Unveiling Activities of Tropic Trooper 2023:
Deep Analysis for Xiangoop Loader and EntryShell payload

Yusuke Niwa (Itochu Cyber & Intelligence Inc.)
Suguru Ishimaru (Itochu Cyber & Intelligence Inc.)
Hajime Yanagishita (Macnica, Inc.)©Macnica,Inc.

0

Who we are?

Suguru Ishimaru
Itochu Cyber & Intelligence Inc.

Yusuke Niwa
Itochu Cyber & Intelligence Inc.

Hajime Yanagishita
Macnica, Inc.
1

1. Overview
2. Initial Infection Vectors
3. Xiangoop Loader

Agenda> payload: Cobalt Strike Beacon> payload: EntryShell
4. CrowDoor
5. Attribution
6. Conclusions

2

Overview3Motivation● The threat actor group Tropic Trooper, which uses a RAT called Keyboy, has been very
active this year.
● In particular, the latest attack campaign has been observed to target overseas
companies based in China. We believe it is necessary to continue to monitor attack
trends closely.

4Who is Tropic Trooper● Tropic Trooper, a cyberespionage group that has beentargeting organizations in the Asia-Pacific region.
● Tropic Trooper (a.k.a. Pirate Panda, Keyboy, and APT23)
is a group that has been active since 2011, according to
Trend Micro.

https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf
https://citizenlab.ca/2016/11/parliament-keyboy/
https://www.macnica.co.jp/business/security/security-reports/pdf/cyberespionage_report_2022.pdf
5What’s NEW!!

Throughout this attack campaign, there were three new findings● Discovery of a new loader malware we named Xiangoop Loader and its deep analysis● Features of EntryShell, a major updated version of the KeyBoy malware● Discovery of unreported RAT, we named CrowDoor, a likely to have been used by
FamousSparrow, and the relationship between threat actors

6Campaign Overview
Post Exploitation

Initial Infection Vectors

Threat Actor

LNK

Spear-phishing EmailPost-Exploit Tools
NEW

TropicTrooper
Xiangoop
LoaderSpear-phish
ing
SMS
NEW
Physical penetration
with WiFi AP

NEW

Cobalt Strike Beacon
or EntryShell

StolenCredential

Xiangoop
LoaderNEW
RelationshipCobalt Strike Beacon
or EntryShell
SparrowDoor
LoaderNEW

CrowDoor

FamousSparrow
7

Initial Infection Vectors
8Initial Infection Vectors● We observe and estimate three main types of initial entry paths in this campaign.
○ Type 1: Spear Phishing E-mails○ Type 2: Spear Phishing SMS○ Type 3: Physical penetration

9

Type 1: Persistent Spear Phishing E-mailMore than 10 spear-phishing E-mails were observed in 2023.

2023年端午节职 端午节礼品
工礼品清单.zip 预定.xlsx.lnk

NTUSER.EXE

McVsoCfg.dll(Xiangoop Loader)&Recycle.Bin\setting.dat

EntryShell

10Type 2: Spear Phishing Using WeChat Application
We observed a spear-phishing SMS by the Windows version of the WeChat application.

http[:]//mail[.]mraden[.]com/win.rar

中色大冶采购信息
计划表.xlsm

zl.vbswin.exe

googleupdate.exe

goopdate.dll(Xiangoop Loader)base.jpg

EntryShell

11

Type 3: Physical Penetration with a fake WiFi AP● An unmanaged host was connected to the IP address of a wireless controller at one of
the sites. Possibly physically connected by an attacker.
● Prior to the intrusion, a suspicious WiFi AP was reported from the same site.
● The threat actor might have physically entered the office building temporarily tocompromise the internal network, rather than spear-phishing!!

Office PC

Fake WiFi

Attacker PC

Office WiFi

Office network

McAfee.exe
McVsoCfg.dll etc.
(Xiangoop Loader)setting.dat

Cobalt Strike
Beacon12

Xiangoop Loader
13

Xiangoop Loader
Why we named Xiangoop Loader for this malware?
Because, we discovered an artifact including a PDB file by the operator’s mistake.

Two specific words from the folder name of the developer’s env,
and combination to generate the loader name.

xiang(mu) + goop(date.dll) -> Xiangoop

14

Xiangoop Loader: Evolution of the Xiangoop[ variant AJ ]Mar 06 08:49:58 2023
Format: PE x64 (DLL)
Filename: McVsoCfg.dll
Export: McVsoCfgGetObject
BLOB: setting.dat[ variant A ]Nov 03 03:12:29 2022
Format: PE x32 (DLL)
Filename: goopdate.dll
Export: DllEntry
BLOB: <embedded>2022[ variant SxJC ]Jun 15 07:14:39 2023
Format: PE x64 (EXE)
Filename: AdobeFlash.exe
BLOB: <embedded>[ variant SxI ]May 23 06:37:26 2023
Format: PE x64 (DLL)
Filename: McVsoCfg.dll
Export: McVsoCfgGetObject
BLOB: setting.dat[ variant AwMJ ]Aug 18 08:14:29 2023
Format: PE x64 (DLL)
Filename: McVsoCfg.dll
Export: McVsoCfgGetObject
BLOB: setting.dat[ variant AM ]Aug 09 08:27:38 2023
Format: PE x64 (DLL)
Filename: McVsoCfg.dll
Export: McVsoCfgGetObject
BLOB: setting.dat

2023

200+ samples -> 6 variants
15

Xiangoop Loader: Variant A in Nov 2022
Xiangoop Loader A isa simple loader
AES ECB mode
hardcoded key = "123456AAAAAAAAAA”
Xiangoop Loader A

win.exe
droppergoogleupdate.exe
legitimate EXE

side-load<in memory>
EntryShelldrop
decrypt
goopdate.dll
Xiangoopreadbase.jpg
BLOB
16

Xiangoop Loader: Variant A in Nov 2022
Xiangoop Loader A isa simple loader
AES ECB mode
hardcoded key = "123456AAAAAAAAAA”
Xiangoop Loader A

win.exe
droppergoogleupdate.exe
legitimate EXE

side-load<in memory>
EntryShelldrop
decrypt
goopdate.dll
Xiangoopreadbase.jpg
BLOB
17

Xiangoop Loader: Variant AJ in Mar 2023
Xiangoop Loader AJ is almost the same as the variant A:
a simple loader
AES ECB mode
hardcoded key = "123456AAAAAAAAAA"
the HUGE Junk code
Xiangoop Loader AJ

Avira.exe
legitimate EXE

side-load<in memory>
Cobalt Strike Beacon

decrypt
McVsoCfg.dll
Xiangoopread<embedded>
BLOB
18

Xiangoop Loader: Variant AJ in Mar 2023
Xiangoop Loader AJ is almost the same as the variant A:
a simple loader
AES ECB mode
hardcoded key = "123456AAAAAAAAAA"
the HUGE Junk code
Xiangoop Loader AJ

Avira.exe
legitimate EXE

side-load<in memory>
Cobalt Strike Beacon

decrypt
McVsoCfg.dll
Xiangoopread<embedded>
BLOB
19

Xiangoop Loader: Variant AJ in Mar 2023
The biggest function size was 586 KB
How about using Hex-rays Decompiler?
the junk pattern is the sameworks well forsome small funcs

does not workfor HUGE func
20

Xiangoop Loader: Variant AJ in Mar 2023
If you want to see a flow of this function, but...

21

Xiangoop Loader: Variant AJ in Mar 2023
Tried to change the node limit to show flow in the IDA configuration!

Node limit-> 30,000
waiting for several tens of minutes..
22

Xiangoop Loader: Variant SxI in May 2023
loader feature + highly complex with uncommon crypto algorithms:
Salsa20 to decrypt payload from BLOB
x25519 + hsalsa20 + hsalsa20 to generate crypto key
Poly-1305 to calculate check value for success of key generation
Installer feature was implemented
Xiangoop Loader SxI
C:\Users\Public\Downloads\

2023年端午节职工礼品清单.zip\&Recycle.Bin\

refer
端午节礼品预定.xlsx.lnk
LNK

side-load

NTUSER.EXE
legitimate EXE

Avira.exe
legitimate EXE

side-load<in memory>
EntryShell

installdecrypt
McVsoCfg.dll
Xiangoop

open

McVsoCfg.dll
Xiangoop

duanwu.xlsx
Decoy

setting.dat
BLOB

read

read
setting.dat
BLOB

23

Xiangoop Loader: Variant SxI in May 2023
loader feature + highly complex with uncommon crypto algorithms:
Salsa20 to decrypt payload from BLOB
x25519 + hsalsa20 + hsalsa20 to generate crypto key
Poly-1305 to calculate check value for success of key generation
Installer feature was implemented
Xiangoop Loader SxI
C:\Users\Public\Downloads\

2023年端午节职工礼品清单.zip\&Recycle.Bin\

refer
端午节礼品预定.xlsx.lnk
LNK

side-load

NTUSER.EXE
legitimate EXE

Avira.exe
legitimate EXE

side-load<in memory>
EntryShell

installdecrypt
McVsoCfg.dll
Xiangoop

open

McVsoCfg.dll
Xiangoop

duanwu.xlsx
Decoy

setting.dat
BLOB

read

read
setting.dat
BLOB

24

Xiangoop Loader: Variant SxI in May 2023
McVsoCfg.dll

gen_key1 = x25519(hardcoded_key2, hardcoded_key1)
gen_key2 = hSalsa20(gen_key1, b”\x00” * 16)

hardcoded_key2 =73 7A A0 25 F2 0E 49 6B 6C F9 FA B1 6C 6F 1D 60
10 8F 05 2A 94 23 72 E1 F8 34 2A 79 9A E9 98 08

hardcoded_key1 =45 57 F9 4E 14 71 06 03 7A 54 89 94 A8 98 84 8B
21 81 B6 9D B1 6A 4E 99 56 55 FC BC BA FD 2A 59

gen_key3 = hSalsa20(gen_key2, blob[0x00:0x10])
dec1 = Salsa20_xor(gen_key3, blob[0x10:0x18], b”\x00” * 32 +blob[0x28:0x48])

setting.dat

blob[0x00:0x10] =1A DB 15 6E DE A9 44 69 E9 96 BD 73 DD E1 8E 10blob[0x10:0x18] =gen_key4 = dec1[0x00:0x20]

A7 C0 A9 C3 82 AA 83 4F

blob[0x18:0x28] =if (poly1305(blob[0x28:0x45a00], gen_key4) == blob[0x18:0x28]):

3B 0E AA E1 04 F9 34 F3 04 FE 0A 05 46 AC 5A D4blob[0x18:0x28] =dec2 = Salsa20_xor(gen_key3, blob[0x10:0x18], blob[0x48:0x459e0])
payload = dec1[0x20:0x40] + dec2

3B 0E AA E1 04 F9 34 F3 04 FE 0A 05 46 AC 5A D4blob[0x28:0x45a00] =F0 C0 4E 94 06 77 B5 64 E4 82 2D 70 AD 86 32 1B
53 41 B7 FD 94 87 CF 30 0A 80 2D 68 D7 DB 56 D2
F8 66 BE B0 4D 7F 98 1B CE 98 60 73 53 57 17 2B
B4 CD 86 59 82 C0 97 A0 E1 83 CE 64 53 61 E1 D1[skipped]

25

Xiangoop Loader: Variant SxJC in Jun 2023
Salsa20 to decrypt payload from BLOB
x25519 + hsalsa20 + hsalsa20 to generate crypto key
Poly-1305 to calculate check value for success of key generationhuge Junk code + Control flow flattering
Xiangoop Loader SxJC
read
AdobeFlash.exe
dropper<in memory>
payloaddecrypt<embedded>
BLOB

Ref-> https://jscrambler.com/blog/jscrambler-101-control-flow-flattening

26

Xiangoop Loader: Variant SxJC in Jun 2023

27

Xiangoop Loader: Variant AM in Aug 2023
Xiangoop Loader AM is very similar to the variant A
AES ECB mode + hardcoded key was updated “1234567890123456”
Malicious functions are divided into Multiple DLLs as expansion modules
Xiangoop Loader AM
load exp

side-load
McAfeeManager.exe
legitimate EXE

McVsoCfg.dll
Xiangoop

decrypt
setting.dat
BLOB

CopyFile.dll

msvcp140.dll<in memory>
Payloadread

msctfmig.dll
Manager.Dat
Junk data

msvcr100.dll
MSS.dll
MSSQ.dll
Expansion modulesNEW
28

Xiangoop Loader: Variant AM in Aug 2023
msvcr100.dll
McVsoCfg.dll

msctfmig.dll

MSSQ.dll

The new AES key =“1234567890123456”
29

Xiangoop Loader: Variant AwMJ in Aug 2023
Xiangoop Loader AwMJ appeared immediately after the variant AM
AES ECB mode using windows crypto API + hardcoded key is “1234567890123456”
Divided into Multiple DLLs as expansion modules + huge Junk code
Xiangoop Loader AwMJ
load exp

side-load
McAfeeManager.exe
legitimate EXE

McVsoCfg.dll
Xiangoop

decrypt
setting.dat
BLOB

CopyFile.dll<in memory>
Payloadmsvcp140.dll
msctfmig.dll
readManager.Dat
Junk data

msvcr100.dll
MSS.dll
MSSQ.dll
Expansion modules
30

Xiangoop Loader: Variant AwMJ in Aug 2023
Xiangoop Loader AwMJ appeared immediately after the variant AM
AES ECB mode using windows crypto API + hardcoded key is “1234567890123456”
Divided into Multiple DLLs as expansion modules + huge Junk code
Xiangoop Loader AwMJ
load exp

side-load
McAfeeManager.exe
legitimate EXE

McVsoCfg.dll
Xiangoop

decrypt
setting.dat
BLOB

CopyFile.dll<in memory>
Payloadmsvcp140.dll
msctfmig.dll
readManager.Dat
Junk data

msvcr100.dll
MSS.dll
MSSQ.dll
Expansion modules

What’s NEXT?? >>31

Xiangoop Loader> payloads Cobalt Strike Beacon
32

Cobalt Strike Beacon: Config

BeaconType

Port- HTTPS- 8443

Config is encoded with xor 0x2E, version 4

SleepTime- 3000
Watermark value is consistent
MaxGetSize- 1398104
Jitter- 10
MaxDNS- Not Found
PublicKey_MD5- 804f157f4176fea2d1ac6db1251ae37b
C2Server- cdn[.]cloudfarle[.]com,/filemaneger/#Modified . > [.]UserAgent- Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
HttpPostUri- /auth/Examples) UserAgent of other Xiangoop loader’s Cobalt Strike Beacon
Malleable_C2_Instructions- Base64 decode.....
Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
HttpGet_Verb- GET
Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2; InfoPath.3)
HttpPost_Verb- POST
HttpPostChunk-0
Spawnto_x86- %windir%\syswow64\svchost.exe -k wksvc
Spawnto_x64- %windir%\sysnative\svchost.exe -k netsvc
CryptoScheme-0
Proxy_Config- Not Found
Proxy_User- Not Found
Proxy_Password- Not Found
Proxy_Behavior- Use IE settings
Watermark_Hash- Not Found

Watermark

- 520
33

Xiangoop Loader> payload: EntryShell
34

What is EntryShell ?
EntryShell is a memory DLL that has only one Export function ‘DllEntry’, a variant of KeyBoy

Updates- String obfuscation- Config encoding, field- C2 traffic- Header code, Command ID- Junk codes$ yara ~/programs/yara/keyboy.yara /Avira.dmp -s -m
new_keyboy_header_codes [author="Matt Brooks, @cmatthewbrooks",desc="Matches
the 2016 sample\'s header
codes",date="2016-08-28",md5="495adb1b9777002ecfe22aaf52fcee93"] /Avira.dmp
0x28a941:$s1: *\x00l\x00*\x00
0x28a9c1:$s2: *\x00a\x00*\x00
0x28aa41:$s3: *\x00s\x00*\x00...
keyboy_commands .... /Avira.dmp
keyboy_errors ... /Avira.dmp
keyboy_systeminfo ... /Avira.dmp
35

EntryShell: String obfuscation'7FA2B5F545A273FA559A0382BACE839C''EEF7B4B46085911C147DBA7BF791CAD2''D040C8DBF7A4794FE079B2EEDC232062''BCC4F3F3F5DCFDC5867769B95F42DE78''0B23F7A0EF08F7E5C6F6EE9882725B43‘'26D61F18CE7B1E058C384B5D243A2958''ADD24D415FEC26FF2D321F50AB7574F8''3184526F7FE518EC686692BDC47D5012''56A1A6951DA31192FFAB15B950F1D468''BFD14534C01E5123ED7D757383DB8AF5''E1B5F3A4F0831CF765AC96C1D59CB489''F06B09A64EB34CA7A8AAAAFE2BDDF2FB''85556311638D0E34F862DB5090896BC4''7E02395FC094912719C2B09F8624A26A''78AC92A56B2FEC8032146B651E0C21E8''2D7394D9317A1E339A1133A98C672726''91F49683EC34675763F4A04B29A12B7B''BCC7A6993A71D44E91783C037A75ED5B''A4CD25265631F38E039408F16AA6E9ED''login_OK''*l*''C69EC9959DD00E211CBBA2BEF3BA6B5A''Update''*a*''UpdateAndRun' '*s*''584D718898D2E88AE29EE23853C32814''Refresh''*d*''16700D53FA061DE86A5F4D33ED3A5034''OnLine''*f*''46E0F662E3622FDFB528AB9EB2DAE14B''Disconnect''*g*''B880EF5F77DB454B89439C1F3C157A5A''Pw_Error''*h*''Pw_OK''Ctrl_End''Sysinfo''Download'
New 'UploadFileOk'
AES-128-ECB'RemoteRun'
key: ‘afkngaikfaf’ + null 'Computer''Shell''ChangeCfg''Cfg_Error'
36EntryShell: Config
New encoding is applied, config is now hardcoded and possible dynamic update by‘ChangeCfg’ request from C2 server

v_enc_mod = (v_enc & (1 << (7 - n_count))) != 0;
result = v_enc_mod + 2 * v_enc_next;
v_enc_next = v_enc_mod + 2 * v_enc_next;

Check Code (0123456789) \r\n C2 address #1 (85[.]209[.]43[.]142) \r\n C2 address #2(0) \r\n C2 address #3 (0) \r\n Port Number #1 (4431) \r\n Port Number #2 (0) \r\nPort Number #3 (0) \r\n Password for C2 Operation (1003) \r\n Campaign ID (0) \r\nProxy (0) \r\n Proxy Port (0) \r\n Proxy User (0) \r\n Proxy Password (0) \r\nNew37

EntryShell: C2 traffic (TCP socket connection)
Decrypted

md5
0c75d92d

AES-128-ECB key (63574154+null)
88103b5663574154b95037cfa76f3dfe

4 byte4 byteLength of
Encrypted String

Length of Decrypted
String (Wide)

Encrypted String(AES-128-ECB)

Header code: *a*Computer Name: _P005
IP address: 10.211.55.5
Campaign ID: 0
Timestamp: 2023/01/27 14:00:53
Version Identifier: aafiegkafeb
38EntryShell: Header code and Command ID
Header code

Command ID*a*

Initial Connection to C2

SysinfoCollect system information*d*Remote shell

Download

Upload file to C2

UploadFileOk

Download file from C2 and execute

RemoteRun

Execute file*l*Beacon*f*

File Handling (e.g. Error2:)*s*

Send system information*g*File Download (e.g. DownloadFile:
Ready Download OK)

Computer

New Collect drive information and list of files(FileManager)
Shell

Remote shell

cd

Change directory*h*File Upload (e.g. UploadFile:)

dir or ls

Collect list of files in the folder(Empty)Send Message (e.g. login_OK,
Cfg_Error ) New

delDelete fileExit

Terminate C2 session

39

EntryShell: Junk code
Like Xiangoop loader, junk code is also sometimes applied to some subroutine
2022

2023

40

EntryShell: Wrap up (KeyBoy update)
Version Identifier

Key Changes

aafiegkafeb● Added static string obfuscation by using
AES-128-ECB with key: ‘afkngaikfaf’● Config encoding update and proxy related values
are added● Config is embedded and dynamic update by‘ChangeCfg’ request from C2 server● C2 traffic data is encrypted with AES-128-ECB● Junk code is applied to some subroutines41

CrowDoor
42

What is CrowDoor ?
‘CrowDoor’ is named after ‘SparrowDoor’
Found CrowDoor sample from the same victim during
the Tropic Trooper incident response in June 2023
Similarities with SparrowDoor● Complete code overwraps at loader shellcode● Actions by command line arguments● Implementation of Command ID
Dissimilarities● Config● C2 Traffic
https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf
https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/
43

CrowDoor: Loader
RC4key ‘fYTUdr643$3u’Loader
WinStore.exe
sqlite3.dll
datastate.dll
datast.dll
WinStore
Payload onshellcode inLegitimate
Legitimate DLL Malicious DLL to load loader DLL Encrypted ﬁleMemoryMemoryExecutableload loader DLL‘CrowDoor’(iTop Data Recovery)$ yara ~/SparrowDoor.yar ./Shellcode_Payload.bin -m -s
SparrowDoor_shellcode [author="NCSC",description="Targets code features of the reflective
loader for SparrowDoor.
Targeting inmemory.",date="2022-02-28",hash1="c1890a6447c991880467b86a013dbeaa66cc615f"]
0x5a:$peb: 8B 48 08 89 4D FC 8B 51 3C 8B 54 0A 78 8B 74 0A 20 03 D1 03 F1 B3 64
0x71:$getp_match: 8B 06 03 C1 80 38 47 75 34 80 78 01 65 75 2E 80 78 02 74 75 28 80 78 03 50
75 22 80 78 04 72 75 ...
0x36:$k_check: 8B 48 20 8A 09 80 F9 6B 74 05 80 F9 4B 75 05
0xda:$resolve_load_lib: C7 45 C4 4C 6F 61 64 C7 45 C8 4C 69 62 72 C7 45 CC 61 72 79 41 C7 45
D0 00 00 00 00 FF 75 FC FF ...
44

CrowDoor: Actions performed by command line argument
4 patterns are very similar to SparrowDoor’s -i -k -d switch
Argument or flag ( Value afterparsing command line argument)

ActionNo argument

Persistence is set through the registry Run key or a service
and the backdoor is restarted

0

Persistence is set through the registry Run key or a service
and the backdoor is restarted

1

The backdoor is restarted by injecting to 'colorcpl.exe'

2

The backdoor interpreter is called45

CrowDoor: Config
Config is hardcoded without encoded

45_32_49_144: C2 IP address
0x01: Connection method
0x1 : TCP socket connection (Hardcoded at found sample)
0x2 : TCP socket connection, do communication thread with lowest priority
0x3 : TCP socket connection and set header string like below, do communication thread with lowest priority'User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) Chrome/107.0'
0x1BB: Port Number (443)
0x11: Number of retries for C2 connection46

CrowDoor: C2 traffic
C2 Communication is done with TCP socket connection and encrypted with RC4. Initial
16 bytes are encrypted with hardcoded key ‘fYTUdr643$3u’ and additional data with arandomly generated key.

Decrypt initial 16 bytes with key ‘fYTUdr643$3u’
random key Command id Length
19 28 bb 9a 35 71 34 02 07 00 00 00 00 00 00 00

Little Endian‘ 9abb2819’ ‘0x2347135’ ‘0x7’

Decrypt additional data with key ‘9abb28199abb2819’
2E 6E E2 AE D6 38 78
47

CrowDoor: Command ID
Command ID

Action0x2347135

Initial connection to C2

0x2347136

Collect ComputerName, UserName, OS version and hostnet or IP address information

0x2347137

Remote Shell

0x234713B

Delete malware files, persistence and exit

0x2347140

File related operation

0x2347141

Read file

0x2347142

Write file

0x2347144

Collect drive information

0x2347145

Search file

0x2347148

Create directory

0x2347149

Rename file or directory

0x234714A

Delete file or directory

0x234714B

Communication with C248

CrowDoor: Similarities with SparrowDoor
SparrowDoor

CrowDoor49

Attribution
50

Attribution -Relationship between Tropic Trooper and FamousSparrow● One event in this Tropic Trooper attack campaign confirmed the presence of CrowDoor
used by FamousSparrow.
● From these series of activities, we first discovered that Tropic Trooper andFamousSparrow may be linked and operationally closely related.

51

Attribution -Developer’s name
The common developer name "joker" was left in the PDB files and attached .lnk files!!
Attached .lnk file

Xiangoop Loader

Entry Shell

52

Conclusions
53

Conclusions
Tropic Trooper attack campaign from 2022 to 2023.
● Beware of physical penetration rather than malware infection by spear-phishing!!
● New malware, “Xiangoop Loader” and its transition to become anti-analysis,
with the variety of encryption algorithm, junk code and CFF● A variant of KeyBoy, "EntryShell”, updating command ID and its similar anti-analysis
features such as obfuscated command ID and junk code as well
● New malware, “CrowDoor”, which is associated with FamousSparrow,and shared a detailed analysis of these features.

54

Finally...
A new version of Xiangoop Loader has been observed last week!
Prepare for TropicTroper attacks!

55

Thank you very much!
Enjoy VB2023

Appendix
57

IoCs: malware types and md5 hashes
Xiangoop Loader A

06d84cd9721bed541b5f59736b39d3a3

Xiangoop Loader A
Xiangoop Loader AM

1ffd397619bc1a5b2ff25a5067312077

Xiangoop Loader AJ +BLOB
Xiangoop Loader SxJC+BLOB

64294f4f6d9a91a7df44d36fa5c88651
22879c3aabceed8968edcadce38fa2c6

53e402edb9196fa30bd1d0bb8e66bde6

Xiangoop Loader SxJC+BLOB

2f91d9ad3a03a4a8f99776f79830dc00

Xiangoop Loader AM

c801c30657a15d398de36519f2072713

BLOB

47c7091a4eedc310b928b57347c57616

Xiangoop Loader AM module

28310ac912df6cd5f7d3ac27a6b5fafc

BLOB

84b6a4044b6a505c1d24f4cceba294d0

Xiangoop Loader AM module29e9f8d8a1609c128e3088515714bb45

BLOB

998ae2fab40c911d321a398c911687e1

Xiangoop Loader AM module4a168c51a6dcc0ac6df273c394133b68

BLOB

b150e9258273e22eec5d49053147b956

Xiangoop Loader AM module

600229a19d26964fdbd2d0caf4a6dc84

BLOB

cccc4cf8267815cf7ae1f924ef2d9b83

Xiangoop Loader AM module61b35baeb8dce981e3d692aedbaac6ae

BLOB

e66eab6fd531377392950d150da8061a

Xiangoop Loader AM module

76d2f0e0f101cdec483d27c08a56ef87

Cobalt Strike beacon

60343197c88fc483072b4875be70a9cb

Xiangoop Loader AM module

7d4ab23dbad10ab728c87666b6513e87

Cobalt Strike beacon

cea56b3f18618c25eab43c4df5cae00c

Xiangoop Loader AM modulebc322adb53f476cea28d9bd4992d9f02

EntryShell

7f2029336efc798486a8e35fe6a2c54a

Xiangoop Loader AM modulec9021f1801c19d1a0198d27ff2453b75

msi file

924e3153b6788f012b7f8626410e1155

Xiangoop Loader AM module

ce7a7238e4ff2d28a3876777f12fbbd2

msi file

aa91030187a7fe89cf6f88018996813a

Xiangoop Loader AM module

e4e8f18c571ec28bb4fe7eba511926fe

cab file

b97f02f0f7fd80b0265899e1b64cb09a

Xiangoop Loader AM modulee687a1f959365a64e5ed7f5748f6a790

cab file

bd5b82e0f5bc53447f024a6cdc584b30

Xiangoop Loader AM module

fc3730e18dd09249d8a19b39f6a1ae80

zip file

4ecde4df3fcba436e9e5bdf8bc2f1248

Xiangoop Loader AwMJ
Xiangoop Loader AwMJ module
Xiangoop Loader AwMJ module

ccb5aa2057a157261606c043ce7d45e8
074b41bbc7018a139212f63331bb0a14

zip file

d9cfd1bed982779eb17ca45b4b31ea8e

rar file

e360559825976478cfc7abe24b2699b7

rar file

f75f6e731048c01bae2d75b53a057ad5

Xiangoop Loader AwMJ module
Xiangoop Loader AwMJ module
Xiangoop Loader AwMJ module
Xiangoop Loader AwMJ module

12be7a86877a561677d2cd63c2b7c19f
36a24ebf972ec1012eedee41863488a6
46048c962243c2999796b3a3fe525631
5f134ca309cacac5f6651c60f1eb0a78
e98be352638418900fd5378de14956be

rar file

567f8cab5d1dd8f42934209b91fe15d3

SparrowDoor Loader

8a900f742d0e3cd3898f37dbc3d6e054

SparrowDoor Loader

a213873eb55dc092ddf3adbeb242bd44

BLOB

90afb6d2dfd161ce7752226b8a52e609

Xiangoop Loader SxI

4006dcb60b94f22e313138d836f6692f

Xiangoop Loader SxI

bb01bc33b0475fb2624d906760ebe290

58

References
https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf
https://citizenlab.ca/2016/11/parliament-keyboy/
https://www.macnica.co.jp/business/security/security-reports/pdf/cyberespionage_report_2022.pdf
https://www.ncsc.gov.uk/files/NCSC-MAR-SparrowDoor.pdf
https://www.welivesecurity.com/2021/09/23/famoussparrow-suspicious-hotel-guest/
https://www.trendmicro.com/en_fi/research/23/h/earth-estries-targets-government-tech-for-cyberespio
nage.html
https://www.eset.com/int/about/newsroom/press-releases/research/eset-research-discovers-famousspa
rrow-apt-group-spying-on-hotels-governments-and-private-companies/
https://blog-en.itochuci.co.jp/entry/2023/09/28/171001

59