Tropic Trooper’s Back: USBferry Attack
Targets Air-gapped Environments
Technical Brief
By Joey Chen (Threats Analyst)

Contents
New findings on Tropic Trooper's old tools and recent activities
Detailing Tropic Trooper’s campaign••••

The discovery of the USBferry attack
A USB malware called USBferry
The evolution of USBferry’s infection
Backdoor information and versions

Potential targets and targeted information
Conclusion
MITRE ATT&CK® Matrix
Indicators of compromise (IoCs)

New findings on Tropic Trooper’s old tools and recent
activities
Tropic Trooper (aka KeyBoy) is a cyberespionage group known for perpetrating attacks against
government institutions, military agencies, hospitals, and the banking industry. Recently, we discovered
the Tropic Trooper group targeting Taiwanese and the Philippine military’s physically isolated
environment using a USBferry attack (the name derived from a sample found in a related research).
USBferry has variants that perform different commands depending on specific targets; it can also
combine capabilities, improve its stealth in infected environments, and steal critical information throughUSB storage. Based on our telemetry, this kind of attack has been active since December 2014 and has
been solely targeting military or government users located in Asia. We started tracking this particularcampaign in 2018, and our analysis shows that this campaign uses a fake executable decoy and USB
trojan strategy to steal targets’ information.

Figure 1. A sample scenario of the USBferry attack

Detailing Tropic Trooper’s campaign
The discovery of the USBferry attack
We first discovered the malware from a PwC report, which mentioned a sample related to Tropic Trooper
but did not include a detailed analysis. Based on this clue and our data, Tropic Trooper has been using
the USBferry attack to deliver its payload to victims as early as December 2014.
We also observed many malware versions and PDB (program database) strings. This should be notedbecause, based on this pattern, we can map out an evolution list of the USBferry malware and attacks.
Their hardcoded malware version number pattern is similar to our previous report on Tropic Trooper.
Furthermore, the malware version number implies that the USBferry malware was modified from trojan
TROJ_YAHOYAH, as published in our report. From the PDB strings, we also found two interestingdetails: The USBferry malware has at least three versions (Find the full list in the indicators ofcompromise [IoCs] section of this document), and it has different variants and components.
The PDB strings in USBferry malware also provided us with insights into the campaign, including the
malware versions:
•
•
•
•
•
•
•

E:\Work\VS Project\USBFerry_For_PH\Bin\Install_EXE.pdb
E:\Work\VS Project\USBFerry_For_PH\Print\Install_EXE.pdb
E:\Work\VS Project\USBFerry_CopyFile_20150331\Bin\Install_EXE.pdb
D:\work\vs\UsbFerry_v2\bin\UsbFerry.pdb
D:\work\vs\UsbFerry_v2\Release\AddAutoRun_x32.pdb
D:\work\vs\UsbFerry_v3\bin\UFLoader.pdb
D:\work\vs\UsbFerry_v3\bin\UsbFerry.pdb

A USB malware called USBferry
We initially decided to name this malware TROJ_YAHOYAH and thought it was an old malware that has
different variants. Its malware network protocol makes it similar to the trojan TROJ_YAHOYAH. However,
we found that the beacon information was a bit different from the oldest one — the hardcode VR strings
from PH changes to UF.

Figure 2. USBferry malware with HTTP GET request sample

Our analysis found that USBferry malware has three versions:•

The first one is a small component with TROJ_YAHOYAH; it will try to check if the target
computer has a USB plugin and copy the USBferry malware installer into USB storage. In thisversion, TROJ_YAHOYAH differs from the oldest one. We also found that a few
TROJ_YAHOYAH samples changed slightly in specific target environments. For instance, some
execute Windows commands, source the victim file or folder list and list the victim’s network••

topology, and copy files from a physically isolated host to a compromised host that has a USB
disk.
The second one has all the capabilities of the first one, but this version combines two malware
variants into one executable.
The third one also has all the capabilities of the above version; however, this version is designed
to be more stealthy in the target's environment. It will reside in the rundll32.exe memory.

Figure 3. USBferry malware’s first version with trojan TROJ_YAHOYAH, where the EXE file is the USBferry malware,and the DLL file is the trojan TROJ_YAHOYAH

Figure 4. USBferry malware’s second version combined into one executable

Figure 5. USBferry malware’s third version becomes resident in memory

The evolution of USBferry’s infection
To paint a bigger picture of Tropic Trooper’s attacks, we correlated the tools and tactics they used against
their targets. We list the notable changes found in Tropic Trooper’s latest campaign below.
Version PH5.0 20141217’s attack chain:
•
•
•
•
•

Uses a fake installer file, sent via spam email to lure a potential victim into clicking it
The fake installer will check the OS version first and drop three USBferry malware components,
encrypted C&C configuration file, USB malware, and trojan downloader
It will create the autorun function in the victim's host, located in "C:\Users\Public\Local
Settings\Microsoft\UsbKey" folder
The trojan downloader will try to download an image file from the C&C website and use
steganography to decrypt the encrypted payload inside the image
The final payload will run resident in the victim's host memory and connect to the C&C server

Figure 6. USBferry attack scenario, version PH5.0 20141217

Figure 7. Three USBferry malware components

Figure 8. USBferry malware autorun function in the target host

Tropic Trooper uses the old way of achieving infection: by ferrying the installer into an air-gapped hostmachine via USB. They employ the USB worm infection strategy using the USB device to carry themalware into the target's computer and facilitate a breach into the secure network environment.

Figure 9. USBferry malware using USB worm infection strategy

Figure 10. Malware version PH5.0 20141217 with HTTP GET request sample

Version PH5.0 20150211, PH5.0 20150213, and PH5.0 20150323 attack chains:
These three malware versions have all the capabilities of the version above, plus other functions
depending on the purpose. It will also copy an installer into the USB recovery folder to keep the USBferrymalware under the radar. Recovery folder location examples are the following:••

E:\Vessels\OSS\STI (marked) \fromvessel\STI (marked) up 27 Nov 2019\Recovery\file001.chk
G:\Recovery\file001.chk

Figure 11. USBferry malware hides the installer in the USB recovery folder

Specific functions will be embedded in the trojan downloader to adopt the target environment. Our indepth analysis found that when Tropic Trooper first penetrates the victim's environment, they will use
basic sourcing scripts to collect the host network’s topology, connection capability, and volume
information. The second function uses USB storage to copy highly classified documents from thephysically isolated environment. Moreover, this function copies certain files into the USB %RECYCLER%
folder, monitors files’ modified time, and updates the newest one to the USB device. The last function will
infiltrate the target’s internal machine with a customized Windows command and reverse backdoor
malware. The summary of the attack is detailed below.

Figure 12. USBferry attack scenario for version PH5.0 20150211, PH5.0 20150213, and PH5.0 20150323

Tropic Trooper modifies the sourcing command to achieve its goal on different targets. Based on some
scripts, we can identify their main target industry or the type of document formats they were trying to find.
The following figures will show the scripts we found embedded in the different malware.

Figure 13. Sourcing script inside the USBferry malware

With the sourcing commands found in the malware, Tropic Trooper intends to learn the network topology
of a target environment. By using "tracert" and "ping" commands, the group discovers the target’s networkarchitecture. For example, "tracert -h 8 8.8.8.8" collects the route (path) and measures transit delays ofpackets across an Internet Protocol (IP) network. The pings, meanwhile, are used to test the target
network’s connectivity; the actors want to know if the machine has access to the internal network and thetarget mail portal. Tropic Trooper can then use the gathered information to plan and prepare the nextstage of the attack.
An analysis of the copy function reveals that Tropic Trooper tries to use the USB storage to exfiltrate
important data.

Figure 14. Copy algorithm inside the USBferry malware

Figure 15. Monitoring the target files’ modified times and updating the files on the USB with the ones to send out

The last strategy uses a command to set the target's host machine. The command indicates that Tropic
Trooper already knows the target’s administrator account password and its internal network topology.
This way, Tropic Trooper can easily use a tool to execute the backdoor directly. On the other hand, thesescripts also show how they use a loader to execute the backdoor, and the following command also
indicates the malware components’ location. From those locations, we can also identify that this payload
belongs to the BKDR_YAHAMAM family. The command inside the malware is shown below.

Figure 16. Attacking the internal machine with known account username/password and tools to execute thebackdoor directly

Version UF0.4 20160202’s attack chain:
In this version, Tropic Trooper decided to name this special target attack as UF, which is an abbreviationof USBferry. We also learned that this version is the USBferry malware version 2, based on these PDB
strings:••

D:\work\vs\UsbFerry_v2\bin\UsbFerry.pdb
D:\work\vs\UsbFerry_v2\Release\AddAutoRun_x32.pdb

Tropic Trooper no longer uses two components to achieve the USBferry attack in this version; they
instead combined two malware versions and changed the name of the new malware to a less suspicioussounding one. They also changed the malware location from C:\Users\Public\Local
Settings\Microsoft\UsbKey to C:\Users\Public\Documents\Flash\, and hid the files’ attributes to evadedetection.

Figure 17. USBferry attack scenario, version UF0.4 20160202

This latest version of the USBferry malware has an auto-start component embedded in its resource
section. This component is executed by rundll32.exe and terminates the flash_en.exe installer. Afterward,
it writes the autorun to the registry and executes the USBferry malware with the -I command, which can
execute the process without showing any windows on the user desktop.
••

Registered value → KEY: [HKEY_CURRENT_USER\Software\Microsoft\Windows
NT\CurrentVersion\Winlogon\Shell]; DATA:[explorer.exe,%USERPROFILE%\Documents\Flash\flash_en.exe I]; TYPE: [REG_SZ]
Executed command → cmd /c "C:\Users\Public\Documents\Flash\flash_en.exe" -I

Figure 18. Auto-start component embedded in the resource section

Figure 19. USBferry malware hidden in the Flash folder

Figure 20. Malware version UF0.4 20160202 with HTTP GET request sample

Version UF1.0 20160226’s attack chain:
The latest USBferry malware uses DLL injection in the target's host machine. Here’s a summary of the
USBferry malware’s attack chain:
1. The decoy file will drop a flash_en.inf DLL file, which is a USBferry loader, and it will try to load
the encrypted USBferry malware
2. Encrypt the USBferry malware embedded in the loader resource section, and the loader will drop
it in the C:\Users\Public\Documents\Flash folder and name it "flash.dat"
3. After loading the encrypted payload, the loader will inject a malicious DLL into rundll32.exe while
the USBferry malware will load C&C configuration file and flash_en.dat, which is also located inthe "C:\Users\Public\Documents\Flash"4. The USBferry malware will try to connect to the download site and use Windows command tocollect/copy target host data

Figure 21. USBferry attack scenario, version UF1.0 20160226

Figure 22. USBFerry Loader, C&C configuration file, and encrypted USBFerry malware hidden in the Flash folder

This version will check the network capability first if the network is unavailable, then it will try to collect thetarget information and copy the collected data into USB storage. This allows the USB device to carry thegathered information out to send to the C&C server.

Figure 23. Exfiltrate target machine information through USB storage

Figure 24. Collecting target machine information and writing it into the files with a timestamp

Backdoor information and versions
In a recent incident, we discovered four different backdoors Tropic Trooper has used. Some backdoors
use injection to execute its routines, while others execute directly and run themselves constantly.
Incidentally, we also have Tropic Trooper's backdoor controller and tools. One of their known backdoors,
BKDR_YAHAMAM, was mentioned in our previous whitepaper on the group. Tropic Trooper also uses
the steganography technique to mask their backdoor routines and evade anti-malware and network
perimeter detection.
To find the full list of the backdoor hashes we encountered and their respective malware version
numbers, check the IoCs listed at the end of this document.

Version WelCome To Svchost 3.2 20110818’s backdoor:
After a full analysis of this backdoor, we noted a few interesting details. First, this backdoor has the samefunctionality as HL3.7x86_20140711, which is a backdoor payload discussed in the aforementioned
Trend Micro whitepaper. Second, from this malware version number, we can confirm this backdoor
variant’s first version was developed in or before 2011, which means that Tropic Trooper’s activities havebeen ongoing for at least ten years now. Third, this backdoor version also tells us that this malware runs
under svchost.exe, hence the name "WelCome To Svchost."

Figure 25. Backdoor version name, registered service name, and malware components’ filenames

Version Welcome To IDShell 1.0 20150310’s backdoor:
We believe this backdoor’s purpose is to recon the target machine because it has fewer functions
compared to previous versions. We listed its backdoor capabilities below.
? or Help -->Help MemuPut [RecvIP] [Port] [FileName] -->Send File To FileClient
ReSetPut -->Reset Put Func
GetFile [IP] [Port] [FileName] -->Get File From FileServer
Get [http://IP/A[.]exe] [File.exe] -->Download File------------------------------------------------------------------------------SysInfo -->1 View System Infor
SoftInfo -->3 View Installed SoftWare
Pslist -->7 List Process
Pskill [PID] -->Kill Process------------------------------------------------------------------------------Shell [cmd.exe] -->4 Get A Shell
ShellA -->Get Shell As LogonUser------------------------------------------------------------------------------Ver -->Show Version
Exit -->Exit Control------------------------------------------------------------------------------List Help Completed
We were able to get two types of this backdoor. This backdoor has a DLL file version and is directly
executed by rundll32.exe. It also has another steganography jpg version, which needs a downloader todownload and decrypt it. Then, it can execute successfully in the target machine. This kind of backdoor,
including all previous versions, uses DNS protocol to communicate with the backdoor controller. TropicTrooper also encrypted the traffic to prevent network detection products from blocking it. The traffic isshown below.

Figure 26. Backdoor’s communication traffic

We were also able to source Tropic Trooper's remote controller tool. The tool provides a user interface(UI) that allows the group to send instructions to and monitor any compromised endpoint host. This tool
can remotely control all the samples developed before 2015-03-10.

Figure 27. Backdoor’s help list and version number. The backdoor remote controller tool also needs a password to
get the backdoor control permission

During our analysis, we found more tools the Tropic Trooper group has used. The tools include port relay
tools, a command-line remote controller tool, and backdoor payload/steganography payload execution

loaders. The group also used port scanning tools during their attack. We provide a snapshot of the attack
below.
1. Remote control listener/port relay tool
Tropic Trooper developed several tools to adapt to different situations and versions of the
backdoors/downloaders.

Figure 28. The lightweight version of the remote control listener

Figure 29. The professional version of the remote control listener uses a more interactive strategy for communicatingwith the backdoor

Figure 30. The SSL version of the remote control listener, which can use the SSL protocol to communicate with the
backdoor

2. Backdoor payload/steganography payload execution loaders

The payload loader has two versions. This loader was also seen in the attack scripts shown in Figure 16.
Tropic Trooper can use this loader to successfully load the encrypted payload and execute the backdoor
loader to run the delete command that deletes itself and the encrypted payload. As seen below, the threat
actor needs to type the correct password to execute these loaders.

Figure 31. Payload execution loaders’ 2.0 version

Figure 32. Payload execution loaders’ 2.1 version, which is the latest version and is more stabilized

The screenshot below shows how we used this payload loader to load the steganography payload in our
test machine. The loader will check the process handle first, then check if the loader executed with
Administrator permissions. After that, the loader will try to run svchost.exe, which is the backdoor carrier.
It finally injects the backdoor BKDR_YAHAMAM and set up the backdoor components. The components’setting path and filename are all discussed in our previous Tropic Trooper whitepaper.

Figure 33. Loaders execute the payload with debug strings

3. Port scanning tools
Tropic Trooper also used this port scan tool in their attack operation; this tool is available for download
online.

Figure 34. TCP port scanner tool

Version Hey! Welcome Server 1.0/1.5/2.0’s backdoor:
This kind of backdoor is different from the previous ones, as it does not use a reverse connection toconnect to any C&C servers. This backdoor will start a web service in the target host and wait for Tropic
Trooper to control the machine. Our analysis found that this backdoor is more like an invisible web shelland has a few powerful features to evade network security products, even the system/web server cannot
log the connection or behavior for this invisible web shell.
This invisible web shell has three notable features: First, it will run the process as a service to makeincident response more difficult. Second, this web shell utilizes the ring 0 port-reuse technique to hide thebackdoor communication, allowing malicious traffic to hide in normal traffic communication. This web shell
also developed a customized protocol and path to forbidden and unknown connections or any
unauthorized connections.

Figure 35. Customized TCP protocol and waits for Tropic Trooper connection

Version Hey! Welcome Server 1.0 backdoor:
How this web shell is invisible is very interesting. We found that this web shell uses three uncommon
Windows APIs — HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl — to achieve its goal. With theAPIs, the malware can easily create an HTTP listener to wait for Tropic Trooper to access the page byusing gethostbyname to get the host machine’s IP address and combining it with "http://" or "https://" toachieve the web service URL. In this version, the web shell also hardcodes the path and encrypts it in the.rtext section.

Figure 36. Encrypted URL path

Figure 37. Using the gethostbyname API to get the host machine IP address

Figure 38. HTTP URL combination algorithm using HttpAddUrl API

After setting up the web shell connection URL, Tropic Trooper can input the correct format to connect the
web shell and remotely control the target host. For instance:
•
•
•
•
•

Connection URL: "https://{victim host IP}::443/Pages/about.aspx"
Correct cookie format: <cookie_name>=<password>;<encoded_cmd>
Cookie_name: 1YV610vNfl+5Ftolm0qMzQ++
Password: awdsxz
Encoded_cmd: [Modify base64 strings]

If the input cookie format is incorrect, then the web shell will return "HTTP Error 404.0 - File Not Found."and acts as if it were a real web service.

CommandCommand description.#

Shows current directory information.sysinfo

Shows target machine information, which includes ProductName, Processor Name, System Name, host disk
information, current directory information, and MAC address.cd

Change directory.download

Downloads files from the target host

.uploadUploads files to the target host.ul

Co-works command with .upload; this command is
to appoint Tropic Trooper’s host files
Table 1. Web shell’s commands and capabilities

Figure 39. Hardcode cookie nameFigure 40. Wrong cookie format input will return "HTTP Error 404.0 - File Not Found."

Version Hey! Welcome Server 1.5’s backdoor:
Version 1.5 has all the capabilities of the first one, plus the ability to set up a connection port and path in
the web shell URL. Moreover, in this version, Tropic Trooper changes it from a dynamic-link library (DLL)
version to an executable version. This change could help the actor more easily restart the web shell
service and change the connection port and path. This version also improves the exception debug
strings; if the web shell receives an unknown HTTP GET request, it will respond with "Not Implemented"
messages and print out debug strings on the server site.

Figure 41. A tool used to emulate Tropic Trooper communication with a 64-bit version of the invisible web shell

Figure 42. Exception debug strings when the web shell receives an unknown HTTP GET request

Version Hey! Welcome Server 2.0’s backdoor:
The invisible web shell 2.0 version has made more progress. This version has not only improved hidden
technical aspects to go around detection, but also added more exceptions to handle wrong input
commands or unauthorized access. We found Tropic Trooper has several ways to execute the web shell.
First, it is the same as the 1.0 version that uses DLL hijacking and runs on svchost.exe. Second, like the
2.0 version, Tropic Trooper compiles the web shell as an executable file and directly runs it in the target
host. Third, it uses a web shell loader to load the encrypted web shell and uses process hollowing to
inject into dllhost.exe. Moreover, the web shell in the 2.0 version is available in 64-bit and 32-bit versions.

Figure 43. The executable version will install and name it as a Windows service, change registry to disable error
display, and launch the service

Figure 44. The loader will try to search *.dat file, which is an encrypted payload

Figure 45. The loader will use XOR with key 0x90 to decrypt the encrypted payload and inject into dllhost.exe

For handling wrong inputs and displaying fake webpages to trick users and security analysts, Tropic
Trooper checks every input argument. If any arguments are missing or incorrect, the web shell will
respond with "404 File Not Found." The error is not a simple text on the web page; Tropic Trooper adds
the HTML code inside to make the fake 404 page more realistic.

Figure 46. The web shell checks each input argument; it responds with "404 File Not Found." if it finds any missing or
incorrect argument

Figure 47. The HTML code is inside to make the fake 404 page more realistic

This version uses a different web shell request format; this version of the web shell still uses a cookie as
the authorization password. However, Tropic Trooper needs to type two values in the cookie column.
Both cookie names could be random strings, but the first cookie should match the cookie value, which isin the hardcoded web shell, and the second cookie could be any of the backdoor commands (e.g., .#,.sysinfo, .cd, .download, .upload, or .ul). In version 2.0, the web shell embeds three URL paths to allow
Tropic Trooper to connect. The group also used their web shell backdoor URL path to fake the Trend

Micro’s OfficeScan console URL. This technique is an attempt to bypass network detection in a target
machine. Lastly, Tropic Trooper shifts their command response from plain text to a png format — each
response will be a png file that encrypts the web shell command results.
SHA-256 : 83eca76156075cda86d931e4048170876c30264e42eabdf2098d303942061b9d
URL filters registered to HttpAddUrl API
https=443/officescan/console/html/help/webhelp/_wh/user/resources/trend.png
https=443/officescan/console/html/help/webhelp/_wh/user/resources/hpball.png
https=443/officescan/console/html/help/webhelp/_wh/user/resources/asia.png
SHA-256 : 34449fe014c30ca50357a7993f237ae07427eee49b354c9d53188fb2a803a074
URL filters registered to HttpAddUrl API
https=443/UIWeb/images/falcon.png
https=443/UIWeb/images/icon.png
https=443/UIWeb/images/tipc.png

Figure 48. The first cookie to pass the authentication and get a successful response from the malware

Figure 49. Both cookies get a successful response from the malware

Here’s how to decode the png file response:
1.
2.
3.
4.

Remove the fake PNG header and footer
XOR the rest bytes with 0xAB
Use base64 to decode
XOR the rest bytes with 0xBC

Figure 50. The png file response with bytes version

Here we’re going to discuss the relationship between the backdoors. The first three backdoors canconnect to the same controller, and the help commands are almost the same. Connecting to thosebackdoors with invisible web shells further helped us attribute them to Tropic Trooper threat actors: First,
we found the latest TROJ_YAHOYAH and invisible web shell in the same target network environment.
Second, the function of showing the target’s disk volume information is almost the same — not only for
the API call but the display information as well.

Figure 51. How the backdoors (Welcome To IDShell, Hey! Welcome Server, and Welcome To Svchost) get disk
information and display format

Potential targets and targeted information
Tropic Trooper seems to have been targeting air-gapped environments over the past six years;
in particular, the group prefers to target military hospitals and national banks as initial footholds. It could
be difficult for some military and government offices to have sufficient security controls; protections can bechallenged and thus make incident response trickier.
Tropic Trooper is aware that main military or government agencies may have protection strategies inplace in physically isolated environments, such as the use of biometrics, secure USB for data transfers, or
plugging the USB device into a quarantined machine before using it in a physically isolated environment.
Therefore, Tropic Trooper chooses to target related organizations and use them as initial footholds. In thiscase, we observed how Tropic Trooper actors successfully moved from a military hospital to the military’s
physically isolated network.
We observed Tropic Trooper’s targets to be the following:••••

Military/Navy agencies
Government institutions
Military hospital
National bank

Based on data from the Trend Micro™ Smart Protection Network™ security infrastructure, we found that
Tropic Trooper tried to steal defense-related, ocean-related, and ship-related documents from the target
networks. We believe that the group is interested in defense confidential information or technology andmarine-related confidential information or intelligence.

Conclusion
Tropic Trooper is an active cyberespionage group that has been operating since 2011. The latest
developments indicated that they are well-prepared to target Taiwanese government institutions andPhilippine military agencies in order to steal information related to defense- and marine-related
intelligence. The group has also taken its time to monitor their targets and study their network
environments in order to steal intelligence from physically isolated networks. We already observed thegroup targeting Taiwanese government institutions and Philippine military agencies. Furthermore, we also
found that the group tries to target other industries or companies that are related to military agencies or
national institutions as jump-off points for eventually infiltrating physically isolated networks. Relatedorganizations, especially those with weak security measures in place, could serve as entry points forotherwise strong network security measures of government institutions and military agencies.
This targeted attack operation can be broken down into four important points. First, putting critical datain physically isolated networks is not an overarching solution for preventing cyberespionage activities.
Second, their preferred technique of steganography isn’t just used to deliver payloads, but also forsending information back to the C&C server. Third, several hacking tools and components can be used tofulfill attacks in different target networks and environments. These tools and components also have a selfdelete command to make it tricky to trace the attack chain and all the related factors. Lastly, using aninvisible web shell hides their C&C server location and makes detecting malicious traffic more difficult for
network protection products.

This research underscores that facilitating a robust monitoring and command/order system isimportant. We often saw targets had difficulties taking sufficient control over their relatedorganizations, which made the overall monitoring system weak and incident response difficult. We hope
we were able to shed light on the latest Tropic Trooper activities to help organizations take sufficientmeasures against this cyberespionage campaign.

MITRE ATT&CK Matrix

TacticInitialAccessExecution

PersistenceTechniqueID

Description

Replication ThroughRemovable Media

T1091

Copies malware to removable media and infects
other machines

Trusted Relationship

T1199

Breaches the organizations who have access tointended victims

Valid Accounts

T1078

Actor hardcodes victim username/password to
infect internal computer

Rundll32

T1085

Uses rundll32.exe for execution

ScriptingT1064

Uses batch scripting to automate execution ofcommands

User Execution

T1204

Lures victims to double-click on decoy files

Hidden Files andDirectories

T1158

Sets its own executable file's attributes tohiddenRegistry Run Keys /T1060

Adds itself to the Registry as a startup programStartup Folder

Privilege
Escalation

DefenseEvasionDiscovery

to establish persistence

Web Shell

T1100

Uses web shells to maintain access to victim
network

Process Injection

T1055

Injects its DLL component into svchost.exe

Web Shell

T1100

Uses web shells to maintain access to victim
network

Valid Accounts

T1078

Uses compromised credentials to log on toother systems

Deobfuscate/Decode
Files or Information

T1140

Uses XOR and RC4 to perform decryption on
C2 or encrypted files

File Deletion

T1107

Loader after execution will delete itself

Hidden Files andDirectories

T1158

Sets its own executable file's attributes tohiddenProcess Hollowing

T1093

Decrypts the payload into memory, creates a
new suspended process of itself, then injects adecrypted payload to the new process andresumes new process execution

ScriptingT1064

Uses batch scripting to automate execution ofcommands

Valid Accounts

T1078

Actor hardcodes victim username/password to
infect internal computer

File and Directory
Discovery

T1083

Uses “dir” to search for C:, D:, E: and F:Process Discovery

T1057

Gathers a list of running processes on thesystem using “tasklist”

Permission Groups
Discovery

T1069

Listed groups are “net view /domain” and “netview”

System Information
Discovery

T1082

Sends an OS version identifier in its beacons

System Network
Configuration
Discovery

T1016

Uses the “ipconfig /all” command to gather
network configuration information

System Owner/User

T1033

Collects the username from the victim’s

Discovery
LateralMovement

Collection

Commandand Control

machineInternal Spearphishing

T1534

Uses USB legitimate file name as internal
spearphishing

Remote File Copy

T1105

Downloads additional files and programs fromits C2 server

Windows Admin
Shares

T1077

Connects to network shares using “net use”

Replication ThroughRemovable Media

T1091

Copies malware to removable media and infects
other machines

Automated Collection

T1119

Uses a batch script to perform a series of
discovery techniques

Data from Local
System

T1005

Collects files from a local victim

Data from Removable
Media

T1025

Copies files with certain extensions from USB
devices

Data Staged

T1074

Stores files and logs in a folder on the local
drive

Commonly Used Port

T1043

Uses port 80/443/53 for C2 communications

Communication
Through Removable
Media

T1092

Captures information from air-gapped
computers via an infected USB

Custom Command
and Control Protocol

T1094

Communicates to the C2 server using a custom
protocol

Custom Cryptographic
ProtocolT1024

Uses a custom encryption algorithm on data
sent back to the C2 server

Data Obfuscation

T1001

Uses steganography to hide malicious code
downloaded to the victim

Fallback Channels

T1008

Has three hard-coded IP/domains for C2servers; if the first does not respond, it will try
othersRemote File Copy

T1105

Downloads additional files for execution on thevictim’s machineStandard NonApplication Layer

T1095

Uses TCP and UDP for C2

Protocol

Exfiltration

ImpactStandard Application
Layer Protocol

T1071

Web shell uses HTTP for command and control

Automated Exfiltration

T1020

Automatically exfiltrates collected files via
removable media when an infected device isconnected to the second victim

Data Encrypted

T1022

Encrypts the data before sending it over the C2serverExfiltration Over
Command and Control
ChannelT1041

Sends system information and files over the C2channelResource Hijacking

T1496

Infected victim’s USB storage

Indicators of compromise (IoCs)
SHA-256

Trend Micro Pattern Detection

Malware version
number4a1e6d9fc0abc5cb77c9efd0261661039
6102d70d06dc79231ede25a024d31bb

TSPY_UFINSTAL.ZCHD-A

PH5.0 20150323

3a9a6fa69e2b97b1cf0d36aa7729e0e2f
cca716efe73a98bfceba30828ee1d28

TSPY_UFINSTAL.ZTHA-A

PH5.0 20141217

a6442744c3aaf38cb9159b553e665220
e4571af11d399237a5d0568623459349

TSPY_UFINSTAL.ZCHD

PH5.0 20141217

0c8bc08bd72938dd74ee62673c19ea79
bcb8923db07fd9b4715d7d86d5756a11

TSPY_UFINSTAL.ZCHD

PH5.0 20141217

ed22b9b212811fb6317999310fdb37e56
6da1b969a78abfca39450aa8e7abf98

TSPY_UFINSTAL.ZCHD

PH5.0 20141217

eb9a801d0542b4aa6dc068bcc10cb8a4
b9f2df332e285e4b5180b1361683e315

TSPY_UFINSTAL.ZCHD

PH5.0 20141217

8305c70825bb2eed99ba8bc0c90cb46b
48f6537edb05c10e54f7778298ab85fa

TSPY_UFINSTAL.ZCHD

PH5.0 20141217

804639742145ef4e9be58a07b62a00f33

TSPY_UFINSTAL.ZYHD-A

PH5.0 20150211

e18438c8f1b87c1833488599251378af1892636e61f285f03bc11b443294c9d6
83defdd2b1ccc48a0337c5458ee80ca

TSPY_UFINSTAL.ZCHD-B

PH5.0 20150213

8a520b6f14d8af81b874cbbf71d09db02
7039add9a7533872bc171862811c279

TSPY_UFINSTAL.ZAHD-A

PH5.0 20150211

cf0fda3a638c25c296d423ebca16f3e905
5ca80f5a1cc96dc940acab9fe42969

TSPY64_UFINSTAL.ZTHA-A

6395f8bc082b319159ef0418e90578351
511de07992280e0f400bc5cf1aa829f

TSPY64_UFINSTAL.ZCHD-A

a8c9f9af6a21f6829e310ca658a37a42a
8e0c76d5206922933596e7f40480144

TSPY64_UFINSTAL.ZCHD-A

6e050eb926e9ad955daa382f4f7abef7fe
abcf6d59dd403bbb0133f69ba77d0c

TSPY64_UFINSTAL.ZBHD-A

bb66f36dabb7781c36a8d5d836c68893
a8cf0c0570cfa7c0e4192498c4ddc05c

TSPY64_UFINSTAL.ZAHD-A

905fcf0f574bf104a62c7a5c91cd95fbacb
06bf3fbcdcb38320113394c7386d7

TROJ64_YAHOYAH.ZTHA-A

90496241ffdbdd1592d0b8aba76d6f861
6fc1093623c0d2c2a4fecc4199293cb

TROJ64_YAHOYAH.ZCHD-A

a0e8c1ece844f18876c951b4360cef1c8
e63d270ab5a8346e4a81cba36795838

TROJ64_YAHOYAH.ZYFK-A

32299feded258d78323a7a23acd5463d
908c3fbbd46842817b53ab9116587d64

TROJ64_YAHOYAH.ZCHD-A

cf0f2b94da0a0cccab7e5b90b0d95e2e2
c7700164e4ca7197122f9a46cd87d5d

TROJ64_YAHOYAH.ZBHD-A

1f383eb5f614669404ef00d693510f40ca
87c30204ef269a0a19aa4564942444

TROJ_YAHOYAH.ZTHA-B

56854c52566a12a8e4d55f5fb3f223766
ef5b60aff65f7dfaff7540e5833206d

TROJ_YAHOYAH.ZBHB

d283cbeee4c21ff2d5983af7fdbd097c84
c56e9252cbd5fb33cb73f8e0bbf323

TROJ_YAHOYAH.ZBHD-A

5f0e14bbb0700318a11e43cb6b3e6ef82
e8d0cc01cf89660a3e9bab20af033fa

TROJ_YAHOYAH.ZYFK-A

4940deb9f4fb84f80b152afce7c1f33ef34

TROJ_YAHOYAH.ZBHD-A

43f3a417e06dcffd31934deb0b041
872b39f0a673183dee8461b3592f3c4ab
7f0e10ed3e00eed59112b517f9e6b89

TROJ_YAHOYAH.ZBHD-A

b4535aa71da630992392c3c202d59274
ce49a3fe4f1ac01d7434f1dceeda47e5

TROJ_UFDROP.ZCFB-A

91cfb699c1aa110949c02b7c736268cad
49b382247577cd0c8e4711a3ae3eb61

TROJ_UFAURU.ZAFB-A

8b735facf228cbb2d9ede905c70119e68
61ad12d0b7a611f691d37841768c0d3

TROJ_USBLODR.ZAHB-A

UF1.0 20160226

e7b89f5a79dc6c8cc0e7850d1f18139a9
31f26513808312de5ec2d95f16f04c2

TROJ_USBLODR.ZAHB-A

UF1.0 20160226

ee0996ba9f60275edc5f65b0f9ee54fe0f
8aee1f1a53097bfeb9aa96293d1c6d

TROJ_USBLODR.ZAHB-A

UF1.0 20160226

f21e3b927d269b0622d94c55db9d2808
758379aa413c10971fa745cd6e0503c0

TROJ_USBLODR.ZAHB-A

UF1.0 20160226

31adbf8a99bf2f7d831df042b403d944ac
ce7909af753048c30ca74da9ecb87b

TROJ_USBLODR.ZAHB-A

UF1.0 20160226

5ebf33c54e2f62bedd0711450e02469a4
b4bcde2e79dca0e57039779c2387c0a

TROJ_USBLODR.ZAHB-A

UF1.0 20160226

545c8993ba46019ce68237ccd078e627
84fc6665d4c27c15ddb421529acfe0f1

BKDR_SVCSHELL.ZAHC-A

WelCome To
Svchost 3.2
20110818697e0984d5aa83024389d848432e6aef
6ef51444b4f71251082bb2aa7d849e6c

BKDR_IDSHELL.ZTFC-A

Welcome To
IDShell 1.0
20150310

9a9845a64ca2e96bdff21810718a0b4d7
e8c230ab3652449350927cc1223a97c

BKDR_IDSHELL.ZTFC-A

Welcome To
IDShell 1.0
20150310

5efdbbd5669afe5aa51791531fb6b0b72
5654198ea0b27a56d71918fa2d13708

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
1.0==================

729114eec9d967266730def64b6e0e14f
7095829442eb0c956e35fdc92e9d6dc

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server

UF0.4 20160202

1.0==================
1d4a3b2f3e201c086dfe0a414fabb5f166
90f1e6d53945cdb00d7b3c9d17aec6

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
1.5==================

e342e94d8705163aeef94db97e2777fa9
7d959dd249e779c7f32d7bbd647a76d

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
2.0==================

32c7a06594b2bd1605453217a8f4a153
46d6c88b128c067886bfe3a0d3dc9cdd

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
2.0==================

34449fe014c30ca50357a7993f237ae07
427eee49b354c9d53188fb2a803a074

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
2.0==================

d4cfe11f59b976d53facdb42355f73edb4
686a98ed93edc4a9738aad704be644

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
2.0==================

83eca76156075cda86d931e404817087
6c30264e42eabdf2098d303942061b9d

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
2.0==================

3187205208a8d78954c053a6aeb6b3e93548b6d0c2a5720f81026b601c7824f4

BKDR_TEBSHELL.ZTGK================== Hey!
Welcome Server
2.0==================
c34764ec05f35f39e72125b2bf9e23167
15ddeaf24eca757e39c3649e51e026b

TROJ_TEBSHELL.ZTGK

0a796b817121f436643e990562dffd6ee
a6cc05c213ef683f7f89f4b4f0e9447

TROJ64_TEBSHELLLDR.ZTGK

5e8cfe1f42a4809cdadcef2f9c7f4473da2
fbbea2d6609b593ab0c3531611d2b

BKDR64_TEBSHELLENC.ZTGK

bbc5917b99a0b080c8f0102aec9059eb
5645dfbaac9e48f3c4bfe9222f3b73f4

TROJ_TEBSHELLLDR.ZTGK

d3a3992d64f4869fd2c020c5051f3b781
6809057d57c57cdb97e17e16ae53cd7

BKDR_TEBSHELLENC.ZTGK

C&C
113[.]10[.]221[.]89/images/bd2015[.]24[.]jpg
128[.]69[.]102[.]172
223[.]27[.]35[.]244
www[.]dpponline[.]trickip[.]org/images/D2015_id[.]jpg
jupiter[.]qpoe[.]com/cat[.]24[.]jpg
jupiter[.]qpoe[.]com/dog[.]24[.]jpg
jupiter[.]qpoe[.]com/cat[.]6[.]jpg
jupiter[.]qpoe[.]com/dog[.]6[.]jpg
jupiter[.]qpoe[.]com/cow[.]6[.]bat
jupiter[.]qpoe[.]com/cow[.]24[.]bat
mila1314[.]ddns[.]info:53/bd141219[.]24[.]jpg
mila1314[.]25u[.]com:443/bd141219[.]24[.]jpg
mila1314[.]4dq[.]com:53/rusbmon[.]24[.]dat
mila1314[.]ddns[.]info:53/baidu0213[.]6[.]jpg
mila1314[.]ddns[.]info:53/baidu0211[.]6[.]jpg
mila1314[.]ddns[.]info:53/baidu0213[.]24[.]jpg
mila1314[.]ddns[.]info:53/baidu0211[.]24[.]jpg
oldape[.]25u[.]com/cfdocs/bai0211[.]24[.]jpg
oldape[.]25u[.]com/cfdocs/bai0211[.]6[.]jpg
oldape[.]4dq[.]com/cfdocs/bai0211[.]6[.]jpg
www[.]myinfo[.]ocry[.]com/images/D2015_id[.]jpg
www[.]myinfo[.]ocry[.]com/images/bd2015[.]24[.]jpg
www[.]myzinfo[.]myz[.]info/images/bd2015[.]24[.]jpg

TREND MICROTM RESEARCH
Trend Micro, a global leader in cybersecurity, helps to make the world safe for exchanging digital information.
Trend Micro Research is powered by experts who are passionate about discovering new threats, sharing key insights, andsupporting efforts to stop cybercriminals. Our global team helps identify millions of threats daily, leads the industry invulnerability disclosures, and publishes innovative research on new threats techniques. We continually work to anticipate new
threats and deliver thought-provoking research.
www.trendmicro.com