Blog

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE–Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.

Description

This Malware Analysis Report (MAR) is the result of analytic efforts between Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners, DHS, FBI, and DoD identified Trojan malware variants used by the North Korean government. This malware variant has been identified as BISTROMATH. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https[:]//www[.]us-cert.gov/hiddencobra.

DHS, FBI, and DoD are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity.

This MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques. Users or administrators should flag activity associated with the malware and report the activity to the Cybersecurity and Infrastructure Security Agency (CISA) or the FBI Cyber Watch (CyWatch), and give the activity the highest priority for enhanced mitigation.

This report looks at multiple versions of a full-featured RAT implant executable and multiple versions of the CAgent11 GUI implant controller/builder. These samples performs simple XOR network encoding and are capable of many features including conducting system surveys, file upload/download, process and command execution, and monitoring the microphone, clipboard, and the screen. The GUI controllers allow interaction with the implant as well as the option to dynamically build new implants with customized options. The implants are loaded with a trojanized executable containing a fake bitmap which decodes into shellcode which loads the embedded implant.

For a downloadable copy of IOCs, see MAR-101265965-1.v1.stix.

Submitted Files (5)

04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 (96071956D4890AEBEA14ECD8015617…)

1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 (688890DDBF532A4DE7C83A58E6AA59…)

618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 (0AE8A7B6B4D70C0884095629FC02C1…)

738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 (C51416635E529183CA5337FADE8275…)

b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 (26520499A3FC627D335E34586E99DE…)

Additional Files (2)

133820ebac6e005737d5bb97a5db549490a9f210f4e95098bc9b0a7748f52d1f (a21171923ec09b9569f2baad496c9e…)

43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c (83833f8dbdd6ecf3a1212f5d1fc3d9…)

IPs (1)

159.100.250.231

1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39

Tags

backdooremotettrojan

Details

Antivirus

YARA Rules

• rule CryptographyFunction    
  {
     meta:
         author = “CISA trusted 3rd party”
         incident = “10271944.r1.v1”
         date =    “2019-12-25”
         category = “Hidden_Cobra”
         family = “HOTCROISSANT”
     strings:
         $ALGO_crypto_1 = { 8A [1-5] 32 [1-4] 32 [1-4] 32 [1-4] 88 [1-5] 8A [1-4] 32 [1-4] 22 [1-4] 8B [1-5] 8D [3-7] 33 [1-4] 81 [3-7] C1 [1-5] C1 [1-5] 0B [1-4] 8D [1-5] 33 [1-4] 22 [1-4] C1 [1-5] 33 [1-4] 32 [1-4] 8B [1-4] 83 [1-5] C1 [1-5] 33 [1-4] C1 [1-5] C1 }
     condition:
         uint16(0) == 0x5A4D and any of them
  }

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

The samples use a PlanetCPP.com ‘RichEdit example’ executable to obfuscate calling a decryption function which decrypts an embedded ‘fake’ bitmap image into the configuration and shellcode. When the malicious function is called, it deobfuscates API pointers, loads the full file into memory, calculates an offset into the memory to a ‘fake’ bitmap image, decodes the image; which becomes configuration options and shellcode and then executes the shellcode.

The embedded shellcode has many selectable options.

———-Begin Shellcode Options———-
– option00: Embedded vs Downloaded payload
   0 -> payload embedded within own file at offset (option27 + option28 + option22)
   1 -> Download payload from url <option30> to %temp$\<option31>\RGID3D88.tmp

– option01: True -> check for vm artifacts:
   registry checks:
       VMWARE Scsi device
       VBOX Scsi device
       QEMU Scsi device
       SOFTWARE\Vmware,Inc.\Vmware_Tools
       HARDWARE\Description\System\SystemBiosVersion == “VBOX”
       HARDWARE\Description\System\SystemBiosVersion == “QEMU”
       HARDWARE\Description\System\SystemBiosVersion == “BOCHS”
       HARDWARE\Description\System\VideoBiosVersion == “VIRTUALBOX”
       HARDWARE\Description\System\SystemBiosDate == 06/23/99
       SOFTWARE\Oracle\VirtualBox_Guest_Additions        
       HARDWARE\ACPI\DSDT\VBOX_
       HARDWARE\ACPI\FADT\VBOX__
       HARDWARE\ACPI\RSDT\VBOX__
       SYSTEM\ControlSet001\Services\VBoxGuest
       SYSTEM\ControlSet001\Services\VBoxMouse
       SYSTEM\ControlSet001\Services\VBoxService
       SYSTEM\ControlSet001\Services\VBoxSF
       SYSTEM\ControlSet001\Services\VBoxVideo
   file checks:
       C:\WINDOWS\system32\drivers\vmmouse.sys
       C:\WINDOWS\system32\drivers\vmhgfs.sys
       \\.\HGFS
       \\.\vmci
       C:\WINDOWS\system32\drivers\VBoxMouse.sys
       C:\WINDOWS\system32\drivers\VBoxGuest.sys
       C:\WINDOWS\system32\drivers\VBoxSF.sys
       C:\WINDOWS\system32\drivers\VBoxVideo.sys
       C:\WINDOWS\system32\vboxdisp.dll
       C:\WINDOWS\system32\vboxhook.dll
       C:\WINDOWS\system32\vboxmrxnp.dll
       C:\WINDOWS\system32\vboxogl.dll
       C:\WINDOWS\system32\vboxoglarrayspu.dll
       C:\WINDOWS\system32\vboxoglcrutil.dll
       C:\WINDOWS\system32\vboxoglerrorspu.dll
       C:\WINDOWS\system32\vboxoglfeedbackspu.dll
       C:\WINDOWS\system32\vboxoglpackspu.dll
       C:\WINDOWS\system32\vboxoglpassthroughspu.dll
       C:\WINDOWS\system32\vboxservice.exe
       C:\WINDOWS\system32\vboxtray.exe
       C:\WINDOWS\system32\VBoxControl.exe
       C:\program_files\oracle\virtualbox_guest_additions
       \\.\VBoxMiniRdrDN
       \\.\pipe\VBoxMiniRdDN
       \\.\VBoxTrayIPC
       \\.\pipe\VBoxTrayIPC        
   Network Adapter checks:
       Check for Vmware MAC addresses
       Check for VirtualBox MAC addresses
       Check for VMware network adapter
   Window Checks:
       VBoxTrayToolWndClass
       VBoxTrayToolWnd
   Process Checks:
       vboxservice.exe
       vboxtray.exe
   Loaded DLLs:
       vmcheck.dll

– option02: True -> check for sandbox artifacts:
   Verify spin loops aren’t skipped
   Verify kernel32 doesn’t contain export “wine_get_unix_file_name”
   Verify Numa api calls are not bypassed
   Loaded DLLs:
       SbieDll.dll
       api_log.dll
       dir_watch.dll
       dbghelp.dll
       wpespy.dll
   registry checks:
       SOFTWARE\Wine
   file checks:
       C:\sandbox\sandbox.exe    
       C:\sandbox\sbfwe.dll    
   username checks:
       SANDBOX
       VIRUS
       MALWARE
       SCHMIDTI
       CURRENTUSER
       ANDY
   current directory checks:
       VIRUS
       SANDBOX
       SAMPLE

– option03: True -> check for debugging artifacts:    
   API calls:
       IsDebuggerPresent
       CheckRemoteDebuggerPresent
       NtQueryInformationProcess
       GetThreadContext
       OutputDebugString

– option04: Check if certain processes are running:
   0 -> ignored
   1 -> exit if specific processes are running
   2 -> exit if specific processes are not running
   parses option31_array_+0x200 for a list of ;,: separated process names

– option05: Queries Software\Microsoft\Windows\CurrentVersion\Uninstall keys
   exits if return value is != 0

– option06: Check for specific languages
   0 -> ignored
   1 -> exit if current language is found in list
   2 -> exit if current language is not found in list
   parses option31_array_+0x4b0 for a list of ;,: separated languages

– option07: Check for specific usernames
   0 -> ignored
   1 -> exit if current username is found in list
   2 -> exit if current username is not found in list
   parses option31_array_+0x6b8 for a list of ;,: separated usernames

– option08: Check for specific computernames
   0 -> ignored
   1 -> exit if current computernames is found in list
   2 -> exit if current computernames is not found in list
   parses option31_array_+0x8ac for a list of ;,: separated computernames

– option09: Something with querying Software\Microsoft\Windows\CurrentVersion\Uninstall keys
   exits if return value is < option09_value

– option10: integer value -> exits if there are fewer than this many processes running

– option11-14: Check for system/drive info
   11==0x001 -> exit if number of processors <= option12
   11==0x010 -> exit if total physical memory <= option13
   11==0x100 -> exit if total harddisk space <= option14

– option12/27/28: if True -> exploit dll hijack in cliconfg.exe (SQL Server Client Network Utility)
   dumps a number (option28) of bytes from an offset (option27) of this file into %temp%\ntwdblib.dll
   creates a Software\Claiomh registry key
   executes cliconfg.exe (which loads ntwdblib.dll)

– option16: Set EnableLUA registry key
   SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA to <option16>

– option17: Create Persistence
   0 -> ignored
   1 -> Add registry key to Software\Microsoft\Windows\CurrentVersion\Run using a name from option31_array_+0x960
   2 -> Copy self into Startup folder
   3 -> Create an hourly Scheduled Task called “System Backup”

– option18/23: Process Hollowing vs Drop/Execute
   == 0 -> Do Process Hollowing
   != 0 -> Dump payload to file and execute directly:
       write to %temp%\RT5380.exe using own file offset (option27 + option28 + option22) and execute
       write to %temp%\<option30> using own file offset (option27 + option28 + option22) and execute
       check option23:
– ==0 -> ignored
– !=0 -> delete self and replace self with the dropped file

– option19: Process to create/hollow/inject/execute
   0 -> self
   1 -> svchost.exe
   2 -> conhost.exe
   3 -> explorer.exe
   4 -> value of “http\shell\open\command” registry key
   5 -> <option33>

– option20: Sleep timer
   Milliseconds to sleep before doing process hollowing

– option21/26: Kill timer
   0 -> ignored
   1 -> if timestamp of module + <option26> >= currentTime -> remove persistance, delete self, exit process

– option29/34/35: move file to desired location, delete old file, and execute from new location
   additional path is in option34
   new filename is in option35
   0 -> C:\
   1 -> %windir%
   2 -> %system%
   3 -> %programfiles%
   4 -> %programfiles%\Common Files\
   5 -> C:\ProgramData\
   6 -> %userprofile%
   7 -> %userprofile%\Documents\
   8 -> %temp%
   9 -> %userprofile%\Favorites\
   10 -> %appdata%n
   11 -> %localappdata%

– option36: char[40] – Unknown – Possibly adds a mutex to the hollowed process to enforce a single execution
   Uses argument to create a named mutex
   Injects additional code into the hollowed process (from offset 0x28c0)
   Injects <option36> into the hollowed process
   Creates another remote thread in the hollowed process pointing at offset 0x465a of the newly injected memory
———-End Shellcode Options———-

Screenshots

618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6

Tags

dropperemotetkeyloggerspywaretrojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Description

See analysis for “04D70BB249206A006F83DB39BBE49FF6E520EA329E5FBB9C758D426B1C8DEC30”.

Implants built with sample “04D70BB249206A006F83DB39BBE49FF6E520EA329E5FBB9C758D426B1C8DEC30” are not compatible with this controller, and vice versa.

b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32

Tags

backdooremotettrojan

Details

Antivirus

YARA Rules

• rule CryptographyFunction    
  {
     meta:
         author = “CISA trusted 3rd party”
         incident = “10271944.r1.v1”
         date =    “2019-12-25”
         category = “Hidden_Cobra”
         family = “HOTCROISSANT”
     strings:
         $ALGO_crypto_1 = { 8A [1-5] 32 [1-4] 32 [1-4] 32 [1-4] 88 [1-5] 8A [1-4] 32 [1-4] 22 [1-4] 8B [1-5] 8D [3-7] 33 [1-4] 81 [3-7] C1 [1-5] C1 [1-5] 0B [1-4] 8D [1-5] 33 [1-4] 22 [1-4] C1 [1-5] 33 [1-4] 32 [1-4] 8B [1-4] 83 [1-5] C1 [1-5] 33 [1-4] C1 [1-5] C1 }
     condition:
         uint16(0) == 0x5A4D and any of them
  }

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

See analysis for file “1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39” for additional details.

738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790

Tags

trojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This sample is a full-featured RAT executable.

See analysis for file “1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39” for additional details. This sample varies slightly in the following ways.

Victim_info for this version contains Unicode strings. The RAT is controllable by an unknown variant of CAgent.exe.

04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30

Tags

dropperemotetkeyloggerspywaretrojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Description

This sample is a GUI implant controller titled “Cyber Agent v11.0”. It is capable of dynamically building new bot payloads with the following options:

——–Begin Payload Options———-
Callback IP
Callback Port
Beacon Interval
Output Path
——–End Payload Options———-

victim_info (see analysis for “43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c”) is displayed for each implant beacon received. The controller can establish Remote Desktop viewer, drive enumeration, file upload/download, list processes and services, reverse shell, microphone capture and recording, keylogger, browser activity, cached passwords, and DLL loading and unloading. The controller has the ability to provide implants with an Update URL as well as an option to uninstall all bots.

159.100.250.231

Ports

• 80 TCP
• 8080 TCP

Whois

% IANA WHOIS server
% for more information on IANA, visit http://www.iana.org
% This query returned 1 object

refer:        whois.arin.net

inetnum:     159.0.0.0 – 159.255.255.255
organisation: Administered by ARIN
status:     LEGACY

whois:        whois.arin.net

changed:     1993-05
source:     IANA

# whois.arin.net

NetRange:     159.100.0.0 – 159.101.255.255
CIDR:         159.100.0.0/15
NetName:        RIPE-ERX-159-100-0-0
NetHandle:     NET-159-100-0-0-1
Parent:         NET159 (NET-159-0-0-0-0)
NetType:        Early Registrations, Transferred to RIPE NCC
OriginAS:    
Organization: RIPE Network Coordination Centre (RIPE)
RegDate:        2003-10-29
Updated:        2003-10-29
Comment:        These addresses have been further assigned to users in
Comment:        the RIPE NCC region. Contact information can be found in
Comment:        the RIPE database at http://www.ripe.net/whois
Ref:            https://rdap.arin.net/registry/ip/159.100.0.0

ResourceLink: https://apps.db.ripe.net/search/query.html
ResourceLink: whois.ripe.net

OrgName:        RIPE Network Coordination Centre
OrgId:         RIPE
Address:        P.O. Box 10096
City:         Amsterdam
StateProv:    
PostalCode:     1001EB
Country:        NL
RegDate:        
Updated:        2013-07-29
Ref:            https://rdap.arin.net/registry/entity/RIPE

ReferralServer: whois://whois.ripe.net
ResourceLink: https://apps.db.ripe.net/search/query.html

OrgTechHandle: RNO29-ARIN
OrgTechName: RIPE NCC Operations
OrgTechPhone: +31 20 535 4444
OrgTechEmail: hostmaster@ripe.net
OrgTechRef:    https://rdap.arin.net/registry/entity/RNO29-ARIN

OrgAbuseHandle: ABUSE3850-ARIN
OrgAbuseName: Abuse Contact
OrgAbusePhone: +31205354444
OrgAbuseEmail: abuse@ripe.net
OrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE3850-ARIN

# whois.ripe.net

inetnum:        159.100.245.0 – 159.100.255.255
netname:        Akenes
descr:         Exoscale Open Cloud DK2
descr:         Exoscale cloud hosting https://www.exoscale.ch
descr:         *******************************************************
descr:         * These IPs are customer assigned STATIC IPs.
descr:         * In case of abuse, please do NOT block entire
descr:         * network as IPs of this block are assigned as /32
descr:         * to individual customers.
descr:         *******************************************************
descr:         * For abuse-complaints please use
descr:         * only abuse@exoscale.ch.
descr:         *******************************************************
country:        CH
admin-c:        AC22866-RIPE
tech-c:         LLL1007-RIPE
status:         LEGACY
mnt-by:         Exoscale-MNT
created:        2017-11-20T10:37:49Z
last-modified: 2017-11-20T10:37:49Z
source:         RIPE

person:         Antoine COETSIER
address:        Boulevard de Grancy 19A
address:        1006 Lausanne
address:        SWITZERLAND
phone:         +41 58 255 00 66
nic-hdl:        AC22866-RIPE
mnt-by:         Exoscale-MNT
created:        2013-02-08T14:10:06Z
last-modified: 2019-04-11T05:30:08Z
source:         RIPE # Filtered

person:         Loic Lambiel
address:        Boulevard de Grancy 19A
address:        1006 Lausanne
address:        Switzerland
phone:         +41 58 255 00 66
nic-hdl:        LLL1007-RIPE
mnt-by:         Exoscale-MNT
created:        2013-02-15T10:16:52Z
last-modified: 2019-04-11T05:31:04Z
source:         RIPE # Filtered

% Information related to ‘159.100.248.0/21AS61098’

route:         159.100.248.0/21
origin:         AS61098
mnt-by:         Exoscale-MNT
created:        2016-12-14T10:12:52Z
last-modified: 2016-12-14T10:12:52Z
source:         RIPE

% This query was served by the RIPE Database Query Service version 1.95.1 (WAGYU)

Relationships

Description

Hard-coded C2 address used by these RATs.

43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c

Tags

keyloggerspywaretrojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This sample is a full-featured RAT executable contained within “1EA6B3E99BBB67719C56AD07F5A12501855068A4A866F92DB8DCDEFAFFA48A39”.

See Figure 1 for full list of commands a hardcoded C2 address of 159.100.250.231 on port 8080 is contained within the sample. The RAT is controllable by CAgent.exe variant “618A67048D0A9217317C1D1790AD5F6B044EAA58A433BD46EC2FB9F9FF563DC6”.

The Imports are obfuscated by prepending “CARAT_” to the API names.

Packets are formatted in the following format:

———-Begin Packet Formatting———
[OPCODE] [4 Bytes length of data] [data]
———-Begin Packet Formatting———

Packets are encoded by performing an XOR on the data after the header with the XOR key 0x07. The implant initiates callback to C2, then immediately sends its victim_info.

———-Begin Victim_Info———-
•    Language
•    Country
•    Victim_ID
•    Computer_Name
•    User_Name
•    Implant_Version = “11.0”
•    Victim_IP
•    System_Architecture
•    Drive_Letters
•    OS_Version
———-End Victim_Info———-

133820ebac6e005737d5bb97a5db549490a9f210f4e95098bc9b0a7748f52d1f

Tags

trojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This sample is a full-featured RAT executable contained within “B6811B42023524E691B517D19D0321F890F91F35EBBDF1C12CBB92CDA5B6DE32”.

See analysis for file “1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39” for additional details. This sample varies slightly in the following ways.

———-Begin Packet Formatting———
[OPCODE][4 Bytes data length][4 Bytes unused][AUTH CODE 72 50 BF 9E][Data]
———-End Packet Formatting———

The implant initiates callback to C2, then waits for tasking (DOES NOT immediately send its victim_info) and the Victim_info for this version contains Unicode strings, it additionally adds UserGeoID to victim_info.

The sample attempts to connect to 159.100.250.231:8080 4 times, with 1 minute between attempts. If does not succeed, then attempts to connect to www.example.com 4 times, with 1 minute between attempts. This loop continues until a connection is made.

Displayed below is a Python3 script used to decrypt and extract the embedded files:

–Begin Decryption and Extraction Python3 Script–
import argparse
import struct

def truncate_nullterm_str(data):
   null_index = data.find(b’\x00′)
   truncated_str = data[:null_index].decode(‘utf-8’)
   return truncated_str

def decode(offset,buffer,length,key1,key2):
   dec = b”
   k3 = key1
   key1 = key1 >> 1
   while length > 0:
       k1 = key1
       k2 = key2
       dec += bytes([(buffer[offset] ^ k1 ^ k2 ^ k3) & 0xff])
       key1 = (key1 >> 8 | ((key1 * 8 ^ key1) & 0x7f8) << 0x14) & 0xffffffff
       k3 = (k3 & k2 ^ (k2 ^ k3) & k1)
       key2 = (key2 >> 8 | (((key2 * 2 ^ key2) << 4 ^ key2) & 0xffffff80 ^ key2 << 7) << 0x11) & 0xffffffff
       offset += 1
       length -= 1
   return dec

offset = 0
def parse_options(buffer):
   options = list(struct.unpack(‘I’*30, buffer[0:120]))
   options.append(buffer[120:320])
   options.append(buffer[320:2820])
   options.append(buffer[2820:3020])
   options.append(buffer[3020:3120])
   options.append(buffer[3120:3220])
   options.append(buffer[3220:3320])
   options.append(buffer[3320:3360])

   enabled_options = ”
   disabled_options = ”

   if options[0] == 0:
       global offset
       offset = options[27] + options[28] + options[22]
       enabled_options += “Embedded payload at offset: %d\n” % offset
       disabled_options += “Download payload\n”
   else:
       enabled_options += “Download payload from: %s\n” % truncate_nullterm_str(options[30])
       disabled_options += “Embedded payload\n”

   str = “VM Detect\n”
   if options[1] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Sandbox Detect\n”
   if options[2] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Debugger Detect\n”
   if options[3] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Active Processes Check\n”
   if options[4] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Installed programs Check\n”
   if options[5] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Language Check\n”
   if options[6] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Username Check\n”
   if options[7] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Computer name Check\n”
   if options[8] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Installed number of programs Check\n”
   if options[9] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Number running processes Check\n”
   if options[10] == 0:
       disabled_options += str
   else:
       enabled_options += “Number running processes Check: %d\n” % options[10]

   str = “System processors/memory/diskspace Check\n”
   if options[11] == 0:
       disabled_options += str
   else:
       if options[11] & 0x001:
           enabled_options += “Processor count check: %d\n” % options[12]
       if options[11] & 0x010:
           enabled_options += “Physical memory check: %d\n” % options[13]
       if options[11] & 0x000:
           enabled_options += “Disk space check: %d\n” % options[14]

   str = “DLL Hijack cliconfg.exe\n”
   if options[12] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “EnableLUA\n”
   if options[16] == 0:
       disabled_options += str
   else:
       enabled_options += str

   str = “Create Persistence\n”
   if options[17] == 0:
       disabled_options += str
   elif options[17] == 1:
       enabled_options += “Create Persistence using Run key: %s\n” % truncate_nullterm_str(options[31][0x960:])
   elif options[17] == 2:
       enabled_options += “Create Persistence in Startup folder\n”
   elif options[17] == 3:
       enabled_options += “Create Persistence using \”System Backup\” hourly Scheduled Task\n”

   if options[18] == 0:
       disabled_options += “Direct Execution\n”
   else:
       disabled_options += “Process Hollowing\n”

   if options[19] == 0:
       enabled_options += “Process Hollowing: self\n”
   elif options[19] == 1:
       enabled_options += “Process Hollowing: svchost.exe\n”
   elif options[19] == 2:
       enabled_options += “Process Hollowing: conhost.exe\n”
   elif options[19] == 3:
       enabled_options += “Process Hollowing: explorer.exe\n”
   elif options[19] == 4:
       enabled_options += “Process Hollowing: \”http\shell\open\command\” registry key value\n”
   elif options[19] == 5:
       enabled_options += “Process Hollowing: %s\n” % truncate_nullterm_str(options[33])

   str = “Sleep Timer\n”
   if options[20] == 0:
       disabled_options += str
   else:
       enabled_options += “Sleep Timer: %d\n” % options[20]

   str = “Kill Timer\n”
   if options[21] == 0:
       disabled_options += str
   else:
       enabled_options += “Kill Timer: %d\n” % options[26]

   if options[29] == 0:
       enabled_options += “Relocate to: C:\\”
   elif options[29] == 1:
       enabled_options += “Relocate to: %windir%\\”
   elif options[29] == 2:
       enabled_options += “Relocate to: %system%\\”
   elif options[29] == 3:
       enabled_options += “Relocate to: %programfiles%\\”
   elif options[29] == 4:
       enabled_options += “Relocate to: %programfiles%\\Common Files\\”
   elif options[29] == 5:
       enabled_options += “Relocate to: C:\\ProgramData\\”
   elif options[29] == 6:
       enabled_options += “Relocate to: %userprofile%\\”
   elif options[29] == 7:
       enabled_options += “Relocate to: %userprofile%\\Documents\\”
   elif options[29] == 8:
       enabled_options += “Relocate to: %temp%\\”
   elif options[29] == 9:
       enabled_options += “Relocate to: %userprofile%\\Favorites\\”
   elif options[29] == 10:
       enabled_options += “Relocate to: %appdata%\\”
   elif options[29] == 11:
       enabled_options += “Relocate to: %localappdata%\\”
   if len(truncate_nullterm_str(options[34])) > 0:
       enabled_options += “%s\\” % truncate_nullterm_str(options[34])
   enabled_options += “%s\n” % truncate_nullterm_str(options[35])

   str = “Mutex\n”
   if len(truncate_nullterm_str(options[36])) == 0:
       disabled_options += str
   else:
       enabled_options += “Mutex: %s\n” % truncate_nullterm_str(options[36])

   print(“\nDisabled Options:”)
   print(disabled_options)

   print(“\nEnabled Options:”)
   print(enabled_options)

def main():
   parser = argparse.ArgumentParser()
   parser.add_argument(‘filename’)
   args = parser.parse_args()

   with open(args.filename, ‘rb’) as f:
       exe = f.read()
       PE_header_pos = struct.unpack(‘<i’, exe[0x3c:0x3c+4])[0]
       PE_header_len = struct.unpack(‘<i’, exe[PE_header_pos+0x54:PE_header_pos+0x54+4])[0]
       PE_header_length = struct.unpack(‘<h’, exe[PE_header_pos+0x14:PE_header_pos+0x14+2])[0]
       section_headers_pos = PE_header_pos + PE_header_length + 0x18
       num_headers = struct.unpack(‘<h’, exe[PE_header_pos+0x6:PE_header_pos+0x6+2])[0]
       curr_header_pos = section_headers_pos
       bitmap_pos = PE_header_len
       for i in range(num_headers):
           header_len = struct.unpack(‘<i’, exe[curr_header_pos+0x10:curr_header_pos+0x10+4])[0]
           bitmap_pos += header_len
           curr_header_pos += 0x28
       key1 = struct.unpack(‘<I’, exe[bitmap_pos+0x3a:bitmap_pos+0x3a+4])[0]
       bitmap_len = len(exe) – bitmap_pos
       bitmap_header_len = struct.unpack(‘<H’, exe[bitmap_pos+0x3e:bitmap_pos+0x3e+2])[0]
       key2 = struct.unpack(‘<I’, exe[bitmap_pos+0x36:bitmap_pos+0x36+4])[0]
       bitmap_len -= bitmap_header_len
       bitmap_len -= 0x036
       print(“[ ] Decoding %d Bytes with:” % bitmap_len)
       print(”    Key1: %s” % hex(key1))
       print(”    Key2: %s” % hex(key2))
       dec = decode(0,exe[bitmap_pos+bitmap_header_len+0x36:],bitmap_len,key1,key2)
       print(“[+] Decoding Complete!”)
       parse_options(dec[0:0xd56-0x36])
       payload_pos = 0xd56-0x36+offset
       print(“[ ] Found embedded payload, extracting..”)
       with open(args.filename + “_payload.exe”, ‘wb’) as out:
           out.write(dec[payload_pos:])
       print(“[+] Wrote %d Bytes to %s” % (len(dec[payload_pos:]), args.filename + “_payload.exe”))

if __name__ == ‘__main__’:
   main()
–End Decryption and Extraction Python3 Script–

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization’s systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines.
• Keep operating system patches up-to-date.
• Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
• Enforce a strong password policy and implement regular password changes.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
• Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
• Scan all software downloaded from the Internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, “Guide to Malware Incident Prevention & Handling for Desktops and Laptops”.

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.gov/forms/feedback/

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or soc@us-cert.gov.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA’s homepage at www.us-cert.gov.