forked from LexusWang/Aurora-demos
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path103.txt
More file actions
626 lines (408 loc) · 31.6 KB
/
103.txt
File metadata and controls
626 lines (408 loc) · 31.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
CVE-2015-2545 is a vulnerability discovered in 2015 and corrected with Microsoft’s update MS15-099. The vulnerability affects Microsoft Office versions 2007 SP3, 2010 SP2, 2013 SP1 and 2013 RT SP1.
The error enables an attacker to execute arbitrary code using a specially crafted EPS image file. The exploit uses PostScript and can evade Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP) protection methods.
The exploit was discovered in the wild in August 2015, when it was used in a targeted attack by the Platinum group, presumably against targets in India. Over the following months, there was significant growth in the number of threat actors using the vulnerability as a primary tool for initial penetration, with both the attack groups and their targets located in South-East and Central Asia and the Far East.
In this research paper, we discuss examples of attacks using the CVE-2015-2545 vulnerability undertaken by some of these groups.
Overview of groups using CVE-2015-2545
CVE-2015-2545: overview of current threats
Platinum (also known as TwoForOne)
The group is believe to originate from South-East Asia. Its attacks can be traced as far back as 2009. The group is notable for exploiting 0-day vulnerabilities and carrying out a small number of highly focused targeted attacks – mostly against government agencies in Malaysia, Indonesia, China and India.
This group was the first to exploit the CVE-2015-2545 vulnerability. After the vulnerability was corrected with Microsoft updates in September and November 2015, no new Platinum attacks exploiting this vulnerability have been detected.
Microsoft presented the activity of this group at the SAS conference in February 2016, and in its paper: PLATINUM: Targeted attacks in South and Southeast Asia.
APT16
The group has been known for several years and is believed to be of Chinese origin. In November and December 2015, it used a modified exploit for CVE-2015-2545 in attacks against information and news agencies in Taiwan. These attacks were described in a FireEye research paper – The EPS Awakens – Part 2 (https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html).
EvilPost
In December 2015, Kaspersky Lab became aware of a targeted attack against the Japanese defense sector. In order to infect victims, the attacker sent an email with an attached DOCX file exploiting the CVE-2015-2545 vulnerability in Microsoft Office using an embedded EPS (Encapsulated Postscript) object. The EPS object contained a shellcode that dropped and loaded a 32-bit or 64-bit DLL file depending on the system architecture. This, in turn exploited another vulnerability to elevate privileges to Local System (CVE-2015-1701) and download additional malware components from the C&C server.
The C&C server used in the attack was located in Japan and appears to have been compromised. However, there is no indication that it has ever been used for any other malicious purpose. Monitoring of the server activity for a period of several months did not result in any new findings. We believe the attackers either lost access to the server or realized that it resulted in too much attention from security researchers, as the attack was widely discussed by the Japanese security community.
According to our research partner in Japan, the original EvilPost attack in December 2015 arrived as a spear-phishing email with a Word document attached.
This document embedded an EPS object file, which triggered a vulnerability in the EPS format handler in Microsoft Word. Even with an exploit component, Microsoft Word rendered the document correctly and displayed the decoy message. The document is written in good Japanese, as shown below.
dantiapt_eng_1
It has been used to decoy New Year impressions of defense-related organizations.
This attack was also described in the FireEye report (https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html), mentioned above.
An overview of the activity of the EvilPost group activity was provided to subscribers of the Kaspersky Lab Threat Intelligence Service in March 2016. For information about the service, please write to intelreports@kaspersky.com.
SPIVY
In March and April 2016, a series of emails laced with an exploit forCVE-2015-2545 were detected. The emails were sent in spear-phishing attacks, presumably targeting organizations in Hong Kong. Identifying a specific group behind these attacks is difficult because they used a new variant of a widely available backdoor known as PoisonIvy (from which the name of the group, SPIVY, is derived). A description of these incidents can be found in the PaloAlto blog.
Danti and SVCMONDR
These two groups have not yet been publicly described. An overview of their attacks and the tools used is provided in this report.
danti_map
Danti attacks
Danti (Kaspersky Lab’s internal name) is an APT actor that has been active at least since 2015, predominantly targeting Indian government organizations. According to our telemetry, Danti has also been actively hitting targets in Kazakhstan, Kyrgyzstan, Uzbekistan, Myanmar, Nepal and the Philippines.
The group implemented a new campaign in February and March 2016, using a repurposed implementation of the CVE-2015-2545 exploit with custom shellcode. In order to infect the victim, the attackers distributed spear-phishing emails with an attached DOCX file exploiting the CVE-2015-2545 vulnerability in Microsoft Office. The exploit is based on a malformed embedded EPS (Encapsulated Postscript) object. This contains the shellcode that drops a backdoor, providing full access to the attackers.
Main findings:
Danti, a previously unknown group, is probably related to NetTraveller and DragonOK
In February-March 2016 the group was observed using CVE-2015-2545
It remains active, conducting attacks against Indian diplomatic organizations
Related attacks have been observed against Central and South East Asia targets
The campaign leveraging the exploit for CVE-2015-2545 took place in February 2016. As a result, several emails with attached DOCX files were uploaded to VirusTotal. The email recipients were connected to the Indian Ministry of External Affairs, as can be seen below:
dsfsi@nic.in, the Foreign Service Institute, Ministry of Foreign Affairs (Under Secretary (FT/NRG), dsfsi@mea.gov.in)
chumarpost@gmail.com, possibly related to the Chumar military post in India, a disputed area between India and China (the mail server is the same as the Indian Ministry of Foreign Affairs- vastuXX.nic.in)
chancery@indianembassy.hu, the Indian embassy in Hungary
amb.copenhagen@mea.gov.in, the Indian Embassy in Denmark
amb.bogota@mea.gov.in, the Indian embassy in Colombia
All these attacks took place between the 2nd and 29th of February, 2016.
Target and date Attachment name Sender
Indian embassy in Hungary
2nd February Mission List.doc unknown (original email was forwarded)
Indian embassy in Denmark
2nd February HQ List.doc mout.gmx.com ([74.208.4.200])
Indian embassy in Colombia
2nd February HQ List.doc mout.gmx.com ([74.208.4.201])
DSFSI
24th February India’s 10 Top Luxury Hotels.doc 191.96.111.195 via mout.gmx.com ([74.208.4.201])
Chumapost
29th February India’s 10 Top Luxury Hotels.doc 43.227.113.129 via mout.gmx.com ([74.208.4.200])
In the case of the Indian Embassy in Hungary, it looks like the original message was forwarded from the embassy to the Indian IT security team in the Ministry of Foreign Affairs, and uploaded later to Virus Total.
Initial vector
The emails that were analysed had originally been sent via “3capp-mailcom-lxa06.server.lan”, perhaps using a spam-mailer program. In all known cases, the sender used the same gate at 74.208.4.200/74.208.4.201 (mout.gmx.com).
The email messages changed for different waves of the campaign. When the campaign started in February 2nd, the emails carried the subject headers “Mission List” and “HQ List”, and forged the identity of a real sender.
CVE-2015-2545: Overview of Current Threats
Original message used in the first wave of attacks
As can be seen above, the original email was supposedly forwarded from Anil Kumar Balani, Director of the Department of Information Technology at the Indian Ministry of Communications & Information Technology.
CVE-2015-2545: Overview of Current Threats
Mission List decoy document
At the same time, attackers sent a slightly different document with the subject “HQ List” to other Indian embassies (for example, those in Denmark and Colombia):
CVE-2015-2545: Overview of Current Threats
Original HQ List email
K.Nagaraj Naidu is Director of the Investments Technology Promotion Division in the Ministry of External Affairs, and a former Counsellor (T&C) at the Embassy of India in China.
dantiapt_eng_5
HQ List decoy document
Both files (“Mission List” and “HQ list”) have different decoy content, but both use the same CVE-2015-2545 EPS exploit (image1.eps, MD5 a90a329335fa0af64d8394b28e0f86c1).
Interestingly, as can be seen in their metadata, both files were modified by the user “India” on 01.02.2016, just one day before they were sent to targets.
“HQ List” metadata “Mission List” metadata
dantiapt_eng_6 dantiapt_eng_7
For the attacks at the end of February, the attackers decided to use the less relevant subject header of “10 top luxury hotels in India”, sent from an unknown sender.
dantiapt_eng_8
Top Luxury Hotels spear-phishing email
This new attachment contains the same EPS exploit, but uses a different decoy document and a new payload.
dantiapt_eng_9
Top 10 Luxury Hotels decoy document
The text of the document was copied from a Forbes article published in 2007. According to its metadata, the document was created in June 2015, so it has probably been used before in unknown attacks.
However, the same mail gate (mout.gmx.com) was used as for the 2nd February attacks.
dantiapt_eng_10
Email header from February 29
dantiapt_eng_11
Email header from February 24
All the “doc” files are Web Archive Files and contain decoy documents and a malicious EPS. The structure of the WAF files is the same in all three cases:
dantiapt_eng_12
Web archive structure
Exploit
The attackers used at least one known 1-day exploit: the exploitforCVE-2015-2545 – EPS parsing vulnerability in EPSIMP32.FLT module, reported by FireEye, and patched by Microsoft on 8 September 2015 with MS15-099.
We are currently aware of about four different variants of the exploit.
The original one was used in August 2015 against targets in India by the Platinum (TwoForOne) APT group.
dantiapt_eng_13
Original EPS exploit, used in August 2015
The second (which is a modified variant of the original exploit) was used in EvilPost attacks against Japan in 2015, and then reused by cybercriminals in March 2016. This variant was also used by the APT16 group (ELMER backdoor) in Taiwan in December 2015. The second variant is easily recognized by the specific strings in its EPS shellcode:
dantiapt_eng_14
The “h:\test.txt” string could have been forgotten by the exploit developer
The third variant was used in December 2015 against a Taiwanese organization, and in February 2016 against an Indian diplomatic organization. This variant uses different shellcode but is based on the original exploit from the Platinum (TwoForOne) APT:
dantiapt_eng_15
Can be recognized by “add2 <eb135” substring
In the third variant, the binaries with the encrypted malicious exe file and the decoy document can be found at the end of the files.
In the third variant, the binary starts with “PdPD” (50 64 50 44), a marker previously used for encrypted binaries by a number of APT groups (Anchor Panda, Samurai Panda, Temper Panda).
dantiapt_eng_16
Encrypted data at the end of the eps file
The decryption function is 1-byte XOR with a key from “x00” to “xff” and replacement of the Odd byte for an Even byte in several hundred bytes from the header.
dantiapt_eng_17
Decrypted exe file
dantiapt_eng_18
Decrypted decoy document
We detected a few different EPS objects in the exploit and these are analyzed below. The fourth variant of the exploit is analyzed in the “March attack” section.
Read more about EPS objects and Payload in the Appendix.
March attack
At the end of March 2016, we discovered a new wave of attacks by the Danti group against Indian governmental institutions. On March 28th several malicious document were sent to various recipients at the Cabinet Secretariat of Government India from the email account of Ms. Richa Gaharwar (<richa.gaharwar@nic.in>), Deputy Secretary at The Department of Administrative Reforms and Public Grievances, the nodal agency of the Government of India.
dantiapt_eng_19
Email sent from the account of Ms. Richa Gaharwar
The message was sent from an internal IP address using Oracle Communications Messenger. This could mean that the employee workstation used to send the malicious emails had been fully compromised.
dantiapt_eng_20
Email header
The attachment contains the file “Holidays in India in 2016.docx” with the embedded EPS exploit. This time the attackers used the second variant of the exploit (previously used by the EvilPost and APT16 groups), with minor changes:
They removed the part with the “h:\test.txt” strings
Dropped the binary added at the end of the EPS object (the same as in the third variant of the exploit)
Instead of using the “PdPD” string as a marker for binary, they used a new identifier: “1111111122222222”
dantiapt_eng_21
New identifier used
All these changes created a new variant of the exploit, detected by very few antivirus products.
The decoy document was created on January 27th, and then modified by adding the EPS exploit on March 28th, right before the attack.
dantiapt_eng_22
Decoy document
According to its metadata, the document was created and modified by Chinese users:
dantiapt_eng_23
Decoy´s metadata
March attack – payload
The dropped file is a RarSFX archive (331307 bytes). According to comments in the archive, this was also created by a Chinese user:
dantiapt_eng_24
The dropper installs four files in the system. The “Appinfo.dat” file launches “PotPlayerMini.exe”, monitors the memory periodically with the GlobalMemoryStatus API function and writes the results to “C:windowsmemstatus.txt”
The main loader “PotPlayerMini.exe” is a legitimate multimedia player from Daum Communication. The file is signed with a legitimate signature from “Daum Communications Corp.”
dantiapt_eng_25
Digital signature information
This legitimate file is used by the attackers to load a malicious, unsigned file from the same folder: PotPlayer.dll (the hardcoded PDB path inside is “C:UsersjohnDesktopPotPlayerReleasePotPlayer.pdb”). This, in turn executes appinfo.dat (the hardcoded PDB path inside is “D:BaiduYunDownloadServiceExeReleaseServiceExe.pdb”), which is a Yoda-compressed binary. The backdoor code is stored inside update.dat.
The potplayer.dll “PreprocessCmdLineEx” export function:
Creates a service named “MemoryStatus” with a path to “appinfo.dat” file and sets it to HKEY_CURRENT_USER SoftwareMicrosoftWindowsCurrentVersionRun with the name “potplayer”.
Opens “update.dat” file, decrypts it with xor operations and passes the execution to the result buffer.
“update.dat”, a backdoor:
Makes its first GET request to hardcoded CnC “newsupdate.dynssl.com/index.html” in order to get the new CnC in the response.
If 407 response code is returned (Proxy authentication required) then the sample sends the request again with “proxyname” string as the proxy username and “proxypass” string as the proxy password. That suggests that may be the sample is compiled using some builder where these parameters must be set manually and in this specific sample were not changed from default.
Finds “8FC628C9F43D42E2B77C2801518AF2A5” substring and decrypts it using AES CTR mode thrice using three 16-bytes keys.
Makes a POST request to the new CnC with “im=validate” URL parameter and expects “success” string as the response.
Forms the following structure in order to send to CnC in POST-request after AES encryption:
“CFB4CDE8-9285-4CC2-ACE2-CD9CCDF22C0D” string
Local IP
Host name
0x3E9 dword
OS version
SYSTEM_INFO structure
Decrypts the response using AES with one key.
Commands:
Lists files in directory
Enumerates drives and their type
Enumerates given registry key and value
Enumerates processes
Deletes given file
Creates given process
Moves or copies given file
Uploads file
Writes to file and launches it
Enumerates services
Terminates given process
Provides shell via cmd.exe
The malware connects to the following C2s:
newsupdate.dynssl.com (103.61.136.120)
dnsnews.dns05.com (118.193.12.252)
The connection:
danticode1
The two hosts are dynamic DNS subdomains, using the provider CHANGEIP DNS.
SVCMONDR: the Taiwan case
In December 2015, we uncovered another example of the type of shellcode found in the exploit for CVE-2015-2545. On 11 December, a spear-phishing email was sent by attackers to an employee of a Taiwanese security software reseller.
dantiapt_eng_26
Spear-phishing email
The attachment contained a Web Archive File with “1-3說明檔.doc” and a malicious EPS file inside.
dantiapt_eng_27
“1-3說明檔.doc”
This EPS (98c57aa9c7e3f90c4eb4afeba8128484) is exploit CVE-2015-2545 and contains an encrypted binary starting with “PdPD” (50 64 50 44), the same as seen in the Danti attacks.
The structure of the Web Archive also carries references to the same files as the Danti group (with image002.gif and “image002.eps”.) However, the files themselves are absent from the archive.
dantiapt_eng_28
Part of the Web Archive
This resemblance could mean that we can attribute this case to the Danti group. However, it could also be a coincidence or yet another case of different groups using the same malicious code. That’s why we are noting this incident separately from the Danti group’s activity.
Interestingly, in the first few days of December, another group – APT16 (FireEye’s classification) also targeted Taiwan-based organizations with a CVE-2015-2545 EPS exploit, and its emails originated from the same domain as the one sent by the SVCMONDR attackers. However, it used another type of shellcode and a different backdoor – ELMER (https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html).
After opening the doc file (which is again a Web Archive File), the exploit drops and executes the Trojan program “svcmondr.exe” (8052234dcd41a7d619acb0ec9636be0b).
This queries the registry:
“HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionInternet SettingsConnectionsDefaultConnectionSettings” and “HKCUSoftwareMicrosoftWindowsCurrentVersionInternetSettingsConnectionsDefaultConnectionSettings” and compares the values. If they don’t coincide, it sets the “DefaultConnectionSettings” value from the HKEY_USERS to HKCU key.
It sets values taken from:
HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3 {A8A88C49-5EB2-4990-A1A2-0876022C854F}
HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3 {AEBA21FA-782A-4A90-978D-B72164C80120}
HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones31A10
To the appropriate HKCU key (for example: HKCUSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZones3 {A8A88C49-5EB2-4990-A1A2-0876022C854F}, etc.).
Then forms the structure in order to send it to the CnC in a POST-request with the following fields:
0x8888 constant
0x8000 constant
18-bytes hex string based on CoCreateGuid function
Local IP
MAC address
dantiapt_eng_29
Example of POST request
It encodes the resulting structure with base64. Example of a POST request:
POST / HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: 59.188.13.204:9080
Content-Length: 112
Connection: Keep-Alive
Cache-Control: no-cache
AAAAAIiIAAAAgAAAAAAAAGQwNTRlYTkxMDAwMGEyZmU3NAAAAAAAAAAAAAAAAAAAMTAuNjMuMTIuNAAAAAAAADAwMEMyOUU5Nzg2QgAAAAAAAAAA
Based on the CnC response, the sample:
Checks the password in the CnC response and compares it with the hardcoded password “1010” in its configuration structure. If the password is valid, it sets a “certified” flag and can further process the following commands.
Launches given command line with ShellExecute, writes output results to %tmp% file, sends results to CnC and deletes the file.
Downloads file to %Temp% folder.
Uploads given file to CnC.
Sets sleep interval.
All results sent to the CnC after processing commands are encrypted with RC4 with a MAC-address as a key.
The CnC points to an IP address in Hong Kong. This IP address belongs to a local private company, but falls within a range of IP addresses that belong to another enterprise that has already been identified as a host location for command and control servers that communicate with malware.
The CnC has been used in other APT incidents, attributed by FireEye to the group “admin@338” aka “Temper Panda” (59.188.0.197, accounts.serveftp.com).
In general, this IP address space from “New World Telecom HK” is one of the favorite places used by different Chinese-origin APT groups to host command & control servers/proxies.
Another detail suggesting a possible relationship between SVCMONDR and Temper Panda is the use of the “PdPD” (50 64 50 44) marker for encrypted binaries. According to Crowdstrike, the same marker has been used previously by a number of APT groups (Anchor Panda, Samurai Panda and Temper Panda).
The latest known activity of “admin@338” was in August 2015, when it was used to target Hong Kong-based media using its own tools, LOWBALL and BUBBLEWRAP.
However, we are unable to draw any conclusion regarding the relationship between the SVCMONDR group and Temper Panda.
According to KSN data, in addition to Taiwan, there are some SVCMONDR victims in Thailand.
Conclusions
We are currently aware of at least four different APT actors actively using exploits of the CVE-2015-2545 vulnerability: TwoForOne (also known as Platinum), EvilPost, APT16 and Danti.
These groups have their own toolsets of malicious program. Danti’s arsenal is more extensive than those of EvilPost and APT16, and in terms of functionality can be compared with Platinum. All groups are focused on targets in the Asian region and have never been seen in incidents in Western Europe or the USA.
The TwoForOne (Platinum) group is described in Microsoft research, APT16 in FireEye reports, and EvilPost and Danti in Kaspersky Lab private reports.
Danti is highly focused on diplomatic entities. It may already have full access to internal networks in Indian government structures. According to Kaspersky Security Network, some Danti Trojans have also been detected in Kazakhstan, Kyrgyzstan, Uzbekistan, Myanmar, Nepal and the Philippines.
Despite the fact that Danti uses a 1-day exploit, the group is able to make its own modifications to bypass current antivirus detections. A number of the modules used by Danti have the same functionality as previously known and used malicious programs like NetTraveller and DragonOK.
The use of CVE-2015-2545 exploits is on the rise. In addition to the groups mentioned above, we have seen numerous examples of these exploits being used by traditional cybercriminals in mass mailings in February-April 2016. Such attacks mostly target financial institutions in Asia. Specifically, attacks have been recorded in Vietnam, the Philippines and Malaysia. There are reasons to believe that Nigerian cybercriminals are behind these attacks. In some cases, the infrastructure used is the same as the one we saw when analyzing the Adwind Trojan.
We expect to see more incidents with this exploit and we continue to monitor new waves of attacks and the potential relationship with other attacks in the region.
To know more about how to address the issue of known vulnerabilities most properly, read this post in the Kaspersky Business Blog.
Additional references:
The EPS Awakens
Part 1
Part 2: https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html
Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets
New Poison Ivy Rat Variant targets Hong-Kong-Pro-Democracy Activists
Microsoft research “Platinum”
EvilPost attacks (Kaspersky Lab Private Report, March 2016)
Appendix A: EPS Objects their payload and http.exe trojan analysis
EPS Objects
File MD5: a90a329335fa0af64d8394b28e0f86c1
File type: Encapsulated Postscript File
Size: 189’238 bytes
File Name: image001.eps (from HQ list)
This EPS file contains a shellcode that decrypts and saves file “lsass.exe” and decoy document to disk.
The dropped malicious files are described below.
File MD5: 07f4b663cc3bcb5899edba9eaf9cf4b5
File type: Encapsulated Postscript File
Size: 211’766 bytes
File Name: image001.eps (from Mission list)
This EPS file contains a shellcode that decrypts and saves file “lsass.exe” and decoy document to disk.
The dropped malicious files are described below.
File MD5: b751323586c5e36d1d644ab42888a100
File type: Encapsulated Postscript File
Size: 398’648 bytes
File Name: image001.eps (from India’s 10 Top Luxury Hotels)
This EPS file contains a shellcode that decrypts and saves the dropper file (Windows CAB) and decoy document to disk.
The dropper and dropped malicious file “http.exe” are described below.
Payload analysis
Backdoor
File Name lsass.exe
MD5 8ad9cb6b948bcf7f9211887e0cf6f02a
File type PE32 executable for MS Windows (GUI) Intel 80386 32-bit
Compilation timestamp 2015-12-28 07:47:54
PE Resources BIN (CHINESE SIMPLIFIED)
Size 138’240 bytes
URL: http://goback.strangled[.]net:443/ [random string]
TYPE: POST
USER AGENT: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)
Real IP: 180.150.227.135:443
Drops file from its resource section to %ALLUSERSPROFILE% IEHelpermshtml.dll. The backdoor then writes a string to a given offset with the value dependent on the %ALLUSERSPROFILE% environment variable.
Thus, the md5 of dropped files can vary. Examples of md5 with standard variables:
be0cc8411c066eac246097045b73c282
bae673964e9bc2a45ebcc667895104ef
Sets registry:
If user is not admin
“HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersioRun” value {53372C34-A872-FACF-70A7-A23C81C766C4} = “C:WindowsSystem32rundll32.exe %ALLUSERSPROFILE% IEHelpermshtml.dll, IEHelper”
In any case:
HKEY_LOCAL_MACHINESoftwareMicrosoftActive SetupInstalled Components{53372C34-A872-FACF-70A7-A23C81C766C4}” value “StubPath” = “C:WindowsSystem32rundll32.exe %ALLUSERSPROFILE% IEHelpermshtml.dll, IEHelper”
Sets the following values before creating the instance of IE for communicating with the CnC:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain DisableFirstRunCustomize=1
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMain Check_Associations=”no”
HKEY_CURRENT_USERSoftwareMicrosoftInternet Connection Wizard Completed=1
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionInternet SettingsZoneMap IEHarden=0
Collects the following info, encodes with base64 and sends to the CnC:
Memory status
OS version
User name
OEM code page identifier
Local IP
CPU speed
Forms the following body in POST request to the CnC:
—-=_Part_%x
Content-Disposition: form-data; name=”m1.jpg”
Content-Type: application/octet-steam
%base64%
—-=_Part_%x
Where %x – decrypted adapter’s MAC address based on xor operation.
The URL path in the POST request is generated randomly with uppercase letters.
Example of CnC communication:
dantiapt_eng_30
Based on the CnC response, the sample:
Provides shell via cmd.exe
Creates directory
Lists files in directory
Deletes file
Uploads given file to CnC
Enumerates drives, gets their type and available space
Launches given file
Moves file
Writes and appends to given file
Uninstalls itself
File Name mshtml.dll
MD5 be0cc8411c066eac246097045b73c282
or bae673964e9bc2a45ebcc667895104ef
or different
File type PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
Compilation timestamp 2015-12-28 07:45:20
Size 72’192 bytes
mshtml.dll repeats entirely the functionality of its dropper (CnC communication and commands processing) in its “IEhelper” export and is built on the same source code.
http.exe trojan
MD5 6bbdbf6d3b24b8bfa296b9c76b95bb2f | Sun, 13 Apr 2008 18:32:45 GMT
Drops file to %Temp%IXP000.TMPhttp.exe and launches it.
Filename http.exe
MD5 3fbe576d33595734a92a665e72e5a04f | Wed, 13 Jan 2016 10:25:10 GM
CnC carwiseplot.no-ip.org/news/news.asp
Sets registry:
HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun
“IME_hp” = %ALLUSERPROFILE%Accessorieswordpade.exe
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun
“IME_hp” = %ALLUSERPROFILE%Accessorieswordpade.exe
HKEY_USERSSoftwareMicrosoftWindowsCurrentVersionRun
“IME_hp” = %ALLUSERPROFILE%Accessorieswordpade.exe
Copies itself to %ALLUSERPROFILE%Accessorieswordpade.exe, launches it and exits self-process.
wordpade.exe file proceeds:
Creates mutex “GlobalwordIE”. Stores keystrokes and windows titles to %Temp%dumps.dat and xors it with 0x99.
Knocks to CnC via IE instance: carwiseplot.no-ip.org/news/news.asp
Includes the following field in HTTP-header:
Cookie: ID=1%x, where %x – Volume Serial number of disk C
dantiapt_eng_31
Based on the CnC response, the sample:
Provides shell via cmd.exe
Lists files in all drives and writes to given file
Retrieves OS version, Local IP, installed browser, Computer name, User name and writes to given file
Writes to given file
Deletes given file
Uploads given file to CnC
Makes screenshots and writes to file %Temp%makescr.dat
Retrieves proxy settings and proxy authentication credentials from Mozilla (signons.sqlite, logins.json) and Chrome files (%LOCALAPPDATA%GoogleChromeUser DataDefaultLogin Data), Microsoft WinInet storage, Microsoft Outlook
Appendix B: Danti sample hashes
Emails:
aae962611da956a26a76d185455f1d44 (chancery@indianembassy.hu)
3ed40dec891fd48c7ec6fa49b1058d24 (amb.bogota@mea.gov.in)
1aefd1c30d1710f901c70be7f1366cae (amb.copenhagen@mea.gov.in)
f4c1e96717c82b14ca76384cb005fbe5 (India, dsfsi@nic.in)
1ba92c6d35b7a31046e013d35fa48775 (India, chumarpost@gmail.com)
6d55eb3ced35c7479f67167d84bf15f0 (India, Cabinet Secretary)
Doc (Web Archive File):
C591263d56b57dfadd06a68dd9657343 (HQ List)
Aebf03ceaef042a833ee5459016f5bde (Mission List)
Fd6636af7d2358c40fe6923b23a690e8 (India’s 10 Top Luxury Hotels)
Docx:
D91f101427a39d9f40c41aa041197a9c (Holidays in India in 2016)
EPS:
07f4b663cc3bcb5899edba9eaf9cf4b5 (India, from Mission list)
a90a329335fa0af64d8394b28e0f86c1 (India, HQ List)
B751323586c5e36d1d644ab42888a100 (India, Hotels)
8cd2eb90fabd03ac97279d398b09a5e9 (Holidays in India in 2016)
CAB dropper:
6bbdbf6d3b24b8bfa296b9c76b95bb2f
RarSFX:
d0407e1a66ee2082a0d170814bd4ab02
4902abe46039d36b45ac8a39c745445a
Potplayer:
f16903b2ff82689404f7d0820f461e5d (clean tool)
Trojans:
6bbdbf6d3b24b8bfa296b9c76b95bb2f (dropper, from cab-archive)
3fbe576d33595734a92a665e72e5a04f (http.exe)
8ad9cb6b948bcf7f9211887e0cf6f02a (lsass.exe)
9469dd12136b6514d82c3b01d6082f59
be0cc8411c066eac246097045b73c282 (mshtml.dll)
bae673964e9bc2a45ebcc667895104ef
d44e971b202d573f8c797845c90e4658 (update.dat)
332397ec261393aaa58522c4357c3e48 (potplayer.dll)
2460871a040628c379e04f79af37060d (appinfo.dat)
C2
180.150.227.135
Goback.strangled[.]net:443
carwiseplot.no-ip[.]org (115.144.69.54, 115.144.107.9)
newsupdate.dynssl[.]com (103.61.136.120)
dnsnews.dns05[.]com (118.193.12.252)
Appendix C: sample hashes of SVCMONDR attacks
Emails:
7a60da8198c4066cc52d79eecffcb327 (Taiwan, janet@eranger.com.tw)
Doc (Web Archive File):
d0533874d7255b881187e842e747c268 (Taiwan, 1-3說明檔.doc)
EPS:
98c57aa9c7e3f90c4eb4afeba8128484 (Taiwan)
Trojans:
8052234dcd41a7d619acb0ec9636be0b (svcmondr.ex, Taiwan)
046b98a742cecc11fb18d9554483be2d (svcmondr.ex,Thailand)
C2:
59.188.13.204
180.128.10.28
www.ocaler.mooo[.]com
www.onmypc.serverpit[.]com