Analysis Report

MAR-10382580-r2.v1 – RAT

Last Revised
Alert Code
AR22-197A

Notification

This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.

Summary

Description

This CISA submission included one unique file. This file is a malicious loader that contains an embedded executable. This embedded executable is a Remote Access Tool (RAT) that provides a vast array of Command and Control (C2) capabilities. These C2 capabilities include the ability to remotely monitor a system's desktop, gain reverse shell access, exfiltrate data, and upload and execute additional payloads. The malware can also function as a proxy, allowing a remote operator to pivot to other systems.

For a downloadable copy of IOCs, see: MAR-10382580.r2.v1.WHITE_stix

Submitted Files (1)

4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f (ilasvc.exe)

IPs (1)

151.106.30.120

Findings

4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f

Tags

remote-access-trojantrojan

Details
Name ilasvc.exe
Size 1056768 bytes
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 05d38bc82d362dd57190e3cb397f807d
SHA1 52b04d348adf7e42e7c7d6c2ec9aabbcaba07188
SHA256 4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f
SHA512 d03894ad9ce7a5f0e58a5e6385926263507f2571e3cbe60fce1ed5463a77152a7779d8b494ee7a6ff4986de19c0a92cbcc8dae5697d69dc196c474723ee553ef
ssdeep 24576:mStdBO8/kIH46+jHd3JURkxXH3rg9fNJa9y5xmDYzgLu8b7oCK:mST2+qXHbg91Ja9y5MOgL3K
Entropy 7.599564
Antivirus
ESET a variant of Win64/Injector.HA.gen trojan
IKARUS Trojan.Win64.Injector
YARA Rules
  • rule CISA_10382580_03 : loader

    {

       meta:

           Author = "CISA Code & Media Analysis"

           Incident = "10382580"

           Date = "2022-05-02"

           Last_Modified = "20220602_1200"

           Actor = "n/a"

           Category = "Loader"

           Family = "n/a"

           Description = "Detects loader samples"

           MD5_1 = "3764a0f1762a294f662f3bf86bac776f"

           SHA256_1 = "f7f7b059b6a7dbd75b30b685b148025a0d4ceceab405e553ca28cacdeae43fab"

           MD5_2 = "21fa1a043460c14709ef425ce24da4fd"

           SHA256_2 = "66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16"

           MD5_3 = "e9c2b8bd1583baf3493824bf7b3ec51e"

           SHA256_3 = "7ea294d30903c0ab690bc02b64b20af0cfe66a168d4622e55dee4d6233783751"

           MD5_4 = "de0d57bdc10fee1e1e16e225788bb8de"

           SHA256_4 = "33b89b8915aaa59a3c9db23343e8c249b2db260b9b10e88593b6ff2fb5f71d2b"

           MD5_5 = "9b071311ecd1a72bfd715e34dbd1bd77"

           SHA256_5 = "3c2c835042a05f8d974d9b35b994bcf8d5a0ce19128ebb362804c2d0f3eb42c0"

           MD5_6 = "05d38bc82d362dd57190e3cb397f807d"

           SHA256_6 = "4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f"

       strings:

           $s0 = { B8 01 00 00 00 48 6B C0 00 C6 44 04 20 A8 B8 01 }

           $s1 = { 00 00 48 6B C0 01 C6 44 04 20 9A B8 01 00 00 }

           $s2 = { 48 6B C0 02 C6 44 04 20 93 B8 01 00 00 00 48 }

           $s3 = { C0 03 C6 44 04 20 9B B8 01 00 00 00 48 6B C0 }

       condition:

           all of them

    }
ssdeep Matches

No matches found.

PE Metadata
Compile Date 2020-04-30 19:43:57-04:00
Import Hash 99197f3296550481a848ea8d4e097487
Company Name Sysinternals - www.sysinternals.com
File Description Flush cached data to disk.
Internal Name Sync
Legal Copyright Copyright (C) 2016 Mark Russinovich
Original Filename Sync.exe
Product Name Sysinternals Sync
Product Version 2.2
PE Sections
MD5 Name Raw Size Entropy
a917582fc3e796bb1d43bfce05c0cfb3 header 1024 3.105665
5fbd29958a5484173910cb06dcfc4e9e .text 310784 6.453454
34b6e6a847957ef90ef9460e0f8dd3d0 .rdata 98304 5.168254
e32c1166142d325350f6e6443db43144 .data 3584 2.609738
ffc4ab2046acad015eba98898e975ad5 .pdata 18432 5.804487
502485fa11633b4eb9eaef15fcb482a5 .rsrc 622080 7.975998
69687e4a3ffbefbe782d13637ce8605a .reloc 2560 4.913641
Relationships
4cd7efdb1a... Connected_To 151.106.30.120
Description

This malware is a 64-bit Windows loader that contains an embedded encrypted malicious executable. During runtime, this embedded executable is decrypted and loaded into memory, never touching the system's hard disk. The encrypted executable is similar in functionality to the file 66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16, described in report MAR-10382580.r1.v1. The malware embedded within this loader attempts to communicate with the hard-coded C2 Internet Protocol (IP) address 151[.]106[.]30[.]120. This malware provides a vast array of C2 capabilities including the ability to log keystrokes, upload and execute additional payloads, function as a proxy, and have graphical user interface (GUI) access over a target Windows system's desktop. Many of the structures utilized to implement the C2 capabilities in this malware appear to be derived from the same source code as 66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16, however this malware utilizes much more complex obfuscation to hinder the analysis of its code structures. This malware also utilizes a more complex encryption algorithm to secure its network communications.



The malware embedded within this binary utilizes a secure strings scheme based on a rotating XOR cipher (Figure 7). The strings are partially decrypted and listed below with their corresponding approximate memory address locations during runtime -- assuming a base address of 0x260000.



--Begin Decoded Strings--



('0x264e32', 'RegQueryValueExl')

('0x264f58', 'RegQueryValueEx\\')

('0x265325', 'GetCurrentProcessId')

('0x265bc9', 'GetEnvironmentVariableW')

('0x265cc1', 'ShellExecuteExW')

('0x268b20', 'GetAdaptersInfo')

('0x268c49', 'GetAdaptersInfo')

('0x26a77c', 'EnumDependentServicesW')

('0x26a98b', 'EnumDependentServi')

('0x26abb9', 'ControlService')

('0x26ad5b', 'QueryServiceStatus')

('0x26af62', 'CloseServiceHandle')

('0x26c3ed', 'GetComputerNameW')

('0x277621', 'GetEnvironmentVariableW')

('0x27856f', 'GetLogicalDriveStringsW')

('0x2788e5', 'GetVolumeInformationW')

('0x278f87', 'FindFirstFileW')

('0x27a3f3', 'GetSystemDirectoryW')

('0x27bf04', 'SetFilePointerEx')

('0x27d125', 'RemoveDirectoryW')

('0x27daa7', 'FindFirstFileW')

('0x284074', 'GetClipboardData')

('0x2850d4', 'GetForegroundWindow')

('0x28513d', 'GetDesktopWindow')

('0x28b443', 'GetProcessHeap')

('0x28b533', 'CoInitializeEx')

('0x28b655', 'StartServiceCtrlDispatch')

('0x28cd63', 'GetModuleFileNameW')

('0x2636f3', 'UnkownError')

('0x2649f3', "Display''''")

('0x264ab0', 'RegOpenKeyExW')

('0x264af0', 'ADVAPI32.dll')

('0x264ca0', 'RegEnumKeyExW')

('0x264ce0', 'ADVAPI32.dll')

('0x264d80', 'RegOpenKeyExW')

('0x264dc0', 'ADVAPI32.dll')

('0x264e90', 'ADVAPI32.dll')

('0x264fb0', 'ADVAPI32.dll')

('0x265160', 'RegCloseKey')

('0x2651b0', 'ADVAPI32.dll')

('0x265390', 'KERNEL32.dll')

('0x265c30', 'KERNEL32.dll')

('0x265d20', 'SHELL32.dll')

('0x266950', 'GetVersionExW')

('0x266990', 'KERNEL32.dll')

('0x266b63', 'CurrentMajorVersionNum')

('0x266c33', 'CurrentMajorVersionNum')

('0x268b80', 'IPHLPAPI.dll')

('0x268c03', 'KERNEL32.dll')

('0x268ca0', 'IPHLPAPI.dll')

('0x26a710', 'GetTickCount')

('0x26a750', 'KERNEL32.dll')

('0x26a7b8', 'EnumDepende')

('0x26a7f3', 'Advapi32.dll')

('0x26a872', 'GetLastError')

('0x26a8b0', 'KERNEL32.dll')

('0x26a940', 'KERNEL32.dll')

('0x26aa17', 'Advapi32.dll')

('0x26aafb', 'OpenServiceW')

('0x26ab4b', 'Advapi32.dll')

('0x26ac33', 'Advapi32.dll')

('0x26acd4', 'Sleep')

('0x26ad24', 'KERNEL32.dll')

('0x26adea', 'Advapi32.dll')

('0x26aeaa', 'GetTickCount')

('0x26af03', 'KERNEL32.dll')

('0x26afdb', 'Advapi32.dll')

('0x26c2e0', 'GetUserNameW')

('0x26c320', 'Advapi32.dll')

('0x26c450', 'KERNEL32.dll')

('0x26cad0', 'KERNEL32.dll')

('0x273220', 'closesocket')

('0x274a90', 'getsockname')

('0x275280', 'getsockname')

('0x276583', 'Erroroccurswhiles')

('0x276714', 'NoTabsinclient.')

('0x2769e3', 'NoTabsinclient.')

('0x276b60', 'KERNEL32.dll')

('0x277690', 'KERNEL32.dll')

('0x2785e0', 'KERNEL32.dll')

('0x2786d3', 'ErroroccursinGetL')

('0x278950', 'KERNEL32.dll')

('0x2789e0', 'GetDriveTypeW')

('0x278a20', 'KERNEL3')

('0x278f10', 'PathCombineW')

('0x278f50', 'SHLWAPI.dll')

('0x278fa4', 'FindFirstFile')

('0x278fe0', 'KERNEL32.dll')

('0x279120', 'PathCombineW')

('0x279160', 'SHLWAPI.dll')

('0x2791c1', 'CreateFileW')

('0x279200', 'KERNEL32.dll')

('0x279280', 'GetFileTime')

('0x2792c0', 'KERNEL32.dll')

('0x279320', 'CloseHandle')

('0x279360', 'KERNEL32.dll')

('0x2796a0', 'FindNextFileW')

('0x2796e0', 'KERNEL32.dll')

('0x2797b3', 'Cannotaccesstofold')

('0x27a460', 'KERNEL32.dll')

('0x27a4e3', 'kernel32.dll')

('0x27a540', 'PathCombineW')

('0x27a580', 'SHLWAPI.dll')

('0x27a5e0', 'CreateFileW')

('0x27a620', 'KERNEL32.dll')

('0x27a692', 'GetFileTime')

('0x27a6d0', 'KERNEL32.dll')

('0x27a730', 'CloseHandle')

('0x27a770', 'KERNEL32.dll')

('0x27acf0', 'CreateFileW')

('0x27ad30', 'KERNEL32.dll')

('0x27ade0', 'GetFileTime')

('0x27ae20', 'KERNEL32.dll')

('0x27af80', 'GetLastError')

('0x27afc0', 'KERNEL32.dll')

('0x27b430', 'GetLastError')

('0x27b470', 'KERNEL32.dll')

('0x27b932', 'CreateFileW')

('0x27b970', 'KERNEL32.dll')

('0x27b9f0', 'GetLastError')

('0x27ba30', 'KERNEL32.dll')

('0x27bf60', 'KERNEL32.dll')

('0x27c000', 'KERNEL32.dll')

('0x27c080', 'KERNEL32.dll')

('0x27c1b0', 'CloseHandle')

('0x27c1f0', 'KERNEL32.dll')

('0x27c270', 'GetLastError')

('0x27c2b0', 'KERNEL32.dll')

('0x27c3c3', 'Nodescriptorfound.')

('0x27c860', 'KERNEL32.dll')

('0x27c950', 'CloseHandle')

('0x27c990', 'KERNEL32.dll')

('0x27c9f0', 'GetLastError')

('0x27ca30', 'KERNEL32.dll')

('0x27cb00', 'CloseHandle')

('0x27cb40', 'KERNEL32.dll')

('0x27cdc0', 'CloseHandle')

('0x27ce00', 'KERNEL32.dll')

('0x27d180', 'KERNEL32.dll')

('0x27d1f0', 'DeleteFileW')

('0x27d230', 'KERNEL32.dll')

('0x27d290', 'GetLastError')

('0x27d2d0', 'KERNEL32.dll')

('0x27d3e3', 'Deletesuccessed.')

('0x2c3743', 'Deletepayloadcorrupt')

('0x27da30', 'PathCombineW')

('0x27da70', 'SHLWAPI.dll')

('0x27dac4', 'FindFirstFile')

('0x27db00', 'KERNEL32.dll')

('0x27dc20', 'PathCombineW')

('0x27dc60', 'SHLWAPI.dll')

('0x27ded1', 'FindNex2@\x04@%@')

('0x27df10', 'KERNEL32.dll')

('0x284030', 'OpenClipboard')

('0x284110', 'Kernel32.dll')

('0x2841b3', '<CTRL+V>')

('0x284253', '</CTRL+V>')

('0x284fe3', 'Composition')

('0x285073', 'Sfwr\\irsf\\i')

('0x28507c', 'otaeMcootW')

('0x285484', 'Monitor%d[%d*%d]')

('0x28b280', 'DeleteObject')

('0x28b400', 'KERNEL32.dll')

('0x28b4a0', 'KERNEL32.dll')

('0x28b6d0', 'Advapi32.dll')

('0x28cdc0', 'KERNEL32.dll')

('0x28d230', 'ExitProcess')

('0x28d270', 'KERNEL32.dll')

('0x28d3b0', 'GetTempPathW')

('0x28d3f0', 'KERNEL32.dll')

('0x28d4a0', 'PathCombineW')

('0x28d4e0', 'SHLWAPI.dll')



--End Decoded Strings--

Screenshots

Figure 1 - This screenshot illustrates the malware sending an initial block of data to its hard-coded C2 server. As with the malware sample 66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16 in MAR-10382580.r1.v1, this malware's initial outbound block contains a chunk of random data and the unicode string "hello".

Figure 2 - This screenshot illustrates the malware's hard-coded cryptographic key it utilizes to encrypt and decrypt its network communications traffic via the algorithm in Figure 4.

Figure 3 - This screenshot illustrates the data returned to the remote operator if they simply reply to the malware's initial "hello" packet with their own "hello" packet. This data block contains the compromised system's MAC address, IP address, OS version, processor type, as well as other system specific information. The cryptographic algorithm illustrated in Figure 4 will be utilized to encrypt this data before it is sent to the remote C2 server.

Figure 4 - This screenshot illustrates code extracted from this malware's primary cryptographic function. This algorithm will be utilized to encrypt and decrypt all network traffic exchanged between this implant and its remote operator. Although the malware does communicate over port 443, this algorithm is utilized rather than SSL. Static analysis indicates a hard-coded 16 byte key is utilized to encrypt and decrypt network traffic. That key can be observed in Figure 2.

Figure 5 - This screenshot illustrates the names of various classes utilized by this implant. The class VK1AlgorithmEngine contains the function which is utilized to encrypt and decrypt this malware's network traffic (Figure 4). Notably, the previously analyzed sample 66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16 utilizes a different class to implement its network traffic encryption. That sample's cryptographic class name is VSimpleXorAlgorithmEngine. This explains why the samples, while structurally and functionally very similar, utilize a different algorithm to secure their network communications.

Figure 6 - This screenshot illustrates several malicious classes this malware utilizes. The class VFeatureCmd provides the function which implements the malware's reverse shell capability -- providing the remote hacker direct access to a Windows command shell. The class VFeatureKeylogger provides advanced key logging capabilities. Static analysis indicates the VFeatureSocks and VFeatureTunnel classes implement the malware's TCP proxying capability. And the VFeatureScreen class provides functions which allow the remote operator to monitor victim user's desktop / GUI sessions. These same classes are utilized in malware sample 66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16 in MAR-10382580.r1.v1.

Figure 7 - This malware sample contains many encoded strings. As illustrated in this screenshot, many of the strings are encoded using an XOR cipher utilizing a single-byte key. A different XOR single-byte key will be used to decode each string.

Figure 8 - his screenshot illustrates a misspelling with the word "modifing" in the malware's source code. This same misspelling can be observed in the plugin embedded within malware sample 66966ceae7e3a8aace6c27183067d861f9d7267aed30473a95168c3fe19f2c16 in MAR-10382580.r1.v1. This piece of information may be useful for attribution purposes.

151.106.30.120

Tags

command-and-control

Ports
  • 443 TCP
Whois

% Abuse contact for '151.106.30.0 - 151.106.30.255' is 'pivps.com@gmail.com'



inetnum:        151.106.30.0 - 151.106.30.255

netname:        VELIANET-FR-PINETLLC

descr:         Pi NET, LLC

country:        FR

org:            ORG-PNL20-RIPE

admin-c:        PNL16-RIPE

tech-c:         PNL16-RIPE

status:         LEGACY

remarks:        ticket.velia.net 110128

notify:         hostmaster@velia.net

mnt-by:         FGK-MNT

created:        2018-04-24T19:17:51Z

last-modified: 2018-04-24T19:17:51Z

source:         RIPE



organisation: ORG-PNL20-RIPE

org-name:     Pi NET, LLC

org-type:     OTHER

address:        No 74, Tang Thiet Giap, Co Nhue

address:        Tu Liem

address:        100000 Hanoi

address:        Viet Nam

phone:         +84 977471775

e-mail:         pivps.com@gmail.com

admin-c:        PNL16-RIPE

tech-c:         PNL16-RIPE

abuse-c:        PNL16-RIPE

mnt-ref:        FGK-MNT

mnt-by:         FGK-MNT

created:        2017-09-07T11:08:29Z

last-modified: 2017-09-07T11:08:29Z

source:         RIPE



role:         Pi NET, LLC

address:        No 74, Tang Thiet Giap, Co Nhue

address:        Tu Liem

address:        100000 Hanoi

address:        Viet Nam

phone:         +84 977471775

e-mail:         pivps.com@gmail.com

nic-hdl:        PNL16-RIPE

mnt-by:         FGK-MNT

created:        2017-09-07T11:08:29Z

last-modified: 2017-09-07T11:08:29Z

source:         RIPE

abuse-mailbox: pivps.com@gmail.com



route:         151.106.0.0/19

descr:         velia.net

origin:         AS29066

notify:         hostmaster@velia.net

mnt-by:         FGK-MNT

created:        2017-11-03T11:55:17Z

last-modified: 2017-11-03T11:55:17Z

source:         RIPE

Relationships
151.106.30.120 Connected_From 4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f
Description

This IP address is the hard-coded C2 the malware communicates with over port 443.

Relationship Summary

4cd7efdb1a... Connected_To 151.106.30.120
151.106.30.120 Connected_From 4cd7efdb1a7ac8c4387c515a7b1925931beb212b95c4f9d8b716dbe18f54624f

Recommendations

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

  • Maintain up-to-date antivirus signatures and engines.
  • Keep operating system patches up-to-date.
  • Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
  • Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
  • Enforce a strong password policy and implement regular password changes.
  • Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
  • Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
  • Disable unnecessary services on agency workstations and servers.
  • Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
  • Monitor users' web browsing habits; restrict access to sites with unfavorable content.
  • Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
  • Scan all software downloaded from the Internet prior to executing.
  • Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, "Guide to Malware Incident Prevention & Handling for Desktops and Laptops".

Contact Information

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/

Document FAQ

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Central.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.cisa.gov.

Revisions

July 18, 2022: Initial version

This product is provided subject to this Notification and this Privacy & Use policy.