APT10 HUNTER RISE ver3.0:
Repel new malware LODEINFO, DOWNJPIT and LilimRAT

Suguru Ishimaru

GReAT APAC
Kaspersky Lab

Total: 647 hunts by Yara (in last 3 months)

Who am I?

Suguru Ishimaru
Senior Security Researcher
Global Research and Analysis Team, APAC
Kaspersky Lab

LODEINFO overview• A new fileless backdoor called“LODEINFO” was discovered since theend of 2019;• Attackers have been updating
LODEINFO backdoor very frequently;• Target region is Japan and industries
are media, diplomatic organizations,public organizations, defense sector
and think-tank;• The goal is gathering confidentials;• This actor operates very carefully.
https://blogs.jpcert.or.jp/en/2020/02/malware-lodeinfo-targeting-japan.html
https://blogs.jpcert.or.jp/en/2020/06/evolution-of-malware-lodeinfo.html
https://blogs.jpcert.or.jp/en/2021/02/LODEINFO-3.html

LODEINFO• Maybe LODEINFO named from a string “LODEPNG” and a PDB name ”png_info.pdb”.

String and PDB ina old LODEINFO v0.1.2• Hardcoded LODEINFO version in “ver” command feature.

Timeline of LODEINFO• In April 2021, new version of LODEINFO which is v0.4.9 was discovered.
• The actor actively developed LODEINFO.
DEC 2019

APR 2020 MAY 2020 JUN 2020

v0.1.2v0.3.2v0.3.5

DEC 2020 JAN 2021

AUG 2020

v0.4.1v0.3.1v0.3.4v0.3.6v0.4.9v0.4.6v0.3.8v0.2.7

APR 2021

v0.4.7v0.4.8Infection flows and payload types
EXE
DOC

ContainLegitimate

VBA

SfsDllSample.exe

Trojan Dropper

malicious.doc

Load

Drop

In memory

DLL
Decrypt

Payload types

SfsDll32.dll

MalwareLODEINFO (backdoor)
LODEINFO (backdoor)
DOWNJPIT (downloader)

PE/shellcode
PE (DLL)
shellcodeshellcode

PayloadLODEINFO

Versionv0.1.2
v0.1.2 – v0.4.9
n/aDLL loader of LODEINFO• Embedded XORed shellcode(LODEINFO) is loaded by the DLL• XOR key is a byte from after the encrypted LODEINFOXORed LODEINFO

A byte xor key

LODEINFO shellcode

in memory

LODEINFO• 18 backdoor commands are implemented in v0.4.9
backdoor command id

Backdoor
command

Descriptioncommand

Show a command embedded backdoor command list.

lsGet a file list.

rm

Delete a file.

mv

Move a file.

cp

Copy a file.

cat

Upload a file to C2.

mkdir

Make a directory.

send

Download a file from C2.

recv

Upload a file to C2.

memoryInject shellcode into svchost.exe.

kill

Kill a process using process ID.

cd

Change directory.

ver

Send malware status includes OS version, malware version,process ID, Current EXE file path, User name, Current
directory, C2 and Mutex.

print

Take a screen capture.

ransomEncrypt files using hardcoded RSA key.

keylog

Run key loggingpsGet process list

pkill

Kill a process

LODEINFO• Generating IAT using hashes in the beginning of the shellcode.

• The hash calculation algorithm is unique.
Generates IAT

GetsProcAddr by hash

LODEINFO• A BLOB is embedded in the end of shellcode, and the offset is calculated by an unique feature.
• The BLOB contains AES key, iv, size and encrypted C2.
Unique feature to calculates a specific offset

offsetnote

0x00

aes_key0x20

aes_iv

0x30

size

0X34

C2: encrypted by AES CBC mode + QuickLZ

Yara/detections for LODEINFO
backdoor command identify• Yara rules and signatures can be
AES SBOX

GetProcAddr by hashmade by these characteristic code

DOWNJPITDOWNJPIT was named from the payload is download from justpaste.it
In memoryshellcode
DOWNJPIT
Download

shellcode
PayloadDecrypt• A fileless downloader which isundiscovered variant of LODEINFO• Removed backdoor functions• Downloads and decrypt payload

Uncovered infection vector/persistence• Powershell and .NET Loaders were used as persistence.
• DOWNJPIT deployed a payload from a web content.
In memory

CMD

Contain

DsSvcBackup.cmd.NET
Malicious.NET assembly

PSExec

EXE
Legitimate

msiexec.EXE

Malicious
PowershellLoad

DATA
perf.dat

Injectshellcode
DOWNJPIT

shellcode
LODEINFO

Download

DecryptPowershell loader
This loader reads “%systemdrive%\PerfLogs\perf.dat” as an encrypted shellcode and a byte xor key.
The x86 shellcode is injected to in a process(msiexec.exe) of x64/x86 by this PS.

•Gets a byte xor key from the end•

Xors the encrypted shellcode•Runs msiexec.exe depends arch•

Injects the shellcode in the proc

.NET loader•

A file “%programdata%ntuser.po1” isalso used as the encrypted data.

•

Exactly the same as the loading
process of Powershell loader.

DOWNJPIT
Generate IAT

GetProcAddr by hash

Find offset of embedded data

Get offset• DOWNJPIT is a variant of LODEINFO.

• Almost functions are same.
• Embedded data structure is also thesame.

Removed backdoor command func
in the DOWNJPIT downloader

LODEINFO (Backdoor)

DOWNJPIT (Downloader)

Diff1: Removed backdoor featuresDecryption algorithms for received data Base64 urlsafe + replace padding
 Original LODEINFO data structure
 AES (CBC mode) decryption
 A byte XOR for the size
 QuickLZ decompress

 AES KEY and IV

JPCERT/CC decrypt tool + @Ref:https://blogs.jpcert.or.jp/en/2020/06/
evolution-of-malware-lodeinfo.html

Decrypted payload
Online content
Decrypts
Shellcode•

Decrypted payload was LODEIFNO backdoor

DEMO of analysis DOWNJPIT
and the decryption tool
Around 3mins

Encrypted payload in pastebin.comLODEINFO v0.3.5

LODEINFO v0.3.8• A user “MATRIXPF” created these content.

Encrypted payload in JustPaste.it

LODEINFO v0.4.1• The actor changed the contents
for hiding in Dec 2020.

Destinations of DOWNJPIT and payloads
Destination

DatePayloadhash of payload

justpaste[.]it/providers

2020.07.29

LODEINFO v0.4.1

0965e5793db2ea3c24fe077c78f273d4

justpaste[.]it/doxcom

2020.12.03

n/an/ajustpaste[.]it/actions

2020.12.03

n/an/apastebin[.]com/raw/fpbkv9GP

2020.05.27

LODEINFO v0.3.8cca4457bbe54264c04e2abe4f1dfa746

2020.12.03

LODEINFO v0.4.6

4d0092f89be7ce083526b0204509505f

pastebin[.]com/raw/SYkDWtas

n/an/an/apastebin[.]com/raw/qDhF2MV0

2020.05.19

LODEINFO v0.3.5

a9b16ffc6850c208ce3e9f5909158692

2020.12.03

PE Loader(LilimRAT v1.2.4)

114bed2ec4bfea26d7c179faf146a290(7234feedad2d028e8f24dc3e627e5873)

ghostbin[.]co/9hyxn

2021.06.07

LODEINFO v0.3.8

ea8e81ac8a6c82e70b043f7a8b34e180

cl1p[.]net/free/backup

2021.06.03

n/an/acl1p[.]net/default

2021.10.08

PE Loader(LilimRAT v1.4.1)

77ed7c82ddf55871f5d586dc7deecbed(3983bd47b0e0f4eee771b2de8a0ca0b0)

PE loader of LilimRATOne of payload of DOWNJPIT was a shellcode of PE loader for LilimRAT.
The LilimRAT is encrypted and embedded in the end of the PE Loader like C2 of DWONJPIT
In memory
Loadshellcode
DOWNJPIT
Download

EXEshellcode
PE Loader

LilimRATDecrypt•

The LilimRAT also has a version
like LODEINFO by the actor

LilimRAT
The LilimRAT is the customized LilithRAT(a widely known open source RAT).

• Additional backdoor commands

like LODEINFO were implimented.
https://github.com/werkamsus/Lilith/Embedded backdoor commands of LilimRAT
command

Description

kill

Terminate a processrestartRestart itself

info

Get infected host information such as hostname, OS version, architecture of current process, username, current PID and malware
version. Seinding template is “${hostname}, ${OSversion} $((x86)|(wow64)), ${username}, ${PID}, ${malversion}“keydump

Dump keystroke

cd

Change directorylsShow file list

mvMove a filecp

Copy a filerm

Remove a filesend

Upload a filememoryInject shellcode in memory of svchost.exe. Received shellcode is encrypted by RC4 using 48bytes RC4 key which is generated from
infected host info: “${hostname}, ${OSversion} $((x86)|(wow64)), ${username}, ${PID}, ${malversion}“

recv

Download a file

remoteControl

Create a session for interactive shell using cmd.exe or powershell.exe

Hash algorism for key generation of LilimRATAn unique RC4 key generation method for decryption shellcode in “memory” command:

Attribution: possibility of TICK?

•••
https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-sMulti-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf

According to a whitepaper of Trendmicro, LilithRAT
was used by an operation of Tick group .
However, it was not customized LilithRAT like
LilimRAT.
We think that LilimRAT is NOT related to Tick group.

Attribution: possibility of APT10?

•••

Mr. Hiroshi Takeuchi from Macnica networks
talked about LODEINFO in VBlocal 2020.
He showed two possibilities of attribution
which are Darkhotel and APT10.
Our research result also showed the shadow ofAPT10.

https://vb2020.vblocalhost.com/conference/presentations/tracking-rapid-evolution-copycat-of-an-apt-rat-in-asia/
https://vb2020.vblocalhost.com/uploads/VB2020-66.pdf

Attribution: APT10
Some coding style similarities between LODEINFO, the LilimRAT, ANEL and Emdivi.
•These malware families contains malware versions string is embedded.

•Malware sends some compromised machine info by commands “info”, “ver”, and “version”.

EmdiviANELLODEINFO

LilimRATAttribution: APT10•The LilimRAT and Emdivi generate a string including the hardcoded malware
version for hash value as a crypto key.

•DOWNJPIT and ANEL generate a hash value from C2 for using malware features.

•

Other observed overlaps and similarities of TTPs are summarized below:
Overlaps/similarities

Malware families related to APT10

Spearphishing email with attached, malicious, passwordprotected Word document

LODEINFO, ANEL, Redleaves

Usage as DLL side-loading to run a payload within memory

LODEINFO, DOWNJPIT, ANEL, Redleaves, Emdivi

Distinct, customized open-source RAT

LilimRAT, Redleaves, QuasarRAT

Targets are exclusively Japanese or Japan-linkedorganizations

LODEINFO, DOWNJPIT, ANEL, Emdivi

C2 infrastructure is built in VPS/cloud services and IPs aremostly located in target countries

LODEINFO, Emdivi

Conclusions• The attacker have been targeting Japan mainly;• A versions of LODEINFO backdoor “v0.4.9” was confirmed in April 2021;• New variant of LODEINFO “DOWNJPIT” was discovered which is atrojanized downloader module to get a payload from an online content;• A customized LilimRAT delivered by DOWNJPIT as 2nd stage RAT;• Some relations during LODEINFO and some malware families of theAPT10 were confirmed.

Email: suguru.Ishimaru@kaspersky.com