Fighting to LODEINFO
Investigation for Continuous Cyberespionage
Based on Open Source

Ryo Minakawa, Daisuke Saika, Hiroki Kubokawa @ NFLaboratories.

Who we are

Ryo Minakawa

Daisuke Saika

Hiroki Kubokawa

APT / Malware Hunter

Malware Analyst

CTI Analyst

Copyright © 2023 N.F.Laboratories Inc.

1

AgendaIntroduction
Continuous LODEINFO Campaign
Research and Hunting Methodologies
New TTPs Observed in 2022
Insight into Threat Actor
Limitation and Conclusion

Copyright © 2023 N.F.Laboratories Inc.

2

Introduction

Copyright © 2023 N.F.Laboratories Inc.

3

OverviewnCampaign using LODEINFO malwareppnContinuously observed
for about 3 years since Dec. 2019
Chinese state-backed APT groupis behind (APT10?)

What we talk about todayppp

Features of the latest LODEINFO malware
How to hunt and defense against threats
based on open-source intelligence
New insight on threat actor attribution
https://blogs.jpcert.or.jp/en/2021/02/LODEINFO-3.html

Copyright © 2023 N.F.Laboratories Inc.

4

OverviewnCampaign using LODEINFO malwareppnContinuously observed
for about 3 years since Dec. 2019
Chineseon
State-backed
APT group
Focus
two topics!

is behind (APT10?)
What we talk about todaypFeatures of latest LODEINFO malware
How to hunt and defense against threats
based on open-source intelligence☛☛ New insight on threat actor attributionpp

https://blogs.jpcert.or.jp/en/2021/02/LODEINFO-3.html

Copyright © 2023 N.F.Laboratories Inc.

5

Continuous
LODEINFO Campaign

Copyright © 2023 N.F.Laboratories Inc.

6

Outline of LODEINFOnFileless RAT used for campaigns targeting JAPANpp

Delivered by spearphishing mailspContinuously updated since Dec. 2019p

Malware version information is hardcorded inside RAT

pnTarget sectors: defense sector,
international politics, diplomatic, media

CnC servers deployed on Japan-located VPS,
hosting services (Vultr, CHOOPA, LINODE ...)

APT10 is said to be behind the campaignsp

Code similarity with BISONAL malware (hardcorded version information)p

Similarity in TTPs (spearphishing, DLL Side-Loading)

Copyright © 2023 N.F.Laboratories Inc.

7

Timeline up to 2022
First observed in Dec. 2019, Continuously updated and used(unconfirmed)

v0.1.2n rm command

n CnC

n first observed

communication
data formatchangedn load malicious

DLL using
Rundll32.exe(LOLBAS)v0.3.5v0.2.7v0.3.2n 11 commands

n print

commandimplemented

implemented
n ransom,

keylogcommandadded butnotimplemented

v0.4.6v0.5.6v0.4.9n ransom,n mv, cp,

keylogcommandimplemented

mkdir
commandimplemented

n ps, pkill

obfuscatedn CnC

communication ismore encrypted

2020
Apr.

May.

n config

n commands list

changed: DLL
Side-Loading

Dec

comc command
implemented
commandimplemented (notavailable)commandimplemented

n infection flow

2019

n autorun,

2021
Dec.

Apr.

Copyright © 2023 N.F.Laboratories Inc.

Nov.

8

v0.1.2

Execution flown

Malicious VBA drops DLL,
execute via RunDll32.exe (LOLBAS)n

Malicious shellcode
embedded in LODEPNG (open-source PNG
encoder/decoder)p

https://github.com/lvandeve/lodepngp

pdb information remains

execute

drop

load

LODEINFO

RunDll32.exe
injectnshellcode is encrypted by single byte XOR key:
trailing 1 bytep

Encryption method remains unchanged today
svchost.exe

Copyright © 2023 N.F.Laboratories Inc.

9

v0.1.2

CnC communication data format
Header and Main Data part are created in separate formats, and encoded with custom Base64
CnC verifies communications with the first 16 bytes of Header (SHA512/128)
Customized Base64 Encode

Customized Base64 Encode

Data format

HeaderMain Data

AES Key
SHA512/128

Data
size

N/A

Raw
data
size

AES Key
SHA512/384

offsetsize (byte)

0x00

16

SHA512 of AES key (first 16 bytes)

0x10

4

size of base64-encoded main data part

0x14

1

N/A

0x15

48

SHA512 of Raw Data (first 48 bytes)

0x45

4

payload size

0x49

variable length

Payloaddescription

payload (encrypted Raw Data)

Copyright © 2023 N.F.Laboratories Inc.

10

v0.1.2

CnC communication data format
Header and Main Data part are created in separate formats, and encoded with custom Base64
CnC verifies communications with the first 16 bytes of Header (SHA512/128)
Customized Base64 Encode

Data format

Process data in order ofRaw
AES KeyData
AES Key
Raw
Data
=>
(CBC)
data
N/AQuickLZ compress => AES256
Payload
SHA512/384
SHA512/128
size
size

offset0x00

HeaderMain Data

Customized Base64 Encode

0x10

size (byte)

description

unique AES key and IV
16
SHA512of AES key (first 16 bytes)
are hardcodedin each4
size of base64-encoded main data partsamples

0x14

1

N/A

0x15

48

SHA512 of Raw Data (first 48 bytes)

0x45

4

payload size

0x49

variable length

KEY

IV

payload (encrypted Raw Data)

Copyright © 2023 N.F.Laboratories Inc.

11

v0.1.2

Beacon data sample

HeaderMain Data

POST parameter name ishardcoded in shellcode

3 characters replaced
custom Base64

Payload plain text = “UNIXTIME of execution|ANSI code|MAC Address|Computer Name”

Copyright © 2023 N.F.Laboratories Inc.

12

v0.1.2

RAT commands list
commanddescription

MZ

execute PE file

0xE9

execute shellcodecommandreturn available commands listcd

change current directorylslist files and directories

send

download filerecv

upload file to CnC servercatupload file to CnC Server

memoryinject shellcode into svchost.exe

killkill processverreturn version information

Copyright © 2023 N.F.Laboratories Inc.

13

Changes in CnC communication data formatnv0.2.7JPCERT released the decryption scriptfor v0.1.2 but the next version (0.2.7) changed
its data format☛ former script no longer worknv0.2.7 is not found on open-source,
but we confirmed the new script works wellfor v0.3.2 and later versions

snip.
https://blogs.jpcert.or.jp/en/2020/06/evolution-of-malware-lodeinfo.html

Copyright © 2023 N.F.Laboratories Inc.

14

v0.2.7

Changes in CnC communication data format
payload size is XORed and key added
Customized Base64 Encode

Customized Base64 Encode

Data format

HeaderMain Data

AES Key
SHA512/128

Data
size

N/A

Enc.
data
size

AES Key
SHA512/384

offsetsize (byte)

0x00

16

SHA512 of AES key (first 16 bytes)

0x10

4

size pf base64-encoded main data part

0x14

1

N/A

0x15

48

SHA512 of Raw Data (first 48 bytes)

0x45

4

payload size XORed by single byte key

0x49

1

single byte XOR key

0x4A

variable length

XOR
Key

Payloaddescription

payload (encrypted Raw Data)

Copyright © 2023 N.F.Laboratories Inc.

15

v0.3.2

Change in execution flownmalicious VBA drops signed executable and
DLL shellcode loadern

DLL is loaded by DLL Side-Loading technique
p

p

drop

drop and execute

Chinese state-backed APT groups often use DLL
Side-Loading for defense evasion
legit. exe: 1871402d3c83b2e15bf516d754458bd4 (md5)
load
SfsDll32.dll

This signed exe
continuously
used for sideloading

SfsDllSample.exe

on memory

LODEINFO

Copyright © 2023 N.F.Laboratories Inc.

16

v0.5.6

Changes in CnC communication data format

beforev0.5.6

Customized Base64 Encode

Customized Base64 Encode
AES Key
SHA512/128

Data
size

N/A

Customized Base64 Encode

v0.5.6and later

AES Key
SHA512/384

Enc.
data
size

XOR
Key

PayloadCustomized Base64 Encode

Encryption
AES Key
SHA512/128

Data
size

N/A

Former header fields are encrypted

AES Key
SHA512/384

Enc.
data
size

XOR
Key

Payload☛ Former script no longer work again...

Copyright © 2023 N.F.Laboratories Inc.

17

v0.5.6

Change in beacon data

HeaderMain Data

offsetsize (byte)

04

data size

4

4

size of dummy data

common key for header
decryption and dummy data added

description

collected system information
0x11

variablelengthdata size + 27

variablelengthPayload
Payload plain
plain text
text

“UNIXTIME of execution|ANSI
code|MAC Address|Computer
Name#key for substitution cypher”
unused Base64 (dummy) data

Copyright © 2023 N.F.Laboratories Inc.

18

v0.5.6

Header encryption procedure

HeaderMain Data
unique value (hardcoded)

Get key length bytes
from Main Data

set as the POST parameter name,and used as a key for header encryption
header is encrypted by the same substitution cipher

string index-based substitution cipher(decryption script → Appendix D)

Copyright © 2023 N.F.Laboratories Inc.

19

RAT commands list obfuscation

v0.5.6command strings stored in a shellcode are 2bytes XORed (keys are unique for each command)create commands list

compare command (ls)compare command (command)

Copyright © 2023 N.F.Laboratories Inc.

20

RAT commands list obfuscation

v0.5.6command strings stored in a shellcode are 2bytes XORed (keys are unique for each command)create commands list

compare command (ls)YARA signatures based oncomparecommand(command)commands
list areno longer
work

https://github.com/JPCERTCC/jpcert-yara/blob/main/other/lodeinfo.yara

Copyright © 2023 N.F.Laboratories Inc.

21

Summaryn

The operation is highly motivated to attack Japan, as evidenced by thewell-crafted decoy documents and its CnC servers' locationn

LODEINFO malware is continuously updated and used for campaigns
targeting JAPANpn

Very likely to be used after 2022

TTPs change frequentlypp

Efforts to avoid analysis by tools and signature matching have been
continuously carried out
Cannot hunt and defense from threats simply by applying threat
intelligence from others as it is

Copyright © 2023 N.F.Laboratories Inc.

22

Research and Hunting
Methodologies

Copyright © 2023 N.F.Laboratories Inc.

23

Motivation of researchnCountering potential threats to your organizationpp

In addition to reading threat reports,
we need to continuously observe threats and track the latest attacks.
A representative example is the campaigns using LODEINFO.

n

But it is difficult for us to handle raw incident cases...

nActions we can take based on open-source threat intelligence☛ Aim to detect glimpses of threats with open-source intelligence !!
pppContinuous observation from externally published IoCs
Digging deeper into reports and creating specific detection logics
Collecting and sharing threat intelligence actively

Copyright © 2023 N.F.Laboratories Inc.

24

Sources of threat intelligence
ANY.RUN & Hybrid Analysis

VirusTotal

Various intelligence is in here.

Famous online sandboxes.

Online analysis service withlarge data sets.

Objectives:n Broad information gatheringn Get the first report quickly

Objectives:n Searching for valuable artifacts
n Conducting YARA rule hunting

Objective:n Real-time YARA rule hunting
n Downloading artifacts(Price: 2 million yen/year +)Twitter

Copyright © 2023 N.F.Laboratories Inc.

25

Threat intelligence monitoring on Twitter
The official Twitter client is too difficult to use in this purpose, so use
TweetDeck to monitor key accounts and keywords.

Copyright © 2023 N.F.Laboratories Inc.

26

Utilizing VirusTotal
Collect artifacts from VirusTotal based on threat reports and IoCs
Analyze malwares and create YARA rules -> using Livehunt to hunt matched artifact real-time☛Rules with good accuracy -> import into your organizations' detection logic

https://www.virustotal.com/

Copyright © 2023 N.F.Laboratories Inc.

27

Is it possible to create YARA rule for loaders ?
Implementation of Shellcode loader (SfsDll32.dll) changed greatly

v0.3.5

XOR decryption

v0.5.6

Easy to change implementation because loader works with a simple logic(sometimes) cannot catch updated loaders by rules created for former samples
hunting 1 byte XOR shellcodes by brute force rules is not going to work when encryption method changes (like RAT command 2 byte XOR)

Copyright © 2023 N.F.Laboratories Inc.

28

Find TTPs that rarely change based on reportsn

LODEINFOʼs loader is side-loaded fromdefault execution flow of legitimate
executablen

Only two legitimate executables
observed so farpp

SfsDllSample.exe: 2020/05 ~ 2021/12
K7SysMon.exe: 2022/03 ~https://www.macnica.co.jp/business/security/
cyberespionage̲report̲2021̲6.pdf

Copyright © 2023 N.F.Laboratories Inc.

29

Find TTPs that rarely change based on reportsn

LODEINFOʼs loader is side-loaded fromn

Only two legitimate executables
observed so far

assumption:
default execution flow of legitimate"It is more difficult to change legitimate executable
executable
than change implementation of loader"☛

SfsDllSample.exe:~ 2021/12
hunting
all files to2020/05
be Side-loadedp
K7SysMon.exe: 2022/03 ~phttps://www.macnica.co.jp/business/security/
cyberespionage̲report̲2021̲6.pdf

Copyright © 2023 N.F.Laboratories Inc.

30

Find function called from default execution flownanalyze legitimate executablestaticallyn“StartSystemMonitor” is the
only loaded function called fromthe default execution flow☛
malicious DLL Loader must haveStartSystemMonitor in export table !

Copyright © 2023 N.F.Laboratories Inc.

31

Using File search modifiers
Files with ”StartSystemMonitor” in export table -> only 4 samples / 3 months☛ manageable amount !

entity: search type
exports: function name in export table of PE
fs: first submission

Copyright © 2023 N.F.Laboratories Inc.

32

Creating YARA rule and hunt
Cheap but enough rule to hunt potential threats of LODEINFO☛ Enabling since v0.5.9 observed, detect samples to v0.6.3

starts with ”MZ” and”StartSystemMonitor” in export table-> v0.5.9 and later LODEINFO

Copyright © 2023 N.F.Laboratories Inc.

33

Semi-automation of analysis (Hunt => Store)

ManualPart

Copyright © 2023 N.F.Laboratories Inc.

34

Storing intelligence
Automated analysis and manual analysis results are stored in OpenCTI
and converted to a format that allows correlation analysis.

Copyright © 2023 N.F.Laboratories Inc.

35

Storing intelligence
Automated analysis and manual analysis results are stored in OpenCTI
and converted to a format that allows correlation analysis.

Copyright © 2023 N.F.Laboratories Inc.

36

Utilizing Hybrid Analysis
Testing accuracy of self-made rules / simple hunting without VirusTotal.

Testing
YARA rule
Accuracy

https://www.hybrid-analysis.com/yara-search

Copyright © 2023 N.F.Laboratories Inc.

37

Utilizing ANY.RUN
ANY.RUN has detailed search options and allow to download artifacts.
It may be possible to observe artifacts used in targeted attacks (need skill).

RuntypeCountry

Verdict

Extension
https://app.any.run/

Copyright © 2023 N.F.Laboratories Inc.

38

Utilizing ANY.RUN

LODEINFO posted to ANY.RUN

Copyright © 2023 N.F.Laboratories Inc.

39

Utilizing ANY.RUN

LODEINFO posted to ANY.RUN
screenshot gives a sense of theoddity of decoy file.

Copyright © 2023 N.F.Laboratories Inc.

40

New TTPs Observed in 2022

Copyright © 2023 N.F.Laboratories Inc.

41

Timeline and trends in 2022nn

No significant change in Initial Access methodology and target sectorsp

Spearphishing emails with malware attachedp

Main targets are media and defense sector

Change legitimate executable file to side-load malicious DLL
pn“SfsDllSample.exe” => “K7SysMon.exe”

some of commands and execution flow changed
v0.6.5v0.6.2v0.6.3https://www.macnica.co.jp/business/security/cyberespionage̲report̲2021̲6.pdf

v0.5.9

2021

Mar.

Apr.

Jun.

2022

Copyright © 2023 N.F.Laboratories Inc.

2023

42

CnC server infrastructure for LODEINFOn

No change in infrastructure trendspUsing hosting service such as Vultr, CHOOPA and LINODEp

IP Geolocation is mostly JapanCnC server

version

Hosting service

location

45.77.28[.]124

v0.5.9, v0.6.2

Vultr

Ōi, Saitama, Japan

172.105.223[.]216

v0.6.2, v0.6.5

LINODETokyo, Tokyo, Japan

202.182.108[.]127

v0.6.2, v0.6.5

CHOOPAŌi, Saitama, Japan103.175.16[.]39

v0.6.3

Mondoze

Kuala Lumpur, Kuala Lumpur, Malaysia

5.8.95[.]174

v0.6.3G-Core Labs S.A.

Urayasu, Tokyo, Japan

172.104.112[.]218

v0.6.5

LINODE

Ōi, Saitama, Japan

Copyright © 2023 N.F.Laboratories Inc.

43

Changes in API hash algorithm (2022/3)

v0.5.9API hashing algorithm changed to JSHash-based algorithm & 2 bytes XOR☛

Extraction of XOR Key is now required for malware analysis.
Before v0.5.9

CRC32

v0.5.9 and after

Justin Sobel hash Based Hashing
Copyright © 2023 N.F.Laboratories Inc.

44

v0.6.2

Changes in beacon payload (2022/4)
snip.

HeaderMain Data

offsetsize(byte)

0

4

Data size

44

Dummy data size

0x11

variablelengthData size + 27

variablelengthdescription

Collected system information

The version information added
to Beacon format“UNIXTIME of execution|ANSI code|MAC Address|
Computer Name#key for substitution cypher-Version”

unused Base64 (dummy) data

Copyright © 2023 N.F.Laboratories Inc.

The code exists in v0.5.9,
but it does not work,
probably due to a memory
manipulation error.

45

Updates for memory command (2022/4)

v0.6.2

Support for 64-bit shellcodenCheck the first byte of shellcoden

In case of 0x8D, replace with 0xE9
and execute as 64bit shellcode

Copyright © 2023 N.F.Laboratories Inc.

46

Locale environment check (2022/4)
No Locale checkCodev0.6.2

ja-JP checken-US check

snip.

snip.

snip.

snip.

Later v0.6.2
MD5 hash

016a974e70bbce6161862e0ac01a0211

da1c9006b493d7e95db4d354c5f0e99f

ff71fadc33b883de934e632ddb4c6b78

Summary

Execute subsequent processes without
checking locale information

If the locale is not ja-JP, this function
loops infinitely.

If the locale is en-US, this function loops
infinitely. (also used in v0.6.3 ~)Behavior varies between v0.6.2 samples☛

Same version does not always work the same

Copyright © 2023 N.F.Laboratories Inc.

47

v0.6.3

Changes in commands (2022/6)

Implemented commands

Removed commands from this version
commands

descriptioncommands

descriptionls

list files and directories

commandreturn available commands listrm

remove fileconfignot implemented (return "Not available")

mv

move file

cd

change current directory

cp

copy filesend

download filecat

upload file to CnC

recv

upload file to CnC

mkdir

make directory

memoryinject shellcode into svchost.exe

keylogenable keylogger

killkill processps

get process informationverreturn version information

pkill

kill target process

print

take screenshot

autorunenable/disable persistence

ransomencrypt filecomc

execute command using WMI

Available commands: 21 => 11

Copyright © 2023 N.F.Laboratories Inc.

48

v0.6.3

Changes in execution flow 1 (2022/6)
SFX & DLL Side-Loading

Side-Loading
XOR Decode
Extract

1.docx

Display Decoy

K7SysMn1.dll

K7SysMon.Exe

Exec.

on memory

LODEINFO

Copyright © 2023 N.F.Laboratories Inc.

49

v0.6.3

Changes in execution flow 2 (2022/6)
SFX & DLL Side-Loading& BLOB

Side-Loading
Extract

4.docxK7SysMon.Exe.db K7SysMn1.dll

K7SysMon.Exe

Exec.

Display Decoy

on memoryXOR Decode

LODEINFO

Copyright © 2023 N.F.Laboratories Inc.

50

Detailed changes for v0.6.5 (2022/6)

v0.6.5v0.6.5v0.6.3

Implementation of pseudo sleep function by inserting useless code

Copyright © 2023 N.F.Laboratories Inc.

51

Detailed changes for v0.6.5 (2022/6)

v0.6.5v0.6.5v0.6.3

Keep calculating SHA256 of random
string until random time elapses

Implementation of pseudo sleep function by inserting useless code

Copyright © 2023 N.F.Laboratories Inc.

52

v0.6.5

New execution flow (2022/6)
shellcode2vba.py

Although the execution flow was changed fromDLL Side-Loading, the threat is not difficult to
detect because of using a well-known toolhttps://github.com/DidierStevens/DidierStevensSuite/blob/master/shellcode2vba.py

VBA shellcode downloader was reported
as new LODEINFO execution flow
https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/

Copyright © 2023 N.F.Laboratories Inc.

53

v0.6.5

New execution flow (2022/6)
Exec.

Download

winword.exe
Exec.

decoy.doc

CnC sever
11554.htm

Start.

blob.tmp
Read &
Decodeon memory

msiexec.exe

on memory

Exec. shellcode

malicious vba

Downloader

Injection

LODEINFO

Side-Loading is no longer done, and it fails to achieve persistence of LODEINFO RAT
These changes seem to be spur-of-the-moment rather than permanent☛

Phase of trial for evasion, the TTPs can change significantly in the future.

Copyright © 2023 N.F.Laboratories Inc.

54

Insight into Threat Actor

Copyright © 2023 N.F.Laboratories Inc.

55

Insights from TTPs changes in v0.6.3
nEvolved to a 3-point set method frequently used by Chinese APT groups『Legitimate executable + DLL shellcode loader + Encrypted BLOB』

☛
p
p
p

n

PlugX
ShadowPad
HUI Loader

In particular, the attack technique using sfx files
is very similar to the APT10 attack casereported in May 2018https://www.lac.co.jp/lacwatch/people/20180521̲001638.html

Copyright © 2023 N.F.Laboratories Inc.

56

Insights from TTPs changes in v0.6.3
Appearance of decoy filen

Evolved to a 3-point set method frequently used by Chinese APT groups『Legitimate executable + DLL shellcode loader + Encrypted BLOB』

☛
p
p
p

n

Ref.: Decoy file for v0.5.9

PlugX
ShadowPad
HUI Loader

In particular, the attack technique using sfx files
Ascasewith LODEINFO,
is very similar to the APT10 attack
some of thereported in May 2018translation andappearance is crude

https://www.lac.co.jp/lacwatch/people/20180521̲001638.html

there any special features in☛ Are
the decoy file?
Copyright © 2023 N.F.Laboratories Inc.

57

Investigation of decoy file information
We found 6 LODEINFO decoy files from VirusTotal.
DLL shellcode loader

Decoy file#
MD5

Version

MD5

Remark1

e7c9d5568ed5c646c410e3928ab9a093

v0.3.5c031b786cb0a7479cc72d299dab2f0e3

N/A

2

327d8070a583bdecc349275b1f018dce

v0.3.6bca533b3336240bc5cc68117408debdf

N/A3

e6979fdd5f92d68cbbf06889f52f4f32

v0.5.6

1871402d3c83b2e15bf516d754458bd4

N/A

4

cb2fcd4fd44a7b98af37c6542b198f8d

v0.5.9da20ff8988198063b56680833c298113

N/A

5

a8220a76c2fe3f505a7561c3adba5d4av0.6.3

bfb70a586ad1a60509dcea8839132662

Enclosed in sfx file626892038ab19c44ba55c84b20083cdbd

v0.6.3025aa0aeb7ed182321bc21e5c9f44fc4

Enclosed in sfx file

Copyright © 2023 N.F.Laboratories Inc.

58

Investigation of decoy file information
show only timestamps of each file#

First Submission
Time for DLL (JST)DLL shellcode loader

Decoy fileCompilation
Timestamp (JST)VersionCreation Time (JST)Last Modified
Time (JST)1

2020/05/20 (Wed) 14:49

2009/02/20 (Fri) 23:27

v0.3.52020/05/18 (Mon) 11:08

2020/05/19 (Tue) 12:07

2

2020/05/26 (Tue) 18:00

2009/02/21 (Sat) 03:25

v0.3.62020/05/25 (Mon) 12:25

2020/05/26 (Tue) 16:20

32021/11/09 (Tue) 14:55

2019/01/04 (Fri) 17:18

v0.5.62021/08/26 (Thu) 15:37

2021/11/06 (Sat) 05:31

42022/03/07 (Mon) 16:15

2021/04/16 (Fri) 02:40

v0.5.92021/08/26 (Thu) 15:37

2022/03/03 (Thu) 21:21

52022/06/17 (Fri) 20:53

2021/08/19 (Thu) 02:58

v0.6.32022/06/14 (Tue) 11:43

2022/06/14 (Tue) 11:47

62022/07/07 (Thu) 21:00

2021/10/24 (Sun) 01:46

v0.6.32022/07/04 (Mon) 14:01

2022/07/04 (Mon) 14:01

Copyright © 2023 N.F.Laboratories Inc.

59

Investigation of decoy file information
The date and time of the first observation in VirusTotal andthe last modified time of the decoy file are almost identical.
#

First Submission
Time for DLL (JST)DLL shellcode loader

Decoy fileCompilation
Timestamp (JST)VersionCreation Time (JST)Last Modified
Time (JST)1

2020/05/20 (Wed) 14:49

2009/02/20 (Fri) 23:27

v0.3.52020/05/18 (Mon) 11:08

2020/05/19 (Tue) 12:07

2

2020/05/26 (Tue) 18:00

2009/02/21 (Sat) 03:25

v0.3.62020/05/25 (Mon) 12:25

2020/05/26 (Tue) 16:20

32021/11/09 (Tue) 14:55

2019/01/04 (Fri) 17:18

v0.5.62021/08/26 (Thu) 15:37

2021/11/06 (Sat) 05:31

42022/03/07 (Mon) 16:15

2021/04/16 (Fri) 02:40

v0.5.92021/08/26 (Thu) 15:37

2022/03/03 (Thu) 21:21

52022/06/17 (Fri) 20:53

2021/08/19 (Thu) 02:58

v0.6.32022/06/14 (Tue) 11:43

2022/06/14 (Tue) 11:47

62022/07/07 (Thu) 21:00 2021/10/24 (Sun) 01:46

v0.6.32022/07/04 (Mon) 14:01

2022/07/04 (Mon) 14:01

Copyright © 2023 N.F.Laboratories Inc.

60

Investigation of decoy file information
The date and time of the first observation in VirusTotal andthe last modified time of the decoy file are almost identical.
#

First Submission
Time for DLL (JST)DLL shellcode loader

Decoy fileCompilation
Timestamp (JST)VersionCreation Time (JST)Last Modified
Time (JST)2009/02/20 (Fri) 23:27

1

2020/05/20 (Wed) 14:49

v0.3.52020/05/18 (Mon) 11:08

2020/05/19 (Tue) 12:07

2

2020/05/26(Tue)
2009/02/21 (Sat) in
03:25
v0.3.6Seems
to 18:00
be concentrated
the time

2020/05/25 (Mon) 12:25

2020/05/26 (Tue) 16:20

32021/11/09 (Tue) 14:55

2021/08/26 (Thu) 15:37

2021/11/06 (Sat) 05:31

42022/03/07 (Mon) 16:15

2021/08/26 (Thu) 15:37

2022/03/03 (Thu) 21:21

2022/06/14 (Tue) 11:43

2022/06/14 (Tue) 11:47

2022/07/04 (Mon) 14:01

2022/07/04 (Mon) 14:01

range which humans are awake.
2019/01/04 (Fri) 17:18

v0.5.6

5

Surface information of2021/04/16 (Fri) 02:40
v0.5.9decoys has not beenfalsified!?
2022/06/17 (Fri)
20:53 2021/08/19(Thu) 02:58
v0.6.362022/07/07(Thu) for21:00use
2021/10/24(Sun) 01:46
Potentialin analysis☛

v0.6.3Copyright © 2023 N.F.Laboratories Inc.

61

Investigation of author/editor of decoy file
Authors and editors vary across decoys, and It is assumed that several people are
creating information in different environments.
Decoy file#
Creation Time (JST)AuthorLast Modified
Time (JST)LastModifiedBy

1

2020/05/18 (Mon) 11:08

John

2020/05/19 (Tue) 12:07

D3vle02

2020/05/25 (Mon) 12:25

D3vle02020/05/26 (Tue) 16:20

user

3

2021/08/26 (Thu) 15:37

D3vle0pc

2021/11/06 (Sat) 05:31

D3vle0pc

4

2021/08/26 (Thu) 15:37

D3vle0pc

2022/03/03 (Thu) 21:21

D3vle0pc

52022/06/14 (Tue) 11:43

Windows ユーザー

2022/06/14 (Tue) 11:47

Windows ユーザー

6

2022/07/04 (Mon) 14:01

user

2022/07/04 (Mon) 14:01

user

Copyright © 2023 N.F.Laboratories Inc.

62

Investigation of author/editor of decoy filen

The decoy file used in v0.6.3 (*1) has the string“Windows ユーザー”(*2) in the office document
propertyp

It seems to be the default value, but rare
because usually the host's username is to be set(*1) MD5: bfb70a586ad1a60509dcea8839132662(*2) the word “ユーザー” is "user" in English

Copyright © 2023 N.F.Laboratories Inc.

63

Search and check with VirusTotal
Only 30 docx files with ”Windows ユーザー” in the surface information in 3 months

tag: Specifying docx files by tag
metadata: Searching against file metadata

After about 6 months of monitoring, only 94 files were found, indicatingthat this initial value is unusual
Copyright © 2023 N.F.Laboratories Inc.

64

Environments where “Windows ユーザー” appear

The initial value is set in older Japaneseversions of Office 2016 and earlier☛

The attacker may be using thesame environment used in thepast operations.

Copyright © 2023 N.F.Laboratories Inc.

65

Further investigation with VirusTotal
When limited to those judged to be malicious by AV scans,the number of cases decreased to 2 in 3 months.

p: The number of malicious judgements
by AV scan

Attack groups using old Office versions in Japanese language environments to create
decoy files could be very rare.

Copyright © 2023 N.F.Laboratories Inc.

66

Further investigation with VirusTotal
When limited to those judged to be malicious by AV scans,the number of cases decreased to 2 in 3 months.

p: The number of malicious judgements
by AV scan

APT10ʼs decoy files reported in May 2018

Copyright © 2023 N.F.Laboratories Inc.

67

Collection of samples containing “Windows ユーザー”
13 samples were observed under the conditions described above, 11 of which were attributed to APT groups.
MD5First Submission
Time for VT (JST)Submission Filename

Creation Time (JST)Last Modified Time(JST)

c965bcc3b2bc3d54bc93121ae46eb0b0

2017/11/29 (Wed) 15:33

防衛省からの情報提供（最新版）
2.docm2017/11/29 (Wed) 15:33

2017/11/29 (Wed) 15:33

797b450509e9cad63d30cd596ac8b608

2018/01/10 (Wed) 16:18

2018年度（平成30年度）税制改正について.doc, 1.docx

2018/01/09 (Tue) 12:56

2018/01/09 (Tue) 13:25

57228e857180205643a0e1c1b43a5c3f

2018/01/23 (Tue) 13:45

test.doc

2018/1/18 (Thu) 13:45

2018/01/18 (Thu) 13:50

fefaa0df12195fc3d90d9393ad3a7840

2018/01/30 (Tue) 13:55

世界経済アウトルック.doc

2018/01/29 (Mon) 18:41

2018/01/29 (Mon) 18:55

9706c9b6c5133c2a9be5a67da069b97f

2018/02/01 (Thu) 13:41[MD5 hash value]

2017/11/29 (Wed) 15:33

2017/11/29 (Wed) 15:33

b7b97eb5a297e8371b6964a83f4650da

2018/02/01 (Thu) 13:45

lmane.doc

2017/11/29 (Wed) 15:33

2017/11/29 (Wed) 15:33

95b862f508bd2473012065947abc2eb3

2018/03/12 (Mon) 18:36

新旧参与会議意見書の比較.doc

2018/03/09 (Fri) 18:05

2018/03/09 (Fri) 18:09

e0b9a79d594e5a05a83e450e7a27637b

2018/04/03 (Tue) 17:08

test.doc

2018/04/03 (Tue) 16:47

2018/04/03 (Tue) 16:47

f82fbfb10958eb37e0d570c66c180c1b

2018/04/03 (Tue) 19:03

1.docx2018/01/09 (Tue) 12:56

2018/01/09 (Tue) 13:25

82f65647ff02fb0f13880f9158acfbcd

2018/04/26 (Thu) 18:50【6月26日（火）】 「三極委員会東京
地域会合」ご案内2.doc.docm

2018/04/26 (Thu) 18:49

2018/04/26 (Thu) 18:49

56cbbea8535c0e8ae967fcdec17db491

2018/05/24 (Thu) 08:02

確認資料 国際法務.doc

2018/05/15 (Tue) 09:45

2018/05/15 (Tue) 13:06

Copyright © 2023 N.F.Laboratories Inc.

68

Collection of samples containing “Windows ユーザー”
13 samples were observed under the conditions described above, 11 of which were attributed to APT groups.
MD5First Submission
Time for VT (JST)Submission Filename

Creation Time (JST)Last Modified Time(JST)

c965bcc3b2bc3d54bc93121ae46eb0b0

2017/11/29 (Wed) 15:33

防衛省からの情報提供（最新版）
2.docm2017/11/29 (Wed) 15:33

2017/11/29 (Wed) 15:33

2018年度（平成30年度）税制改正について.doc, 1.docx

2018/01/09 (Tue) 12:56

2018/01/09 (Tue) 13:25

test.doc

2018/1/18 (Thu) 13:45

2018/01/18 (Thu) 13:50

世界経済アウトルック.doc

2018/01/29 (Mon) 18:41

2018/01/29 (Mon) 18:55(Wed) 16:18
All 11 decoy files2018/01/10
used in57228e857180205643a0e1c1b43a5c3f
2018/01/23(Tue) in
13:45
APT10 operations
reported
fefaa0df12195fc3d90d9393ad3a7840
2018/01/30 (Tue) 13:55
May 2018
797b450509e9cad63d30cd596ac8b608

2018/02/01 (Thu) 13:41[MD5 hash value]

2017/11/29 (Wed) 15:33

2017/11/29 (Wed) 15:33

b7b97eb5a297e8371b6964a83f4650da

2018/02/01 (Thu) 13:45

lmane.doc

2017/11/29 (Wed) 15:33

2017/11/29 (Wed) 15:33

95b862f508bd2473012065947abc2eb3

2018/03/12 (Mon) 18:36

新旧参与会議意見書の比較.doc

2018/03/09 (Fri) 18:05

2018/03/09 (Fri) 18:09

test.doc

2018/04/03 (Tue) 16:47

2018/04/03 (Tue) 16:47

1.docx2018/01/09 (Tue) 12:56

2018/01/09 (Tue) 13:25【6月26日（火）】 「三極委員会東京
地域会合」ご案内2.doc.docm

2018/04/26 (Thu) 18:49

2018/04/26 (Thu) 18:49

確認資料 国際法務.doc

2018/05/15 (Tue) 09:45

2018/05/15 (Tue) 13:06☛

9706c9b6c5133c2a9be5a67da069b97f

Possibly reused environment
e0b9a79d594e5a05a83e450e7a27637b
2018/04/03 (Tue) 17:08
used by APT10 in the past
f82fbfb10958eb37e0d570c66c180c1b
due to changes in2018/04/03
TTP (Tue) 19:03
82f65647ff02fb0f13880f9158acfbcd
2018/04/26 (Thu) 18:50(Moderate Confidence)
56cbbea8535c0e8ae967fcdec17db491

2018/05/24 (Thu) 08:02

Copyright © 2023 N.F.Laboratories Inc.

69

Diamond model for LODEINFO campaign
AdversaryppBelieved to be China state-backed
There are likely to be members
associated with APT10

Social-Politics Axisp

Capabilitiesp

Custom Malware(LODEINFO/
MirrorFace)

Motivated to Attack Japanese
Economic Organizations

Technical Axis
Infrastructurep

VPS/Hosting service(Vultr/CHOOPA/LINODE)p

Spear-phishingp

DLL Side-LoadingpJapanese decoy filepUsing custom RAT

p

Use of IPs belonging to Japan

Victimsp

Japanese defense, diplomatic, politics and media

Copyright © 2023 N.F.Laboratories Inc.

70

Relation to Operation RestyLinkn

Attack campaigns targeting Japan observed
since around Oct. 2021
p
p

p

n

Target sectors: academic (energy), think-tank
spearphishing emails lead to a URL with amalicious file
The attacker is not attributed.

J-CRAT reported LODEINFO emails spoofing theorganization attacked by Operation RestyLink

https://www.ipa.go.jp/files/000106897.pdf“2.1” => Operation RestyLink

Copyright © 2023 N.F.Laboratories Inc.

71

Spearphishing emails that may be relevantJapan Productivity Center (Aug. 4th, 2022)

Center for International
Economic Collaboration(Aug. 10th, 2022)

snip.
snip.

https://www.jpc-net.jp/news/detail/20220804̲005992.html

https://www.cfiec.jp/2022-08-07/

We guess that the attacker are sending emails to people and organizations interested ineconomics, defense, and diplomacy.
Copyright © 2023 N.F.Laboratories Inc.

72

Comparison of Diamond Models
LODEINFO
Campaign

Social-Politics Axis
Interest in a wide range ofJapanese foundationspAdversary
Capabilities
Custom
Malware(LODEINFO/
MirrorFace)p

Spear-phishingp

DLL Side-LoadingpJapanese decoy filepUsing custom RAT

p

Use of IPs belonging to
Japan

p

Believed to be China
state-backedpThere are likely to bemembers associatedwith APT10

Social-Politics Axisp

CapabilitiesppJapanese diplomacy in East Asia
(Also interested in politics and defense?)

Adversary

Downloader(LNK file,Multiple document,
Golang binary)

VPS/Hosting service(Vultr/CHOOPA/LINODE)p

Victimsp

Japanese defense, diplomatic,
politics and media

Believed to be based in
East Asia?

p

Cobalt Strike

Infrastructure

Infrastructure

Technical Axisp

Operation
RestyLink ([11])pTechnical Axis

VPS/Hosting service(Vultr/CHOOPA/LINODE)p

Spear-phishingp

OpenRestyp

DLL Side-LoadingpMimicking domain namep

Microsoft word startuppJapanese decoy filep

Use of IPs belonging toJapan

Copyright © 2023 N.F.Laboratories Inc.

VictimsppJapanese company
Diplomatic field(academic, think-tank)73

Comparison of Diamond Models
Social-Politics Axis

LODEINFO
Campaign

Interest in a wide range ofJapanese foundationspAdversary
Capabilities
Custom
Malware(LODEINFO/
MirrorFace)p

Social-Politics Axisp

Japanese diplomacy in East Asia
(Also interested in politics and defense?)

Capabilities

Adversary

DownloaderpBelieved to be China(LNK file,state-backed
Multiple document,p
There are likely to be
Golang binary)
While the specific tools used are different,pBelieved to be based in
East Asia?

pmembers associatedwithseen
APT10 in the TTPs Cobalt
similarities can be
and Strikeareas of target interest

Technical Axisp

Spear-phishingp

DLL Side-LoadingpJapanese decoy filepUsing custom RAT

pOperation
RestyLink ([11])p☛

Use of IPs belonging toJapan

Infrastructure

InfrastructurepTechnical Axis

VPS/Hosting
serviceRelevantorganizations
urgently need to be able
(Vultr/CHOOPA/LINODE)
Spear-phishing
to detect and defend against thesetechniques
DLL Side-LoadingpVictimsp

Japanese defense, diplomatic,
politics and media

VPS/Hosting service(Vultr/CHOOPA/LINODE)pp

OpenRestypp

Mimicking domain namep

Microsoft word startuppJapanese decoy filep

Use of IPs belonging toJapan

Copyright © 2023 N.F.Laboratories Inc.

VictimsppJapanese company
Diplomatic field(academic, think-tank)74

Limitation and Conclusion

Copyright © 2023 N.F.Laboratories Inc.

75

Limitation for open-source based researchnnFall behindpMalware samples must be posted on the Internet to be investigatedp

In many cases context is lost.

p

Difficult to follow if TTPs change significantly

Without external intelligence source and contacts to gather and analyze
information, only piecemeal research is possible.
p

It is essential to try to understand the entire campaign as much as possible.

p

There is a limit to what one organization can do...

Copyright © 2023 N.F.Laboratories Inc.

76

Difficulty in takedown

Taking down the attacker infrastructure is thepreferred means of getting ahead of attackers.
......but very difficultnAttackers choose infrastructures that are
difficult to take down.

nEven in cases where the message wasreceived from LINODE, the case did not
result in a takedown.

Copyright © 2023 N.F.Laboratories Inc.

77

Difficulty in takedownnDifficult to prove that it is a Localized
Targeted RAT infrastructure in the first
place
p

p

n

Even if the service providers are positive
about takedown, they cannot take actions
without hard evidences
What is the evidence of LODEINFO CnC
server that even a layman can understand 🤔

We will continue to report of abuse,
but the effect of such reports is unknown.

Copyright © 2023 N.F.Laboratories Inc.

78

What we can do against the LODEINFO threatnGenerators of Intelligence: provide real-time threat intelligence by monitoring open-sourcepReproducible IoCs and signatures (“ACT”)

nConsumers of Intelligence: Build an organization for effective use of intelligencep

Can you detect intrusion based on hash values or network artifacts?

p

Can you evaluate signatures in your organization? Can it be incorporated?

ppWhat type of logs are being obtained?
How long can the investigation be traced back to?

The Sliding Scale of Cyber Security(SANS: 『The Sliding Scale of Cyber Security』, Figure 1)
https://www.sans.org/white-papers/36240/

Copyright © 2023 N.F.Laboratories Inc.

79

Tips: Control DLLs by AppLockernUseful as a means of preventing
DLL Side-Loading from signed
executablespnMethodology for users who
do not add software frequently

DLL execution by LOLBAS can
also be preventedprundll32.exe

pregsvr32.exe

Copyright © 2023 N.F.Laboratories Inc.

80

ConclusionnSharing about the latest LODEINFO campaignppn

New insight into attribution analyzed from a decoy file perspective

Introduction of CTI and analysis methods based on open-sourcepn

The TTPs have been changed to those frequently used by Chinese APT groups
in v0.6.3

Despite the limitations of the research, threat intelligence relevant to yourorganization may be available more quickly than in vendor reports.

Necessary of building an organization for effective use of intelligencepp

Efforts to take the best possible steps
Know your organization properly

Copyright © 2023 N.F.Laboratories Inc.

81

Any Questions?

Copyright © 2023 N.F.Laboratories Inc.

82

References (1)n[1] JPCERT 『Malware “LODEINFO” Targeting Japan』(2020/02/27)
https://blogs.jpcert.or.jp/en/2020/02/malware-lodeinfo-targeting-japan.htmln[2] JPCERT 『Evolution of Malware LODEINFO』(2020/06/19)
https://blogs.jpcert.or.jp/en/2020/06/evolution-of-malware-lodeinfo.htmln[3] JPCERT 『Further Updates in LODEINFO Malware』(2021/02/18)
https://blogs.jpcert.or.jp/en/2021/02/LODEINFO-3.htmln[4] macnica & T5 『標的型攻撃の実態と対策アプローチ 第5版 日本を狙うサイバーエスピオナージの動向 2020 年度』(2021/05/21)
https://www.macnica.co.jp/business/security/manufacturers/files/mpressioncss̲ta̲report̲2020̲5.pdf

n[5] macnica, 『Tracking rapid evolution? Copycat? of An APT RAT in Asia』, VB2020, (2020/09)
https://vb2020.vblocalhost.com/uploads/VB2020-66.pdf

Copyright © 2023 N.F.Laboratories Inc.

83

References (2)n[6] kaspersky 『 APT10 HUNTER RISE ver3.0: Repel new malware LODEINFO, DOWNJPIT and LilimRAT』,
HITCON 2021, (2021/11)
https://hitcon.org/2021/agenda/6d88317b-4d90-4249-ba87d81c80a21382/APT10%20HUNTER%20RISE%20ver3.0%20Repel%20new%20malware%20LODEINFO%20DO
WNJPIT%20and%20LilimRAT.pdfn[7] macnica & T5 『標的型攻撃の実態と対策アプローチ 第6版 日本を狙うサイバーエスピオナージの動向 2021年度』(2022/06/15)
https://www.macnica.co.jp/business/security/cyberespionage̲report̲2021̲6.pdf

n[8] kaspersky, 『 APT10: Tracking down LODEINFO 2022, part I』 (2022/10/31)
https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-in[9] kaspersky, 『 APT10: Tracking down LODEINFO 2022, part II』 (2022/10/31)
https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-iin[10] eset 『Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities』(2022/12/14)
https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanesepolitical-entities/

Copyright © 2023 N.F.Laboratories Inc.

84

References (3)n[11] NTT Security 『Operation RestyLink: APT campaign targeting Japanese companies』(2022/5/13)
https://insight-jp.nttsecurity.com/post/102hojk/operation-restylink-apt-campaign-targeting-japanesecompaniesn[12] IPA『サイバーレスキュー隊（J-CRAT）活動状況 [2022年度上半期] 』(2022/12/28)
https://www.ipa.go.jp/files/000106897.pdfn[13] LAC, 『 APT攻撃者グループ menuPass(APT10) による新たな攻撃を確認』 (2018/5/21)
https://www.lac.co.jp/lacwatch/people/20180521̲001638.html

Copyright © 2023 N.F.Laboratories Inc.

85

Appendix A: IoC - file hash (1)TypeVersionb50d83820a5704522fee59164d7bc69bea5c834ebd9be7fd8ad35b040910807f

dll

v0.1.2

1cc809788663e6491fce42c758ca3e52e35177b83c6f3d1b3ab0d319a350d77d

shellcode

v0.3.2

8c062fef5a04f34f4553b5db57cd1a56df8a667260d6ff741f67583aed0d4701

dll

v0.3.565433fd59c87acb8d55ea4f90a47e07fea86222795d015fe03fba18717700849

dll

v0.3.6641d1e752250d27556de774dbb3692d24c4236595ee0e26cc055d4ab5e9cdbe0

doc

v0.3.573470ea496126133fd025cfa9b3599bea9550abe2c8d065de11afb6f7aa6b5df

doc

v0.3.63fda6fd600b4892bda1d28c1835811a139615db41c99a37747954dcccaebff6e

dll

v0.4.6

f142eecf2defc53a310b3b00ae39ffecc1c345527fdfbfea8ccccd0d69276b41

dll

v0.4.92169d93f344e3f353444557b9009aef27f1b0a0a8aa3d947b5b8f0b36ef20672

dll

v0.5.6d75537d59954ec3cc092378f00b16b6c9935590ef1074cb308e1ed65e922762c

dll

v0.5.61dbf67d7dadba5505073aaf3e4478dd295b074bddf10ac5ac7b80d7fc14bea63

dll

v0.5.6

fc602ebcf5f9697bedae0e641adfc16985058212f7b9e69dad0f1bf53daf93f9

doc

v0.5.6

SHA-256

Copyright © 2023 N.F.Laboratories Inc.

86

Appendix A: IoC - file hash (2)SHA-256

Type

Version978ba248c02eb9c130c1459b767527f8a3a9714c6686c12432e027da56f6c553

dll

v0.5.9dab7d79644453a7ca61b9b585c1081167dbe5df0da398df2458c1081295f68e6

dll

v0.5.950cf6841cbc0ce395a23b9a4d2ddac77b11a376929878717e90c9a7430feddc3

dll

v0.5.988efbc6e883336a0b910b7bcf0ef5c2172d913371db511a59a4a525811173bf1

dll

v0.5.9e764f26c3e5bf8467da51fbb33c3d80f026b8fe5bd5a6b84318b3f0aedb667cd

dll

v0.5.9fde82dcccd471b63f511c6f76dc04e12334818cda8b38f5048b8ad85c9357089

doc

v0.5.9a5cf580c1768bb8d28716978fa026b7e2dec4eb5a9c4396ede0c704bfe09ed36

dll

v0.5.9Copyright © 2023 N.F.Laboratories Inc.

87

Appendix A: IoC - file hash (3)SHA-256

Type

Version40a650488e94455b181716efba43f082e891e1c6e45d3f1e5ab827de319276c9

dll

v0.6.25738bf7b27c61c1421b08be98143ab3bc32b779a45d5350f40f689bf268489ed

dll

v0.6.2

9af72a598dc4a1e10265dcf7da20d6433a9473a338e2fc012f4e490ad721d871

dll

v0.6.2

7f32df11846b0a5b4d43d8ce1f7ddcebf9aef6d568ba210534a0b9e246d6561edll

v0.6.20abbdee5d3c5191bfb9a3a91712d8b538d6d8a0cc0489b3e5aa10034b2fccd3c

dll

v0.6.2

5faa813b811236f14fec8e0e7ee9d0135efaf296d6dcb4bd2be8cf3165fa940d

dll

v0.6.231c87d9a84c7996a56024c93787de9332099faf707cd8d0166e5af9d491977b8

dll

v0.6.2

f53c5fd78000755ccfff11d2f1b7d659f4a71c887083697d54b8fe8cf905ef6a

sfx

v0.6.3a8ec766eee6cc3c6416519f8407ac534f088637ed1a6bc05ed0596d8a0237548

sfx

v0.6.3a5ce5a179ec56aa6e2bc86be77df07b15650cdbcbca046515263fe16b8e2a036

dll

v0.6.38260b1e80eeff2e0b39f782eebfa9460b00ebef480c3fed6fbccf8cfc67dbef9

loader

v0.6.3ed82f4fff39fbdcbefdbcb0a9c9ae6fb689f6db64f94bd8eb6c924fd0409792c

XORed shellcode

v0.6.38f51b5bdb9b7234426fa8fdfbfac9eb46d650c6a22c9ed49ab8f0fc09e5d76a5

XORed shellcode

v0.6.5

Copyright © 2023 N.F.Laboratories Inc.

88

Appendix A: IoC - network
LODEINFO CnC Server
45.67.231[.]169

45.76.216[.]40

45.77.28[.]124

162.244.32[.]148

103.140.45[.]71

172.105.223[.]216

193.228.52[.]57

139.180.192[.]19

103.175.16[.]39

103.27.184[.]27

167.179.84[.]162

172.104.112[.]218

103.140.187[.]183

167.179.65[.]11

202.182.108[.]127

103.204.172[.]210

130.130.121[.]44

5.8.95[.]174

133.130.121[.]44

118.107.11[.]135

172.104.72[.]4

167.179.101[.]46

172.105.230[.]196

www.amebaoor[.]net

167.179.112[.]74

172.104.78[.]44

www.evonzae[.]com

172.105.232[.]89

108.61.201[.]135

www.dvdsesso[.]com

194.68.27[.]49

139.162.112[.]40

Copyright © 2023 N.F.Laboratories Inc.

89

Appendix B: MITRE ATT&CK (1)TacticTechniqueID

Procedure

Resource Development

Acquire Infrastructure: Server

T1583.004

Using Hosting service for CnC server.

Initial Access

Phishing: Spearphishing
Attachment

T1566.001

Delivery by spearphishing email.

Execution

Windows Management
Instrumentation

T1047

Execute commands using wmi(comc command)

Execution

Command and ScriptingInterpreter: Visual Basic

T1059.005

VBA Macro embedded in documents
are executed and malicious DLL wasdropped.

Execution

User Execution: Malicious File

T1204.002

User opens malicious document andinfected

Persistence

Boot or Logon Autostart
Execution: Registry Run Keys /Startup Folder

T1547.001

Sets a value in Registry Run Keys.

Copyright © 2023 N.F.Laboratories Inc.

90

Appendix B: MITRE ATT&CK (2)TacticTechniqueID

Defense Evasion

Hijack Execution Flow: DLL SideLoading

T1574.002

Legitimate executables Side-Load
LODEINFO DLL file.

Defense Evasion

Obfuscated Files orInformation: Dynamic API
Resolution

T1027.007

Windows API was resolved by hashsuch as CRC32 and JShash.

Defense Evasion

Obfuscated Files orInformation: Embedded Payloads

T1027.009

Encrypted shellcode was embedded in
malicious DLL file.

Defense Evasion

Deobfuscate/Decode Files orInformation

T1140

Encrypted configuration was embedded
in LODEINFO malware.

Defense Evasion

Process Injection

T1055

Injects shellcode into svchost.exe.
(memory command)

Copyright © 2023 N.F.Laboratories Inc.

Procedure91

Appendix B: MITRE ATT&CK (3)TacticDiscovery

Technique
System Location
Discovery: System Language
Discovery

ID

T1614.001

Procedure
Got language information about thetarget's environment and modify its
behavior.

Discovery

System Information Discovery

T1082

Steals system information such as MAC
address, ANSI code and computer
name.

Discovery

File and Directory Discovery

T1083

The ability to list files and directories is
implemented. (ls command)

Collection

Archive Collected Data: Archive via
Library

T1560.002

Collected data was compressed with
QuickLZ.

Collection

Screen Capture

Collection

Input Capture: Keylogging

T1113

Take snapshots. (print command)

T1056.001

Keylogging functionality has been
implemented.
(keylog command)

Copyright © 2023 N.F.Laboratories Inc.

92

Appendix B: MITRE ATT&CK (4)TacticTechniqueID

Procedure

Command and Control

Application Layer Protocol: Web
Protocols

T1071.001

Using HTTP for communication with the
CnC server

Command and Control

Encrypted Channel: Symmetric
Cryptography

T1573.001

Communication with the CnC server
was encrypted by AES.

Command and Control

Data Encoding: Non-Standard
Encoding

T1132.002

Using customized Base64 algorithm forcommunication.

Exfiltration

Exfiltration Over C2 Channel

T1041

Uploads any file to CnC server.
(recv command)

ImpactData Encrypted for Impact

T1486

Encrypts files and directories.
(ransom command)

ImpactData Destruction

T1485

Deletes any directory or file.
(rm command)

Copyright © 2023 N.F.Laboratories Inc.

93

Appendix C: RAT Commands list (~ 2022)
commanddescription

v0.3.2v0.3.5v0.3.6v0.4.6v0.4.9v0.5.6

〇

〇

〇

〇

〇

〇

print

Take a screenshotrm

Delete file

〇

〇

〇

〇

〇

ransomEncrypt file

△

△

〇

〇

〇

keylogEnable keylogging

△

△

〇

〇

〇

ps

Get process list

〇

〇

〇

pkill

Kill process

〇

〇

〇

mv

Move file

〇

〇

cp

Copy file

〇

〇

mkdir

Make Directory〇〇

autorunSets persistence setting

〇

comc

Executes OS commands using wmi〇

config

Not yet implemented△△ : Not yet implemented（return strings, “Not Available”）

Copyright © 2023 N.F.Laboratories Inc.

94

Appendix D: Scripts

n Decryption scripts for CnC communication+n IDAPython scripts for API Hash resolution
and shellcode triage.

All scripts => https://github.com/nflabs/aa̲tools/tree/main/lodeinfo

Copyright © 2023 N.F.Laboratories Inc.

95