mrmoor/cyber-threat-intelligence huggingface dataset:
The fake Silverlight download page of the watering hole attack      Figure 6.
Anti-VM checks in sample c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5      Figure 7.
Check for zh-CN-preferred UI language in sample 89c0b2036ce8d1d91f6d8b8171219aafcd6237c811770fa16edf922cedfecc54
The legitimate known application is downloaded and executed.
Authenticode-signed files are either downloaded from the official websites (as seen in sample c47fabc47806961f908bed37d6b1bbbfd183d564a2d01b7cae87bd95c20ff8a5) or are hosted on Alibaba Cloud OSS on the attackers’ account.
Visual C++ runtime, a legitimate and signed vc_redist.x??.exe, and Python runtime are then downloaded.
These files are also hosted on Alibaba Cloud OSS on an attacker-controlled account.
The Python runtime is usually a ZIP file with all required executables, as well as the DLL and Python libraries necessary for running Python scripts on machines where Python is not installed.
Scheduled tasks that are activated on a new login are created.
These tasks can run a BPS backdoor or a Cobalt Strike loader.
Figure 8.
Code excerpt from the scheduled task     We also noticed the path string “ServiceHub”, which is a path to the extracted Python runtime.
After the hex decoding of the arguments, we get a Python one-liner that downloads additional Python scripts from the cloud.
Python code for downloading additional components from Alibaba Cloud OSS      Figure 10.
The BIOPASS RAT infection flow
Examining the BIOPASS RAT modules We observed a few scheduled tasks being created, with the number dependent on the analyzed sample.
In the following section, we provide an analysis for each important backdoor module.
The cdaemon module  One of the modules used is called “cdaemon”.
At the time of our research into this threat, only the “print(1)” command is able to be executed.
An old sample of the module (30ccfbf24b7c8cc15f85541d5ec18feb0e19e75e1e4d2bca9941e6585dad7bc7) is likely a watchdog to check the status of another module that is known as “c1222”.  The malicious actors can change this behavior by replacing the content of the cdaemon.txt service in the cloud so that when combined with the regular execution of the scheduled task, the cdaemon task can behave like a backdoor.
Figure 11.
The content of the cdaemon.txt backdoor     The c1222 module
The second scheduled task is called “c1222.txt,” which is a Python code run by a previously downloaded Python runtime.
This code runs an HTTP server that listens on predefined ports.
If accessed by an HTTP client, it returns a marker value.
The list of predefined ports to bind an HTTP service to, which is reversed     After accessing the infected machine with an HTTP server bound to a predefined port
, the module returns the marker value.
Figure 13.
The HTTP service with marker BPSV3     We also observed other markers — such as, “cs_online”, “online”, and “dm_online”.
The purpose of the HTTP service is to act as a marker for an infected machine to avoid repeated infection, as aforementioned in the infection chain section.
The most important task of the c1222 script is to download, decode, and execute the Cobalt Strike shellcode.
Based on the platform, it downloads a file with an encoded shellcode (sc3.txt, x64.txt), and then decodes it (the shellcode is base85 and hex-encoded).      Figure 14. Decoding the Cobalt Strike shellcode     The big module (BIOPASS RAT)
The third scheduled task —is called “big.txt”— is responsible for implementing the BIOPASS RAT malware.
This is a Python-based backdoor that is distributed in plain text or compiled with Nuitka or PyArmor and PyInstaller.
When the malware starts, it checks whether the file with the hard-coded name “%PUBLIC%/20200318” exists.
This file is a marker to determine if the scheduled task of the backdoor has been installed.
If the file (that is, the marker) is not found, the backdoor creates a new one and writes the current timestamp onto it.
The malware will then delete the scheduled tasks added by the loader and add two new scheduled tasks that are listed in Table 1.
Task Name  Behavior   ServiceHub  Executes Python with a parameter that is the Python script to download and execute Cobalt Strike loader script “c1222” module  ShellExperienceHost  Executes Python with a parameter that is the Python script to download and execute BIOPASS RAT script “big” module   Table 1.
The scheduled tasks created by BIOPASS RAT   The BIOPASS RAT malware loads a Python script, “online.txt” that will open an HTTP server that listens on one of the following port numbers: 43990, 43992, 53990, 33990, 33890, 48990, 12880, 22880, 32880, 42880, 52880, or 62880.
The HTTP server does nothing but returns string “BPSV3” to request.
A second HTTP server will also be created to listen on one of the aforementioned port numbers.
The second HTTP server behaves the same as the first but returns a string, “dm_online”, instead.
These are the markers of infection as previously mentioned.
After the servers are established and running, the backdoor creates an execution root directory in the folder “%PUBLIC%/BPS/V3/”.
The script of a simple HTTP server to return string “dm_online”     If the malware finds that the system username is “vbccsb”
, it will stop.
It must be noted that “vbccsb” is the default username on ThreatBook Cloud Sandbox, a popular alternative to VirusTotal in China.
If the backdoor finds that the file “debug” present inside the root directory, it will wait for 130 seconds and then continue with execution.       Figure 16.
The script used to check the username and debug mode
Next, the backdoor will try to read the file “bps.key” inside the root directory.
This file contains the victim ID assigned by the command-and-control (C&C) server.
If the file hasn’t been created, it will set the victim ID to a null value until the C&C server assigns it.
At the end of initialization, it collects the information of the victim’s system and initializes values in the global config variable that contains important configuration information.
This includes the backdoor version (we observed V2 and V3), access keys, endpoint address, the bucket name for Alibaba Cloud OSS, and a URL for downloading the utility sc.exe that is used for taking screenshots.
Figure 17.
The BPS backdoor global configuration variable     The backdoor communicates with the C&C server using the Socket.io protocol.
The C&C communication is encrypted with AES ECB algorithm using a hard-coded password, ZLIB compression, and base85 encoding.
Figures 18 and 19 show how the malware sends the “join” event to initialize C&C communication and attach the victim’s encrypted data.
Encoded “join” event sent to the C&C server      Figure 19.
Decoded “join” event sent to the C&C server.
It’s important to note that attributes like IP address, computer and username, architecture, installed antivirus, and geolocation are included.
The BIOPASS RAT malware registers three custom Socket.io event handlers:
1.      The “notice” handler is used for checking the connection with the C&C server.
The backdoor regularly sends a “notice” event to the server and records the timestamp if it also receives a “notice” event as the response.
If the malware doesn’t receive any “notice” event within a hard-coded threshold period, it will restart.
2.      The “set key” handler is used for accepting the victim ID, a random string with six characters, assigned by the C&C server.
It will be attached in each of commands sent from the server and will also be used as the folder name on a cloud storage service to save the stolen data.
The victim ID will be stored in the “bps.key” file.
3.      The “accept task” handler is the main handler used to process the command sent from the C&C server and to return the execution result.
We share more details of each command in the next section.
After the malware joins the C&C server, the server will assign a victim ID with “set key” event and send multiple “accept task” events with the commands “ScreenShot”, “SnsInfo”, “PackingTelegram”, “GetBrowsersCookies”, “GetBrowsersLogins”, “GetBrowsersHistories”, and “GetBrowsersBookmarks” to instruct the malware to collect private data from the victim.
A closer look at the BIOPASS RAT commands
The BIOPASS RAT malware implements multiple commands, most of which are self-explanatory.
A summary of commands is listed in Table 2, while additional details of some commands are explained in the following section.
Command  Behavior  Compress_Files  Compresses specified files or directories to a ZIP archive  Decompress_File  Extracts files from a specified ZIP archive  AutoRun  Creates a scheduled task for persistence  CloseEverything  Kills the Everything process with the command “TASKKILL /F /IM Everything.exe”  OpenEverything  Downloads and runs Everything from voidtools  CloseFFmpegLive  Kills the FFmpeg process with the command “TASKKILL /F /IM ffmpeg.exe”  OpenFFmpegLive  Downloads and runs FFmpeg (for screen video capture)  DeleteFile  Deletes files or directories at specified locations  CreateDir  Creates a directory at a specified location  ShowFiles  Gets the disk partition or lists a specified directory with detailed information, including file name, file path, size, create time, and time of modification  Download_File  Downloads a URL and saves the file to a specified location  Upload_File  Uploads the victim’s files to cloud storage  uUninstall  Kills the BIOPASS RAT process and deletes installed files.  CloseObsLive  Kills the OBS process with command “TASKKILL /F /IM obs64.exe”  Open_Obs_Live  Downloads OBS Studio and starts live streaming  ProcessList  Lists processes on the victim’s environment and their process identifier (PID)  KillProcess  Kills the process specified by PID with the TASKKILL command  ScreenShot  Takes a screenshot and uploads it to cloud storage  Shell  Executes commands or scripts (subcommands with prefixes subprocess, python, noreturn, getversion, restart)  SnsInfo  Lists QQ, WeChat, and Aliwangwang directories  InstallTcpdump  Downloads and installs the tcpdump tool  PackingTelegram  Compresses and uploads Telegram's “tdata” directory to cloud storage  CloseProxy  Kills frpc process with command “TASKKILL /F /IM frpc.exe”  OpenProxy  Downloads and installs the frp proxy client in the “%PUBLIC%” folder  OpenVnc  Downloads and installs jsmpeg-vnc tool in the “%PUBLIC%/vnc/” folder  CloseVnc  Kills the VNC process with the command “TASKKILL /F /IM vdwm.exe”  GetBrowsersCookies  Decrypts the cookie file of the browser and uploads it to cloud storage  GetBrowsersLogins  Decrypts the login file of the browser and uploads it to cloud storage  GetBrowsersHistories  Uploads the history file of the browser to cloud storage  GetBrowsersBookmarks  Uploads the bookmark file of the browser to cloud storage   Table 2.
BIOPASS RAT commands   OpenEverything  The malware downloads “Everything” files if the “Everything” binary is not found in the “%TEMP%” folder.
It then changes the port number of the HTTP server inside the configuration file and starts the Everything process, which will open an HTTP server to allow the threat actor to access the file system of the victim.
OpenFFmpegLive  The malware downloads FFmpeg files if they are not found on the victim’s machine.
Next, it starts the FFmpeg process to monitor the victim’s desktop via RTMP live streaming to the cloud.
The malicious actor can then connect to the relevant RTMP address to watch the streaming.
Open_Obs_Live
The malware downloads OBS Studio files if the OBS folder and config file are not found in the root directory.
It writes the basic config and RTMP config of OBS and then starts the OBS process to monitor the victim’s desktop using RTMP live streaming to the cloud.
The malicious actor can connect to the relevant RTMP address to watch the streaming.
Figure 20.
The script used to download OBS Studio, prepare the configuration, and start the process     ScreenShot
The malware downloads the screenshot-cmd tool if it is not found in the root directory.
It takes a screenshot of the victim’s screen with the tool and saves it as a PNG file with a random number as the file name.
The malware will then upload the screenshot files to cloud storage.
The malware uses a number of methods to execute the shell command or script.
The “Shell” command instructs the malware to execute a command using the Python function “win32api.ShellExecute” and to return the result to a C&C server, applying a 60-second timeout for command execution.
If the command has one of the following prefixes, it will perform a specific behavior:
1.      “subprocess”: executes a system command using the Python function “subprocess.Popen”.
2.      “python”: executes a Python script delivered with the command.
3.      “noreturn”: executes a system command using the Python function “win32api.ShellExecute” without waiting for the result.
4.      “getversion”: returns the string “20200202”.
5.      “restart”: kills the process itself and restarts it via scheduled malicious tasks. SnsInfo
The command will list the installation directory of several popular instant messaging applications including WeChat, QQ, and Aliwangwang and return this information to the C&C server.
Figures 21 and 22 show the result of running “SnsInfo” command to enumerate messengers.
Figure 21.
Encoded SUBMIT RESULT command sent to C&C server      Figure 22. Decoded SUBMIT RESULT command sent to C&C server     None of the Chinese messenger applications has been installed on our testing machine, which explains the result seen in the images.
GetBrowsersCookies  This command is designed to steal cookie information from browsers.
It will read the “Local State” file to grab the AES secret key of Google Chrome-based browsers.
Depending on the different argument “type” delivered with the command, it performs different behaviors.
If the value of the “type” argument is “Chrome”, it will use the AES secret key or DPAPI (for Chrome versions before 80) to decrypt the cookie file.
The decrypted result will be sent to the C&C server.
The script to decrypt Chrome’s file with AES or DPAPI decryption     If the value of the “type” argument is “File”
, it will directly upload the cookie file to cloud storage.
The command that we received showed that the targeted browsers include Google Chrome, Microsoft Edge Beta, 360 Chrome, QQ Browser, 2345 Explorer, Sogou Explorer, and 360 Safe Browser.
Figure 24.
Code showing the command to target Sogou Explorer     GetBrowsersLogins
This command has a nearly identical function to “GetBrowsersCookies”, although it targets a browser’s “Login Data” files instead.
Additional Findings on BIOPASS RAT
Although these are not implemented inside the BIOPASS RAT malware, we have observed two additional plug-ins that are written in Python (“getwechatdb” and “xss_spoof”) and were deployed by the threat actor to a victim who had been infected with Cobalt Strike.
The script “getwechatdb” is used for exfiltrating the chat history from the WeChat Windows client.
The script will detect the version of the installed WeChat client and grab the decryption key and the user ID.
The predefined list of offsets is used to locate where the decryption key and the user ID are embedded.
The list supports 36 different versions of memory offsets for the message client.
The script will then upload database files inside the WeChat folder including “MicroMsg.db” to cloud storage.
These database files are used for saving the chat history.
Finally, the script will print out the client ID and the decryption key that allows the malicious actors to decrypt the stolen database files of the chat history.
Figure 25.
A predefined list of memory offset intended to grab information from different versions of WeChat      Figure 26.
The script used to exfiltrate WeChat chat database files     The other plug-in, “xss_spoof”, is an archive that contains multiple Python scripts.
The scripts are designed for web server infection via a cross-site scripting (XSS) attack.
This plug-in can inject malicious scripts into the response of the victim’s web server by leveraging the WinDivert package, which is used to sniff and manipulate the network traffic on Windows.
The scripts intercept HTTP GET requests that are sent to port 80.
An “ignore” list is used to filter the file extensions of URLs to avoid manipulating resources that are not JavaScript or HTML.
The script then modifies the original JavaScript or HTML content and delivers it to website visitors.
Figure 27.
The JavaScript payload used to replace the original script of compromised websites     The delivered script is almost the same as the malicious script previously discussed in the section on the watering hole attack.
The script performs checks by scanning localhost to determine if the machine is infected by BIOPASS RAT while showing the fake updated webpages.
It is likely that the malicious actors compromised the web servers first and then ran “xss_spoof” for propagation.
Figure 28.
The main script used to manipulate traffic with WinDivert     Potential links with the Winnti group
We have found several connections between BIOPASS RAT and the Winnti Group:
1.      We discovered that many BIOPASS RAT loader binaries were signed with two valid certificates.
It is well known that the Winnti Group has previously used stolen certificates from game studios to sign its malware.
Certificate Thumbprint  Valid From  Valid To  EFB70718BC00393A01694F255A28E30E9D2142A4  12:00 a.m.,  Jan. 2, 2019  11:59 p.m., Mar. 2, 2021  8CE020AA874902C532B9911A4DCA8EFFA627DC80  12:00 a.m., Sept. 6, 2018  11:59 p.m., Oct. 5, 2021   Table 3.
Information from the stolen certificates   2.      While checking the stolen certificates, we found a server-side variant of the Derusbi malware sample (e5fdb754c1a7c36c288c46765c9258bb2c7f38fa2a99188a623182f877da3783) that was signed with the same stolen certificate.
Derusbi is known to be used by multiple advanced persistent threat (APT) groups.
The server-side variant has also been noted to be used as a malware loader by the Winnti Group.
3.      We found an interesting Cobalt Strike loader (a7e9e2bec3ad283a9a0b130034e822c8b6dfd26dda855f883a3a4ff785514f97) that embeds a URL that leads to the BIOPASS RAT loader.
However, the URL is unused and was likely left inside the loader as a mistake.
The Cobalt Strike loader, which has a PDB string “C:\Users\test\Desktop\fishmaster\x64\Release\fishmaster.pdb”, connects to the C&C server “download[.]google-images[.]ml”.
The domains and the PDB string have been mentioned in a recent report and have been attributed to the Winnti Group.
While these connections allow us to link the malware to the Winnti Group, the different targets between BIOPASS RAT and the current operations by Winnti’s that we are tracking makes associating the two more difficult.
BIOPASS RAT highlights the importance of downloading from trusted sources BIOPASS RAT is a sophisticated type of malware that is implemented as Python scripts.
It possesses many features, such as the ability to use scheduled tasks as a method of maintaining persistence in the infected system.
The malware abuses publicly available tools and cloud services for its malicious behavior.
Given that the malware loader was delivered as an executable disguised as a legitimate update installer on a compromised website, we advise users to be careful  with regard to the applications that they download.
As much as possible, it is recommended to download apps only from trusted sources and official websites to avoid being compromised by attacks such as the one discussed here.
Organizations can also help protect their end users by implementing security solutions that provide  a multilayered defense system that helps with detecting, scanning, and blocking malicious URLs.
Note that we’ve submitted an abuse report to Alibaba, but we have yet to receive feedback at the time of publication.
Indicators of Compromise (IoCs)      SHA256  Filename  Note  Analysis  84fbf74896d2a1b62d73b9a5d0be2f627d522fc811fe08044e5485492d2d4249  big.txt  BIOPASS RAT Python Script (Version 3)  TrojanSpy.Python.BIOPASS.A  f3c96145c9d6972df265e12accfcd1588cee8af1b67093011e31b44d0200871f  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan.Python.BIOPASS.A  0f8a87ca5f94949904804442c1a0651f99ba17ecf989f46a3b2fde8de455c4a4  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan.Python.BIOPASS.A  d8b1c4ad8f31c735c51cb24e9f767649f78ef5c571769fbaac9891c899c33444  c1222.txt  BIOPASS RAT Python Script (C1222 module)
Trojan.
Python.BIOPASS.A  ee4150f18ed826c032e7407468beea3b1f738ba80b75a6be21bb8d59ee345466
c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan
.Python.BIOPASS.A  34be85754a84cc44e5bb752ee3a95e2832e7be1f611dd99e9a1233c812a6dad2  c1222.txt  BIOPASS RAT Python Script (C1222 module)  Trojan
.Python.BIOPASS.A  30ccfbf24b7c8cc15f85541d5ec18feb0e19e75e1e4d2bca9941e6585dad7bc7  cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)  Trojan
.Python.BIOPASS.A  f21decb19da8d8c07066a78839ffd8af6721b1f4323f10a1df030325a1a5e159  cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)
Python.BIOPASS.A
40ab025d455083500bfb0c7c64e78967d4d06f91580912dccf332498681ebaf6
cdaemon.txt  BIOPASS RAT Python Script (Cdaemon module)  Trojan
.Python.BIOPASS.A  e479823aa41d3f6416233dba8e765cf2abaa38ad18328859a20b88df7f1d88d5  sc2.txt  BIOPASS RAT encoded Cobalt Strike shellcode  Trojan.Win32.COBEACON.A  e567fd0f08fdafc5a89c9084373f3308ef464918ff7e4ecd7fb3135d777e946d  sc3.txt
BIOPASS RAT encoded Cobalt Strike shellcode  Trojan.Win32.COBEACON.A  0c8c11d0206c223798d83d8498bb21231bbeb30536a20ea29a5d9273bc63313d  s.txt  BIOPASS RAT encoded Cobalt Strike shellcode  Trojan.Win32.COBEACON.A  2beabd8a9d9a485ab6d850f67ec25abbd66bf97b933ecc13cf0d63198e9ba26e  x.txt  Python script of Cobalt Strike shellcode loader  Trojan.Python.COBEACON.A  00977e254e744d4a242b552d055afe9d6429a5c3adb4ba169f302a53ba31795d  ﻿1-CS-443.lua  LUA script of Cobalt Strike shellcode loader  Trojan.Win32.COBEACON.BG dbb6c40cb1a49f4d1a5adc7f215e8e15f80b9f0b11db34c84e74a99e41671e06  Online.txt  BIOPASS RAT Python Script (local online server)  Trojan.Python.BIOPASS.A  943e8c9b0a0a37237ec429cb8a3ff3b39097949e6c57baf43918a34b0110dd8f  getwechatdb.txt  BIOPASS RAT Python Script (getwechatdb plugin script)  TrojanSpy.Python.BIOPASS.A  760fe7645134100301c69289a366bb92ab14927a7fbb9b405c1352989f16488c  wechat.txt  BIOPASS RAT Python Script (getwechatdb plugin script)  TrojanSpy.Python.BIOPASS.A  bdf7ebb2b38ea0c3dfb13da5d9cc56bf439d0519b29c3da61d2b2c0ab5bc6011  xss_spoof.zip  BIOPASS RAT Python Script (xss_spoof plugin package)  Trojan.Python.BIOPASS.A  e3183f52a388774545882c6148613c67a99086e5eb8d17a37158fc599ba8254b  x.js  XSS watering hole attack script  Trojan.JS.BIOPASS.A  d3956e237066a7c221cc4aaec27935d53f14db8ab4b1c018c84f6fccfd5d0058  script.txt  XSS attack JavaScript payload  Trojan.JS.BIOPASS.A  4e804bde376dc02daedf7674893470be633f8e2bda96fa64878bb1fcf3209f60  xss.txt  XSS attack HTML payload  Trojan.HTML.BIOPASS.A  05d1c273a4caeae787b2c3faf381b5480b27d836cd6e41266f3eb505dcee6186  flash.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  09530096643b835cff71a1e48020866fd0d4d0f643fe07f96acdcd06ce11dfa4  test-ticker.exe  BIOPASS RAT Loader  Backdoor.
Win32.BIOPASS.A
0b16dfa3e0bbcc7b04a9a43309e911059a4d8c5892b1068e0441b177960d3eee
Silverlight_ins.exe  BIOPASS RAT Loader
Backdoor.Win64.BIOPASS.A  0f18694b400e14eb995003541f16f75a5afc2478cc415a6295d171ba93565a82  flash_installer.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  11b785e77cbfa2d3849575cdfabd85d41bae3f2e0d33a77e7e2c46a45732d6e4  System.exe
BIOPASS RAT Loader  Backdoor.
Win64.BIOPASS.A
2243c10b1bd64dfb55eda08bc8b85610d7fa5ba759527b4b4dd16dfac584ef25
test3.exe  BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  281c938448e32eb12fe8c5439ef06cea848668cf57fed5ad64b9a8d1e07de561
flash1.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  2b580af1cdc4655ae75ef503aba7600e05cdd68b056a9354a2184b7fbb24db6f  Silverlight_ins.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  30a65a54acfbf8d412ade728cad86c5c769befa4e456f7c0e552e1ab0862a446  flash-64.exe
BIOPASS RAT Loader  Backdoor.Win32.BIOPASS.A  30d9ffd4b92a4ed67569a78ceb25bb6f66346d1c0a7d6d6305e235cbdfe61ebe  Silverlight_ins.exe
BIOPASS RAT Loader  Backdoor.Win64.BIOPASS.A  3195c355aa564ea66b4b37baa9547cb53dde7cf4ae7010256db92fff0bde873d  flash.exe