MAR-10265965-1.v1 – North Korean Trojan: BISTROMATH

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.

Description

This Malware Analysis Report (MAR) is the result of analytic efforts between Department of Homeland Security (DHS), the Federal Bureau of Investigation (FBI), and the Department of Defense (DoD). Working with U.S. Government partners, DHS, FBI, and DoD identified Trojan malware variants used by the North Korean government. This malware variant has been identified as BISTROMATH. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https[:]//www[.]us-cert.gov/hiddencobra.



DHS, FBI, and DoD are distributing this MAR to enable network defense and reduce exposure to North Korean government malicious cyber activity.



This MAR includes malware descriptions related to HIDDEN COBRA, suggested response actions and recommended mitigation techniques. Users or administrators should flag activity associated with the malware and report the activity to the Cybersecurity and Infrastructure Security Agency (CISA) or the FBI Cyber Watch (CyWatch), and give the activity the highest priority for enhanced mitigation.



This report looks at multiple versions of a full-featured RAT implant executable and multiple versions of the CAgent11 GUI implant controller/builder. These samples performs simple XOR network encoding and are capable of many features including conducting system surveys, file upload/download, process and command execution, and monitoring the microphone, clipboard, and the screen. The GUI controllers allow interaction with the implant as well as the option to dynamically build new implants with customized options. The implants are loaded with a trojanized executable containing a fake bitmap which decodes into shellcode which loads the embedded implant.

For a downloadable copy of IOCs, see MAR-101265965-1.v1.stix.

Submitted Files (5)

04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 (96071956D4890AEBEA14ECD8015617...)

1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 (688890DDBF532A4DE7C83A58E6AA59...)

618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 (0AE8A7B6B4D70C0884095629FC02C1...)

738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 (C51416635E529183CA5337FADE8275...)

b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 (26520499A3FC627D335E34586E99DE...)

Additional Files (2)

133820ebac6e005737d5bb97a5db549490a9f210f4e95098bc9b0a7748f52d1f (a21171923ec09b9569f2baad496c9e...)

43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c (83833f8dbdd6ecf3a1212f5d1fc3d9...)

IPs (1)

159.100.250.231

1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39

Tags

backdooremotettrojan

Details

Antivirus

YARA Rules

• rule CryptographyFunction    
  
  {
  
     meta:
  
         author = "CISA trusted 3rd party"
  
         incident = "10271944.r1.v1"
  
         date =    "2019-12-25"
  
         category = "Hidden_Cobra"
  
         family = "HOTCROISSANT"
  
     strings:
  
         $ALGO_crypto_1 = { 8A [1-5] 32 [1-4] 32 [1-4] 32 [1-4] 88 [1-5] 8A [1-4] 32 [1-4] 22 [1-4] 8B [1-5] 8D [3-7] 33 [1-4] 81 [3-7] C1 [1-5] C1 [1-5] 0B [1-4] 8D [1-5] 33 [1-4] 22 [1-4] C1 [1-5] 33 [1-4] 32 [1-4] 8B [1-4] 83 [1-5] C1 [1-5] 33 [1-4] C1 [1-5] C1 }
  
     condition:
  
         uint16(0) == 0x5A4D and any of them
  
  }

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

The samples use a PlanetCPP.com ‘RichEdit example’ executable to obfuscate calling a decryption function which decrypts an embedded ‘fake’ bitmap image into the configuration and shellcode. When the malicious function is called, it deobfuscates API pointers, loads the full file into memory, calculates an offset into the memory to a ‘fake’ bitmap image, decodes the image; which becomes configuration options and shellcode and then executes the shellcode.



The embedded shellcode has many selectable options.



----------Begin Shellcode Options----------

- option00: Embedded vs Downloaded payload

   0 -> payload embedded within own file at offset (option27 + option28 + option22)

   1 -> Download payload from url <option30> to %temp$\<option31>\RGID3D88.tmp



- option01: True -> check for vm artifacts:

   registry checks:

       VMWARE Scsi device

       VBOX Scsi device

       QEMU Scsi device

       SOFTWARE\Vmware,Inc.\Vmware_Tools

       HARDWARE\Description\System\SystemBiosVersion == "VBOX"

       HARDWARE\Description\System\SystemBiosVersion == "QEMU"

       HARDWARE\Description\System\SystemBiosVersion == "BOCHS"

       HARDWARE\Description\System\VideoBiosVersion == "VIRTUALBOX"

       HARDWARE\Description\System\SystemBiosDate == 06/23/99

       SOFTWARE\Oracle\VirtualBox_Guest_Additions        

       HARDWARE\ACPI\DSDT\VBOX_

       HARDWARE\ACPI\FADT\VBOX__

       HARDWARE\ACPI\RSDT\VBOX__

       SYSTEM\ControlSet001\Services\VBoxGuest

       SYSTEM\ControlSet001\Services\VBoxMouse

       SYSTEM\ControlSet001\Services\VBoxService

       SYSTEM\ControlSet001\Services\VBoxSF

       SYSTEM\ControlSet001\Services\VBoxVideo

   file checks:

       C:\WINDOWS\system32\drivers\vmmouse.sys

       C:\WINDOWS\system32\drivers\vmhgfs.sys

       \\.\HGFS

       \\.\vmci

       C:\WINDOWS\system32\drivers\VBoxMouse.sys

       C:\WINDOWS\system32\drivers\VBoxGuest.sys

       C:\WINDOWS\system32\drivers\VBoxSF.sys

       C:\WINDOWS\system32\drivers\VBoxVideo.sys

       C:\WINDOWS\system32\vboxdisp.dll

       C:\WINDOWS\system32\vboxhook.dll

       C:\WINDOWS\system32\vboxmrxnp.dll

       C:\WINDOWS\system32\vboxogl.dll

       C:\WINDOWS\system32\vboxoglarrayspu.dll

       C:\WINDOWS\system32\vboxoglcrutil.dll

       C:\WINDOWS\system32\vboxoglerrorspu.dll

       C:\WINDOWS\system32\vboxoglfeedbackspu.dll

       C:\WINDOWS\system32\vboxoglpackspu.dll

       C:\WINDOWS\system32\vboxoglpassthroughspu.dll

       C:\WINDOWS\system32\vboxservice.exe

       C:\WINDOWS\system32\vboxtray.exe

       C:\WINDOWS\system32\VBoxControl.exe

       C:\program_files\oracle\virtualbox_guest_additions

       \\.\VBoxMiniRdrDN

       \\.\pipe\VBoxMiniRdDN

       \\.\VBoxTrayIPC

       \\.\pipe\VBoxTrayIPC        

   Network Adapter checks:

       Check for Vmware MAC addresses

       Check for VirtualBox MAC addresses

       Check for VMware network adapter

   Window Checks:

       VBoxTrayToolWndClass

       VBoxTrayToolWnd

   Process Checks:

       vboxservice.exe

       vboxtray.exe

   Loaded DLLs:

       vmcheck.dll



- option02: True -> check for sandbox artifacts:

   Verify spin loops aren't skipped

   Verify kernel32 doesn't contain export "wine_get_unix_file_name"

   Verify Numa api calls are not bypassed

   Loaded DLLs:

       SbieDll.dll

       api_log.dll

       dir_watch.dll

       dbghelp.dll

       wpespy.dll

   registry checks:

       SOFTWARE\Wine

   file checks:

       C:\sandbox\sandbox.exe    

       C:\sandbox\sbfwe.dll    

   username checks:

       SANDBOX

       VIRUS

       MALWARE

       SCHMIDTI

       CURRENTUSER

       ANDY

   current directory checks:

       VIRUS

       SANDBOX

       SAMPLE



- option03: True -> check for debugging artifacts:    

   API calls:

       IsDebuggerPresent

       CheckRemoteDebuggerPresent

       NtQueryInformationProcess

       GetThreadContext

       OutputDebugString



- option04: Check if certain processes are running:

   0 -> ignored

   1 -> exit if specific processes are running

   2 -> exit if specific processes are not running

   parses option31_array_+0x200 for a list of ;,: separated process names



- option05: Queries Software\Microsoft\Windows\CurrentVersion\Uninstall keys

   exits if return value is != 0



- option06: Check for specific languages

   0 -> ignored

   1 -> exit if current language is found in list

   2 -> exit if current language is not found in list

   parses option31_array_+0x4b0 for a list of ;,: separated languages



- option07: Check for specific usernames

   0 -> ignored

   1 -> exit if current username is found in list

   2 -> exit if current username is not found in list

   parses option31_array_+0x6b8 for a list of ;,: separated usernames



- option08: Check for specific computernames

   0 -> ignored

   1 -> exit if current computernames is found in list

   2 -> exit if current computernames is not found in list

   parses option31_array_+0x8ac for a list of ;,: separated computernames



- option09: Something with querying Software\Microsoft\Windows\CurrentVersion\Uninstall keys

   exits if return value is < option09_value



- option10: integer value -> exits if there are fewer than this many processes running



- option11-14: Check for system/drive info

   11==0x001 -> exit if number of processors <= option12

   11==0x010 -> exit if total physical memory <= option13

   11==0x100 -> exit if total harddisk space <= option14



- option12/27/28: if True -> exploit dll hijack in cliconfg.exe (SQL Server Client Network Utility)

   dumps a number (option28) of bytes from an offset (option27) of this file into %temp%\ntwdblib.dll

   creates a Software\Claiomh registry key

   executes cliconfg.exe (which loads ntwdblib.dll)



- option16: Set EnableLUA registry key

   SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA to <option16>



- option17: Create Persistence

   0 -> ignored

   1 -> Add registry key to Software\Microsoft\Windows\CurrentVersion\Run using a name from option31_array_+0x960

   2 -> Copy self into Startup folder

   3 -> Create an hourly Scheduled Task called "System Backup"



- option18/23: Process Hollowing vs Drop/Execute

   == 0 -> Do Process Hollowing

   != 0 -> Dump payload to file and execute directly:

       write to %temp%\RT5380.exe using own file offset (option27 + option28 + option22) and execute

       write to %temp%\<option30> using own file offset (option27 + option28 + option22) and execute

       check option23:

- ==0 -> ignored

- !=0 -> delete self and replace self with the dropped file



- option19: Process to create/hollow/inject/execute

   0 -> self

   1 -> svchost.exe

   2 -> conhost.exe

   3 -> explorer.exe

   4 -> value of "http\shell\open\command" registry key

   5 -> <option33>



- option20: Sleep timer

   Milliseconds to sleep before doing process hollowing



- option21/26: Kill timer

   0 -> ignored

   1 -> if timestamp of module + <option26> >= currentTime -> remove persistance, delete self, exit process



- option29/34/35: move file to desired location, delete old file, and execute from new location

   additional path is in option34

   new filename is in option35

   0 -> C:\

   1 -> %windir%

   2 -> %system%

   3 -> %programfiles%

   4 -> %programfiles%\Common Files\

   5 -> C:\ProgramData\

   6 -> %userprofile%

   7 -> %userprofile%\Documents\

   8 -> %temp%

   9 -> %userprofile%\Favorites\

   10 -> %appdata%n

   11 -> %localappdata%



- option36: char[40] - Unknown - Possibly adds a mutex to the hollowed process to enforce a single execution

   Uses argument to create a named mutex

   Injects additional code into the hollowed process (from offset 0x28c0)

   Injects <option36> into the hollowed process

   Creates another remote thread in the hollowed process pointing at offset 0x465a of the newly injected memory

----------End Shellcode Options----------

Screenshots

618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6

Tags

dropperemotetkeyloggerspywaretrojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Description

See analysis for "04D70BB249206A006F83DB39BBE49FF6E520EA329E5FBB9C758D426B1C8DEC30".



Implants built with sample "04D70BB249206A006F83DB39BBE49FF6E520EA329E5FBB9C758D426B1C8DEC30" are not compatible with this controller, and vice versa.

b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32

Tags

backdooremotettrojan

Details

Antivirus

YARA Rules

• rule CryptographyFunction    
  
  {
  
     meta:
  
         author = "CISA trusted 3rd party"
  
         incident = "10271944.r1.v1"
  
         date =    "2019-12-25"
  
         category = "Hidden_Cobra"
  
         family = "HOTCROISSANT"
  
     strings:
  
         $ALGO_crypto_1 = { 8A [1-5] 32 [1-4] 32 [1-4] 32 [1-4] 88 [1-5] 8A [1-4] 32 [1-4] 22 [1-4] 8B [1-5] 8D [3-7] 33 [1-4] 81 [3-7] C1 [1-5] C1 [1-5] 0B [1-4] 8D [1-5] 33 [1-4] 22 [1-4] C1 [1-5] 33 [1-4] 32 [1-4] 8B [1-4] 83 [1-5] C1 [1-5] 33 [1-4] C1 [1-5] C1 }
  
     condition:
  
         uint16(0) == 0x5A4D and any of them
  
  }

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

See analysis for file "1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39" for additional details.

738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790

Tags

trojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This sample is a full-featured RAT executable.



See analysis for file "1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39" for additional details. This sample varies slightly in the following ways.



Victim_info for this version contains Unicode strings. The RAT is controllable by an unknown variant of CAgent.exe.

04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30

Tags

dropperemotetkeyloggerspywaretrojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Description

This sample is a GUI implant controller titled “Cyber Agent v11.0”. It is capable of dynamically building new bot payloads with the following options:



--------Begin Payload Options----------

Callback IP

Callback Port

Beacon Interval

Output Path

--------End Payload Options----------



victim_info (see analysis for "43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c") is displayed for each implant beacon received. The controller can establish Remote Desktop viewer, drive enumeration, file upload/download, list processes and services, reverse shell, microphone capture and recording, keylogger, browser activity, cached passwords, and DLL loading and unloading. The controller has the ability to provide implants with an Update URL as well as an option to uninstall all bots.

159.100.250.231

Ports

• 80 TCP
• 8080 TCP

Whois

% IANA WHOIS server

% for more information on IANA, visit http://www.iana.org

% This query returned 1 object



refer:        whois.arin.net



inetnum:     159.0.0.0 - 159.255.255.255

organisation: Administered by ARIN

status:     LEGACY



whois:        whois.arin.net



changed:     1993-05

source:     IANA



# whois.arin.net



NetRange:     159.100.0.0 - 159.101.255.255

CIDR:         159.100.0.0/15

NetName:        RIPE-ERX-159-100-0-0

NetHandle:     NET-159-100-0-0-1

Parent:         NET159 (NET-159-0-0-0-0)

NetType:        Early Registrations, Transferred to RIPE NCC

OriginAS:    

Organization: RIPE Network Coordination Centre (RIPE)

RegDate:        2003-10-29

Updated:        2003-10-29

Comment:        These addresses have been further assigned to users in

Comment:        the RIPE NCC region. Contact information can be found in

Comment:        the RIPE database at http://www.ripe.net/whois

Ref:            https://rdap.arin.net/registry/ip/159.100.0.0



ResourceLink: https://apps.db.ripe.net/search/query.html

ResourceLink: whois.ripe.net





OrgName:        RIPE Network Coordination Centre

OrgId:         RIPE

Address:        P.O. Box 10096

City:         Amsterdam

StateProv:    

PostalCode:     1001EB

Country:        NL

RegDate:        

Updated:        2013-07-29

Ref:            https://rdap.arin.net/registry/entity/RIPE



ReferralServer: whois://whois.ripe.net

ResourceLink: https://apps.db.ripe.net/search/query.html



OrgTechHandle: RNO29-ARIN

OrgTechName: RIPE NCC Operations

OrgTechPhone: +31 20 535 4444

OrgTechEmail: hostmaster@ripe.net

OrgTechRef:    https://rdap.arin.net/registry/entity/RNO29-ARIN



OrgAbuseHandle: ABUSE3850-ARIN

OrgAbuseName: Abuse Contact

OrgAbusePhone: +31205354444

OrgAbuseEmail: abuse@ripe.net

OrgAbuseRef:    https://rdap.arin.net/registry/entity/ABUSE3850-ARIN





# whois.ripe.net



inetnum:        159.100.245.0 - 159.100.255.255

netname:        Akenes

descr:         Exoscale Open Cloud DK2

descr:         Exoscale cloud hosting https://www.exoscale.ch

descr:         *******************************************************

descr:         * These IPs are customer assigned STATIC IPs.

descr:         * In case of abuse, please do NOT block entire

descr:         * network as IPs of this block are assigned as /32

descr:         * to individual customers.

descr:         *******************************************************

descr:         * For abuse-complaints please use

descr:         * only abuse@exoscale.ch.

descr:         *******************************************************

country:        CH

admin-c:        AC22866-RIPE

tech-c:         LLL1007-RIPE

status:         LEGACY

mnt-by:         Exoscale-MNT

created:        2017-11-20T10:37:49Z

last-modified: 2017-11-20T10:37:49Z

source:         RIPE



person:         Antoine COETSIER

address:        Boulevard de Grancy 19A

address:        1006 Lausanne

address:        SWITZERLAND

phone:         +41 58 255 00 66

nic-hdl:        AC22866-RIPE

mnt-by:         Exoscale-MNT

created:        2013-02-08T14:10:06Z

last-modified: 2019-04-11T05:30:08Z

source:         RIPE # Filtered



person:         Loic Lambiel

address:        Boulevard de Grancy 19A

address:        1006 Lausanne

address:        Switzerland

phone:         +41 58 255 00 66

nic-hdl:        LLL1007-RIPE

mnt-by:         Exoscale-MNT

created:        2013-02-15T10:16:52Z

last-modified: 2019-04-11T05:31:04Z

source:         RIPE # Filtered



% Information related to '159.100.248.0/21AS61098'



route:         159.100.248.0/21

origin:         AS61098

mnt-by:         Exoscale-MNT

created:        2016-12-14T10:12:52Z

last-modified: 2016-12-14T10:12:52Z

source:         RIPE



% This query was served by the RIPE Database Query Service version 1.95.1 (WAGYU)

Relationships

Description

Hard-coded C2 address used by these RATs.

43193c4efa8689ff6de3fb18e30607bb941b43abb21e8cee0cfd664c6f4ad97c

Tags

keyloggerspywaretrojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This sample is a full-featured RAT executable contained within "1EA6B3E99BBB67719C56AD07F5A12501855068A4A866F92DB8DCDEFAFFA48A39".



See Figure 1 for full list of commands a hardcoded C2 address of 159.100.250.231 on port 8080 is contained within the sample. The RAT is controllable by CAgent.exe variant "618A67048D0A9217317C1D1790AD5F6B044EAA58A433BD46EC2FB9F9FF563DC6".



The Imports are obfuscated by prepending "CARAT_" to the API names.



Packets are formatted in the following format:



----------Begin Packet Formatting---------

[OPCODE] [4 Bytes length of data] [data]

----------Begin Packet Formatting---------



Packets are encoded by performing an XOR on the data after the header with the XOR key 0x07. The implant initiates callback to C2, then immediately sends its victim_info.



----------Begin Victim_Info----------

•    Language

•    Country

•    Victim_ID

•    Computer_Name

•    User_Name

•    Implant_Version = "11.0"

•    Victim_IP

•    System_Architecture

•    Drive_Letters

•    OS_Version

----------End Victim_Info----------

133820ebac6e005737d5bb97a5db549490a9f210f4e95098bc9b0a7748f52d1f

Tags

trojan

Details

Antivirus

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

PE Sections

Packers/Compilers/Cryptors

Relationships

Description

This sample is a full-featured RAT executable contained within "B6811B42023524E691B517D19D0321F890F91F35EBBDF1C12CBB92CDA5B6DE32".



See analysis for file "1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39" for additional details. This sample varies slightly in the following ways.



----------Begin Packet Formatting---------

[OPCODE][4 Bytes data length][4 Bytes unused][AUTH CODE 72 50 BF 9E][Data]

----------End Packet Formatting---------



The implant initiates callback to C2, then waits for tasking (DOES NOT immediately send its victim_info) and the Victim_info for this version contains Unicode strings, it additionally adds UserGeoID to victim_info.



The sample attempts to connect to 159.100.250.231:8080 4 times, with 1 minute between attempts. If does not succeed, then attempts to connect to www.example.com 4 times, with 1 minute between attempts. This loop continues until a connection is made.

Displayed below is a Python3 script used to decrypt and extract the embedded files:



--Begin Decryption and Extraction Python3 Script--

import argparse

import struct



def truncate_nullterm_str(data):

   null_index = data.find(b'\x00')

   truncated_str = data[:null_index].decode('utf-8')

   return truncated_str



def decode(offset,buffer,length,key1,key2):

   dec = b''

   k3 = key1

   key1 = key1 >> 1

   while length > 0:

       k1 = key1

       k2 = key2

       dec += bytes([(buffer[offset] ^ k1 ^ k2 ^ k3) & 0xff])

       key1 = (key1 >> 8 | ((key1 * 8 ^ key1) & 0x7f8) << 0x14) & 0xffffffff

       k3 = (k3 & k2 ^ (k2 ^ k3) & k1)

       key2 = (key2 >> 8 | (((key2 * 2 ^ key2) << 4 ^ key2) & 0xffffff80 ^ key2 << 7) << 0x11) & 0xffffffff

       offset += 1

       length -= 1

   return dec



offset = 0

def parse_options(buffer):

   options = list(struct.unpack('I'*30, buffer[0:120]))

   options.append(buffer[120:320])

   options.append(buffer[320:2820])

   options.append(buffer[2820:3020])

   options.append(buffer[3020:3120])

   options.append(buffer[3120:3220])

   options.append(buffer[3220:3320])

   options.append(buffer[3320:3360])



   enabled_options = ''

   disabled_options = ''



   if options[0] == 0:

       global offset

       offset = options[27] + options[28] + options[22]

       enabled_options += "Embedded payload at offset: %d\n" % offset

       disabled_options += "Download payload\n"

   else:

       enabled_options += "Download payload from: %s\n" % truncate_nullterm_str(options[30])

       disabled_options += "Embedded payload\n"



   str = "VM Detect\n"

   if options[1] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Sandbox Detect\n"

   if options[2] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Debugger Detect\n"

   if options[3] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Active Processes Check\n"

   if options[4] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Installed programs Check\n"

   if options[5] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Language Check\n"

   if options[6] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Username Check\n"

   if options[7] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Computer name Check\n"

   if options[8] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Installed number of programs Check\n"

   if options[9] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Number running processes Check\n"

   if options[10] == 0:

       disabled_options += str

   else:

       enabled_options += "Number running processes Check: %d\n" % options[10]



   str = "System processors/memory/diskspace Check\n"

   if options[11] == 0:

       disabled_options += str

   else:

       if options[11] & 0x001:

           enabled_options += "Processor count check: %d\n" % options[12]

       if options[11] & 0x010:

           enabled_options += "Physical memory check: %d\n" % options[13]

       if options[11] & 0x000:

           enabled_options += "Disk space check: %d\n" % options[14]



   str = "DLL Hijack cliconfg.exe\n"

   if options[12] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "EnableLUA\n"

   if options[16] == 0:

       disabled_options += str

   else:

       enabled_options += str



   str = "Create Persistence\n"

   if options[17] == 0:

       disabled_options += str

   elif options[17] == 1:

       enabled_options += "Create Persistence using Run key: %s\n" % truncate_nullterm_str(options[31][0x960:])

   elif options[17] == 2:

       enabled_options += "Create Persistence in Startup folder\n"

   elif options[17] == 3:

       enabled_options += "Create Persistence using \"System Backup\" hourly Scheduled Task\n"



   if options[18] == 0:

       disabled_options += "Direct Execution\n"

   else:

       disabled_options += "Process Hollowing\n"



   if options[19] == 0:

       enabled_options += "Process Hollowing: self\n"

   elif options[19] == 1:

       enabled_options += "Process Hollowing: svchost.exe\n"

   elif options[19] == 2:

       enabled_options += "Process Hollowing: conhost.exe\n"

   elif options[19] == 3:

       enabled_options += "Process Hollowing: explorer.exe\n"

   elif options[19] == 4:

       enabled_options += "Process Hollowing: \"http\shell\open\command\" registry key value\n"

   elif options[19] == 5:

       enabled_options += "Process Hollowing: %s\n" % truncate_nullterm_str(options[33])



   str = "Sleep Timer\n"

   if options[20] == 0:

       disabled_options += str

   else:

       enabled_options += "Sleep Timer: %d\n" % options[20]



   str = "Kill Timer\n"

   if options[21] == 0:

       disabled_options += str

   else:

       enabled_options += "Kill Timer: %d\n" % options[26]



   if options[29] == 0:

       enabled_options += "Relocate to: C:\\"

   elif options[29] == 1:

       enabled_options += "Relocate to: %windir%\\"

   elif options[29] == 2:

       enabled_options += "Relocate to: %system%\\"

   elif options[29] == 3:

       enabled_options += "Relocate to: %programfiles%\\"

   elif options[29] == 4:

       enabled_options += "Relocate to: %programfiles%\\Common Files\\"

   elif options[29] == 5:

       enabled_options += "Relocate to: C:\\ProgramData\\"

   elif options[29] == 6:

       enabled_options += "Relocate to: %userprofile%\\"

   elif options[29] == 7:

       enabled_options += "Relocate to: %userprofile%\\Documents\\"

   elif options[29] == 8:

       enabled_options += "Relocate to: %temp%\\"

   elif options[29] == 9:

       enabled_options += "Relocate to: %userprofile%\\Favorites\\"

   elif options[29] == 10:

       enabled_options += "Relocate to: %appdata%\\"

   elif options[29] == 11:

       enabled_options += "Relocate to: %localappdata%\\"

   if len(truncate_nullterm_str(options[34])) > 0:

       enabled_options += "%s\\" % truncate_nullterm_str(options[34])

   enabled_options += "%s\n" % truncate_nullterm_str(options[35])



   str = "Mutex\n"

   if len(truncate_nullterm_str(options[36])) == 0:

       disabled_options += str

   else:

       enabled_options += "Mutex: %s\n" % truncate_nullterm_str(options[36])



   print("\nDisabled Options:")

   print(disabled_options)



   print("\nEnabled Options:")

   print(enabled_options)





def main():

   parser = argparse.ArgumentParser()

   parser.add_argument('filename')

   args = parser.parse_args()



   with open(args.filename, 'rb') as f:

       exe = f.read()

       PE_header_pos = struct.unpack('<i', exe[0x3c:0x3c+4])[0]

       PE_header_len = struct.unpack('<i', exe[PE_header_pos+0x54:PE_header_pos+0x54+4])[0]

       PE_header_length = struct.unpack('<h', exe[PE_header_pos+0x14:PE_header_pos+0x14+2])[0]

       section_headers_pos = PE_header_pos + PE_header_length + 0x18

       num_headers = struct.unpack('<h', exe[PE_header_pos+0x6:PE_header_pos+0x6+2])[0]

       curr_header_pos = section_headers_pos

       bitmap_pos = PE_header_len

       for i in range(num_headers):

           header_len = struct.unpack('<i', exe[curr_header_pos+0x10:curr_header_pos+0x10+4])[0]

           bitmap_pos += header_len

           curr_header_pos += 0x28

       key1 = struct.unpack('<I', exe[bitmap_pos+0x3a:bitmap_pos+0x3a+4])[0]

       bitmap_len = len(exe) - bitmap_pos

       bitmap_header_len = struct.unpack('<H', exe[bitmap_pos+0x3e:bitmap_pos+0x3e+2])[0]

       key2 = struct.unpack('<I', exe[bitmap_pos+0x36:bitmap_pos+0x36+4])[0]

       bitmap_len -= bitmap_header_len

       bitmap_len -= 0x036

       print("[ ] Decoding %d Bytes with:" % bitmap_len)

       print("    Key1: %s" % hex(key1))

       print("    Key2: %s" % hex(key2))

       dec = decode(0,exe[bitmap_pos+bitmap_header_len+0x36:],bitmap_len,key1,key2)

       print("[+] Decoding Complete!")

       parse_options(dec[0:0xd56-0x36])

       payload_pos = 0xd56-0x36+offset

       print("[ ] Found embedded payload, extracting..")

       with open(args.filename + "_payload.exe", 'wb') as out:

           out.write(dec[payload_pos:])

       print("[+] Wrote %d Bytes to %s" % (len(dec[payload_pos:]), args.filename + "_payload.exe"))



if __name__ == '__main__':

   main()

--End Decryption and Extraction Python3 Script--

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

• Maintain up-to-date antivirus signatures and engines.
• Keep operating system patches up-to-date.
• Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
• Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
• Enforce a strong password policy and implement regular password changes.
• Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
• Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
• Disable unnecessary services on agency workstations and servers.
• Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
• Monitor users' web browsing habits; restrict access to sites with unfavorable content.
• Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
• Scan all software downloaded from the Internet prior to executing.
• Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, "Guide to Malware Incident Prevention & Handling for Desktops and Laptops".

• 1-888-282-0870
• NCCICCustomerService@us-cert.gov (UNCLASS)
• us-cert@dhs.sgov.gov (SIPRNET)
• us-cert@dhs.ic.gov (JWICS)

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.gov/forms/feedback/

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or soc@us-cert.gov.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

• Web: https://malware.us-cert.gov
• E-Mail: submit@malware.us-cert.gov
• FTP: ftp.malware.us-cert.gov (anonymous)

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.us-cert.gov.