mrmoor/cyber-threat-intelligence huggingface dataset:
Figure 1: Extra section .idata added to the original loadperf.dll  Figure 2: Extra imported function gzwrite64
The payload is a file named loadoerf.ini that contains decryption, run, and code injection functions.
When it is loaded by the system, DLLMain decrypts the payload via CryptUnprotectData.
Since the function highly depends on the actual “machine ID”, decryption on another machine that isn’t the original infected host is not viable, making malware analysis more difficult.
Figure 3: Part of the decryption function used in the payload
After decryption, partial code is run on the machine, which is then injected to svchost.exe (a key Windows component); payload is then loaded into memory.
Figure 4: Execution/infection flow of loadoerf.ini
How is GitHub abused?
Upon successful infection, the malware starts communicating with an HTML page from a repository stored in a GitHub project.
Figure 5: GitHub account hosting an HTML page used for C&C communication
Any malware threat analyst will immediately recognize Line 3 in the image above as a potential PlugX-encrypted line.
The beginning and end markers, DZKS and DZJS, are typical in PlugX. A closer look, however, shows that the decryption algorithm is different from PlugX.
In this case, decrypting them reveals references to its actual command and control (C&C) server: an IP address and a port number the malware will connect to.
Winnti currently uses different encryption algorithms to store those C&C references in the files they stored on Github.
Among them is an algorithm utilized by PlugX.
In fact, we found references to PlugX in the C&C strings we analyzed, indicating that the group may also be using the same backdoor in this particular campaign.
Although we were unable to find a PlugX sample through that particular GitHub, we surmise some PlugX variants in the wild use this GitHub repository to get their C&C information.
Nearly all the other algorithms used in this GitHub campaign are derived from the original PlugX algorithm:  PlugX style + shift string + Base64 PlugX style + shift string + Base64 + XOR PlugX style + Base64 + XOR  One algorithm is also built in mark strings + shift string + Base64 encoding.
Following Winnti's Trails The GitHub account used by the threat actor was created in May 2016.
It created one legitimate project/repository (mobile-phone-project) in June 2016, derived from another generic GitHub page.
The repository for Winnti’s C&C communications was created on August 2016.
We surmise that the GitHub account was not compromised, and instead created by Winnti.
By March 2017, the repository already contained 14 different HTML pages created at various times.
Timeline of the Campaign
We mapped Winnti’s activities for this campaign by analyzing the dates exposed in GitHub.
For each file, GitHub stores first-and-last commit timestamps; these enabled us to create a timeline of the first use of the group’s many C&C servers.
We monitored the period during which IP addresses were found connecting to Winnti’s C&C servers and found that they started their operations in the afternoon up to late evening.
The timetable resembles traditional working hours for cybercriminals, compared to those with less structure who prefer starting their days late, but also working until very late hours.
In fact, we only observed one instance of activity during the weekend, where a new HTML file was created.
The earliest activity we tracked on the GitHub account was from August 17, 2016, with the most recent in March 12, 2017.
Here is a timeline of when the C&C server’s IP addresses were first used, based on our monitoring: Figure 6: Timeline of the C&C server’s IP addresses C&C Servers
The GitHub account used by Winnti shows 12 different IP addresses, with various port numbers used for them.
All communication to these C&C servers are done on three different port numbers: 53 (DNS), 80 (HTTP), and 443 (HTTPS).
These are typical techniques PlugX and Winnti malware variants use to communicate between compromised machines and their C&C servers.
Nearly all the C&C servers are hosted in the U.S., while two are located in Japan.
C&C Server's IP Address Port Number 160[.]16[.]243[.]129 443 (HTTPS) 160[.]16[.]243[.]129 53 (DNS) 160[.]16[.]243[.]129 80 (HTTP) 174[.]139[.]203[.]18 443 (HTTPS) 174[.]139[.]203[.]18 53 (DNS) 174[.]139[.]203[.]20 53 (DNS) 174[.]139[.]203[.]22 443 (HTTPS) 174[.]139[.]203[.]22 53 (DNS) 174[.]139[.]203[.]27 53 (DNS) 174[.]139[.]203[.]34 53 (DNS) 174[.]139[.]62[.]58 80 (HTTP) 174[.]139[.]62[.]60 443 (HTTPS) 174[.]139[.]62[.]60 53 (DNS) 174[.]139[.]62[.]60 80 (HTTP) 174[.]139[.]62[.]61 443 (HTTPS) 61[.]195[.]98[.]245 443 (HTTPS) 61[.]195[.]98[.]245 53 (DNS) 61[.]195[.]98[.]245 80 (HTTP) 67[.]198[.]161[.]250 443 (HTTPS) 67[.]198[.]161[.]250 53 (DNS) 67[.]198[.]161[.]251 443 (HTTPS) 67[.]198[.]161[.]252 443 (HTTPS)   Figure 6: IP addresses used for C&C communication, and the port numbers they use
We have privately disclosed our findings to GitHub prior to this publication and are proactively working with them about this threat.
Abusing popular platforms like GitHub enables threat actors like Winnti to maintain network persistence between compromised computers and their servers, while staying under the radar.
Although Winnti may still be employing traditional malware, its use of a relatively unique tactic to stay ahead of the threat landscape’s curve reflects the increased sophistication that threat actors are projected to employ.
Related Hashes (SHA256) detected as BKDR64_WINNTI.ONM: 06b077e31a6f339c4f3b1f61ba9a6a6ba827afe52ed5bed6a6bf56bf18a279ba — cryptbase.dll 1e63a7186886deea6c4e5c2a329eab76a60be3a65bca1ba9ed6e71f9a46b7e9d – loadperf.dll 7c37ebb96c54d5d8ea232951ccf56cb1d029facdd6b730f80ca2ad566f6c5d9b – loadoerf.ini 9d04ef8708cf030b9688bf3e8287c1790023a76374e43bd332178e212420f9fb — wbemcomn.ini b1a0d0508ee932bbf91625330d2136f33344ed70cb25f7e64be0620d32c4b9e2 — cryptbase.ini e5273b72c853f12b77a11e9c08ae6432fabbb32238ac487af2fb959a6cc26089 — wbemcomn.dll        Tags  Malware | APT & Targeted Attacks | Endpoints | Research
We discovered a malware family called Maikspy — a multi-platform spyware that can steal users’ private data.
The spyware targets Windows and Android users, and first posed as an adult game named after a popular U.S.-based adult film actress.
Maikspy, which is an alias that combines the name of the adult film actress and spyware, has been around since 2016.
Our analysis of the latest Maikspy variants revealed that users contracted the spyware from hxxp://miakhalifagame[.]com/, a website that distributes malicious apps (including the 2016 adult game) and connects to its C&C server to upload data from infected devices and machines.
Multiple Twitter handles were found promoting the adult game called Virtual Girlfriend and sharing the malicious domain via short links.
Figure 1. Tweets that mention Virtual Girlfriend and the short link of hxxp://miakhalifagame[.]com/ Maikspy on the Android platform  Figure 2.
Infection chain of Maikspy Android variant
Based on the analysis of samples that were last seen in the wild in March 2018, the Maikspy variant (detected by Trend Micro as AndroidOS_MaikSpy.HRX) that runs on Android poses as Virtual Girlfriend to lure users into visiting the attackers’ malicious domain.
When users open the short link version of the domain shared on Twitter, a page that shows gender option buttons will appear followed by a page that will let users choose their “first girlfriend” and lead them to the download page.
Virtual Girlfriend’s option buttons (first and second screen from the left) and download page (third screen)
When the downloaded APK file is installed and launched, it will send the infected device’s Unix timestamp to 0046769438867, a phone number containing Sweden’s code.
This is presumably used for the device’s ID registration:  Figure 4.
Code snippet of the device’s Unix timestamp being sent to 0046769438867 Subsequently, the Maikspy-carrying app will display "Error: 401. App not compatible.
as an attempt to deceive the user into thinking that the app is already removed from the device.
However, the spyware just hides itself and runs in the background.
There, the malicious app first checks the required permissions and then proceeds with its routine:  Steal phone number Steal accounts Steal installed app list Steal contacts Steal SMS  The stolen information will be either written into .txt or .csv formats before being uploaded to the C&C server.
After fetching and uploading the abovementioned stolen data, the malicious app will check the command (CMD) from the C&C server every 60 seconds.
The following are the supported commands:  CMD Details startrecording Start recording the sound around the device stoprecording Stop recording uploaddata Upload /sdcard/DCIM,/sdcard/Downloads, /sdcard/Movies, /sdcard/Pictures, /sdcard/Documents files getnumber Get and upload phone number getclipboard Get and upload clipboard contents sms- Send SMS get- Get and upload dedicated files getcontacts Get and upload Contacts getinstalledapps
Get and upload installed APP list getmsgdata Get and upload received SMS getmsgdatasent Get and upload sent SMS getaccounts
Get and upload Accounts tree
Get and upload dedicated directory file list
In the first launch of Virtual Girlfriend, the malicious app will use a combination of the Unix timestamp, the device’s Bluetooth adapter name, and the name of user’s Twitter account as device identification name: Timestamp_BTAdapterName_TwitterAccount.
If the user doesn’t have the Twitter app, it will just be a null string (“”).
If the user has multiple Twitter accounts, the spyware will use the account where the user is logged in.
Code snippet of the process where the Unix timestamp, the device’s Bluetooth adapter name, and the name of user’s Twitter account are combined to produce a device identification name
Additionally, the spyware will open hxxp://miakhalifagame[.]com/get_access2[.]php when first installed.
It will display the page below.
The spyware displays the online dating scam website upon the installation of the malicious Virtual Girlfriend app What will be shown is the registration page of an online dating site, which will lure users into giving out their credit card information.
When users register, their credit cards will be charged.
This happens when the data is uploaded with the hidden iframe found in the bottom right part of the page (underlined in red).
As a result, the attackers behind the scheme will not only obtain the credit card information of the victim, but also steal any money charged to the credit card, so long as the user doesn’t request a chargeback.
Maikspy on the Windows platform  Figure 7.
Infection chain of Maikspy Windows variant  Figure 8.
These buttons greeted users who clicked the Twitter short link of hxxp://miakhalifagame[.]com/
In the case of the Windows variant (WORM_INFOKEY.A) of Maikspy last seen in April 2017, the user will be tricked into downloading a MiaKhalifa.rar file, which contains the files seen in the screenshot below:
Content of the MiaKhalifa.rar file README.txt provides instructions teaching the user how to turn off the anti-virus software and how to turn on the network, which the attacker needs to steal and upload data to its C&C server.
Content of README.txt register.bat is used to gain administrator privilege.
Code snippet of register.bat Uninstall.exe is a copy of the open-source hacking tool Mimikatz (https://github[.]com/gentilkiwi/mimikatz).
It has the ability to extract plaintext passwords, hash, PIN code, and Kerberos tickets from memory.
Here, Uninstall.exe is used to get the Windows account and password, and then writes the result to C:\Users\%username%\AppData\local\password.txt.
Setup.exe is the core module used to steal data.
Like the Android Maikspy, it first sends a notification to its C&C server to register the device.
Code snippet of notification being sent to the C&C server to register the device
After that, it fetches .jpg, .jpeg, .png, .txt, .wav, .html, .doc, .docx and .rtf files from the following directories: C:/Users/%username%/Desktop, C:/Users/%username%/Pictures, C:/Users/%username%/Documents, and C:/Users/%username%/Downloads.
File lists of the directories are also stolen.
Subsequently, it writes them into files before uploading it to the C&C server.
Code snippets of the scanning, fetching, and uploading of .jpg, .jpeg, .png, .txt, .wav, .html, .doc, .docx and .rtf files (left).
It also steal information about the machine’s system i.e. default browser, OS version, Firefox version, Chrome version, IE version and Network configuration (right).
We also stumbled upon a Chrome extension plugin (VirtualGirlfriend.crx) that Windows users can contract upon visiting hxxp://miakhalifagame[.]com.
When the extension plugin (BREX_INFOSTEAL.A) is downloaded, the victims will be instructed how to load it into the browser.
After that, the malware will collect the username and password inputs from web pages and sends it to hxxps://miakhalifagame[.]com/testinn[.]php.
Instructions given to the user on how to load the malicious Chrome extension  Figure 15.
Code snippet of the malicious extension plugin Connection between Round Year Fun and Maikspy
We looked into one of the Twitter accounts (seen in Figure 1) that promoted Virtual Girlfriend.
The name of the Twitter account is Round Year Fun (hxxps://twitter[.]com/RoundYear_Fun), and its homepage is full of tweets that promote games from hxxp://www[.]roundyearfun[.]org.
Twitter homepage of Round Year Fun hxxp://www[.]roundyearfun[.]org is a portal that promotes games on Twitter.
As seen in the figure below, it also has other games aside from Virtual Girlfriend.
Upon checking the cached version of the page, we discovered that it was also used to distribute the adult game first used by the attackers behind Maikspy.
Virtual Girlfriend in the list of games advertised by hxxp://www[.]roundyearfun[.]org  Figure 18.
The adult game first used by the attackers was also found in the list of games advertised by hxxp://www[.]roundyearfun[.]org Our analysis revealed that hxxp://www[.]roundyearfun[.]org was also used as a C&C address to save victims’ data.
The malware also shares the same certification with Virtual Girlfriend.
One of the samples was sourced from hxxp://roundyearfun[.]org/noavi/MiaKhalifa[.]apk.
Interestingly, we discovered an image that shows the logo of Round Year Fun, found at hxxp://miakhalifagame[.]com/img/ryf[.]jpg.
Figure 19. Round Year Fun logo found at Maikspy’s malicious domain
Based on these findings, it’s possible that the attackers behind Maikspy operate //www[.]roundyearfun[.]org/ and hxxp://miakhalifagame[.]com/.
Another thing that we discovered about the games offered by Round Year Fun is that if you authorize it to use your Twitter account, the author can use the account to promote games using automation tools.
The author used the other Twitter handle in Figure 1, rifusthegr8, to tweet about Virtual Girlfriend and retweet Round Year Fun’s own Twitter promotion of the game.
History of Maikspy from 2016 to 2018
The first variant of Maikspy appeared on the Windows platform in December 2016.
It disguised itself as the adult game named after an adult film actress.
It has the ability to update itself from hxxp://fakeomegle[.]com/, and steal .jpg, .jpeg, .png, .txt, .wav, .html, .doc, .docx and .rtf files located in the Desktop, Picture, Documents, and Downloads folders, as well as information about the machine’s Internet Explorer, Chrome, Firefox or default browsers, OS, and network configuration.
The spyware connects to 107[.]180[.]46[.]243.
Meanwhile, the first Android variant of this spyware family appeared in January 2017.
It was also under the guise of the previously mentioned adult game and still connects to the aforementioned C&C server.
It was capable of recording phone calls and stealing information such as the device’s location, SMS, contacts, WhatsApp database, and record sound around the affected device.
The next variant appeared quickly, and it added the following abilities to its routines: Steal information about the device’s clipboard, phone number, installed app list, and accounts.
Meanwhile, the ability to steal the WhatsApp database was removed.
It also changed its command format.
In March 2017, another new variant appeared with the ability to steal photos when users take them using the camera.
The code structure and package name also changed, as well as its C&C address: 198[.]12[.]155[.]84.
It was in April 2017 when the last Windows variant of Maikspy appeared with the following changes: The C&C server was changed to 198[.]12[.]155[.]84, password theft is added, as well as the theft of .doc, .docx, and .rtf files.
Between June and December 2017, the Android variant had the following alterations: C&C server was changed to 192[.]169[.]217[.]55, the ability to record phone calls was removed, and the C&C server was again changed to 198[.]12[.]149[.]13.
In January 2018, the Android variant’s app label changed to Virtual Girlfriend.
Two months later, the C&C server was changed to hxxp://miakhalifagame[.]com.
The attackers were found using the HTTP protocol to transfer data.
The ability to steal location and pictures was removed from its routine.
Relationship between variants and C&C servers used by Maikspy
The attackers behind Maikspy have changed domains and IP addresses over the years, but all were found hosted in a publicly traded internet domain registrar and web hosting company in the U.S.
The following figures show how Maikspy variants from 2016 to 2018 are connected to C&C servers (found in this appendix, along with the Android and Windows hashes) used by the attackers:  Figure 20.
The connection of Maikspy variants to 198[.]12[.]155[.]84, hxxp://roundyearfun[.]org/, and 192[.]169[.]217[.]55.
Note: The green nodes represent Android samples, while the blue nodes represent Windows samples.
Figure 21. Connection of Maikspy variants to 107[.]180[.]46[.]243 and hxxp://fakeomegle[.]com  Figure 22. Connection of Maikspy variants to 198[.]12[.]149[.]13and hxxp://miakhalifagame[.]com/
Downloading only from legitimate app stores like Google Play can prevent Maikspy from compromising computers and mobile devices.
It is also important to be aware of what apps are allowed to access, and to understand the risks before accepting any terms or granting certain permissions to apps.
Trend Micro’s Mobile App Reputation Service (MARS) already covers Android and iOS threats using leading sandbox and machine learning technology.
End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security for Android™ which is also available on Google Play.
The Trend Micro™ Deep Discovery™ threat protection platform enables companies to detect, analyze, and respond to modern threats such as sophisticated malware, targeted attacks, and APTs.
Trend Micro™ Smart Protection for Endpoints with Maximum XGen™ security infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across user activity and any endpoint—the broadest possible protection against advanced attacks.        Tags  APT & Targeted Attacks | Endpoints | Research | Mobile | Articles, News, Reports | Network
Real enterprises are messy places.
One messy reality is that enterprises don’t manage all their endpoints.
A smart colleague turned me onto using the % of endpoints and servers managed as a prime security metric.
On one end of the spectrum are places like universities that maybe manage 10% of the endpoints on their network.
On the other end are places like some large banking and R&D companies that can manage about 98 or 99%.
A financial services company that was spending millions of dollars on getting from 96% to achieving 98%, using the very good reasoning that they were “cutting their biggest security problem in half” rather than “2%, meh.” So even the very best enterprises can have unmanaged endpoints that can be more easily exploited than ones with a security agent deployed on them.
A lot of the advanced security we’ve been delivering on the last few years has been focused on this problem.
EDR is an example of how stealthy or evasive attackers can be better uncovered than with traditional endpoint protection.
EDR is great for endpoints they are on.
Ian Loe of NTUC gives a killer example of uncovering stealthy attacks using EDR and MDR here.
But most of EDR’s capabilities are for endpoints they are on: ones they manage.
Sure there’s some herd-immunity with EDR that the greater number of managed endpoints the harder it is for an attacker to move laterally or deeper.
But more capable, patient, and stealthy attackers are getting better at being evasive, knowing that EDR may be or is deployed.
Mark Nunnikhoven does a great job in this post talking about lateral movement.
EDR can only go so far on its own to help spot attacks that are exceptionally low and slow, and/or using unmanaged endpoints.
Endpoint security needs to step outside the endpoint silo to keep step with advanced attackers.
An attack using many hops could see movement between managed endpoints, IoT, email, network components, containers and cloud-based servers over the course of many months.
The delivery and reconnaissance could involve multiple protocols, emails, payloads, files, and credentials.
Pulling together the tenuous and ephemeral threads of such an intentional attack needs more modern tools, rather than hoping we stumble on a supply of highly advanced threat hunters.
Pulling together deep security information from across your enterprise is what is needed to face off against such advanced and intentionally evasive attacks.
XDR is intended to be that security data lake of deeper enterprise infrastructure and security information than we’ve previously gathered in a single addressable pool and designed to be useful for threat hunters and analysts.
In these posts here and here we talk about what XDR is and how it brings in more sources, such as network data.
In the game of measure-countermeasure that is cybersecurity today and tomorrow, XDR is the next evolutionary step in dealing with more evasive threats.
Malicious actors, once in an organization’s network, will need to move beyond their initial infection location to other parts of the network, seeking out areas that hold the data or critical systems they wish to utilize.
Whether that is the data center, an OT network, or finding critical business systems to support their criminal or destructive intent.
There are a number of ways lateral movement is performed, but the key is to hide and remove evidence of their presence.
Initially they will look to scan the internal network using similar scanning tools used by admins to identify what systems are available to them.
Hacking tools and keyloggers will be used to steal user accounts and passwords to obtain legitimate user credentials within systems.
More tools will typically be downloaded using the command & control infrastructure to help with their attack.
After obtaining more powerful user accounts, the attacker can laterally move to other systems and use “normal” tools to perform other activities.
These activities may be difficult to identify for defenders due to the use of these things like:     PSEXEC to execute a program from remote system Schedule a remote task to execute back door or malicious code RDP or net use to connect to other hosts
Leverage WMI for fileless intrusion Execute Powershell script for fileless intrusion
Utilize exploits targeting unpatched systems for known vulnerabilities Execute normal tool like Bitlocker, to encrypt customer data like ransomware did.
But normal tools will not detect by antivirus system.
This is where adding network intelligence to an XDR and correlating with other intelligence from different areas of the network can be most beneficial.
An XDR that supports advanced detection capabilities can identify correlate data across areas to identify events that would otherwise go unnoticed.
Additionally, in many attacks the malicious actors are removing their tracks once finished with that area, so having the ability to capture and keep intelligence can help with root cause analysis and correlate the different disparate components of an attack.