded	O
(	O
base64	O
)	O
.	O
	
The	O
RAT	O
supports	O
13	O
commands	O
including	O
.	O
	
Each	O
time	O
a	O
command	O
(	O
task	O
)	O
is	O
executed	O
,	O
the	B-Entity
result	I-Entity
of	I-Entity
that	I-Entity
command	I-Entity
is	O
stored	B-Action
in	B-Modifier
the	O
registry	B-Entity
under	I-Entity
a	I-Entity
subkey	I-Entity
named	I-Entity
"	I-Entity
done	I-Entity
"	I-Entity
or	I-Entity
"	I-Entity
doneEXT	I-Entity
"	I-Entity
.	O
	
The	O
results	B-Entity
(	O
which	O
are	O
called	O
"	O
answers	O
"	O
by	O
the	O
authors	O
)	O
are	O
then	O
POSTED	B-Action
to	B-Modifier
the	O
C&C	B-Entity
server	I-Entity
.	O
	
The	O
ClientX	O
backdoor	O
is	O
analyzed	O
in	O
depth	O
in	O
Appendix	O
5	O
.	O
	
Karagany	B-Entity
is	O
a	O
simple	O
backdoor	O
that	O
connects	B-Action
to	B-Modifier
the	O
C&C	B-Entity
and	O
keeps	O
waiting	B-Action
for	B-Modifier
commands	B-Entity
.	O
	
It	B-Entity
can	O
download	B-Action
and	O
run	B-Action
additional	O
executables	B-Entity
,	O
load	B-Action
/	I-Action
delete	I-Action
modules	B-Entity
,	O
read	B-Action
file	O
content	B-Entity
,	O
reboot	O
the	O
computer	O
,	O
update	B-Action
itself	B-Entity
and	O
remove	B-Action
all	O
components	B-Entity
.	O
	
Besides	O
backdoor	O
functionality	O
,	O
it	B-Entity
also	O
extracts	B-Action
credentials	B-Entity
from	B-Modifier
Internet	O
Explorer	B-Entity
's	I-Entity
password	I-Entity
manager	I-Entity
to	B-Modifier
the	O
prx.jpg	B-Entity
file	I-Entity
and	O
injects	B-Action
a	O
small	B-Entity
DLL	I-Entity
into	B-Modifier
the	O
processes	B-Entity
of	I-Entity
web	I-Entity
browsers	I-Entity
.	O
	
This	O
DLL	B-Entity
keeps	O
listening	B-Action
to	B-Modifier
outgoing	O
network	B-Entity
traffic	I-Entity
and	O
looking	B-Action
for	I-Action
basic	O
access	B-Entity
authentication	I-Entity
details	I-Entity
sent	I-Entity
over	I-Entity
unencrypted	I-Entity
HTTP	I-Entity
.	O
	
Affected	O
browsers	O
include	O
Internet	O
Explorer	O
,	O
Firefox	O
,	O
Mozilla	O
and	O
Opera	O
.	O
	
When	O
executed	O
,	O
it	B-Entity
copies	B-Action
itself	B-Entity
to	B-Modifier
the	O
folder	B-Entity
under	I-Entity
%	I-Entity
APPDATA%	I-Entity
and	O
creates	B-Action
a	O
.lnk	B-Entity
file	I-Entity
in	B-Modifier
the	O
%	B-Entity
STARTUP%	I-Entity
directory	I-Entity
.	O
	
The	O
folder	O
name	O
and	O
filename	O
are	O
chosen	O
from	O
a	O
list	O
of	O
strings	O
hardcoded	O
in	O
the	O
binary	O
.	O
	
It	O
also	O
creates	O
the	O
C:\ProgramData\Mail\MailAg\	O
folder	O
,	O
where	O
the	O
information	O
harvested	O
by	O
downloaded	O
modules	O
will	O
be	O
stored	O
.	O
	
After	O
checking	O
if	O
a	O
connection	O
to	O
the	O
Internet	O
is	O
up	O
,	O
it	B-Entity
sends	B-Action
an	O
initial	B-Entity
POST	I-Entity
request	I-Entity
to	B-Modifier
the	O
C&C	B-Entity
server	I-Entity
.	O
	
Known	O
parameters	O
used	O
in	O
C&C	O
communication	O
are	O
.	O
	
This	O
module	O
is	O
used	O
to	O
drop	O
and	O
run	O
the	O
DuckLink	O
CmdCapture	O
tool	O
-	O
a	O
3rd	O
party	O
freeware	O
AutoIt	O
application	O
for	O
capturing	O
screenshots	O
(	O
hxxp://www.ducklink.com/	O
)	O
.	O
	
A	O
screenshot	B-Entity
of	I-Entity
the	I-Entity
desktop	I-Entity
is	O
saved	B-Action
into	B-Modifier
the	O
C:\ProgramData\Mail\MailAg\scs.jpg	B-Entity
file	I-Entity
.	O
	
Additionally	O
,	O
other	B-Entity
system	I-Entity
information	I-Entity
-	O
such	O
as	O
the	O
date	O
and	O
time	O
of	O
capture	O
,	O
computer	O
name	O
,	O
username	O
,	O
cpu	O
architecture	O
,	O
os	O
version	O
,	O
IP	O
address	O
,	O
logon	O
domain	O
and	O
logon	O
server	O
,	O
desktop	O
details	O
(	O
height	O
,	O
width	O
,	O
depth	O
,	O
refresh	O
rate	O
)	O
and	O
environmental	O
variables	O
-	O
are	B-Action
logged	I-Action
in	B-Modifier
C:\ProgramData\Mail\MailAg\scs.txt	O
file	B-Entity
.	O
	
This	O
module	B-Entity
is	O
used	O
to	O
list	B-Action
all	O
files	B-Entity
and	I-Entity
documents	I-Entity
with	I-Entity
specified	I-Entity
extensions	I-Entity
,	I-Entity
or	I-Entity
which	I-Entity
have	I-Entity
names	I-Entity
containing	I-Entity
specified	I-Entity
strings	I-Entity
in	I-Entity
the	I-Entity
C:\ProgramData\Mail\MailAg\fls.txt	I-Entity
file	I-Entity
.	O
	
Saved	O
information	O
includes	O
path	O
,	O
size	O
and	O
modification	O
time	O
.	O
	
File	O
matching	O
patterns	O
.	O
	
The	O
Command	O
and	O
Control	O
Servers	O
are	O
compromised	O
legitimate	O
websites	O
,	O
like	O
Blogs	O
,	O
from	O
different	O
countries	O
.	O
	
In	O
total	O
we	O
have	O
identified	O
219	O
unique	O
domain	O
names	O
for	O
these	O
C&C	O
servers	O
hosted	O
in	O
21	O
different	O
countries	O
.	O
	
We	O
found	O
most	O
hosted	O
C&Cs	O
in	O
the	O
United	O
States	O
(	O
81	O
servers	O
)	O
,	O
Germany	O
(	O
33	O
servers	O
)	O
,	O
the	O
Russian	O
Federation	O
(	O
19	O
servers	O
)	O
and	O
the	O
United	O
Kingdom	O
(	O
7	O
servers	O
)	O
.	O
	
The	O
table	O
below	O
shows	O
the	O
distribution	O
of	O
victims	O
affected	O
by	O
the	O
samples	O
identified	O
according	O
to	O
our	O
KSN	O
data	O
.	O
	
Victims	O
infected	O
with	O
samples	O
from	O
any	O
of	O
the	O
Crouching	O
Yeti	O
group	O
's	O
malware	O
were	O
found	O
in	O
.	O
	
65	O
of	O
these	O
C&C	O
servers	O
,	O
in	O
the	O
following	O
countries	O
,	O
were	O
monitored	O
during	O
our	O
investigation	O
.	O
	
This	O
monitoring	O
enabled	O
us	O
to	O
get	O
a	O
list	O
of	O
the	O
victims	O
connected	O
to	O
them	O
.	O
	
The	O
C&C	O
Backend	O
is	O
written	O
in	O
PHP	O
,	O
consisting	O
of	O
3	O
files	O
.	O
	
The	O
Backdoors	O
interact	O
with	O
"	O
source.php	O
"	O
,	O
which	O
is	O
the	O
control	O
script	O
.	O
	
These	O
are	O
its	O
functions	O
on	O
execution	O
.	O
	
1	O
.	O
	
Collect	O
the	O
following	O
information	O
.	O
	
2	O
.	O
	
Write	O
the	O
above	O
information	O
to	O
"	O
testlog.php	O
"	O
,	O
separated	O
by	O
"	O
Tabulator	O
"	O
and	O
base64-	O
encoded	O
,	O
with	O
the	O
following	O
syntax	O
.	O
	
<	O
timestamp>\t	O
<	O
victim	O
ip	O
-	O
address>\t	O
<	O
proxy>\t	O
<	O
botID>\t	O
<	O
request	O
-	O
uri>\t	O
<	O
useragent	O
>	O
3	O
.	O
	
Write	O
all	O
transferred	O
HTTP	O
-	O
GET	O
Variables	O
to	O
"	O
<	O
botID>.log	O
"	O
,	O
separated	O
by	O
"	O
Tabulator	O
"	O
and	O
base64-encoded	O
.	O
	
4	O
.	O
	
If	O
the	O
bot	O
executes	O
an	O
HTTP	O
-	O
POST	O
-	O
request	O
,	O
the	O
transferred	O
data	O
is	O
written	O
to	O
the	O
file	O
"	O
<	O
botID>.ans	O
"	O
,	O
enclosed	O
in	O
"	O
xdata	O
"-	O
Tag	O
with	O
timestamp	O
.	O
	
(	O
"	O
ans	O
"	O
is	O
the	O
acronym	O
for	O
"	O
Answer	O
"	O
)	O
.	O
	
5	O
.	O
	
Check	O
for	O
any	O
"	O
<	O
botID>_*.txt	O
"	O
files	O
a.	O
	
If	O
found	O
the	O
first	O
step	O
is	O
to	O
append	O
the	O
timestamp	O
,	O
filename	O
and	O
a	O
"	O
sent	O
"	O
Status	O
indicated	O
to	O
"	O
<	O
botID>.log	O
"	O
.	O
	
Then	O
the	O
file	O
content	O
is	O
transferred	O
to	O
the	O
bot	O
,	O
embedded	O
into	O
HTML	O
with	O
the	O
HTML	O
-	O
Body	O
"	O
No	O
data	O
!	O
"	O
and	O
the	O
HTML	O
-	O
Comment	O
"	O
havex	O
"	O
,	O
which	O
contains	O
the	O
data	O
to	O
be	O
transferred	O
.	O
	
Finally	O
the	O
file	O
on	O
the	O
server	O
is	O
removed	O
.	O
	
If	O
this	O
removal	O
fails	O
it	O
is	O
logged	O
to	O
"	O
<	O
botID>.log	O
"	O
.	O
	
b.	O
	
If	O
no	O
matching	O
file	O
is	O
found	O
,	O
an	O
HTML	O
-	O
Response	O
is	O
sent	O
with	O
an	O
empty	O
"	O
havex	O
"	O
HTML	O
-	O
Comment	O
and	O
HTML	O
-	O
Body	O
text	O
"	O
Sorry	O
,	O
no	O
data	O
corresponding	O
to	O
your	O
request	O
.	O
"	O
The	O
term	O
"	O
victim	O
"	O
in	O
this	O
section	O
refers	O
to	O
a	O
botID	O
(	O
unique	O
String	O
of	O
the	O
Backdoor	O
)	O
,	O
connecting	O
to	O
one	O
or	O
more	O
C&C	O
Servers	O
.	O
	
Based	O
on	O
the	O
45	O
C&C	O
Servers	O
wemonitored	O
,	O
a	O
total	O
of	O
2,811	O
unique	O
Victims	O
were	O
discovered	O
.	O
	
The	O
average	O
number	O
of	O
victims	O
per	O
C&C	O
is	O
70	O
.	O
	
The	O
following	O
chart	O
depicts	O
the	O
first	O
(	O
red	O
line	O
)	O
and	O
last	O
(	O
blue	O
line	O
)	O
appearance	O
of	O
each	O
victim	O
on	O
the	O
C&C.	O
	
The	O
"	O
FirstHit	O
"	O
shows	O
how	O
the	O
rate	O
of	O
accumulating	O
new	O
victims	O
has	O
accelerated	O
over	O
the	O
course	O
of	O
2014	O
.	O
	
"	O
LastHit	O
"	O
shows	O
how	O
the	O
last	O
connection	O
of	O
victims	O
to	O
C&C	O
servers	O
also	O
increases	O
over	O
time	O
.	O
	
This	O
could	O
mean	O
victims	O
are	O
disinfecting	O
their	O
computers	O
,	O
or	O
it	O
may	O
be	O
that	O
they	O
simply	O
report	O
to	O
a	O
different	O
C&C	O
server	O
that	O
we	O
do	O
not	O
monitor	O
.	O
	
Mapping	O
the	O
unique	O
hits	O
of	O
victims	O
per	O
day	O
also	O
indicates	O
a	O
decrease	O
of	O
"	O
active	O
"	O
infections	O
.	O
	
The	O
following	O
chart	O
clearly	O
shows	O
a	O
difference	O
between	O
weekdays	O
(	O
groups	O
of	O
five	O
higher	O
bars	O
)	O
and	O
weekends	O
(	O
two	O
lower	O
bars	O
)	O
.	O
	
The	O
daily	O
unique	O
hit	O
-	O
rate	O
fell	O
by	O
about	O
half	O
from	O
around	O
800	O
connections	O
at	O
the	O
beginning	O
of	O
2014	O
to	O
around	O
400	O
connections	O
per	O
week	O
-	O
day	O
by	O
the	O
middle	O
of	O
the	O
year	O
.	O
	
More	O
than	O
half	O
of	O
the	O
victims	O
always	O
connect	O
from	O
the	O
same	O
IP	O
address	O
.	O
	
Fewer	O
than	O
half	O
of	O
the	O
victims	O
connect	O
from	O
two	O
or	O
more	O
different	O
IP	O
addresses	O
as	O
the	O
following	O
graph	O
shows	O
.	O
	
This	O
might	O
indicate	O
that	O
some	O
of	O
the	O
victims	O
are	O
behind	O
proxies	O
,	O
which	O
makes	O
sense	O
for	O
corporate	O
environments	O
.	O
	
Victims	O
using	O
many	O
different	O
IP	O
addresses	O
may	O
indicate	O
laptops	O
.	O
	
The	O
following	O
chart	O
visualizes	O
all	O
the	O
unique	O
victims	O
connecting	O
to	O
C&C	O
servers	O
.	O
	
The	O
main	O
C&C	O
Servers	O
can	O
be	O
clearly	O
seen	O
in	O
Russia	O
and	O
the	O
USA	O
.	O
	
The	O
victims	O
are	O
distributed	O
across	O
99	O
different	O
countries	O
.	O
	
From	O
the	O
total	O
of	O
2,811	O
victims	O
,	O
it	O
was	O
possible	O
to	O
accurately	O
identify	O
106	O
of	O
them	O
.	O
	
Appendix	O
8	O
contains	O
a	O
brief	O
description	O
about	O
the	O
sector	O
/	O
company	O
in	O
which	O
these	O
victims	O
operate	O
.	O
	
The	O
table	O
below	O
summarizes	O
the	O
distribution	O
of	O
the	O
identified	O
victims	O
by	O
sector	O
.	O
	
Based	O
on	O
our	O
monitoring	O
,	O
the	O
most	O
widespread	O
Backdoor	O
is	O
Havex	O
with	O
a	O
total	O
of	O
2,470	O
infected	O
systems	O
,	O
mostly	O
based	O
in	O
USA	O
and	O
Spain	O
.	O
	
32	O
different	O
versions	O
of	O
Havex	O
are	O
used	O
among	O
all	O
victims	O
,	O
with	O
51	O
victims	O
left	O
without	O
any	O
identifiable	O
Havex	O
version	O
.	O
	
Havex	O
Version	O
024	O
,	O
compiled	O
at	O
the	O
end	O
of	O
2012	O
,	O
is	O
the	O
most	O
widespread	O
.	O
	
Besides	O
the	O
Havex	O
version	O
,	O
the	B-Entity
OS	I-Entity
Version	I-Entity
of	I-Entity
the	I-Entity
victim	I-Entity
computer	I-Entity
is	O
also	O
communicated	B-Action
to	B-Modifier
the	O
C&C	B-Entity
server	I-Entity
.	O
	
The	O
most	O
common	O
Operating	O
System	O
among	O
victims	O
is	O
Windows	O
XP	O
,	O
but	O
Windows	O
8.1	O
is	O
also	O
on	O
the	O
list	O
.	O
	
The	O
Sysmain	O
victims	O
connect	O
to	O
six	O
of	O
the	O
monitored	O
C&C	O
servers	O
,	O
where	O
261	O
unique	O
victims	O
were	O
counted	O
,	O
located	O
in	O
38	O
different	O
countries	O
.	O
	
Victims	O
of	O
the	O
Clientx	O
backdoor	O
connect	O
to	O
2	O
of	O
the	O
monitored	O
C&C	O
Servers	O
,	O
where	O
10	O
unique	O
Victims	O
were	O
counted	O
in	O
5	O
different	O
countries	O
.	O
	
Based	O
on	O
the	O
analysis	O
of	O
the	O
monitored	O
C&C	O
Servers	O
we	O
can	O
identify	O
some	O
clusters	O
based	O
on	O
malware	O
versions	O
and	O
the	O
victims	O
.	O
	
This	O
graph	O
visualizes	O
these	O
relations	O
.	O
	
Every	O
dot	O
represents	O
a	O
victim	O
,	O
different	O
Backdoors	O
and	O
versions	O
are	O
colored	O
differently	O
.	O
	
The	O
C&C	O
Servers	O
are	O
also	O
represented	O
as	O
dots	O
where	O
several	O
clients	O
connect	O
.	O
	
Grey	O
lines	O
are	O
connections	O
from	O
a	O
victim	O
to	O
its	O
C&C	O
Server	O
.	O
	
Some	O
C&C	O
Servers	O
are	O
dedicated	O
to	O
a	O
given	O
version	O
of	O
a	O
backdoor	O
(	O
big	O
Cluster	O
)	O
.	O
	
Others	O
share	O
connections	O
with	O
different	O
backdoor	O
versions	O
and	O
different	O
backdoors	O
.	O
	
Breaking	O
this	O
down	O
to	O
the	O
sectors	O
of	O
the	O
identified	O
victims	O
,	O
we	O
can	O
not	O
see	O
any	O
correlation	O
between	O
C&Cs	O
and	O
victims	O
.	O
	
The	O
same	O
sectors	O
are	O
targeted	O
with	O
different	O
backdoor	O
versions	O
.	O
	
Compared	O
to	O
our	O
other	O
APT	O
research	O
the	O
available	O
data	O
is	O
more	O
non	O
-	O
specific	O
than	O
usual	O
.	O
	
There	O
simply	O
is	O
no	O
one	O
piece	O
or	O
set	O
of	O
data	O
that	O
would	O
lead	O
to	O
the	O
conclusion	O
that	O
the	O
threat	O
actor	O
is	O
Bear	O
,	O
Kitten	O
,	O
Panda	O
,	O
Salmon	O
,	O
or	O
otherwise	O
.	O
	
Significant	O
data	O
points	O
below	O
.	O
	
It	O
is	O
rare	O
to	O
see	O
file	O
timestamps	O
used	O
as	O
a	O
precise	O
,	O
primary	O
source	O
of	O
information	O
when	O
it	O
comes	O
to	O
threat	O
actor	O
attribution	O
.	O
	
In	O
previous	O
reports	O
,	O
these	O
timestamps	O
have	O
been	O
used	O
as	O
supporting	O
,	O
or	O
secondary	O
pieces	O
of	O
data	O
.	O
	
They	O
may	O
help	O
to	O
suggest	O
or	O
support	O
a	O
time	O
range	O
for	O
attacker	O
activity	O
,	O
but	O
they	O
are	O
very	O
easily	O
modified	O
.	O
	
So	O
it	O
is	O
not	O
very	O
helpful	O
to	O
focus	O
on	O
this	O
data	O
set	O
.	O
	
The	O
strings	O
present	O
in	O
the	O
backdoors	O
,	O
web	O
components	O
,	O
and	O
exploits	O
are	O
in	O
English	O
.	O
	
Almost	O
200	O
malicious	O
binaries	O
and	O
the	O
related	O
operational	O
content	O
all	O
present	O
a	O
complete	O
lack	O
of	O
Cyrillic	O
content	O
,	O
the	O
opposite	O
of	O
our	O
documented	O
findings	O
from	O
researching	O
Red	O
October	O
,	O
Miniduke	O
,	O
Cosmicduke	O
,	O
Snake	O
,	O
and	O
TeamSpy	O
.	O
	
The	O
OPC	O
module	O
strings	O
include	O
typos	O
and	O
bad	O
grammar	O
.	O
	
Some	O
are	O
so	O
bad	O
they	O
are	O
almost	O
silly	O
and	O
there	O
does	O
n't	O
seem	O
to	O
be	O
a	O
consistent	O
pattern	O
here	O
.	O
	
Programm	O
was	O
started	O
at	O
%	O
02i:%02i:%02i	O
Start	O
finging	O
of	O
LAN	O
hosts	O
...	O
	
Finding	O
was	O
fault	O
.	O
	
Unexpective	O
error	O
Was	O
found	O
%	O
i	O
hosts	O
in	O
LAN	O
:	O
Hosts	O
was't	O
found	O
.	O
	
There	O
are	O
also	O
three	O
interesting	O
strings	O
inside	O
the	O
Karagany	O
backdoor	O
.	O
	
identifiant	O
(	O
which	O
is	O
French	O
for	O
identifier	O
)	O
,	O
fichier	O
(	O
French	O
for	O
file	O
)	O
and	O
liteliteliteskot	O
(	O
lite	O
scot	O
is	O
Swedish	O
for	O
little	O
sheet	O
)	O
Timestamp	O
analysis	O
is	O
based	O
on	O
a	O
total	O
of	O
154	O
collected	O
binaries	O
.	O
	
Highlights	O
.	O
	
Activity	O
/	O
Year	O
(	O
all	O
samples	O
)	O
.	O
	
Activity	O
/	O
Weekdays	O
based	O
on	O
compilation	O
time	O
.	O
	
Activity	O
/	O
Hours	O
(	O
UTC	O
)	O
based	O
on	O
compilation	O
time	O
.	O
	
All	O
the	O
exploit	O
servers	O
delivered	O
slightly	O
modified	O
ripped	O
content	O
from	O
open	O
source	O
repositories	O
.	O
	
All	O
the	O
servers	O
appear	O
to	O
be	O
hacked	O
servers	O
.	O
	
According	O
to	O
the	O
available	O
data	O
,	O
no	O
zero	O
-	O
day	O
exploits	O
were	O
used	O
in	O
any	O
of	O
these	O
attacks	O
,	O
either	O
to	O
compromise	O
the	O
servers	O
in	O
the	O
first	O
place	O
,	O
or	O
delivered	O
as	O
client	O
side	O
attack	O
exploits	O
by	O
the	O
Lights	O
Out	O
Exploit	O
Kit	O
.	O
	
While	O
this	O
purely	O
malicious	O
re	O
-	O
use	O
of	O
metasploit	O
PoC	O
highlights	O
the	O
danger	O
that	O
these	O
attack	O
tools	O
pose	O
,	O
it	O
is	O
also	O
unusual	O
to	O
see	O
an	O
exclusively	O
metasploit	O
attack	O
toolset	O
effectively	O
used	O
in	O
this	O
way	O
,	O
delivered	O
from	O
what	O
appear	O
to	O
be	O
a	O
chain	O
of	O
higher	O
value	O
compromised	O
sites	O
.	O
	
All	O
of	O
these	O
compromised	O
web	O
applications	O
were	O
vulnerable	O
to	O
freely	O
available	O
offensive	O
security	O
tools	O
.	O
	
We	O
acknowledge	O
that	O
many	O
of	O
the	O
compromised	O
referrer	O
servers	O
were	O
related	O
to	O
power	O
producers	O
in	O
some	O
way	O
.	O
	
However	O
,	O
these	O
targets	O
almost	O
seem	O
an	O
afterthought	O
,	O
as	O
the	O
exploit	O
servers	O
themselves	O
were	O
compromised	O
web	O
servers	O
from	O
Cuban	O
travel	O
agency	O
sites	O
,	O
a	O
Californian	O
winery	O
site	O
,	O
a	O
US	O
based	O
women	O
's	O
fashion	O
site	O
,	O
an	O
Iranian	O
general	O
interest	O
/	O
religious	O
inspiration	O
site	O
,	O
a	O
number	O
of	O
dating	O
and	O
adult	O
content	O
websites	O
,	O
and	O
a	O
variety	O
of	O
others	O
.	O
	
Although	O
,	O
we	O
note	O
that	O
the	O
known	O
Trojanized	O
software	O
packages	O
were	O
ICS	O
/	O
SCADA	O
related	O
as	O
well	O
,	O
possibly	O
because	O
those	O
victim	O
sets	O
or	O
environments	O
required	O
special	O
attention	O
.	O
	
So	O
,	O
while	O
there	O
was	O
a	O
strong	O
set	O
of	O
offensive	O
activities	O
on	O
power	O
producers	O
during	O
the	O
campaigns	O
,	O
it	O
was	O
by	O
no	O
means	O
the	O
full	O
focus	O
of	O
them	O
.	O
	
While	O
it	O
may	O
be	O
"	O
shocking	O
"	O
to	O
observe	O
power	O
producers	O
around	O
the	O
world	O
targeted	O
by	O
any	O
one	O
threat	O
actor	O
,	O
this	O
actor	O
's	O
attack	O
activity	O
does	O
not	O
appear	O
to	O
be	O
constrained	O
to	O
power	O
producers	O
.	O
	
The	O
related	O
industries	O
of	O
interest	O
show	O
a	O
much	O
broader	O
global	O
scope	O
than	O
previously	O
discussed	O
,	O
and	O
the	O
geographic	O
regions	O
of	O
interest	O
have	O
gone	O
completely	O
undiscussed	O
.	O
	
For	O
example	O
,	O
Spain	O
had	O
the	O
highest	O
number	O
of	O
victims	O
.	O
	
However	O
,	O
it	O
appears	O
that	O
there	O
was	O
no	O
significant	O
correlation	O
between	O
the	O
victim	O
location	O
and	O
the	O
C&C	O
geolocation	O
.	O
	
And	O
,	O
according	O
to	O
our	O
data	O
,	O
the	O
list	O
also	O
includes	O
victim	O
organizations	O
fitting	O
the	O
following	O
additional	O
categories	O
.	O
	
The	O
Crouching	O
Yeti	O
actor	O
has	O
been	O
performing	O
massive	O
surveillance	O
campaigns	O
in	O
recent	O
years	O
,	O
since	O
at	O
least	O
2010	O
.	O
	
Their	O
targets	O
included	O
thousands	O
of	O
victims	O
of	O
which	O
we	O
were	O
able	O
to	O
identify	O
a	O
few	O
,	O
confirming	O
Crouching	O
Yeti	O
's	O
interest	O
in	O
several	O
strategic	O
sectors	O
.	O
	
The	O
distribution	O
strategy	O
of	O
the	O
group	O
focuses	O
on	O
methods	O
following	O
this	O
targeted	O
philosophy	O
,	O
including	O
spear	O
phishing	O
and	O
waterholing	O
.	O
	
Noticeably	O
,	O
they	O
also	O
compromised	O
legitimate	O
software	O
packages	O
from	O
strategic	O
actors	O
in	O
the	O
SCADA	O
sector	O
in	O
order	O
to	O
infect	O
their	O
final	O
victims	O
.	O
	
The	O
victim	O
list	O
confirms	O
that	O
the	O
tactic	O
proved	O
successful	O
.	O
	
There	O
is	O
nothing	O
especially	O
sophisticated	O
in	O
their	O
exploits	O
,	O
or	O
in	O
the	O
malware	O
they	O
used	O
to	O
infect	O
victims	O
.	O
	
Their	O
RATs	B-Entity
are	O
flexible	O
enough	O
to	O
perform	B-Action
surveillance	B-Entity
and	O
data	B-Entity
exfiltration	I-Entity
efficiently	O
.	O
	
They	O
used	O
dozens	O
of	O
compromised	O
servers	O
as	O
Command	O
and	O
Control	O
domains	O
with	O
a	O
simple	O
,	O
but	O
effective	O
,	O
PHP	O
backend	O
.	O
	
However	O
there	O
is	O
an	O
interesting	O
connection	O
with	O
this	O
group	O
and	O
the	O
LightsOut	O
Exploit	O
Kit	O
for	O
the	O
distribution	O
of	O
its	O
malware	O
in	O
some	O
waterholing	O
attacks	O
.	O
	
We	O
believe	O
they	O
are	O
likely	O
its	O
only	O
operators	O
as	O
of	O
June	O
2014	O
.	O
	
Thanks	O
to	O
the	O
monitoring	O
of	O
several	O
of	O
the	O
Command	O
and	O
Control	O
domains	O
used	O
by	O
the	O
group	O
,	O
we	O
were	O
able	O
to	O
identify	O
several	O
victims	O
.	O
	
This	O
victims	O
'	O
list	O
reinforces	O
the	O
interests	O
shown	O
by	O
the	O
Crouching	O
Yeti	O
actor	O
in	O
strategic	O
targets	O
,	O
but	O
also	O
shows	O
the	O
interest	O
of	O
the	O
group	O
in	O
many	O
other	O
not	O
-	O
so	O
-	O
obvious	O
institutions	O
.	O
	
We	O
believe	O
they	O
might	O
be	O
collateral	O
victims	O
,	O
but	O
it	O
might	O
also	O
be	O
fair	O
to	O
redefine	O
the	O
Crouching	O
Yeti	O
actor	O
not	O
only	O
as	O
a	O
highly	O
targeted	O
one	O
in	O
a	O
very	O
specific	O
area	O
of	O
interest	O
,	O
but	O
a	O
broad	O
surveillance	O
campaign	O
with	O
interests	O
in	O
different	O
sectors	O
.	O
	
We	O
will	O
continue	O
monitoring	O
this	O
actor	O
.	O
	
The	O
experts	O
of	O
G	O
DATA	O
's	O
SecurityLabs	O
discovered	O
a	O
cyber	O
-	O
espionage	O
campaign	O
that	O
perfectly	O
exemplifies	O
the	O
way	O
how	O
targeted	O
attacks	O
work	O
.	O
	
The	O
purpose	O
of	O
this	O
campaign	O
was	O
to	O
steal	O
valuable	O
documents	O
from	O
the	O
targeted	O
entity	O
.	O
	
We	O
entitle	O
this	O
operation	O
"	O
TooHash	O
"	O
.	O
	
The	O
attackers	B-Entity
'	O
modus	O
operandi	O
is	O
to	O
carry	B-Action
out	I-Action
spear	O
phishing	B-Entity
using	B-Modifier
a	O
malicious	B-Entity
Microsoft	I-Entity
Office	I-Entity
document	I-Entity
as	I-Entity
an	I-Entity
attachment	I-Entity
.	O
	
The	O
attackers	O
do	O
not	O
choose	O
their	O
targets	O
indiscriminately	O
,	O
which	O
we	O
derive	O
from	O
the	O
fact	O
that	O
they	O
sent	O
specially	O
crafted	O
CV	O
documents	O
,	O
probably	O
to	O
human	O
resources	O
management	O
employees	O
.	O
	
Naturally	O
,	O
the	O
recipients	O
are	O
inclined	O
to	O
open	O
such	O
documents	O
on	O
a	O
daily	O
base	O
.	O
	
The	O
majority	O
of	O
discovered	O
samples	O
were	O
submitted	O
from	O
Taiwan	O
.	O
	
As	O
part	O
of	O
the	O
documents	O
are	O
in	O
Simplified	O
Chinese	O
which	O
is	O
used	O
in	O
the	O
Chinese	O
mainland	O
and	O
others	O
in	O
Traditional	O
Chinese	O
which	O
is	O
used	O
in	O
Hong	O
Kong	O
,	O
Macao	O
and	O
Taiwan	O
,	O
these	O
malicious	O
documents	O
might	O
have	O
been	O
used	O
against	O
targets	O
in	O
the	O
whole	O
Greater	O
China	O
area	O
.	O
	
The	O
attached	B-Entity
documents	I-Entity
exploit	O
a	O
well	O
-	O
known	O
and	O
rather	O
aged	O
vulnerability	O
(	O
CVE-2012	O
-	O
0158	O
)	O
to	O
drop	B-Action
a	O
remote	B-Entity
administration	I-Entity
tool	I-Entity
,	O
or	O
RAT	O
for	O
short	O
,	O
onto	B-Modifier
the	O
targeted	B-Entity
user	I-Entity
's	I-Entity
computer	I-Entity
.	O
	
During	O
the	O
campaign	O
,	O
we	O
identified	O
two	O
different	O
pieces	O
of	O
malware	O
.	O
	
Both	B-Entity
include	B-Action
common	O
cyber	O
-	O
espionage	O
components	O
such	O
as	O
code	B-Entity
execution	I-Entity
,	O
file	B-Entity
listing	I-Entity
,	O
document	B-Entity
exfiltration	I-Entity
and	O
more	O
.	O
	
We	O
discovered	O
more	B-Entity
than	I-Entity
75	I-Entity
command	I-Entity
and	I-Entity
control	I-Entity
servers	I-Entity
,	O
all	O
used	B-Action
to	B-Modifier
administrate	O
infected	B-Entity
machines	I-Entity
.	O
	
The	O
servers	O
were	O
mainly	O
located	O
in	O
Hong	O
Kong	O
and	O
the	O
USA	O
.	O
	
Furthermore	O
,	O
the	O
administration	O
panel	O
's	O
language	O
,	O
used	O
by	O
the	O
attackers	O
to	O
manage	O
infected	O
systems	O
,	O
was	O
partly	O
written	O
in	O
Chinese	O
and	O
partly	O
in	O
English	O
.	O
	
The	O
exploit	O
used	O
by	O
the	O
attackers	O
is	O
identified	O
and	O
blocked	O
by	O
G	O
DATA	O
's	O
Exploit	O
Protection	O
technology	O
and	O
G	O
DATA	O
's	O
security	O
solutions	O
detect	O
the	O
dropped	O
binaries	O
as	O
Win32.Trojan	O
.	O
Cohhoc	O
.	O
A	O
and	O
Win32.Trojan	O
.	O
DirectsX.A	O
respectively	O
.	O
	
Nowadays	O
,	O
trade	O
secrets	O
describe	O
one	O
of	O
the	O
major	O
values	O
of	O
almost	O
every	O
company	O
.	O
	
Therefore	O
,	O
begrudged	O
competitors	O
may	O
be	O
tempted	O
to	O
steal	O
valuable	O
sensitive	O
information	O
for	O
their	O
purposes	O
.	O
	
The	O
leak	O
of	O
sensitive	O
documents	O
can	O
be	O
a	O
disaster	O
for	O
a	O
company	O
and	O
lead	O
to	O
large	O
financial	O
losses	O
.	O
	
Furthermore	O
,	O
governmental	O
entities	O
use	O
sensitive	O
,	O
private	O
or	O
classified	O
documents	O
.	O
	
Intelligence	O
agencies	O
may	O
be	O
interested	O
to	O
obtain	O
such	O
documents	O
.	O
	
The	O
analyzed	O
samples	O
used	O
in	O
the	O
"	O
TooHash	O
"	O
campaign	O
were	O
Microsoft	O
Office	O
documents	O
,	O
and	O
were	O
submitted	O
to	O
us	O
from	O
a	O
Taiwanese	O
customer	O
.	O
	
An	O
indication	O
leading	O
to	O
the	O
target	O
area	O
is	O
one	O
of	O
the	O
documents	O
used	O
by	O
the	O
attackers	O
,	O
which	O
contained	O
the	O
string	O
"	O
102年尾牙、	O
"	O
which	O
means	O
"	O
end	O
of	O
the	O
year	O
102	O
"	O
.	O
	
The	O
official	O
calendar	O
used	O
in	O
Taiwan	O
starts	O
in	O
1912	O
(	O
year	O
1	O
)	O
,	O
so	O
the	O
year	O
102	O
is	O
the	O
year	O
2013	O
according	O
to	O
the	O
Gregorian	O
calendar	O
(	O
1911	O
+	O
102=2013	O
)	O
.	O
	
We	O
conclude	O
that	O
the	O
targets	O
are	O
entities	O
located	O
in	O
the	O
Greater	O
China	O
area	O
and	O
on	O
the	O
name	O
of	O
another	O
document	O
used	O
by	O
the	O
attacker	O
called	O
李辉简历.doc	O
which	O
translates	O
to	O
"	O
resume	O
of	O
Li	O
Hui	O
"	O
.	O
	
Another	O
lead	O
,	O
suggesting	O
that	O
the	O
attacks	O
occurred	O
in	O
the	O
Greater	O
China	O
area	O
,	O
is	O
the	O
fact	O
that	O
the	O
majority	O
of	O
samples	O
available	O
on	O
VirusTotal	O
were	O
originally	O
submitted	O
from	O
Taiwan	O
.	O
	
The	O
DNS	O
-	O
name	O
of	O
the	O
C&C	O
server	O
contained	O
information	O
about	O
affected	O
companies	O
.	O
	
Here	O
is	O
a	O
list	O
of	O
some	O
targeted	O
entities	O
.	O
	
To	O
drop	O
the	O
malware	O
onto	O
the	O
targeted	O
computer	O
and	O
to	O
control	O
the	O
system	O
,	O
the	B-Entity
attackers	I-Entity
chose	O
to	O
carry	B-Action
out	I-Action
a	O
spear	B-Entity
phishing	I-Entity
campaign	I-Entity
.	O
	
This	O
campaign	O
comprised	O
a	O
Microsoft	O
Office	O
document	O
being	O
sent	O
to	O
the	O
victim	O
.	O
	
A	O
probable	O
entry	O
point	O
for	O
a	O
manipulated	O
CV	O
would	O
be	O
an	O
HR	O
department	O
.	O
	
If	O
the	O
document	O
is	O
opened	O
with	O
an	O
outdated	O
Microsoft	O
Office	O
version	O
,	O
malware	O
is	O
installed	O
by	O
exploiting	O
vulnerability	O
CVE-2012	O
-	O
0158	O
.	O
	
To	O
appear	O
credible	O
,	O
the	O
attackers	O
selected	O
the	O
targeted	O
users	O
and	O
the	O
type	O
of	O
the	O
attached	O
documents	O
cleverly	O
.	O
	
For	O
example	O
,	O
a	O
Microsoft	O
Office	O
Word	O
document	O
called	O
resume	O
of	O
Li	O
Hui.doc	O
.	O
	
The	O
document	O
title	O
as	O
well	O
as	O
the	O
content	O
was	O
written	O
in	O
Simplified	O
Chinese	O
.	O
	
The	O
titles	O
of	O
the	O
attacking	O
documents	O
involved	O
are	O
as	O
follows	O
.	O
	
To	O
explain	O
the	O
exploit	O
used	O
,	O
we	O
have	O
a	O
look	O
at	O
the	O
Word	O
document	O
,	O
the	O
ostensible	O
CV	O
.	O
	
The	O
mentioned	O
exploit	O
causes	O
Microsoft	O
Word	O
to	O
crash	O
,	O
which	O
might	O
alert	O
attacked	O
users	O
just	O
right	O
away	O
.	O
	
In	O
our	O
case	O
,	O
the	O
attackers	O
crafted	O
their	O
malicious	O
document	O
in	O
a	O
special	O
way	O
to	O
conceal	O
the	O
software	O
crash	O
:	O
The	O
malicious	O
.doc	O
causes	O
a	O
crash	O
,	O
but	O
moments	O
after	O
the	O
crash	O
a	O
legitimate	O
Word	O
session	O
opens	O
up	O
and	O
,	O
to	O
the	O
user	O
,	O
everything	O
appears	O
to	O
be	O
normal	O
.	O
	
Nevertheless	O
,	O
cautious	O
users	O
might	O
suspect	O
malicious	O
actions	O
behind	O
such	O
activities	O
and	O
notify	O
security	O
staff	O
.	O
	
The	O
CV	O
that	O
comes	O
with	O
the	O
legitimate	O
Word	O
document	O
(	O
Wo.doc	O
)	O
is	O
written	O
in	O
Chinese	O
characters	O
and	O
style	O
used	O
in	O
the	O
Chinese	O
mainland	O
.	O
	
Nevertheless	O
,	O
this	O
sample	O
has	O
also	O
been	O
submitted	O
to	O
us	O
from	O
Taiwan	O
.	O
	
The	O
resume	O
visible	O
to	O
the	O
user	O
(	O
Wo.doc	O
)	O
holds	O
a	O
tracking	O
mechanism	O
:	O
Li	O
Hui	O
's	O
picture	O
,	O
visible	O
in	O
the	O
document	O
as	O
the	O
blank	O
square	O
on	O
the	O
right	O
hand	O
side	O
,	O
is	O
not	O
stored	O
locally	O
but	O
stored	O
on	O
the	O
Internet	O
.	O
	
The	O
following	O
tag	O
,	O
inside	O
the	O
document	O
,	O
reveals	O
this	O
function	O
.	O
	
As	O
soon	O
as	O
the	O
document	O
is	O
loaded	O
,	O
a	B-Entity
network	I-Entity
query	I-Entity
is	O
performed	B-Action
and	O
notifies	O
the	O
attacker	O
about	O
the	O
successful	O
exploit	O
and	O
the	O
availability	O
of	O
a	O
newly	O
infected	O
machine	O
.	O
	
We	O
identified	O
two	O
types	O
of	O
malware	O
used	O
to	O
administrate	O
the	O
infected	O
machines	O
:	O
Cohhoc	O
and	O
DirectsX.	O
	
The	O
first	O
one	O
is	O
a	O
"	O
classic	O
"	O
Remote	O
Administration	O
Tool	O
.	O
	
The	O
second	O
one	O
is	O
more	O
advanced	O
and	O
of	O
a	O
different	O
kind	O
,	O
the	O
malware	O
is	O
a	O
rootkit	O
.	O
	
It	O
is	O
executed	O
in	O
kernel	O
mode	O
.	O
	
The	O
RAT	O
and	O
the	O
rootkit	O
both	O
share	O
the	O
same	O
command	O
and	O
control	O
infrastructure	O
.	O
	
The	O
malware	O
is	O
divided	O
into	O
three	O
parts	O
.	O
	
The	O
second	O
component	O
is	O
installed	O
into	O
a	O
subfolder	O
of	O
the	O
directory	O
%	O
APPDATA%	O
(	O
for	O
example	O
in	O
%	O
APPDATA%\Microsoft\	O
)	O
.	O
	
Known	O
file	O
names	O
for	O
the	O
files	O
used	O
during	O
the	O
campaign	O
discussed	O
:	O
svchost.exe	O
and	O
conime.exe	O
.	O
	
The	O
second	O
component	O
works	O
similarly	O
.	O
	
In	O
case	O
you	O
are	O
interested	O
in	O
information	O
regarding	O
the	O
unpacking	O
of	O
this	O
malware	O
,	O
please	O
feel	O
free	O
to	O
contact	O
us	O
using	O
toohash.securityblog@gdata.de	O
During	O
the	O
TooHash	O
campaign	O
,	O
we	O
were	O
able	O
to	O
identify	O
two	O
variants	O
of	O
"	O
Cohhoc	O
"	O
.	O
	
Those	O
two	O
versions	O
can	O
be	O
distinguished	O
by	O
looking	O
at	O
the	O
creation	O
of	O
the	O
respective	O
mutex	O
after	O
the	O
malware	O
is	O
started	O
.	O
	
The	O
main	O
difference	O
between	O
the	O
two	O
malware	O
variants	O
is	O
the	O
handling	O
of	O
the	O
payload	O
(	O
component	O
three	O
)	O
.	O
	
In	O
the	O
earlier	O
version	O
,	O
the	O
payload	O
is	O
located	O
within	O
a	O
resource	O
inside	O
component	O
two	O
.	O
	
In	O
the	O
later	O
version	O
,	O
the	O
payload	O
is	O
an	O
additional	O
file	O
.	O
	
This	O
additional	O
file	O
is	O
stored	O
in	O
the	O
same	O
directory	O
as	O
the	O
second	O
component	O
and	O
its	O
name	O
is	O
brndlog	O
.	O
	
As	O
small	O
as	O
this	O
difference	O
seems	O
to	O
be	O
for	O
a	O
normal	O
computer	O
user	O
,	O
from	O
a	O
malware	O
analyst	O
's	O
point	O
of	O
view	O
,	O
it	O
is	O
a	O
huge	O
difference	O
.	O
	
If	O
,	O
in	O
the	O
first	O
case	O
,	O
the	O
sample	O
was	O
found	O
within	O
a	O
sample	O
database	O
,	O
the	O
analyst	O
would	O
be	O
able	O
to	O
extract	O
the	O
payload	O
and	O
to	O
analyze	O
it	O
right	O
away	O
.	O
	
However	O
,	O
in	O
the	O
second	O
case	O
,	O
the	O
analyst	O
can	O
not	O
extract	O
and	O
analyze	O
the	O
payload	O
at	O
all	O
.	O
	
In	O
this	O
context	O
,	O
the	O
second	O
component	O
alone	O
is	O
rather	O
useless	O
;	O
one	O
needs	O
to	O
find	O
the	O
binary	O
which	O
installs	O
the	O
payload	O
.	O
	
Furthermore	O
,	O
it	O
is	O
rather	O
complex	O
to	O
create	O
signature	O
detection	O
for	O
an	O
encrypted	O
file	O
,	O
such	O
as	O
the	O
payload	O
discussed	O
.	O
	
Persistence	B-Entity
is	O
ensured	B-Action
by	B-Modifier
the	O
creation	B-Entity
of	I-Entity
a	I-Entity
shortcut	I-Entity
file	I-Entity
(	I-Entity
.lnk	I-Entity
)	I-Entity
in	I-Entity
the	I-Entity
Start	I-Entity
Menu	I-Entity
folder	I-Entity
.	O
	
This	O
shortcut	O
is	O
labeled	O
as	O
Internet	O
Explorer	O
.lnk	O
.	O
	
The	O
blank	O
space	O
just	O
before	O
the	O
file	O
name	O
extension	O
was	O
inserted	O
to	O
trick	O
the	O
user	O
.	O
	
The	O
text	O
looks	O
exactly	O
like	O
the	O
original	O
without	O
the	O
additional	O
space	O
.	O
	
Furthermore	O
,	O
it	O
is	O
not	O
only	O
the	O
file	O
's	O
name	O
which	O
sidetracks	O
,	O
but	O
also	O
the	O
icon	O
used	O
for	O
this	O
link	O
comes	O
in	O
the	O
disguise	O
of	O
Microsoft	O
's	O
Internet	O
Explorer	O
.	O
	
The	O
screenshot	O
below	O
reveals	O
that	O
the	O
actual	O
file	O
behind	O
this	O
shortcut	O
points	O
to	O
a	O
different	O
program	O
:	O
conime.exe	O
:	O
The	O
"	O
Cohhoc	O
"	O
malware	O
is	O
a	O
Remote	O
Administration	O
Tool	O
and	O
is	O
able	O
to	O
.	O
	
Within	O
the	O
samples	O
,	O
we	O
found	O
two	O
different	O
hardcoded	O
command	O
and	O
control	O
servers	O
and	O
a	O
feature	O
to	O
easily	O
choose	O
an	O
alternative	O
server	O
.	O
	
If	O
the	O
file	O
%	O
APPDATA%\Adobe\ActiveX.dat	O
exists	O
on	O
the	O
system	O
,	O
the	O
malware	O
uses	O
the	O
server	O
listed	O
in	O
this	O
file	O
instead	O
of	O
the	O
hardcoded	O
servers	O
.	O
	
The	O
content	O
in	O
the	O
file	O
must	O
use	O
the	O
obfuscation	O
system	O
described	O
in	O
the	O
next	O
chapter	O
.	O
	
This	O
approach	O
,	O
using	O
an	O
extra	O
file	O
with	O
server	O
information	O
,	O
proves	O
to	O
be	O
particularly	O
useful	O
for	O
the	O
attackers	O
,	O
as	O
they	O
do	O
not	O
have	O
to	O
transmit	O
new	O
payload	O
to	O
the	O
infected	O
system	O
.	O
	
Furthermore	O
,	O
it	O
keeps	O
analysts	O
in	O
the	O
dark	O
about	O
additional	O
C&Cs	O
in	O
case	O
they	O
only	O
see	O
the	O
.dat	O
file	O
.	O
	
This	O
file	O
alone	O
is	O
rather	O
useless	O
.	O
	
We	O
have	O
seen	O
the	O
same	O
technique	O
when	O
looking	O
at	O
the	O
differences	O
between	O
the	O
two	O
malware	O
variants	O
before	O
.	O
	
The	O
"	B-Entity
Cohhoc	I-Entity
"	I-Entity
malware	I-Entity
uses	B-Action
an	O
obfuscation	B-Entity
layer	I-Entity
,	O
to	B-Modifier
disguise	O
the	B-Entity
malware	I-Entity
and	O
to	B-Modifier
complicate	O
the	B-Entity
analysis	I-Entity
.	O
	
The	O
obfuscation	O
is	O
used	O
.	O
	
This	O
algorithm	O
can	O
easily	O
be	O
adapted	O
in	O
C	O
language	O
.	O
	
Fellow	O
researchers	O
are	O
welcome	O
to	O
receive	O
the	O
code	O
after	O
contacting	O
samplerequest@gdata.de	O
.	O
	
To	O
be	O
readable	O
and	O
easily	O
usable	O
,	O
the	O
base64	O
encoded	O
data	O
(	O
in	O
binary	O
format	O
)	O
is	O
converted	O
into	O
ASCII	O
.	O
	
Here	O
is	O
an	O
example	O
to	O
decode	O
a	O
command	O
and	O
control	O
.	O
	
The	O
malware	O
uses	O
HTTP	O
to	O
communicate	O
to	O
the	O
command	O
and	O
control	O
servers	O
.	O
	
Here	O
is	O
an	O
example	O
of	O
a	O
request	O
performed	O
by	O
an	O
infected	O
system	O
.	O
	
The	O
relevant	O
data	O
is	O
placed	O
after	O
the	O
GET	O
request	O
.	O
	
Here	O
is	O
the	O
content	O
of	O
the	O
request	O
,	O
decoded	O
by	O
using	O
the	O
code	O
mentioned	O
above	O
.	O
	
Here	O
are	O
the	O
different	O
parts	O
of	O
the	O
data	O
transmitted	O
.	O
	
The	O
dropper	O
is	O
used	O
to	O
install	O
two	O
files	O
and	O
the	O
persistence	O
mechanism	O
.	O
	
The	O
two	O
files	O
are	O
DirectsX.sys	O
(	O
the	O
malicious	O
driver	O
)	O
and	O
directsx	O
(	O
without	O
any	O
extension	O
)	O
.	O
	
The	O
second	O
file	O
is	O
the	O
encoded	O
payload	O
used	O
by	O
the	O
driver	O
.	O
	
The	O
persistence	B-Entity
mechanism	I-Entity
is	O
realized	B-Action
by	B-Modifier
the	O
creation	B-Entity
of	I-Entity
a	I-Entity
service	I-Entity
.	O
	
The	O
installed	O
file	O
and	O
the	O
registry	O
modifications	O
are	O
stored	O
in	O
a	O
resource	O
within	O
the	O
dropper	O
.	O
	
Here	O
is	O
a	O
screenshot	O
of	O
the	O
registry	O
key	O
created	O
.	O
	
The	O
dropper	O
and	O
the	O
driver	O
are	O
both	O
signed	O
by	O
a	O
legitimate	O
certificate	O
.	O
	
The	O
certificate	O
is	O
owned	O
by	O
"	O
Jiangxi	O
you	O
ma	O
chuang	O
da	O
software	O
technology	O
Co.	O
,	O
LTD	O
"	O
,	O
has	O
been	O
reported	O
stolen	O
and	O
is	O
known	O
to	O
have	O
been	O
used	O
in	O
APT	O
attacks	O
.	O
	
Here	O
is	O
a	O
screenshot	O
of	O
the	O
certificate	O
.	O
	
The	O
main	O
purpose	O
of	O
the	O
driver	O
is	O
to	O
decode	O
the	O
content	O
of	O
the	O
directsx	O
file	O
and	O
to	O
inject	O
the	O
payload	O
into	O
a	O
userland	O
process	O
.	O
	
The	O
algorithm	O
used	O
to	O
encode	O
the	O
data	O
in	O
the	O
file	O
is	O
a	O
XOR	O
followed	O
by	O
a	O
SUB	O
.	O
	
The	O
values	O
of	O
the	O
XOR	O
and	O
the	O
SUB	O
can	O
be	O
different	O
.	O
	
The	O
decoding	O
file	O
contains	O
the	O
configuration	O
(	O
command	O
and	O
control	O
)	O
and	O
a	O
library	O
(	O
.dll	O
)	O
to	O
inject	O
in	O
userland	O
.	O
	
Here	O
is	O
an	O
example	O
of	O
configuration	O
.	O
	
Actually	O
,	O
the	B-Entity
library	I-Entity
is	O
injected	B-Action
into	B-Modifier
the	O
process	B-Entity
of	I-Entity
BitDefender	I-Entity
(	I-Entity
seccenter.exe	I-Entity
)	I-Entity
,	I-Entity
ZoneAlarm	I-Entity
(	I-Entity
svchost.exe	I-Entity
)	I-Entity
or	I-Entity
360	I-Entity
(	I-Entity
360tray.exe	I-Entity
)	I-Entity
,	O
which	O
means	O
that	O
three	O
popular	O
security	O
products	O
are	O
abused	O
.	O
	
If	O
the	O
processes	O
are	O
not	O
running	O
on	O
the	O
infected	O
system	O
,	O
the	B-Entity
injection	I-Entity
is	O
performed	B-Action
into	B-Modifier
explorer.exe	B-Entity
.	O
	
To	O
perform	O
the	O
injection	O
,	O
the	O
driver	O
uses	O
the	O
API	O
KeStackAttachProcess	O
(	O
)	O
.	O
	
This	O
function	O
allows	O
it	O
to	O
attach	O
the	O
current	O
thread	O
to	O
an	O
address	O
space	O
of	O
a	O
userland	O
process	O
.	O
	
The	O
name	O
of	O
the	O
rootkit	O
is	O
linked	O
to	O
its	O
device	O
name	O
:	O
\\device\DirectsX	O
and	O
its	O
symbolic	O
name	O
:	O
\\DosDevices\DirectsX.	O
	
The	O
injected	O
dll	O
is	O
signed	O
with	O
the	O
same	O
certificate	O
,	O
too	O
.	O
	
It	O
is	O
the	O
remote	O
administration	O
tool	O
itself	O
,	O
injected	O
by	O
the	O
rootkit	O
.	O
	
The	O
tool	O
allows	O
the	O
attackers	O
.	O
	
This	O
library	O
is	O
a	O
variant	O
of	O
a	O
remote	O
administration	O
tool	O
also	O
known	O
as	O
Savit	O
.	O
	
We	O
identified	O
more	O
than	O
75	O
different	O
servers	O
.	O
	
The	O
complete	O
list	O
of	O
domains	O
is	O
available	O
in	O
the	O
appendix	O
.	O
	
The	O
IP	O
resolved	O
by	O
the	O
domains	O
changed	O
frequently	O
.	O
	
At	O
the	O
time	O
of	O
writing	O
this	O
report	O
,	O
all	O
known	O
C&C	O
servers	O
were	O
mainly	O
located	O
in	O
Hong	O
Kong	O
,	O
with	O
three	O
different	O
host	O
companies	O
.	O
	
A	O
fourth	O
host	O
company	O
used	O
was	O
located	O
in	O
the	O
US	O
.	O
	
The	O
IP	O
ranges	O
used	O
by	O
then	O
.	O
	
The	O
choice	O
of	O
domain	O
names	O
was	O
made	O
to	O
trick	O
the	O
users	O
or	O
the	O
security	O
team	O
during	O
their	O
analysis	O
of	O
the	O
web	O
logs	O
collected	O
.	O
	
Have	O
a	O
look	O
at	O
two	O
examples	O
used	O
during	O
the	O
TooHash	O
campaign	O
.	O
	
For	O
each	O
domain	O
,	O
the	O
attackers	O
add	O
a	O
subdomain	O
,	O
the	O
subdomain	O
is	O
generally	O
assumed	O
to	O
be	O
the	O
name	O
(	O
or	O
the	O
acronym	O
)	O
of	O
the	O
targeted	O
entities	O
.	O
	
Here	O
is	O
an	O
example	O
:	O
nspo.intarnetservices.com	O
.	O
	
This	O
could	O
,	O
in	O
the	O
context	O
of	O
the	O
Greater	O
China	O
area	O
,	O
stand	O
for	O
the	O
National	O
Space	O
Organization	O
located	O
in	O
Taiwan	O
.	O
	
The	O
attackers	O
control	O
infected	O
machines	O
with	O
the	O
help	O
of	O
web	O
servers	O
installed	O
on	O
the	O
C&Cs	O
,	O
they	O
do	O
not	O
need	O
to	O
have	O
remote	O
access	O
.	O
	
Here	O
is	O
the	O
authentication	O
page	O
of	O
the	O
administration	O
panel	O
and	O
aswe	O
can	O
see	O
,	O
the	O
panel	O
is	O
partly	O
written	O
in	O
Simplified	O
Chinese	O
.	O
	
We	O
did	O
not	O
clearly	O
identify	O
the	O
people	O
behind	O
this	O
campaign	O
.	O
	
The	O
use	O
of	O
the	O
stolen	O
certificate	O
could	O
point	O
the	O
Shiqiang	O
group	O
,	O
but	O
nothing	O
can	O
be	O
proven	O
.	O
	
Anyway	O
,	O
in	O
our	O
case	O
,	O
the	O
attackers	O
clearly	O
targeted	O
private	O
business	O
and	O
governmental	O
organizations	O
as	O
well	O
.	O
	
Either	O
the	O
group	O
decided	O
to	O
target	O
governmental	O
entities	O
as	O
well	O
or	O
the	O
stolen	O
certificate	O
is	O
used	O
by	O
several	O
groups	O
.	O
	
In	O
any	O
case	O
,	O
the	O
attackers	O
are	O
well	O
organized	O
and	O
use	O
a	O
huge	O
and	O
complex	O
infrastructure	O
to	O
manage	O
the	O
infected	O
systems	O
.	O
	
Furthermore	O
,	O
they	O
use	O
two	O
different	O
malware	O
types	O
in	O
order	O
to	O
always	O
have	O
access	O
to	O
the	O
targeted	O
organizations	O
even	O
if	O
one	O
malware	O
is	O
detected	O
.	O
	
The	O
second	O
malware	O
becomes	O
a	O
spare	O
wheel	O
.	O
	
We	O
assume	O
that	O
the	O
people	O
behind	O
the	O
group	O
are	O
professionals	O
.	O
	
This	O
campaign	O
showed	O
us	O
once	O
more	O
,	O
that	O
people	O
do	O
not	O
hesitate	O
to	O
use	O
sophisticated	O
and	O
deceptive	O
methods	O
to	O
steal	O
data	O
from	O
companies	O
or	O
governmental	O
organizations	O
.	O
	
The	O
files	O
submitted	O
to	O
us	O
seem	O
to	O
have	O
targeted	O
companies	O
in	O
the	O
Greater	O
China	O
area	O
but	O
this	O
technology	O
can	O
easily	O
be	O
used	O
against	O
organizations	O
in	O
other	O
countries	O
and	O
regions	O
across	O
the	O
globe	O
.	O
	
Due	O
to	O
the	O
increasing	O
value	O
of	O
nowadays	O
'	O
trade	O
secrets	O
and	O
political	O
secrets	O
,	O
we	O
believe	O
that	O
the	O
use	O
of	O
this	O
kind	O
of	O
sponsored	O
campaign	O
is	O
very	O
likely	O
to	O
increase	O
in	O
the	O
future	O
.	O
	
Companies	O
and	O
other	O
entities	O
as	O
well	O
need	O
to	O
increase	O
their	O
security	O
measures	O
and	O
to	O
educate	O
the	O
users	O
about	O
the	O
risks	O
they	O
might	O
encounter	O
while	O
working	O
with	O
a	O
computer	O
–	O
ranging	O
from	O
social	O
engineering	O
to	O
malware	O
attacks	O
,	O
etc	O
.	O
	
The	O
exploits	O
used	O
during	O
this	O
campaign	O
are	O
detected	O
by	O
G	O
DATA	O
's	O
exploit	O
protection	O
system	O
and	O
the	O
files	O
involved	O
are	O
detected	O
by	O
our	O
antivirus	O
engines	O
.	O
	
In	O
case	O
you	O
would	O
like	O
to	O
receive	O
further	O
technical	O
information	O
or	O
would	O
like	O
to	O
contribute	O
any	O
information	O
to	O
this	O
case	O
,	O
please	O
feel	O
free	O
to	O
contact	O
us	O
by	O
using	O
the	O
following	O
email	O
address	O
:	O
toohash.securityblog@gdata.de	O
Documents	O
(	O
and	O
the	O
original	O
name	O
)	O
.	O
	
Cohhoc	O
samples	O
.	O
	
DirectsX	O
samples	O
.	O
	
%	O
USERPROFILE%\Start	O
Menu\Programs\Startup\Internet	O
Explorer	O
.lnk	O
%	O
APPDATA%\Roaming\Microsoft\Windows\Start	O
Menu\Programs\Startup\Internet	O
Explorer	O
.lnk	O
%	O
APPDATA%\Adobe\ActiveX.dat	O
%	O
APPDATA%\Adobe\ActiveX.bat	O
%	O
APPDATA%\Microsoft\conime.exe	O
%	O
APPDATA%\Microsoft\conime.exe.en	O
%	O
TEMP%\svchost.exe	O
%	O
TEMP%\war.exe	O
%	O
TEMP%\Wo.doc	O
%	O
SystemRoot%\System\directsx.sys	O
%	O
CommonProgramFiles%\System\directsx	O
\\Device\DirectsX	O
\\DosDevices\DirectsX	O
*	O
.cnnic	O
-	O
micro.com	O
*	O
.proxydomain.org	O
*	O
.dyndns	O
-	O
office.com	O
*	O
.kmdns.net	O
*	O
.privnsb.com	O
*	O
.adobeservice.net	O
*	O
.webmailerservices.com	O
*	O
.intarnetservice.com	O
In	O
case	O
you	O
wish	O
to	O
have	O
information	O
about	O
the	O
IPs	O
involved	O
,	O
please	O
get	O
in	O
touch	O
with	O
us	O
via	O
toohash.securityblog@gdata.de	O
	
Disclaimer	O
:	O
CrowdStrike	O
derived	O
this	O
information	O
from	O
investigations	O
in	O
non	O
-	O
classified	O
environments	O
.	O
	
Since	O
we	O
value	O
our	O
client	O
's	O
privacy	O
and	O
interests	O
,	O
some	O
data	O
has	O
been	O
redacted	O
or	O
sanitized	O
.	O
	
Crowdstrike	O
presents	O
"	O
Mo	O
'	O
Shells	O
Mo	O
'	O
Problems	O
"	O
-	O
A	O
four	O
part	O
series	O
featuring	O
two	O
unique	O
web	O
shells	O
used	O
by	O
a	O
Chinese	O
threat	O
group	O
we	O
call	O
Deep	O
Panda	O
.	O
	
The	O
series	O
will	O
culminate	O
with	O
a	O
CrowdCast	O
in	O
April	O
2014	O
detailing	O
a	O
case	O
study	O
of	O
the	O
incident	O
response	O
investigation	O
conducted	O
to	O
identify	O
these	O
web	O
shells	O
.	O
	
Special	O
thanks	O
to	O
Josh	O
Phillips	O
of	O
the	O
CrowdStrike	O
Global	O
Intelligence	O
Team	O
for	O
providing	O
the	O
technical	O
analysis	O
in	O
this	O
blog	O
post	O
.	O
	
Today	O
we	O
'll	O
cover	O
part	O
one	O
of	O
this	O
series	O
,	O
which	O
provides	O
an	O
overview	O
of	O
what	O
web	O
shells	O
are	O
,	O
functionality	O
of	O
two	O
web	O
shells	O
recently	O
identified	O
during	O
an	O
incident	O
response	O
investigation	O
and	O
how	O
they	O
were	O
leveraged	O
by	O
the	O
attacker	O
.	O
	
Parts	O
two	O
through	O
four	O
will	O
provide	O
details	O
on	O
successful	O
analytical	O
techniques	O
you	O
can	O
use	O
to	O
discover	O
web	O
shells	O
within	O
your	O
environment	O
.	O
	
A	O
Web	O
Shell	O
is	O
a	O
file	O
containing	O
backdoor	O
functionality	O
written	O
in	O
a	O
web	O
scripting	O
language	O
such	O
ASP	O
,	O
ASPX	O
,	O
PHP	O
or	O
JSP	O
.	O
	
When	O
a	O
web	O
shell	O
is	O
hosted	O
on	O
an	O
internet	O
facing	O
victim	O
system	O
,	O
an	O
adversary	O
can	O
remotely	O
access	O
the	O
system	O
to	O
perform	O
malicious	O
actions	O
.	O
	
Deep	O
Panda	O
is	O
a	O
China	O
based	O
threat	O
group	O
CrowdStrike	O
has	O
observed	O
targeting	O
companies	O
in	O
the	O
defense	O
,	O
legal	O
,	O
telecommunication	O
and	O
financial	O
industries	O
.	O
	
Crowdstrike	O
has	O
observed	O
Deep	O
Panda	O
adopting	O
web	O
shells	O
as	O
their	O
primary	O
access	O
back	O
into	O
a	O
victim	O
organization	O
.	O
	
This	O
is	O
an	O
interesting	O
shift	O
as	O
web	O
shells	O
have	O
typically	O
been	O
seen	O
as	O
only	O
a	O
first	O
stage	O
into	O
obtaining	O
a	O
persistent	O
foothold	O
in	O
an	O
environment	O
.	O
	
Previously	O
,	O
web	O
shells	O
were	O
quickly	O
abandoned	O
once	O
persistent	O
second	O
stage	O
malware	O
was	O
successfully	O
beaconing	O
.	O
	
Using	B-Action
a	O
web	B-Entity
shell	I-Entity
as	B-Modifier
a	O
primary	B-Entity
backdoor	I-Entity
gives	O
Deep	O
Panda	O
several	O
advantages	O
.	O
	
To	O
assist	O
organizations	O
with	O
identifying	O
web	O
shells	O
in	O
their	O
environment	O
,	O
this	O
post	O
will	O
cover	O
two	O
popular	O
Deep	O
Panda	O
web	O
shells	O
.	O
	
By	O
gaining	O
insight	O
into	O
their	O
capabilities	O
and	O
footprint	O
,	O
organizations	O
should	O
find	O
it	O
feasible	O
to	O
detect	O
and	O
remediate	O
these	O
backdoors	O
.	O
	
Showimg.asp	B-Entity
is	O
an	O
example	O
of	O
an	O
early	O
stage	O
web	O
shell	O
used	O
to	O
build	B-Action
an	O
initial	B-Entity
foothold	I-Entity
within	I-Entity
a	I-Entity
network	I-Entity
.	O
	
After	O
it	O
is	O
replaced	O
by	O
more	O
robust	O
backdoors	O
,	O
it	O
may	O
be	O
left	O
in	O
place	O
as	O
a	O
last	O
resort	O
should	O
remediation	O
take	O
place	O
.	O
	
At	O
a	O
diminutive	O
28	O
bytes	O
,	O
it	O
is	O
one	O
of	O
the	O
smallest	O
Active	O
Server	O
Page	O
(	O
ASP	O
)	O
backdoors	O
in	O
the	O
wild	O
.	O
	
In	O
a	O
recent	O
case	O
,	O
we	O
witnessed	O
this	O
web	O
shell	O
written	O
to	O
a	O
standalone	O
file	O
(	O
named	O
showimg.asp	O
)	O
,	O
but	O
it	O
could	O
easily	O
be	O
injected	O
into	O
an	O
existing	O
page	O
,	O
making	O
it	O
even	O
stealthier	O
.	O
	
The	O
code	O
for	O
this	O
web	O
shell	O
can	O
be	O
found	O
below	O
.	O
	
ASP	O
uses	O
Microsoft	O
Visual	O
Basic	O
(	O
VBScript	O
)	O
as	O
its	O
implementation	O
language	O
.	O
	
The	O
code	O
above	O
uses	O
the	O
chr	O
(	O
)	O
function	O
to	O
convert	O
an	O
integer	O
into	O
a	O
character	O
,	O
which	O
is	O
then	O
passed	O
as	O
an	O
argument	O
to	O
the	O
ASP	O
Request	O
(	O
)	O
object	O
.	O
	
The	O
Request	O
(	O
)	O
object	O
will	O
search	O
the	O
Query	O
String	O
for	O
any	O
keys	O
matching	O
the	O
input	O
.	O
	
In	O
our	O
case	O
,	O
the	O
code	O
is	O
equivalent	O
to	O
Request	O
.	O
QueryString	O
(	O
'	O
*	O
'	O
)	O
.	O
	
The	O
request	O
object	O
will	O
look	O
for	O
chr(42	O
)	O
which	O
is	O
an	O
asterisk	O
(	O
*	O
)	O
,	O
returning	O
whatever	O
is	O
passed	O
to	O
it	O
in	O
a	O
HTTP	O
GET	O
or	O
POST	O
.	O
	
Next	O
,	O
the	O
Execute	O
(	O
)	O
function	O
will	O
execute	O
any	O
value	O
returned	O
by	O
the	O
lookup	O
.	O
	
Effectively	O
,	O
an	O
attacker	O
can	O
form	O
a	O
request	O
that	O
will	O
execute	O
any	O
VBScript	O
code	O
.	O
	
As	O
you	O
might	O
imagine	O
,	O
this	O
is	O
a	O
powerful	O
capability	O
.	O
	
For	O
example	O
,	O
this	O
code	O
can	O
perform	O
any	O
of	O
the	O
following	O
actions	O
.	O
	
This	O
web	O
shell	O
is	O
an	O
example	O
of	O
a	O
"	O
thick	O
client	O
"	O
shell	O
,	O
meaning	O
that	O
while	O
the	O
server	O
side	O
code	O
is	O
quite	O
small	O
,	O
attackers	O
typically	O
use	O
a	O
larger	O
GUI	O
client	O
to	O
construct	O
the	O
sent	O
commands	O
.	O
	
The	O
client	O
GUI	O
runs	O
on	O
the	O
attacker	O
's	O
system	O
and	O
hence	O
is	O
not	O
typically	O
found	O
within	O
the	O
victim	O
network	O
.	O
	
As	O
a	O
simple	O
example	O
of	O
an	O
encoded	O
command	O
,	O
the	O
following	O
GET	O
request	O
would	O
cause	O
the	O
backdoor	O
to	O
execute	O
the	O
code	O
Response	O
.	O
Write("	O
<	O
h1>Hello	O
World</h1	O
>	O
"	O
)	O
and	O
would	O
render	O
"	O
Hello	O
World	O
"	O
to	O
be	O
printed	O
in	O
the	O
web	O
browser	O
.	O
	
Path	O
:	O
C:\inetpub\wwwroot\aspnet_client\system_web\<VERSION>\	O
MD5	O
Hash	O
:	O
cc875db104a602e6c12196fe90559fb6	O
File	O
Size	O
:	O
45187	O
Table	O
4	O
:	O
Metadata	O
of	O
"	O
system_web.aspx	O
"	O
System_web.aspx	O
is	O
an	O
excellent	O
example	O
of	O
a	O
more	O
robust	O
web	O
shell	O
used	O
to	O
replace	O
Deep	O
Panda	O
's	O
traditional	O
beaconing	O
command	O
and	O
control	O
infrastructure	O
.	O
	
It	O
is	O
an	O
ASP.NET	O
backdoor	O
written	O
in	O
C	O
#	O
,	O
with	O
far	O
more	O
capabilities	O
than	O
we	O
saw	O
with	O
the	O
showimage.asp	O
sample	O
.	O
	
The	O
web	O
shell	O
supports	O
a	O
form	O
of	O
authentication	O
to	O
protect	O
against	O
unauthorized	O
access	O
.	O
	
This	O
prevents	O
its	O
discovery	O
from	O
search	O
engine	O
indexing	O
,	O
vulnerability	O
scanning	O
tools	O
and	O
other	O
unauthorized	O
access	O
to	O
the	O
backdoor	O
.	O
	
In	O
order	O
to	O
bypass	O
authentication	O
,	O
a	O
user	O
session	O
must	O
satisfy	O
one	O
of	O
three	O
options	O
.	O
	
Since	O
web	O
shells	O
are	O
text	O
-	O
based	O
,	O
we	O
can	O
easily	O
see	O
how	O
this	O
authentication	O
takes	O
place	O
.	O
	
First	O
,	O
the	O
code	O
checks	O
if	O
a	O
cookie	O
by	O
the	O
name	O
of	O
cp	O
exists	O
.	O
	
If	O
so	O
,	O
the	O
response	O
object	O
has	O
its	O
End	O
(	O
)	O
method	O
invoked	O
,	O
denying	O
the	O
user	O
access	O
.	O
	
Next	O
,	O
the	O
code	O
uses	O
the	O
IsValidUser()method	O
and	O
checks	O
the	O
Hyper	O
Text	O
Transport	O
Protocol	O
(	O
HTTP	O
)	O
headers	O
for	O
the	O
Keep	O
-	O
Alive	O
value	O
,	O
which	O
,	O
if	O
equal	O
to	O
320	O
,	O
will	O
return	O
true	O
.	O
	
If	O
the	O
value	O
does	O
not	O
equal	O
320	O
the	O
IsValidUser()method	O
iterates	O
over	O
the	O
Request	O
.	O
UserLanguages	O
collection	O
searching	O
for	O
a	O
language	O
named	O
es	O
-	O
DN	O
,	O
and	O
if	O
found	O
,	O
the	O
IsValidUser	O
(	O
)	O
method	O
will	O
return	O
true	O
.	O
	
If	O
neither	O
check	O
passes	O
,	O
the	O
code	O
returns	O
false	O
and	O
the	O
code	O
will	O
finally	O
check	O
for	O
the	O
presence	O
of	O
a	O
cookie	O
named	O
<	O
REDACTED>.	O
	
If	O
the	O
cookie	O
is	O
present	O
,	O
the	O
authentication	O
step	O
is	O
satisfied	O
.	O
	
If	O
not	O
,	O
a	O
blank	O
web	O
page	O
with	O
no	O
content	O
is	O
displayed	O
.	O
	
After	O
successful	O
authentication	O
,	O
the	O
attacker	O
is	O
provided	O
with	O
the	O
following	O
page	O
.	O
	
System_web.aspx	O
packs	O
a	O
large	O
amount	O
of	O
functionality	O
into	O
a	O
compact	O
interface	O
.	O
	
It	O
provides	O
the	O
following	O
capabilities	O
.	O
	
The	O
web	B-Entity
shell	I-Entity
supports	B-Action
8	O
main	B-Entity
commands	I-Entity
,	O
with	O
most	O
command	O
execution	O
via	O
Transact	O
-	O
SQL	O
using	O
the	O
xp_cmdshell	O
function	O
.	O
	
This	O
command	O
depends	O
on	O
the	O
contents	O
of	O
the	O
first	O
unlabeled	O
textbox1	O
.	O
	
If	O
unlabeled	O
textbox1	O
is	O
empty	O
,	O
the	B-Entity
code	I-Entity
will	O
enumerate	B-Action
attached	O
drives	B-Entity
.	O
	
Provider=	O
or	O
Driver=	O
-	O
Will	O
connect	O
using	O
the	O
OleDbConnection	O
class	O
.	O
	
Data	O
Source=	O
-	O
The	O
code	O
will	O
connect	O
using	O
the	O
SqlConnection	O
class	O
.	O
	
iis://	O
-	O
If	O
this	O
appears	O
in	O
unlabeled	O
textbox1	O
,	O
the	O
code	O
will	O
use	O
data	O
from	O
the	O
second	O
unlabeled	O
textbox2	O
to	O
execute	O
Active	O
Directory	O
requests	O
.	O
	
This	O
command	O
also	O
depends	O
on	O
the	O
text	O
contained	O
in	O
the	O
unlabeled	O
textbox1	O
.	O
	
If	O
the	O
field	O
is	O
left	O
empty	O
,	O
the	O
code	O
will	O
assume	O
a	O
valid	O
path	O
to	O
a	O
file	O
on	O
the	O
local	O
machine	O
and	O
will	O
read	O
and	O
display	O
contents	O
to	O
user	O
.	O
	
Data	O
Source=	O
-	O
the	O
code	O
will	O
assume	O
that	O
the	O
unlabeled	O
textbox2	O
contains	O
a	O
valid	O
SQL	O
query	O
and	O
will	O
execute	O
it	O
and	O
display	O
the	O
results	O
.	O
	
http://	O
-	O
If	O
this	O
appears	O
in	O
unlabeled	O
textbox1	O
,	O
download	O
content	O
from	O
the	O
assumed	O
URL	O
.	O
	
$	O
SEX	O
–	O
If	O
this	O
appears	O
in	O
unlabeled	O
textbox1	O
,	O
pass	O
the	O
contents	O
to	O
the	O
Server	O
.	O
Execute	O
(	O
)	O
method	O
.	O
	
Execute	O
contents	O
in	O
unlabeled	O
textbox1	O
as	O
a	O
SQL	O
query	O
and	O
return	O
binary	O
data	O
to	O
adversary	O
.	O
	
Execute	O
contents	O
in	O
unlabeled	O
textbox1	O
as	O
a	O
SQL	O
statement	O
and	O
return	O
valid	O
textual	O
data	O
to	O
adversary	O
.	O
	
Upload	B-Action
the	O
file	B-Entity
chosen	I-Entity
by	I-Entity
the	I-Entity
Choose	I-Entity
File	I-Entity
button	I-Entity
and	O
save	O
it	O
to	O
a	O
temporary	O
table	O
in	O
the	O
database	O
file	O
worktbl	O
in	O
chunks	O
of	O
10240	O
bytes	O
.	O
	
Then	O
executes	O
xp_cmdshell	O
(	O
which	O
executes	O
the	O
Bulk	O
Copy	O
Program	O
)	O
to	O
copy	O
the	O
data	O
from	O
that	O
table	O
to	O
a	O
file	O
whose	O
name	O
is	O
specified	O
in	O
unlabeled	O
textbox2	O
.	O
	
After	O
the	O
file	O
is	O
saved	O
,	O
the	O
code	O
deletes	O
the	O
temporary	O
table	O
.	O
	
If	O
unlabeled	O
textbox1	O
is	O
a	O
local	O
file	O
on	O
infected	O
system	O
,	O
the	O
file	O
is	O
read	O
and	O
displayed	O
to	O
attacker	O
.	O
	
\\	O
-	O
If	O
unlabeled	O
textbox1	O
starts	O
with	O
\\	O
,	O
use	O
xp_cmdshell	O
to	O
execute	O
the	O
copy	O
command	O
to	O
copy	O
file	O
to	O
%	O
windir%\Temp\temp.bin	O
.	O
	
Then	O
,	O
issue	O
the	O
dir	O
command	O
and	O
display	O
results	O
to	O
user	O
.	O
	
Finally	O
,	O
delete	O
the	O
temporary	O
file	O
%	O
windir%\Temp\temp.bin	O
.	O
	
Perform	O
Active	O
Directory	O
queries	O
.	O
	
The	O
code	O
handles	O
create	O
,	O
delete	O
,	O
set	O
,	O
get	O
,	O
and	O
enum	O
queries	O
,	O
while	O
any	O
query	O
not	O
matching	O
those	O
is	O
executed	O
directly	O
.	O
	
All	O
commands	O
are	O
executed	O
using	O
the	O
System	O
.	O
DirectoryServices	O
API	O
.	O
	
Simple	O
wrapper	O
around	O
the	O
CSharpCodeProvider	O
API	O
,	O
allowing	O
the	O
adversary	O
to	O
compile	O
and	O
execute	O
arbitrary	O
C	O
#	O
source	O
code	O
.	O
	
Login	O
Checkbox	O
Attempt	O
to	O
use	O
the	O
username	O
,	O
password	O
,	O
and	O
domain	O
from	O
the	O
User	O
,	O
Pass	O
and	O
Domain	O
fields	O
and	O
LogonUserA	O
(	O
)	O
Win32	O
API	O
function	O
to	O
impersonate	B-Action
a	O
specific	B-Entity
user	I-Entity
.	O
	
Detatch	O
Checkbox	O
Specifies	O
whether	O
commands	O
run	O
from	O
the	O
Exec	O
button	O
will	O
have	O
their	O
output	O
redirected	O
and	O
displayed	O
to	O
the	O
adversary	O
when	O
the	O
command	O
is	O
finished	O
executing	O
.	O
	
In	O
short	O
,	O
system_web.aspx	B-Entity
provides	B-Action
an	O
adversary	B-Entity
with	B-Modifier
a	O
very	B-Entity
stealthy	I-Entity
means	I-Entity
of	I-Entity
near	I-Entity
full	I-Entity
control	I-Entity
of	I-Entity
the	I-Entity
server	I-Entity
on	I-Entity
which	I-Entity
it	I-Entity
resides	I-Entity
.	O
	
This	O
stealth	B-Entity
might	O
be	B-Action
its	O
most	B-Entity
important	I-Entity
attribute	I-Entity
.	O
	
As	O
we	O
will	O
see	O
,	O
identifying	O
web	O
shells	O
can	O
be	O
much	O
harder	O
than	O
finding	O
malicious	O
binaries	O
.	O
	
In	O
our	O
next	O
post	O
,	O
we	O
will	O
discuss	O
techniques	O
for	O
identifying	O
web	O
shells	O
.	O
	
Stay	O
tuned	O
for	O
Parts	O
2	O
-	O
4	O
as	O
we	O
cover	O
File	O
Stacking	O
,	O
Web	O
Log	O
Review	O
,	O
and	O
Network	O
Detection	O
.	O
	
In	O
the	O
meantime	O
,	O
register	O
now	O
for	O
the	O
April	O
1st	O
CrowdCast	O
.	O