Report on APT Attacks byBlackTech

NTT Security Holdings Corporation
Japan SOC

Objective of Report
NTT Security Holdings Corporation Japan Security Operation Center provides
Managed Security Service (MSS). We monitor our client systems round-theclock, find security incidents promptly and provide best solutions. We perform
various research on latest threats and output the achievements as black lists,
custom signatures and Indicators of Compromise (IoCs). These knowledges arealso used by our SOC analysts.
Our SOC has been monitoring attacks by one of well-known APT groups,
BlackTech. Though many organizations have been reported the malware usedby BlackTech, our SOC publishes this whitepaper discussing the latest attacks
by BlackTech based on the actual attacks we monitored in 2021. We expect that
this whitepaper contributes to better defense against attacks from BlackTech.

1

Table of Contents
Objective of Report ........................................................ 1
Preface........................................................................ 3
1. Introduction ............................................................. 4
2. Attack Overview ........................................................ 5
2.1.

Spear Phishing ................................................................................. 5

2.2.

Vulnerability Exploitation (on server) ........................................................ 7

2.3.

Malware Families ............................................................................... 8

3. Malware Analysis ...................................................... 9

4.
5.
6.
7.
8.

3.1.

Flagpro ........................................................................................... 9

3.2.

SelfMake Service ..............................................................................13

3.3.

SelfMake Loader ..............................................................................14

3.4.

HeavyROT Loader ............................................................................17

3.5.

AresPYDoor ....................................................................................22

3.6.

Spider RAT .....................................................................................24

3.7.

BTSDoor ........................................................................................31

3.8.

Gh0stTimes ....................................................................................33

3.9.

TSCookie .......................................................................................37

3.10.

ELF_TSCookie ................................................................................41

3.11.

IamDown........................................................................................44

3.12.

ELF_Bifrose ....................................................................................49

3.13.

ELF_PLEAD....................................................................................53Countermeasures .................................................... 57
Postface ................................................................ 59
About Report.......................................................... 60
References ............................................................ 61
Appendix ............................................................... 632

Preface
NTT Security Holdings Corporation Japan Security Operation Center has beenmonitoring active attacks from APT group BlackTech. This report covers thefollowing topics on the attacks based on our research.

⚫

Summary of attacks by BlackTech focusing on their initial attack vector,
that are spear phishing emails and exploiting server vulnerabilities.

⚫

Result of analysis on the malware used by BlackTech.

⚫

Consideration on the logic to protect from attacks by BlackTech.

Appendix contains the list of hash values that we obtained during our research.
This would help to prevent infection or isolate the victims.

3

1. Introduction
It is known that APT group BlackTech (also called as Palmerworm, Red Djinn,
Earth Hundun or HUAPI) had started their activity at the latest 2012. They havebeen targeting organizations based in Eastern Asia, especially in Taiwan andJapan. Their main objective seems to steal sensitive information from target
organizations.
BlackTech utilizes various malware families. Some of them are publicly
available (Bifrose or Gh0st RAT) and others are self-developed (TSCookie or
PLEAD). They have kept developing new malwares, which means that they are
actively working.
Our SOC has observed attacks by BlackTech, but the number of attacks rapidly
increased around 2020. Our SOC has observed they repeatedly attacked several
organizations in telecommunication, defense and mass media industries. In
many cases, they established their initial foothold in overseas branch office ofJapanese companies, then intruded into mission critical system in headquarters.
It is highly probable that BlackTech keep targeting Japanese companies,
therefore implementing proper countermeasures both in remote office andheadquarters is required to protect from their attacks. This whitepaper reviews
and summarizes the BlackTech's attack campaigns and malware targeting
Japanese organizations that our SOC observed in 2021. We hope that thiscontent will help considering and implementing effective countermeasures toprotect each organization.

4

2. Attack Overview
Origins of BlackTech attacks targeting Japanese organizations are almost
either of below.

1. Spear phishing
2. Vulnerability exploitation (on server)

2.1. Spear Phishing
Most of the attacks we observed started with spear phishing. An attacker
sends an email pretended to be sent from a business partner to a user. As soon
as opening the attached file, the user is infected by malware. The mail body andattached file are so sophisticated that it is difficult for the user to feel odd at a
glance. Our SOC has observed attacks that leveraged real internal documentused in the target organization in the past.
The attached file was either an executable file with double file extension or
Microsoft Excel file in xlsm format. These files can be contained in an archive
file including RAR format. The archive file is password-protected, and thepassword is included in the mail body.
Our SOC had observed several xlsm files (also called as LAMICE [1]) andmacros embedded on them were very similar. This suggests that all of thesefiles were created by single tool.

5

Figure 1. Macro example BlackTech frequently uses

Interestingly, it is observed that APT group Blackgear had used very similar
macro during their attacks. This implies that the tool that generate this macro
could be shared among multiple APT groups or BlackTech and Blackgear areclosely related.

6

2.2. Vulnerability Exploitation (on server)
BlackTech has been abused various vulnerabilities in their attacks. According
to the blog article by JPCERT/CC [2], there were many tools that can exploit
various vulnerabilities on C&C server operated by BlackTech. It is also reported[3][4][5] that they had actually abused vulnerabilities on Microsoft Exchange
Server.
Successful exploitation results in malware execution. Using the malware, theattacker collects environmental information, repeats lateral movement, and go
deeper into the target organization. It is also observed that they use certain
malware family on different platforms. For example, they use ELF Bifrose on
Linux environment and PE Bifrose on Windows environment.

72.3. Malware Families
BlackTech utilize various malware families. The figure below summarizes themalware families that they use by attacking vectors.

Figure 2. Malware families used by BlackTech

8

3. Malware Analysis
3.1. Flagpro
Flagpro is malware used in initial phases of an attack to investigate a target
environment and download and execute further malware [6][7]. Flagpro (v1.0)
may have been used in attacks of October 2020, and the new Flagpro (v2.0)
using the MFC (Microsoft Foundation Class) library may have been used after
July 2021.

The main functions of Flagpro are as follows.
⚫

Download and execute tool.

⚫

Execute OS commands and send their results.

⚫

Collect of authentication information stored in Windows and exfiltrateof collected information.

3.1.1. Use of COM object
Flagpro uses IWebBrowser2 interface and other interfaces from Internet
Explorer’s COM object to handle access to and from a C&C server.

Figure 3. Use of COM object for external access93.1.2. Auto close of dialog
Flagpro automatically closes dialogs, which appear when accessing externalsites, such as proxy authentication confirmation dialogs. We assume that theauto-close function was implemented to keep users from realizing that Flagpro
has accessed an external site.

3.1.3. Inserting dummy codes
Flagpro is obfuscated by inserting dummy code repeatedly. The obfuscation
technique is often implemented in the malware used by BlackTech.

Figure 4. Insertion of dummy functions10

3.1.4. Control commands
Control commands received from C&C server are encoded in Base64. Decodedcommands used in Flagpro (v2.0) have the following format.

Figure 5. Flagpro command format

The Download Command format is shown in Figure 6, and consists of thestring “Exec”, “Yes”, and the URL path to the download site. The string “Exec” isan activity flag, which must be present in both Download Command 1 and 2 inFigure 5 for the main process such as downloading and executing OS commands
to take place. The string "Yes" is the execution flag; without it, the downloaded
file will not be executed.

Figure 6. Download Command format

3.1.5. C&C Communication
Flagpro uses HTTP protocol to communicate with C&C server. As shown in
Table 1, it switches the URL path for each communication purpose. In addition,
when this malware sends the results of OS commands execution and collectedauthentication information, the contents are encoded in Base64 format and sent
to the C&C server as URL parameter values.

11Table 1. The URL paths and queries for each communication purpose
URL path and query

Purpose/index.html

Requesting the control commands/index.htmld?flag=[Encoded Data]

Sending the results of OS commands
execution/index.htmld?flagpro=[Encoded Data]

Sending the authentication information

3.1.6. Indicators of Compromise (IoCs)⚫

⚫

⚫

URL path⚫

index.htmld?flag=[Base64 Encoded String]⚫

index.htmld?flagpro=[Base64 Encoded String]

File path⚫

%TEMP%\~MY[Uppercase Hexadecimal Value (16bit)].tmp⚫

%TEMP%\~MY[Uppercase Hexadecimal Value (16bit)].tmp.exe

Mutex
⚫

71564__40Fllk293_DD71_4715_A3177782516DB5__71564_⚫

71564__40Fllk293_DD71_4715_A55778278645__71564_⚫

71564__40Fllk293_DD71_4715_A317try516DB5__71564_

12

3.2. SelfMake Service
SelfMake Service is a loader that loads and executes malware on the infected
hosts. It is designed to run as Windows Service. Besides, according to the article[5], this loader executes SelfMake Loader described on the next section.

Some samples of SelfMake Service not only load and execute malware, but
also

kill

the

legitimate

splwow64.exe

process

andexecutemalicious

splwow64.exe that has been overwritten with the malware on the infected host.
The splwow64.exe is a file used by PrintSpooler, a Windows Service related toprinting.

Figure 7. Execute malicious splwow64 overwritten with malware

13

3.3. SelfMake Loader
SelfMake Loader is malware that loads and execute other malware [1][3]. It
has been reported that this malware executed Spider RAT. The name of
SelfMake Loader is derived from the strings “selfmake2” or “selfmake3” in themalware samples. One of the features is that this malware uses MFC (Microsoft
Foundation Class).

Figure 8. Code contains the string “selfmake2”

Figure 9. Code contains the string “selfmake3”

SelfMake Loader can be divided into two types based on the method of loading
malware. The first type is to load and execute malware located on the infected
host. The loader searches the following directories in order and executes thefirst malware it found.
⚫

Directory where the SelfMake Loader is executed⚫

C:\Program Files (x86)\Common Files
14

The other type is to download the malware from a C&C server tothe %TEMP%directory and execute the downloaded file. The file also includes
an XOR encoded configuration. This configuration is a pipe-delimited format andcontains domain and port number of the C&C server. The configuration format
is similar to Bifrose malware which BlackTech uses. This pipe-delimited
configuration is a common characteristic of BlackTech's malware.

Figure 10. Pipe-delimited configuration of SelfMake Loader

The following figure shows a file format that SelfMake Loader loads from theinfected host. The file which is downloaded from the C&C server is in a similar
format. The malware is XOR encoded and is decoded by a key contained in the
file.

Figure 11. File format that SelfMake Loader loads from an infected host15

In addition, based on the code similarities, we consider that the code of
executing the decoded data is used the one published on GitHub [8].
SelfMake Loader calls the following function several times. The following
function simply output a string using the printf function; that is to say, this is adummy code. BlackTech tends to utilize malware that contain such dummy code.

Figure 12. Dummy code of SelfMake Loader

16

3.4. HeavyROT Loader
HeavyROT Loader is a loader that downloads malware from a C&C server andexecutes it. There is a sample of this loader which downloads malware from thesame C&C server as SelfMake Loader and it would indicate the sample relates
to BlackTech. We named this malware HeavyROT Loader since it uses bit
rotation calculation for RC6 cryptographic algorithm or calculation of checksums,
as will be described later.

The malware communicates with C&C servers using HTTP, and Basicauthentication is implemented to the servers. The malware communicates withthe servers again with the flag enabled which ignores a certification error(ERROR_INTERNET_INVALID_CA)

in

case

this

error

occursin

HTTPS

communication. In addition, the malware gets the User Agent string from aninfected machine’s registry in order to set the string to an HTTP header.

Figure 13. Process of communication with C&C servers

17

The downloaded data from C&C servers contains encrypted PE data as well
as a seed for generating a decryption key. Furthermore, the malware calculates
the checksum before and after decrypting PE data and it halts processing if thechecksum does not match the downloaded data.

Figure 14. Downloaded data format

def calc_checksum(data):rol = lambda val, r_bits, max_bits=32: ¥(val << r_bits%max_bits) & (2**max_bits-1) | ¥((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))
result = 0
for byte_val in data:
result = rol(result,0xb) + byte_val
return result
Figure 15. Checksum calculation

18

The following figure shows how the malware generates a key for decryption
from a seed.

def calc_key(seed):val1 = (seed&1)|(seed<<16)&0xFFFFFFFF
val2 = (seed>>16)|(seed&0x00001000)
return ((val1<<8)&0xFFFFFFFF) | ((val2)>>8)&0xFFFFFFFF)
Figure 16. Process of generating decryption key from seed

It is notable that the malware extracts original PE file by using RC6 encryption(not decryption) routine after generating the key. Although there was no
theoretical evidence, we confirmed that the data encrypted by RC6 decryption
routine can be decrypted by RC6 encryption routine. We assume that the data
downloaded from a C&C server contained the encrypted data by RC6 decryption
routine, and the malware decrypted original PE file by RC6 encryption routine
to the encrypted data.

class RC6Const:
round = 16
blocksize = 64
def get_wordsize():
return RC6Const.blocksize // 2
def get_extend_s_len():return 2 * RC6Const.round + 4
rol = lambda val, r_bits, max_bits=32: ¥(val << r_bits%max_bits) & (2**max_bits-1) | ¥((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))
def init_S(key):s_len=get_extend_s_len()w=get_wordsize()
MOD = 2**w
encoded = [key]19

S=s_len*[0]S[0]=0xB7E15163
for i in range(1,s_len):S[i]=S[i-1]+0x9E3779B9
S[i]=S[i]%MOD
A=B=i=j=0
for _ in range(0,3*max(len(encoded),s_len)):
A = S[i] = rol((S[i] + A + B)%MOD,3,w)
B = encoded[j] = rol((encoded[j] + A + B)%MOD,(A+B)%w,w)
i = (i + 1) % s_len
j = (j + 1) % len(encoded)
return S
def rc6_encrypt(data,S):
r=RC6Const.roundw=get_wordsize()
MOD = 2**w
lgw = 5A = int.from_bytes(data[0:4],'little')
B = int.from_bytes(data[4:8],'little')
C = int.from_bytes(data[8:12],'little')
D = int.from_bytes(data[12:16],'little')
B = (B + S[0])%MOD
D = (D + S[1])%MODfor i in range(1,r+1):
t = rol(((B*(2*B + 1))%MOD),lgw,w)
u = rol(((D*(2*D + 1))%MOD),lgw,w)
A = (rol(A^t,u%w,w) + S[2*i])%MODC = (rol(C^u,t%w,w) + S[2*i+1])%MOD(A, B, C, D) = (B, C, D, A)
A = (A + S[2 * r + 2])%MODC = (C + S[2 * r + 3])%MOD
ret = [A,B,C,D]
return ret
def main():## set appropriate parameters
key = 0x68000010## set the key generated from seed in
downloaded data.
input_file = "encrypted.bin" ## set a inputdata filename.
output_file = "decrypted.bin" ## set a outputdata filename.
## initialize S
S = init_S(key)20

## decrypt
in_datas = open(input_file,"rb").read()i = 0
out_f = open(output_file,"wb")while i < len(in_datas):
in_data = in_datas[i:i+16]
decrypted = rc6_encrypt(in_data,S)for e in decrypted:
bin = e.to_bytes(4, byteorder="little")
out_f.write(bin)i=i+16
out_f.close()
if __name__ == "__main__":main()
Figure 17. Process of decrypting PE data

21

3.5. AresPYDoor
AresPYDoor is backdoor malware. It is said to be related to BlackTech,because the C&C server used by AresPYDoor has relation to it used by Bifrose,also BlackTech malware [17]. AresPYDoor is based on a Python RAT [9] releasedon Github under the name Ares and is converted to an executable file.

AresPYDoor uses the URL format shown in Figure 18 to access the C&C server
and receive commands.
(scheme)://(host)/api/(uid)/hello
Figure 18. URL format to receive commands

The uid is generated by the code in Figure 19.
import uuid, getpass
def get_UID(self):""" Returns a unique ID for the agent """return getpass.getuser() + '_' + str(uuid.getnode())
Figure 19. The code generates uid

The implemented commands are shown in Table 2.

22

Table 2. AresPYDoor commands
Command

Description

cd

Change the current directory

uploadUploaddownload

Download

persistEstablish persistenceclean

Remove persistenceexit

Terminate AresPYDoor processzip

Compress files or folders to a ZIP
archivepythonExecute Python codes

help

View help(Others)

Execute Shell commands

One of the characteristics of AresPYDoor is its multi-platform support. There
are several codes implemented to work on both Windows and Linux. As an
example, Figure 20 shows some of the persistence codes.

Figure 20. Multi-platform persistence commands

23

3.6. Spider RAT
Spider RAT is a RAT [1][4] executed by LAMICE or SelfMake Loader. There are
32-bit and 64-bit samples. Although they have some similarities, these functions
implemented in each sample are different. In this section, we will start with
32bit sample and continue with 64bit sample.

3.6.1. 32-bit
3.6.1.1. Configuration
The configuration is encoded by XOR, and its format is shown below.
IP1|PORT1|IP2|PORT2|IP3|PORT3|PROXYNAME|PROXYUSERNAME|PROXYPASS|SLEEPTIME|UNKNOWN_COLUMN|PERSISTENCE
Figure 21. Configration format

The observed sample had the following settings shown in Figure 22.

Figure 22. Spider RAT configuration

24

3.6.1.2. Embedded DLL file
We observed that there are two executable files (DLL files) embedded in
the .data section, one of which will later be edited and dropped in the persistent
phase.

The

behavior

of

these

DLL

files

is

to

execute“C:\Windows\System32\calc.exe". Although there are two embedded DLL files,
they have the same behavior.

Figure 23. DLL files embedded in Spider RAT

3.6.1.3. Characteristic strings
The characteristic strings, shown in Figure 24, can be seen in the debug
output. Such strings are also seen in 64-bit samples.

Figure 24. The characteristic string in Spider RAT

25

3.6.1.4. Persistent behavior
Three persistent behaviors described below can be specified depending on thevalue of PERSISTENCE in the configuration. In this case, the sample was set not
to run these persistent behaviors.
⚫

Using the Registry Run key➢ Spider RAT copies itself to c:\users\public\downloads\schmet.exe.
➢ Spider RAT set the full path as the value of “Ofice” subkey in
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key.

Figure 25. The persistence using the Run key

26

⚫

Using DLL Search Order Hijacking in OneDrive➢ Spider RAT copies itself to “C:\programdata\schost.exe”.
➢ Spider RAT replaces the string ”C:\Windows\System32\calc.exe” in theembedded DLL files of .data section with “C:\programdata\schost.exe”.
➢ Spider RAT writes its binary to
c:\Users\USERNAME\AppData\Local\Microsoft\OneDrive\FileSyncFl
wb.dll➢ Spider RAT relaunches OneDrive with the following command“cmd /c taskkill /f /im onedrive.exe”➢ The

malicious

FileSyncFlwb.dll

will

be

loadedtoexecute“C:\programdata\schost.exe”, which is replaced to Spider RAT.

Figure 26. The persistence using DLL search order hijacking

27⚫

Using the Registry key HKCU\Environment\UserInitMprLogonScript➢ Spider RAT copies itself to c:\users\public\downloads\mpetect.exe.
➢ Spider

RAT

set

the

full

path

as

the

value

of

HKCU\Environment\UserInitMprLogonScript key.
➢ When user logs into Windows, replaced malicious mpetect.exe will be
executed.

Figure 27. The persistence using
HKCU\Environment\UserInitMprLogonScript28

3.6.1.5. Control Commands
Control commands implemented in Spider RAT 32-bit sample are shown in
Table 3. The pair of offset values 0x4 and 0x8 in the received data determine
each command.

Table 3. Control commands of 32-bit Spider RAT
Offset 0x4

Offset 0x8

Description

0

2

Reconnecting

1

1

Launching PowerShell

1

10

Terminating PowerShell

1

11

Executing PowerShell Command

1

2

Launching PowerShell

1

20

Terminating PowerShell

1

21

Executing PowerShell Command

20

Terminating FileManager

2

1

Launching FileManager

2

6

Downloading file2

7

Uploading file2

8

Renaming file2

9

Sending list of files

2

100

Deleting file29

3.6.2. 64-bit
We also observed 64-bit samples, and their implementation is simple
compared with 32-bit sample. The 64-bit samples use multi-threads approachfor processing. However, we have confirmed that some threads have noprocessing content. We assume that some features will be implemented in the
future.

3.6.2.1. Characteristics
The configuration of 64-bit samples do not have specific structure like 32-bit
one, but information such as C&C server is hard-coded. In addition, there aresome characteristic strings that are also found in 32-bit in the debug output.

Figure 28. The characteristic strings in 64-bit sample

3.6.2.2. Control Commands
Control commands implemented in 64-bit Spider RAT are shown in Table 4.
The pair of offset values 0x4 and 0x8 in the received data determine eachcommand.
Table 4. Control commands of 64-bit Spider RAT
Offset 0x4

Offset 0x8

Description

1

1

Executing command

3

0

－

3

1

Downloading and Executing file30

3.7. BTSDoor
BTSDoor is backdoor malware [6]. It has been observed that Flagpro
downloaded and executed this backdoor. The name of BTSDoor is derived fromthe pdb pathname BTSWindows.

Figure 29. PDB path of BTSDoor

Before BTSDoor receives commands, it sends the following information about
the infected host to the C&C server. The traffic is encrypted with AES.

⚫

IP address⚫

Computer name⚫

Username⚫

Windows OS version⚫

Process ID of BTSDoor

31

BTSDoor implements the following commands. The traffic is encrypted with
AES as is the case with sending information about the infected host.

Table 5. List of BTSDoor commands
Command ID

Description

0x20

Upload a file

0x22

Release the semaphore of the file upload
thread

0x30

Open the handle of file download

0x31

Download a file

0x33

Close the handle of file download

0x39

Execute command through ShellExecuteW

0x40

Return the string "Not implemented!"

0x41

Return the string "N"

0x50

Start a Command Prompt process

0x51

Kill the Command Prompt process

0x52

Send commands to the Command Prompt

0x53

Release the semaphore of the Command
Prompt thread

0xA1

Terminate the BTSDoor process323.8. Gh0stTimes
Gh0stTimes is customized based on the leaked Gh0st RAT source code andhas been used in some attack cases since early 2020 [2].

3.8.1. Feature Enhancement and Code Reuse
Gh0stTimes adds the feature to communicate with the C&C server byimplementing the new CPortmapManager and CUltraPortmapManager classes.
In addition, Gh0stTimes implements features such as file operations(CFileManager class) and remote shell execution (CShellManager class) that arereused from Gh0stRAT.

Figure 30. Added the feature to communicate with the C&C server

33

3.8.2. Dummy Code Insertion
Gh0stTimes repeatedly inserts dummy code to make analysis difficult.
BlackTech frequently uses this type of obfuscation technique.

Figure 31. Inserted dummy code34

3.8.3. Control Commands
Gh0stTimes equips control commands for each function, such as file operation
and remote shell execution [2]. Additionally, this malware supports somespecific commands for file operations.
Table 6. Control commands of Gh0stTimes
Command ID

Description

0x0

Communication termination

0x1

File operation (CFileManager)

0x28

Remote shell execution (CShellManager)

0x32

C&C server redirect function (CPortmapManager)

0x3F

Proxy function (CUltraPortmapManager)

Table 7. File operation commands
Command ID

Description

0x2

Retrieve a file list (SendFilesList)

0x3

Upload a file (UploadToRemote)

0x4

Download a file (CreateLocalRecvFile)

0x5

Download a file (WriteLocalRecvFile)

0x7

Upload a file (SendFileData)

0x8

Stop file transfer (StopTransfer)

0x9

Delete a file (DeleteFile)

0xA

Delete a folder

0xB

Set transfer mode (SetTransferMode)

0xC

Create a folder (CreateFolder)

0xD

Rename a file (Rename)

0xE

Execute a file (OpenFile (SW_SHOW))

0xF

Execute a file (OpenFile (SW_HIDE))

35

3.8.4. C&C Communication
Gh0stTimes uses a proprietary TCP protocol to communicate with the C&C
server. At the beginning of its communication to the C&C server, Gh0stTimes
sends an authentication ID and data for generating encryption key. If theauthentication ID is not correct, authentication fails. The encryption key isgenerated by processing the data sent from the victim host, which is provided
at the beginning of the communication. Afterward, Gh0stTimes sends/receives
control commands that are encrypted with custom RC4 algorithm (RC4 + XOR
0xAC) and compressed with zlib.

36

3.9. TSCookie
TSCookie is a downloader that downloads TSCookie Loader and TSCookie RAT[11]. The downloaded files are encoded. Therefore, TSCookie decodes themafter loading them on memory, then it executes them. It exists two versions ofTSCookie, Windows and ELF binary version. This section describes a Windows
version, and the next section explains an ELF binary version. The behaviors of
TSCookie Loader and TSCookie RAT can be checked in JPCERT/CC blog posts[10][11].

3.9.1. Decrypting DLL
Executing TSCookie leads to load RC4-encrypted data on memory. The data
exists in the resource section of TSCookie. Afterwards, it will be decrypted as a
DLL file. The decrypted DLL contains dummy codes like other BlackTech’s
malware.

Figure 32. Inserted dummy code37

After executing the decrypted DLL, it will connect to a C&C server. The
configuration, which includes destinations of C&C server, is hard-coded in thesample, and its structure is almost the same as the samples reported by
JPCERT/CC [11].

3.9.2. Downloading Loader
TSCookie connects to the C&C server using HTTP GET method to download a
TSCookie Loader. When TSCookie downloads TSCookie Loader, it will send RC4encrypted data to the C&C server. JPCERT/CC reported that their samples
inserted the encrypted data into the Cookie header [11]. Whereas, our sample
inserted the data into the URL path.

Figure 33. GET request to download the loader

URL path is replaced by swprintf() based on format string. TSCookie splits theencrypted data into two parts, and the split position is decided by random
number. The URL path of HTTP GET request is as follows:

Description①, ②

Randomized 32bit integer③, ⑤

Randomized lowercase alphabets④

Former part of encrypted data⑥

Latter part of encrypted data

Figure 34. URL path format

38

The structure of the original data, which means the sending data before
encryption, has been changed since the existing report from JPCERT/CC [11] asfollows:

Table 8. Structure of sending data before encryption by GET request
OffsetLengthContents

0x00

4Four bytes hex value created fromsystem information

0x04

4

0x10050017

0x08

4

0x1E9CE6A

0x0C

4

0x04

0x10

4

Four bytes hex value created fromsystem information

This download activity will not execute if the first four bytes of the response
data do not match to the hard-coded value in the sample.

39

3.9.3. Downloading modules
After downloading TSCookie Loader, TSCookie downloads its modules. HTTP
POST method is used for downloading the modules. TSCookie inserts the RC4
encrypted data into the BODY part. The Date header value is used as the RC4
key.

Figure 35. POST request to download the modules

This POST request also works as heartbeat and is sent around every 50
seconds. However, if the first four bytes of the response does not match to thehard-coded value in the sample, the POST request will not be sent from the next
request.

40

3.10. ELF_TSCookie
This section explains ELF version of TSCookie (ELF_TSCookie) [14].
ELF_TSCookie contains same functions as Windows version. However, thefunctions are limited.
The samples, which we found, target not only Linux environment users, butalso FreeBSD ones. We assume that the attacker uses the different version of
TSCookie depending on the target's environment.
The command values of our samples have changed from the values reported
by JPCERT/CC [12]. This JPCERT/CC report provides the detailed analysis resultof the past samples.

3.10.1. Characteristics
The results of “file” and “readelf” commands are as follows:

Figure 36. File information of ELF_TSCookie

The “file” command result shows that it is static-linked file, and the “readelf”
command result indicates that this malware could be compiled in olddevelopment environment. It seems that attackers would like to evadeenvironmental problems.

41

As JPCERT/CC has already reported [12] that information about C&C servers
is inserted as plain text. ELF_TSCookie copies the information onto allocatedmemory space and encrypts it with RC4. The encrypted information will be usedin later process.

Figure 37. Inserted plain-text information

ELF_TSCookie sends the host information to the C&C servers. The information
contains TSCookie PID, IP address, hostname, and login username.
The code to obtain the host information is shown in Figure 38. It may beintended to get the result of “uname” command, but it has a wrong option “a00”. Hence the command will be failed, and the result will not be sent.

Figure 38. Collecting infected host information

42

3.10.2. Control Commands
ELF_TScookie commands are listed in Table 9. No major changes of thecommands have been observed since JPCERT/CC had published its analysis
result [12].
Table 9. ELF_TSCookie command list
Command

Description

0x7200AC03

Launch remote shell

0x7200AC04

Send commands to remote shell

0x7200AC05

Terminate remote shell

0x7200AC07－

0x7200AC0B

Send fixed number

0x7200AC0C

Send file list

0x7200AC0D

Download file

0x7200AC0E

Upload file

0x7200AC10－

0x7200AC11

Terminate process

0x7200AC13

Remove file (rm -rf)

0x7200AC16

Move file/Change file name

0x7200AC1A

Execute command43

3.11. IamDown
IamDown is a malware that downloads and executes another malware. It has
been used since at least 2014. We call this malware “IamDown” because thestring “i am mutex!” is inserted into this malware and this is a downloader
malware.

Figure 39. Inserted string “i am mutex!”

IamDown, which has been found, has some common characteristics. We will
explain those characteristics from next section.

3.11.1. Hard-coded characteristic strings
The hard-coded strings such as “i am mutex!”, the C&C server domains, anda Mutex value are embedded in IamDown. We assume that this malware hassome relationships between Poison Ivy, because the Mutex value of
IamDown ”)!VoqA” is same as the head of the default Mutex value of Poison
Ivy ”)!VoqA.I4” [13].

443.11.2. Sending data
IamDown uses Socket for communicating with the C&C server with TCP/443
port. The first 16 bytes data is the fixed value.

Figure 40. Packet capture of the sending data

3.11.3. Receiving data
IamDown sequentially checks the received data from head. If the data
matches the condition, Socket will close, and if not, the data procedure willcontinue as shown in Figure 41.

45

Figure 41. Checking received data

3.11.4. On-memory execution (Fileless)
IamDown executes the downloaded data on a new thread in the same process.
This means that the data is not stored as a file on the infected host.

46

Figure 42. Executing downloaded data on memory47

3.11.5. API Hash
APIs such as CreatMutexA and Socket related ones are obfuscated using Hashvalue.

Figure 43. Using API hash48

3.12. ELF_Bifrose
We will explain about ELF version of Bifrose (ELF_Bifrose). Our sample does
not exist big differences from the past reported samples [14].

3.12.1. Characteristics
The results of “file” and “readelf” commands is shown in Figure 44. The
samples were compiled in an old environment and statically linked. It seems
that attackers would like to evade environmental problems.

Figure 44. File information of ELF_Bifrose49

3.12.2. Sending data
ELF_Bifrose encrypts and sends the following data at the first communication
to the C&C server:⚫

IP address⚫

Hostname⚫

PID

Figure 45. Sending data to C&C server of ELF_Bifrose

As JPCERT/CC reported [15], ELF_Bifrose leverages RC4 encryption. Someminor differences in the encryption handling exist depending on the samples.

50

Figure 46. RC4 encryption handlingAn example of the first sending data is shown in Figure 47. ELF_Bifrosecommunicates with port 80,443, and 8080, but it uses Socket connection
rather than the HTTP(S) protocol.

51

Figure 47. Example of sending data to C&C server

3.12.3. Control Commands
After sending the data, ELF_Bifrose receives commands from the C&C server.
The implemented commands are in Table 10. The commands have not beenchanged significantly from the existing samples [14].

Table 10. ELF Bifrose command list
Command

Description

0x15

Send randomized data

0xC6

Terminate process

0xF7

Send command to remote shell

0xF8

Terminate remote shell

0xF6

Launch remote shell

0x82

Send fixed value

0x83

Send file list

0x84

Send file attribution

0x85

Download file

0x86

Upload file

0x87

Close file

0x89

Create directory

0x8A

Delete file

0x8B

Delete directory52

3.13. ELF_PLEAD
We will explain about ELF version of PLEAD (ELF_PLEAD). JPCERT/CC
reported the detailed analysis result about the existing samples [16]. However,
we will show the analysis result of newly observed samples in this report.

3.13.1. Characteristics
The results of “file” and “readelf” command are shown in Figure 48. The
samples were compiled in an old environment and statically linked. It seems
that attackers would like to evade environmental problems.

Figure 48. File information of ELF_PLEAD

3.13.2. Configuration
ELF_PLEAD encrypts configuration with RC4 as existing samples does. Figure
49 shows an example of the decrypted configuration. The first 32 bytes datain the Figure 49 is the RC4 key, and after the key follows the configuration.
The configuration size is 0x1AA. As the following configuration indicates that a
private IP address is set as the destination. In addition, the uncommon
destination port 29678 is configured. From these settings, we assume that thisconfiguration was adapted to the targeted company that had already been
intruded.

53

Figure 49. Decoded configuration of ELF_PLEAD

3.13.3. Control Commands
The implemented commands are as follows:

Table 11. Group number 0 command list
Command

Description

4

Send randomized data

5

Reconnect

6

Restart7

Terminate8

Terminate

9

Change Socket

10

Change connection destination

54

Table 12. Group number 1 (CFileManager) command list
Command

Description

0

Send file list

5

Send file attribution

7

Change file name9

Delete file/directory11

Upload file13

Execute file17

Create directory

19

Move file

21

Delete directory

Table 13. Group number 2 (CFileTransfer) command list
Command

Description

0

Send file attribution

3

Create directory

6

Download file

7

Send file information

11

Upload file

Table 14. Group number 3 (CRemoteShell) command list
Command

Description0

Launch remote shell

2

Launch remote shell

5

Change current directory

7

Terminate remote shell

9

Send file list

12

Delete directory55

Table 15. Group number 4 (CPortForwardManager) command list
Command

Description2

Setup proxy

4

－

6

Send proxy data

8

－

10

Connect proxy12

Terminate proxy56

4. Countermeasures
BlackTech has two main attack vectors. The first is an attack method
originates from spear phishing emails. The second is an attack method exploits
server vulnerabilities.
The best way to defend against spear phishing emails is to avoid opening
suspicious emails, links or files. BlackTech attacks with emails and attachmentsthat are spoofed as if they were clients of the target. It is possible to preventthe attack by carefully checking the sender email address, the text of emails,
and the double extensions of attachments. In addition, the installation of email
security products is also an effective measure. Our SOC has observed that theseproducts have detected spear phishing emails by BlackTech.
To defend against exploitation of server vulnerabilities, we recommend that
applying the latest update programs or the latest security patches. Furthermore,
the installation and the properly operation of network security products andendpoint security products are also effective measure. Even if your organization
were initially accessed by such threat actor, these products will detect later
behaviors. Our SOC has created custom signatures to detect such behaviors,
and in some cases, we have been able to minimize the damage by detecting
and quarantining them. Although BlackTech is actively developing new malware,
its attack techniques have not changed much. Thus, it is important to build
detection logics against them.
In both attack vectors as we mentioned, BlackTech targets vulnerable areasof the target organization. In particular, overseas offices tend to be attacked byBlackTech. Even if your organization’s critical infrastructure is managed in aclosed network, BlackTech will examine all possible paths to penetrate it, identify
where are vulnerable areas, and attempt to compromise them. Hence, proper
management of your organization’s systems is important.
Furthermore, BlackTech is known to repeatedly attack against the same57

targeted organization. Even if BlackTech intruded once, or even if intrusions
were prevented, your organization’s systems still have risk to be attacked over
and over. We recommend keeping up with the latest attack trends and taking
measures properly and quickly.

58

5. Postface
NTT Security Holdings Corporation Japan Security Operation Center has
conducted research activities for the prevention of security incidents and early
detection when they occur. In particular, we have actively investigated andanalyzed on targeted attacks for clue to consider countermeasures against
further sophisticated attack.
In this report, we provided a walkthrough of BlackTech’s activities based on
the cases we observed in 2021. BlackTech has extremely actively attacked
against Japanese organizations repeatedly, and it can be continued. Our SOC
will continue to research BlackTech.
IoCs are listed in the Appendix. We hope you will find it useful.

596. About Report
Authors:
NTT Security Holdings Corporation Japan SOC
Shogo Hayashi, Fumio Ozawa, Hajime Takai, Nobuyuki Amakasu,
Rintaro Koike, Ryuichi Tanabe, Yuta Sawabe, Sachito Hirao
Translators:
NTT Security Holdings Corporation Japan SOC
Ryu Hiyoshi, Hisayo Enomoto, Mikuru Bansho, Naoki Kubota, Ryuichi Tanabe

Release:April 20th, 2022 (Ver1.0) : Original Japanese version released
April 27th, 2022 (Ver1.1)
September 26th, 2022

: English version released60

7. References[1]

TrendMicro, "Ambiguously Black: The Current State of Earth Hundun's

Arsenal", https://jsac.jpcert.or.jp/archive/2022/pdf/JSAC2022_8_hara_en.pdf[2]

JPCERT/CC, "Malware Gh0stTimes Used by BlackTech “,

https://blogs.jpcert.or.jp/en/2021/10/gh0sttimes.html[3]

SEQRITE, "Everything you need to know about the Microsoft Exchange

Server Zero-Day Vulnerabilities", https://www.seqrite.com/blog/4898-2/[4]

Deep Learning for Cybersecurity, "Blue Hexagon Security Advisory:

Microsoft Exchange Server 0-days", https://medium.com/deep-learning-forcybersecurity/blue-hexagon-security-advisory-microsoft-exchange-server-0days-83f49d528d34[5]

FREEBUF, "利用 Exchange 漏洞入侵安插后门，小心数据泄露",

https://www.freebuf.com/articles/system/303176.html[6]PwC, "Back to Black(Tech): an analysis of recent BlackTech operations

and an open directory full of exploits",
https://vblocalhost.com/uploads/VB2021-50.pdf[7]

NTT Security Holdings, " Flagpro: The new malware used by BlackTech", https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malwareused-by-blacktech[8]

GitHub, "abhisek/Pe-Loader-Sample", https://github.com/abhisek/Pe-

Loader-Sample[9]

GitHub, "sweetsiftware/Ares", https://github.com/sweetsoftware/Ares[10] JPCERT/CC, "Malware Used by BlackTech after Network Intrusion",
https://blogs.jpcert.or.jp/en/2019/09/tscookie-loader.html[11] JPCERT/CC, "Malware “TSCookie”",
https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html[12] JPCERT/CC, "ELF_TSCookie - Linux Malware Used by BlackTech",https://blogs.jpcert.or.jp/en/2020/03/elf-tscookie.html

61

[13] Volatility Labs, "Reverse Engineering Poison Ivy's Injected CodeFragments",
https://volatility-labs.blogspot.com/2012/10/reverse-engineering-poisonivys.html[14] マクニカネットワークス, "標的型攻撃の実態と対策アプローチ 第 4 版 日本を狙うサイバーエスピオナージの動向 2019 年度下期",
https://www.macnica.co.jp/business/security/manufacturers/files/mpressionc
ss_ta_report_2019_4.pdf[15] TeamT5, "中國駭客 HUAPI 的惡意後門程式 BiFrost 分析",https://teamt5.org/tw/posts/technical-analysis-on-backdoor-bifrost-of-theChinese-apt-group-huapi/[16] JPCERT/CC, "ELF_PLEAD - Linux Malware Used by BlackTech",https://blogs.jpcert.or.jp/en/2020/11/elf-plead.html[17] ThreatBook, "东亚黑客组织 BlackTech 针对金融、教育等行业展开攻击",http://report.threatbook.cn/BL.pdf

62

8. Appendix
IOCs of malware associated with BlackTech are as follows.

Malware Samples
Hash value (SHA256)

e81255ff6e0ed937603748c1442ce9d6588decf6922
537037cf3f1a7369a8876
77680fb906476f0d84e15d5032f09108fdef8933bca
d0b941c9f375fedd0b2c9655ca39beb2413803af099879401e6d634942a169d2
f57eb30f96154a78b2ad5
e197c583f57e6c560b576278233e3ab050e38aa9424
a5d95b172de66f9cfe970
935e61aba8df5f6e80e001af0fa9c6a50c2cf50f406
8e9dd4277f2cd1297d95c
2657ca121a3df198635fcc53efb573eb069ff2535dc
f3ba899f68430caa2ffce
7da969010a55919aa66ed97a2d2d6d6a0be3d8dc615
1eeb6cebc15e4f06d4553
5a57c9d19c7fb42832085f88d92f9f57d64b1bca8f2
a19b0533a4caee1a792cc
3891fb7b3d1e5fc2d028ed3d0debe868189971b20eb
8edb295e2b8d2d0c1a02a
8bdfc1ed5bfec964050a42a0f1ddd8709fcf14fab1ede151c5a7161be904cd96
92c75df382218e7743359aa83b403e443550e766c84
74a59c9dcbd4903a4bf02
c2b23689ca1c57f7b7b0c2fd95bfef326d6a22c1508
9d35d31119b104978038b
8c3df0e4d7ff0578d143785342a8033fb6e76ce9f61
c2ea14c402f45a76ab118
dced553a6f835162f0515a41a330404466f3ca44bc4
3a2f8b5675ca28609c905
d196969b35966462fa03ef857e375e9d6172b34053b
115df04cefa3d673b9d85
ee6ed35568c43fbb5fd510bc863742216bba54146c6
ab5f17d9bfd6eacd0f796
85fa7670bb2f4ef3ca688d09edfa6060673926edb3d
2d21dff86c664823dd609
01581f0b1818db4f2cdd9542fd8d663896dc043efb6
a80a92aadfac59ddb7684

Description
FlagproFlagproFlagproFlagpro
SelfMake Loader
SelfMake Loader
SelfMake Loader
SelfMake Loader
SelfMake Loader
SelfMake Loader
SelfMake Loader
Spider RAT
Spider RAT
Spider RAT
Spider RAT
BTSDoor
BTSDoor
Gh0stTimes63

13c19132f7c0c2c02f4070eca9367bdf8ab2bf59c59
93c6e853584ac215857c7
638cfbe609d7f3e88767133be5ea5f9a75f1d703275
f38eb9ec2414e179483b9
0e0198d3409e8dccf2ba1eeed41f56e24b633188230
ed062a43fac0517e8da8f
3802fe08235724a1c8f68563aa1166e509aeb27c59c
008dccace5e2513b03375
994b294eac5d099392621e6c813694bc254a7d77471
7709ee3b67211df10d963
42416e73ebc0b776c726e6075fa73bb418f24b53b0b
2086141a2aba22301ec6a
d8500672e293ef4918ff77708c5b82cf34d40c440d5
a4b957a5dbd3f3420fdc4
0a06d4dc8d5be03cc932b74758f0004aeaa6cdf1480
6635b9452b5c4db900184
a914c729e4816fb49c8b9830694be385460c2cc366b
f1ab1410e84295cfa0946
0478fe3022b095927aa630ae9a00447eb024eb862db
fce3eaa3ca6339afec9c1
4549745d0bbc9b4c16c815927e7720258cd64bb3dcc
76e6f850c845d603cca13
a394250a66dede23931b9bb5d5aced5d32ab171b1f2
8382305d9c942859ef5d1
4dc515a288be6e64b006fe418c5477bd0982ce801e829d8299ee0eb949b20dc2
f32318060b58ea8cd458358b4bae1f82e073d1567b9
a29e98eb887860cec563c
4991c98c55bfa0b269b05b8e2f0944edb85ddc1d2ba
4dffe0cbf9a7b89a98911
76bf5520c19d469ae7fdc723102d140a375bb32f64b
0065470238e6c29ac2518
e4d837dc1a700bf71b218e41ed50abdbb2ba0352394
504a0cdaa12948d3daf2f

TSCookie
ELF_TSCookie
ELF_TSCookie
ELF_TSCookie
IamDown
IamDown
IamDown
IamDown
ELF_Bifrose
ELF_Bifrose
SelfMake Service
SelfMake Service
SelfMake Service
HeavyROT Loader
HeavyROT Loader
AresPYDOOR
ELF_PLEAD

64