www.welivesecurity.com Open in urlscan Pro
2600:1400:9000::687e:7499  Public Scan

Form analysis
5 forms found in the DOM

GET https://www.welivesecurity.com/

<form action="https://www.welivesecurity.com/" class="basic-searchform imc dark col-md-12 col-sm-10 col-xs-12" method="get" role="search">
  <div class="search-input clearfix">
    <input type="text" name="s" value="" placeholder="Search..." class="imc">
    <button class="imc">
      <span class="icomoon icon-icon_search imc"></span>
    </button>
  </div>
</form>

---

GET https://www.welivesecurity.com/

<form action="https://www.welivesecurity.com/" class="basic-searchform imc dark col-md-12 col-sm-10 col-xs-12" method="get" role="search">
  <div class="search-input clearfix">
    <input type="text" name="s" value="" placeholder="Search..." class="imc">
    <button class="imc">
      <span class="icomoon icon-icon_search imc"></span>
    </button>
  </div>
</form>

---

GET https://www.welivesecurity.com/

<form action="https://www.welivesecurity.com/" class="basic-searchform imc  col-md-12 col-sm-10 col-xs-12" method="get" role="search">
  <div class="search-input clearfix">
    <input type="text" name="s" value="" placeholder="Search..." class="imc">
    <button class="imc">
      <span class="icomoon icon-icon_search imc"></span>
    </button>
  </div>
</form>

---

POST https://enjoy.eset.com/pub/rf

<form action="https://enjoy.eset.com/pub/rf" class="basic-searchform col-md-12 col-sm-12 col-xs-12 no-padding newsletter" method="post" role="search">
  <div class="search-input clearfix">
    <input type="text" name="EMAIL_ADDRESS_" value="" placeholder="Email...">
    <input type="hidden" name="TOPIC" value="We Live Security Ukraine Newsletter">
    <input type="hidden" name="_ri_" value="X0Gzc2X%3DAQpglLjHJlTQGgXv4jDGEK4KW2uhw0qgUzfwuivmOJOPCgzgo9vsI3VwjpnpgHlpgneHmgJoXX0Gzc2X%3DAQpglLjHJlTQGzbD6yU2pAgzaJM16bkTA7tOwuivmOJOPCgzgo9vsI3">
    <input type="hidden" name="_ei_" value="Ep2VKa8UKNIAPP_2GAEW0bY">
    <input type="hidden" name="_di_" value="m0a5n0j02duo9clmm4btuu5av8rdtvqfqd03v1hallrvcob47ad0">
    <input type="hidden" name="EMAIL_PERMISSION_STATUS_" value="O">
    <input type="hidden" name="CONTACT_SOURCE_MOST_RECENT" value="WLS_Subscribe_Form">
    <button class="button-flag"> Submit </button>
  </div>
</form>

---

POST https://enjoy.eset.com/pub/rf

<form action="https://enjoy.eset.com/pub/rf" class="basic-searchform col-md-12 col-sm-12 col-xs-12 no-padding newsletter" method="post" role="search">
  <div class="search-input clearfix">
    <input type="text" name="EMAIL_ADDRESS_" value="" placeholder="Email...">
    <input type="hidden" name="NEWSLETTER" value="We Live Security">
    <input type="hidden" name="_ri_" value="X0Gzc2X%3DAQpglLjHJlTQGgXv4jDGEK4KW2uhw0qgUzfwuivmOJOPCgzgo9vsI3VwjpnpgHlpgneHmgJoXX0Gzc2X%3DAQpglLjHJlTQGzbD6yU2pAgzaJM16bkTA7tOwuivmOJOPCgzgo9vsI3">
    <input type="hidden" name="_ei_" value="Ep2VKa8UKNIAPP_2GAEW0bY">
    <input type="hidden" name="_di_" value="m0a5n0j02duo9clmm4btuu5av8rdtvqfqd03v1hallrvcob47ad0">
    <input type="hidden" name="EMAIL_PERMISSION_STATUS_" value="O">
    <input type="hidden" name="CONTACT_SOURCE_MOST_RECENT" value="WLS_Subscribe_Form">
    <button class=""> Submit </button>
  </div>
</form>

---

Text Content

In English
 * Em Português
 * En français
 * En Español
 * In Deutsch

Menu toggle menu

 * All Posts
 * Ukraine Crisis – Digital Security Resource Center
 * We Live Progress
 * Research
 * How To
 * Videos
 * White Papers
 * Threat Reports
 * Resources
 * Our Experts

 * Em Português
 * En français
 * En Español
 * In Deutsch





Award-winning news, views, and insight from the ESET security community


MUSTANG PANDA’S HODUR: OLD TRICKS, NEW KORPLUG VARIANT

ESET researchers have discovered Hodur, a previously undocumented Korplug
variant spread by Mustang Panda, that uses phishing lures referencing current
events in Europe, including the invasion of Ukraine
Alexandre Côté Cyr
23 Mar 2022 - 09:00AM
Share

ESET researchers have discovered Hodur, a previously undocumented Korplug
variant spread by Mustang Panda, that uses phishing lures referencing current
events in Europe, including the invasion of Ukraine

ESET researchers discovered a still-ongoing campaign using a previously
undocumented Korplug variant, which they named Hodur due to its resemblance to
the THOR variant previously documented by Unit 42 in 2020. In Norse mythology,
Hodur is Thor’s blind half-brother, who is tricked by Loki into killing their
half-brother Baldr.

Key findings in this blogpost:

 * As of March 2022, this campaign is still ongoing and goes back to at least
   August 2021.
 * Known victims include research entities, internet service providers, and
   European diplomatic missions.
 * The compromise chain includes decoy documents that are frequently updated and
   relate to events in Europe.
 * The campaign uses a custom loader to execute a new Korplug variant.
 * Every stage of the deployment process utilizes anti-analysis techniques and
   control-flow obfuscation, which sets it apart from other campaigns.
 * ESET researchers provide an in-depth analysis of the capabilities and
   commands of this new variant.

Victims of this campaign are likely lured with phishing documents abusing the
latest events in Europe such as Russia’s invasion of Ukraine. This resulted in
more than three million residents fleeing the war to neighboring countries,
leading to an unprecedented crisis on Ukraine’s borders. One of the filenames
related to this campaign is Situation at the EU borders with Ukraine.exe.

Other phishing lures mention updated COVID-19 travel restrictions, an approved
regional aid map for Greece, and a Regulation of the European Parliament and of
the Council. The last one is a real document available on the European Council’s
website. This shows that the APT group behind this campaign is following current
affairs and is able to successfully and swiftly react to them.

Figure 1. Countries affected by Mustang Panda in this campaign


AFFECTED COUNTRIES:

 * Mongolia
 * Vietnam
 * Myanmar
 * Greece
 * Russia
 * Cyprus
 * South Sudan
 * South Africa


AFFECTED VERTICALS:

 * Diplomatic missions
 * Research entities
 * Internet service providers (ISPs)


ANALYSIS

Based on code similarities and the many commonalities in Tactics, Techniques,
and Procedures (TTPs), ESET researchers attribute this campaign with high
confidence to Mustang Panda (also known as TA416, RedDelta, or PKPLUG). It is a
cyberespionage group mainly targeting governmental entities and NGOs. Its
victims are mostly, but not exclusively, located in East and Southeast Asia with
a focus on Mongolia. The group is also known for its campaign targeting the
Vatican in 2020.

While we haven’t been able to identify the verticals of all victims, this
campaign seems to have the same targeting objectives as other Mustang Panda
campaigns. Following the APT’s typical victimology, most victims are located in
East and Southeast Asia, along with some in European and African countries.
According to ESET telemetry, the vast majority of targets are located in
Mongolia and Vietnam, followed by Myanmar, with only a few in the other affected
countries.

Mustang Panda’s campaigns frequently use custom loaders for shared malware
including Cobalt Strike, Poison Ivy, and Korplug (also known as PlugX). The
group has also been known to create its own Korplug variants. Compared to other
campaigns using Korplug, every stage of the deployment process utilizes
anti-analysis techniques and control-flow obfuscation.

This blogpost contains a detailed analysis of this previously unseen Korplug
variant used in this campaign. This activity is part of the same campaign
recently covered by Proofpoint, but we provide additional historical and
targeting information.


TOOLSET

Mustang Panda is known for its elaborate custom loaders and Korplug variants,
and the samples used in this campaign showcase this perfectly.

Compromise chains seen in this campaign follow the typical Korplug pattern: a
legitimate, validly signed, executable vulnerable to DLL search-order hijacking,
a malicious DLL, and an encrypted Korplug file are deployed on the target
machine. The executable is abused to load the module, which then decrypts and
executes the Korplug RAT. In some cases, a downloader is used first to deploy
these files along with a decoy document. This process is illustrated in Figure
2.

Figure 2. Overview of the deployment process for the Hodur Korplug variant.

What sets this campaign apart is the heavy use of control-flow obfuscation and
anti-analysis techniques at every stage of the deployment process. The following
sections describe the behavior of each stage and take a deeper look at the
defense evasion techniques used in each of them.


INITIAL ACCESS

We haven’t been able to observe the initial deployment vector, but our analysis
points to phishing and watering hole attacks as likely vectors. In instances
where we saw a downloader, the filenames used suggest a document with an
interesting subject for the target. Such examples include:

 * COVID-19 travel restrictions EU reviews list of third countries.exe
 * State_aid__Commission_approves_2022-2027_regional_aid_map_for_Greece.exe
 * REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL.exe
 * Situation at the EU borders with Ukraine.exe

To further the illusion, these binaries download and open a document that has
the same name but with a .doc or .pdf extension. The contents of these decoys
accurately reflect the filename. As shown in Figure 3, at least one of them is a
publicly accessible legitimate document from the European Parliament.

Figure 3. First page of the decoy document for the REGULATION OF THE EUROPEAN
PARLIAMENT AND OF THE COUNCIL.exe downloader. It’s a real document available on
the European Council’s website.


DOWNLOADER

Although its complexity has increased over the course of the campaign, the
downloader is fairly straightforward. This increase in complexity comes from
additional anti-analysis techniques, which we cover later in this section.

It first downloads four files over HTTPS: a decoy document, a legitimate
executable, a malicious module, and an encrypted Korplug file. The combination
of those last three components to execute a payload via DLL side-loading is
sometimes referred to as a trident and is a technique commonly used by Mustang
Panda, and with Korplug loaders in general. Both the server addresses and file
paths are hardcoded in the downloader executable. Once everything is downloaded,
and the decoy document opened to distract the victim, the downloader uses the
following command line to launch the legitimate executable:

cmd /c ping 8.8.8.8 -n 70&&”%temp%\<legitimate executable>”

This ping command both checks internet connectivity and introduces a delay
(through the -n 70 option) before executing the downloaded, legitimate
executable.

The downloader uses multiple anti-analysis techniques, many of which are also
used in the loader and final payload. Additional obfuscation has been added to
new versions over the course of the campaign without otherwise changing their
goal.

In early versions of the downloader, junk code and opaque predicates were used
to hinder analysis, as shown in Figure 4, but the server and filenames are
plainly visible in cleartext.

Figure 4. Control flow obfuscation in early versions of the downloader

In later versions, the files on the server are RC4 encrypted, using the base 10
string representation of the file size as the key, and then hex-encoded. This
process is illustrated in the Python snippet below. The opposite operations are
performed client-side by the downloader to recover the plaintext files. This is
likely done to bypass network-level protections.

from Crypto.cipher import ARC4
key = “%d” % len(plaintext)
rc4 = ARC4.new(key)
cipher_content = rc4.encrypt(plaintext).hex().upper()

These versions replace the use of cleartext strings with encrypted stack
strings. They are still hardcoded in the file, but the obfuscation surrounding
them, and the use of different keys, makes it hard to decrypt them statically in
an automated manner. This same technique is used heavily in the subsequent
stages. Encrypted stack strings are also used to obfuscate calls to Windows API
functions.

First, the name of the target function is decrypted and passed to a function.
This function obtains a pointer to the InMemoryOrderModuleList field of the PEB
(Process Environment Block). It then iterates over the loaded modules, passing
each handle to GetProcAddress along with the function name until the target
function is successfully resolved. Part of this process can be seen in Figure 5.

Figure 5. Obfuscation of Windows API calls in the downloader. The screenshot
shows a call to WriteFile, but the same pattern is used for all API functions.


LOADER

As is common with Korplug, the loader is a DLL that exploits a side-loading
vulnerability in a legitimate, signed executable. We have observed many
different applications being abused in this campaign, for instance a vulnerable
SmadAV executable previously seen by Qurium in a campaign attributed to Mustang
Panda that targeted Myanmar.

The loader exports multiple functions. The exact list varies depending on the
abused application, but in all cases, only one of them does anything of
consequence. In all of the loaders we observed, this is the exported function
with the highest load address. All the other exports, and the library’s entry
point, either return immediately or execute some do-nothing junk code. Many of
these exports have names that consist of random lowercase letters and point to
the same address as shown in Table 1.

Table 1. Functions exported by a Hodur loader. The createSystemFontsUsingEDL
export is the one that loads the final malware stage in this version.

NameOrdinalFunction RVA CreatePotPlayerExW10x00007894 RunPotPlayer20x000166A5
createSystemFontsUsingEDL30x00016779 gGegcerhwyvxtkrtyawvugo40x00007894
liucigvyworf50x00007639 ojohjinbgdfqtcwxojeusoneslciyxtiyjuieaugadjpd60x000077CA
soeevhiywsypipesxfhgxboleahfwvlqcqp70x00007894
srkeqffanuhiuwahbmatdurggpffhbkcpukyxgxmosn80x00007894 thggvmrv90x00007701

The loader function obtains the directory from which the DLL is running using
GetModuleFileNameA and tries to open the encrypted Korplug file it contains.
That filename is hardcoded in the loader. It reads the file’s contents into a
locally allocated buffer and decrypts it. The loader makes this buffer
executable using VirtualProtect before calling into it at offset 0x00.

Windows API function calls are obfuscated with a different technique than that
used in the downloader. Unlike the loader, which contains the names of its
functions (as shown in Table 1 above), only the 64-bit hashes of the Windows API
function calls are present in the binary. To resolve those functions, the loader
traverses the export lists of all loaded libraries via the
InMemoryOrderModuleList of the PEB. Each export’s name is hashed, then compared
to the expected value. The FNV-1a hash algorithm, recently brought back into the
mainstream by the Sunburst backdoor, has previously been used by Mustang Panda,
in Korplug loaders documented by XORHEX, to resolve GetProcAddress and
LoadLibraryA, although it was not identified by name in that analysis. In this
version, however, it is used for all API functions.


KORPLUG BACKDOOR

Korplug (also known as PlugX) is a RAT used by multiple APT groups. In spite of
it being so widely used, or perhaps because of it, few reports extensively
describe its commands and the data it exfiltrates. Its functionality is not
constant between variants, but there does seem to exist a significant overlap in
the list of commands between the version we analyzed and other sources such as
the Avira report from January 2020 and the plugxdecoder project on GitHub.

As previously mentioned, the variant used in this campaign bears many
similarities to the THOR variant, which is why we have named it Hodur. The
similarities include the use of the Software\CLASSES\ms-pu registry key, the
same format for C&C servers in the configuration, and use of the Static window
class.

As expected for Korplug payloads, this stage is only ever decrypted in memory by
the loader. Only the encrypted version is written to disk in a file with a .dat
extension.

Unless stated otherwise, all hardcoded strings discussed in this section are
stored as encrypted stack strings.

In this module, Windows API functions are obfuscated through a combination of
the methods used in previous stages. LoadLibraryA and GetProcAddress are
resolved via the FNV-1a hashing technique and stack strings are decrypted and
passed to them to obtain the target function.

LOADING

Once decrypted, the payload is a valid DLL that exports a single function. In
almost all observed samples from this campaign, this function is named
StartProtect. However, launching it directly via this export or its entry point
will not execute the main payload and the loading process is quite intricate.

As explained in the previous section, the file is decrypted in memory as a
continuous blob by the loader and the execution starts at offset 0x00. The PE
header contains shellcode, shown in Figure 6, that calls a specific offset that
corresponds to the module’s single export.

Figure 6. Shellcode in the PE header that calls the exported function

This function parses the PE blob in memory and manually maps it as a library
into a newly allocated buffer. This includes mapping the various sections,
resolving imports and, finally, using DLL_PROCESS_ATTACH to call the DLL entry
point. Once again, opaque predicates and junk code are used to obfuscate the
purpose of this function.

The entry point of the properly loaded library is then called with the
non-standard value of 0x04 for the fdwReason parameter (only values from 0x00 to
0x03 are currently defined). This special value is required to get it to execute
its main payload. This simple check prevents the RAT from being trivially
executed directly with a generic tool like rundll32.exe.

The backdoor first decrypts its configuration using the string 123456789 as a
repeating XOR key. Once decrypted, the configuration block starts with ########.
The layout of the configuration varies slightly between samples, but they all
contain at least the following fields:

 * Installation directory name. Also used as the name of the registry key
   created for persistence. This value roughly corresponds to the name of the
   abused application with three random letters appended (e.g., FontEDLZeP or
   AdobePhotosGQp)
 * Mutex name
 * A value that is either a version or ID string
 * List of C&C servers. Each entry includes IP address, port number, and a
   number indicating the protocol to use with that C&C

The backdoor then checks the path from which it is running using
GetModuleFileNameW. If this matches %userprofile%\<installation directory> or
%allusersprofile%\<installation directory>, the RAT functionality will be
executed. Otherwise, it will go through the installation process.

INSTALLATION

To install itself, the malware creates the aforementioned directory under
%allusersprofile%. Using SetFileAttributesW, it is then marked as hidden and
system. The vulnerable executable, loader module, and encrypted Korplug files
are copied to the new directory.

Next, persistence is established. Earlier samples achieved this by creating a
scheduled task to be run at boot via schtasks.exe. Newer samples add a registry
entry to Software\Microsoft\Windows\CurrentVersion\Run, trying the HKLM hive
first, then HKCU. This entry has the same name as the installation directory
with its value set to the newly copied executable’s path.

Once persistence has been set up, the malware launches the executable from its
new location and exits.

RAT

The RAT functionality of the Hodur variant used in this campaign mostly lines up
with other Korplug variants, with some additional commands and characteristics.
As we have previously stated, though, detailed analyses of Korplug commands are
few and far between, so we aim to provide such an analysis in the hopes of
aiding future analysts.

When in this mode, the backdoor iterates through the list of C&C servers in its
configuration until it reaches the end or receives an Uninstall command. For
each of those servers, it processes commands until it receives a Stop command or
encounters an error.

Hodur’s initial handshake can be done over HTTPS or TCP. This is determined by a
value in the configuration for that particular C&C server. Subsequent
communication is always done over TCP using a custom protocol that we describe
in this section, along with the commands that can be issued. Hodur uses sockets
from the Windows Sockets API (Winsock) that support overlapped I/O.

Following the initial handshake, Hodur’s communications involve TCP messages
that consist of a header, with the structure described in Table 2, followed by a
message body that is usually compressed using LZNT1 and always encrypted with
RC4. Messages whose Command number header field have the 0x10000000 bit set
(those that contain file contents for the ReadFile and WriteFile commands,
described in Table 3) have encrypted but not compressed message bodies. All
encrypted message bodies use the hardcoded key sV!e@T#L$PH% with a four-byte
random nonce (the value at offset 0x00 in the header) appended to it.

Table 2. Header format used for communication between the C&C and the backdoor

OffsetFieldDescription 0x00NonceRandom nonce appended to the RC4 key.
0x04Command numberThis field indicates the command to run or the command that
caused this response to be sent. 0x08Length of bodyLength of the message body.
It seems that this field isn’t checked by the client for messages from the C&C
server. 0x0CCommand exit statusThe return or error value of the command that was
run. This field is not checked by the client in messages received from the C&C
server.

Hodur’s C&C message headers are transmitted in the clear, followed by variably
sized (the value at offset 0x08 of the header) message bodies. The format of the
message body varies per command, but once decrypted and decompressed, values of
variable length (like strings) are always at a message body’s end and their
offset in the body is stored as an integer in the corresponding message field.

Like the version described by Avira, Hodur has two groups of commands – 0x1001
and 0x1002 – each with its own handler. The C&C server can set which group to
listen for by sending the corresponding ID as the command number when a client
is not already in one of the two modes. It will continue to listen for the same
group until it receives the Stop command, or an error occurs (including
receiving a message with an invalid Command number in its header).

The first group, 0x1001, contains commands for managing the execution of the
backdoor and doing initial reconnaissance on a newly compromised host. As these
commands take no arguments, messages sent by the C&C server consist only of the
headers. Table 3 contains a list of these commands. The GetSystemInfo command is
described in more detail below. Note that no command names are present in the
RAT; they were either taken from previous analyses or provided by us.

Table 3. Commands in group 0x1001

IDNameDescriptionData in client response 0x1000PingSent by the client when it
starts listening for commands from this group.Between 0 and 64 random bytes
0x1001GetSystemInfoGet information about the system.See Table 4
0x1002ListenThreadStart a new thread that listens for group 0x1002 commands.None
0x1004ResetConnectionTerminate with WSAECONNRESET.N/A 0x1005UninstallDelete
persistence registry keys, remove itself and created folders.None 0x1007StopSet
registry key System\CurrentControlSet\Control\‌Network\allow to 1 and exit.N/A

The GetSystemInfo command collects extensive information about the system, as
detailed in Table 4. If it doesn’t already exist, the
Software\CLASSES\ms-pu\CLSID registry key is set to the current timestamp,
trying HKLM first then HKCU. The value of this key is then sent in the response.

Table 4. Response body format for the GetSystemInfo response

OffsetValueOffsetValue 0x00Magic bytes 0x201903010x38Suite mask 0x04Client IP
address of the C&C socket0x3AProduct type 0x08Server IP address of the C&C
socket0x3C0x01 if the process is running as WOW64 0x0CRAM in KB0x40System time –
year 0x10CPU clock rate in MHz0x42System time – month 0x14Display width in
pixels0x44Timestamp of first run (offset) 0x18Display height in
pixels0x46Service pack version string (offset) 0x1CDefault locale0x48Unknown
0x20Current tick count0x4AUsername (offset) 0x24OS major version0x4CComputer
name (offset) 0x28OS minor version0x4EMutex name (offset) 0x2COS build
number0x50Unknown 0x30OS platform ID0x52List of machine IP addresses (offset)
0x34Service pack major version0x54Always two 0x00 bytes 0x36Service pack minor
version

The 0x1002 group contains commands that provide RAT functionality, as detailed
in Table 5. Some of these take parameters provided in the command’s message
body. The FindFiles command is described in more detail below. Again, note that
no command names are present in the RAT; they were either taken from previous
analyses or provided by us.

Table 5. Commands in group 0x1002

IDNameDescriptionData in C&C requestData in client response 0x1002PingSent by
the client when it starts listening for commands from this group.N/ANone
0x3000ListDrivesList all mapped drives (A: to Z:) and their properties.

All 26 entries are sent back in one message body. Drives that aren’t present
have all fields set to 0x00.None· Drive type
· Total size
· Space available to user
· Free space
· Volume name (offset)
· File system name (offset) 0x3001ListDirectoryList the contents of the
specified directory. The client sends one response message per entry.Directory
path· Is a directory?
· File attributes
· File size
· Creation time
· Last write time
· Filename (offset)
· 8.3 filename (offset) 0x3002Sent by the client when it has finished executing
the ListDirectory command.N/ANone 0x3004ReadFileRead a file in chunks of 0x4000
bytes. · Creation time
· Last access time
· Last write time
· Has offset
· Offset in file
· File size
· File path 0x10003005Chunk of read file data.N/ARead data 0x10003006Sent by the
client when it has finished executing the ReadFile command.N/ANone
0x3007WriteFileWrite to a file and restore previous timestamp.

Creates parent directories if they don’t exist.· Creation time
· Last access time
· Last write time
· Has offset
· Offset in file
· File path (offset)
None 0x10003008Sent by the server with data to write to the file.Data to
writeN/A 0x10003009Sent by the server when the WriteFile operation is
complete.NoneN/A 0x300ACreateDirectoryCreate a directory.Directory pathNone
0x300BCanReadFileTry to open a file with read permissions.File pathNone
0x300CDesktopExecuteExecute a command on a hidden desktop.Command line to
executePROCESS_INFORMATION structure for the created process.
0x300DFileOperationPerform a file operation using SHFileOperation.· wFunc
· fFlags
· pFrom (offset)
· pTo (offset)None 0x300EGetEnvValueGet the value of an environment
variable.Environment variableEnvironment variable value.
0x300FCreateProgramDataDirCreates the directory %SYSTEM%\ProgramData, optionally
with a subdirectory.Subdirectory relative path (optional)None
0x3102FindFilesRecursively search a directory for files matching a given
pattern.· Starting directory
· Search patternSee response body format in Table 6. 0x7002RemoteShellStart an
interactive remote cmd.exe session.NoneNone 0x7003Result of the last command
run.N/ACommand output

FINDFILES COMMAND

Starting from the provided directory, this command searches for files whose
names match the given pattern. This pattern supports the same wildcard
characters as the Windows FindFirstFile API. For each matching file, the client
sends a response message with its body in the format described in Table 6.

Table 6. Format of the response body for the FindFiles command

OffsetValueOffsetValue 0x00File attributes0x24Folder path (offset) 0x04File size
in bytes0x26Filename (offset) 0x0CCreation time0x288.3 filename (offset)
0x1CLast write time

One response message with an empty body is sent once the search is completed.


CONCLUSION

The decoys used in this campaign show once more how quickly Mustang Panda is
able to react to world events. For example, an EU regulation on COVID-19 was
used as a decoy only two weeks after it came out, and documents about the war in
Ukraine started being used in the days following the beginning of the launch of
the invasion. This group also demonstrates an ability to iteratively improve its
tools, including its signature use of trident downloaders to deploy Korplug.



For any inquiries about our research published on WeLiveSecurity, please contact
us at threatintel@eset.com.



ESET Research now also offers private APT intelligence reports and data feeds.
For any inquiries about this service, visit the ESET Threat Intelligence page.




IOCS

SHA-1FilenameESET detection nameDescription
69AB6B9906F8DCE03B43BEBB7A07189A69DC507Bcoreclr.dllWin32/Agent.ADMWKorplug loader.
10AE4784D0FFBC9CD5FD85B150830AEA3334A1DEN/AWin32/Korplug.TCDecrypted Korplug
(dumped from memory).
69AB6B9906F8DCE03B43BEBB7A07189A69DC507Bcoreclr.dllWin32/Agent.ADMWKorplug
loader.
4EBFC035179CD72D323F0AB357537C094A276E6DPowerDVD18.exeWin32/Delf.UTNKorplug
loader. FDBB16B8BA7724659BAB5B2E1385CFD476F10607N/AWin32/Korplug.TBDecrypted
Korplug (dumped from memory).
7E059258CF963B95BDE479D1C374A4C300624986N/AWin32/Korplug.TCDecrypted Korplug
(dumped from memory).
7992729769760ECAB37F2AA32DE4E61E77828547SHELLSEL.ocxWin32/Agent.ADMWKorplug
loader. F05E89D031D051159778A79D81685B62AFF4E3F9SymHp.exeWin32/Delf.UTNKorplug
loader.
AB01E099872A094DC779890171A11764DE8B4360BoomerangLib.dllWin32/Korplug.THKorplug
loader.
CDB15B1ED97985D944F883AF05483990E02A49F7PotPlayer.dllWin32/Agent.ADYOKorplug
loader.
908F55D21CCC2E14D4FF65A7A38E26593A0D9A70SmadHook32.dllWin32/Agent.ADMWKorplug
loader. 477A1CE31353E8C26A8F4E02C1D378295B302C9EN/AWin32/Agent.ADMWKorplug
loader.
52288C2CDB5926ECC970B2166943C9D4453F5E92SmadHook32c.dllWin32/Agent.ADMWKorplug
loader.
CBD875EE456C84F9E87EC392750D69A75FB6B23ASHELLSEL.ocxWin32/Agent.ADMWKorplug
loader.
2CF4BAFE062D38FAF4772A7D1067B80339C2CE82Adobe_Caps.dllWin32/Agent.ADMWKorplug
loader.
97C92ADD7145CF9386ABD5527A8BCD6FABF9A148DocConvDll.dllWin32/Agent.ADYOKorplug
loader. 39863CECA1B0F54F5C063B3015B776CDB05971F3N/AWin32/Korplug.TDDecrypted
Korplug (dumped from memory).
0D5348B5C9A66C743615E819AEF152FB5B0DAB97FontEDL.execleanVulnerable legitimate
Font File Generator executable.
C8F5825499315EAF4B5046FF79AC9553E71AD1C0Silverlight.Configuration.execleanVulnerable
legitimate Microsoft Silverlight Configuration Utility executable.
D4FFE4A4F2BD2C19FF26139800C18339087E39CDPowerDVDLP.execleanVulnerable legitimate
PowerDVD executable.
65898ACA030DCEFDA7C970D3A311E8EA7FFC844ASymantec.execleanVulnerable legitimate
Symantec AntiVirus executable. 7DDB61872830F4A0E6BF96FAF665337D01F164FCAdobe
Stock Photos CS3.execleanVulnerable legitimate Adobe Stock Photos executable.
C13D0D669365DFAFF9C472E615A611E058EBF596COVID-19 travel restrictions EU reviews
list of third countries.exeWin32/Agent_AGen.NJDownloader.
062473912692F7A3FAB8485101D4FCF6D704ED23REGULATION OF THE EUROPEAN PARLIAMENT
AND OF THE COUNCIL.exeWin32/TrojanDownloader.Agent.GDLDownloader.
2B5D6BB5188895DA4928DD310C7C897F51AAA050log.dllWin32/Agent.ACYWKorplug loader.
511DA645A7282FB84FF18C33398E67D7661FD6632.exeWin32/Agent.ADPLKorplug loader.
59002E1A58065D7248CD9D7DD62C3F865813EEE6log.dllWin32/Agent.ADXEKorplug loader.
F67C553678B7857D1BBC488040EA90E6C52946B3KINGSTON.exeWin32/Agent.ADXZKorplug
Loader. 58B6B5FD3F2BFD182622F547A93222A4AFDF4E76PotPlayer.execleanVulnerable
legitimate executable.


NETWORK

DomainIPFirst seenNotes 103.56.53[.]1202021‑06‑15Korplug C&C
154.204.27[.]1812020‑10‑05Korplug C&C. 43.254.218[.]422021‑02‑09Download server.
45.131.179[.]1792020‑10‑05Korplug C&C. 176.113.69[.]912021-04-19Korplug C&C.
upespr[.]com45.154.14[.]2352022-01-17Download server.
urmsec[.]com156.226.173[.]232022‑02‑23Download server.
101.36.125[.]2032021-06-01Korplug C&C. 185.207.153[.]2082022‑02‑03Download
server. 154.204.27[.]1302021-12-14Korplug C&C. 92.118.188[.]782022-01-27Korplug
C&C. zyber-i[.]com107.178.71[.]2112022-03-01Download server.
locvnpt[.]com103.79.120[.]662021-05-21Download server. This domain was
previously used in a 2020 campaign documented by Recorded Future.


MITRE ATT&CK TECHNIQUES

This table was built using version 10 of the MITRE ATT&CK framework.

TacticIDNameDescription Resource DevelopmentT1583.001Acquire Infrastructure:
DomainsMustang Panda has registered domains for use as download servers.
T1583.003Acquire Infrastructure: Virtual Private ServerSome download servers
used by Mustang Panda appear to be on shared hosting. T1583.004Acquire
Infrastructure: ServerMustang Panda uses servers that appear to be exclusive to
the group. T1587.001Develop Capabilities: MalwareMustang Panda has developed
custom loader and Korplug versions. T1588.006Obtain Capabilities:
VulnerabilitiesMultiple DLL hijacking vulnerabilities are used in the deployment
process. T1608.001Stage Capabilities: Upload MalwareMalicious payloads are
hosted on the download servers. ExecutionT1059.003Command and Scripting
Interpreter: Windows Command ShellWindows command shell is used to execute
commands sent by the C&C server. T1106Native APIMustang Panda uses CreateProcess
and ShellExecute for execution. T1129Shared ModulesMustang Panda uses
LoadLibrary to load additional DLLs at runtime. The loader and RAT are DLLs.
T1204.002User Execution: Malicious FileMustang Panda relies on the user
executing the initial downloader. T1574.002Hijack Execution Flow: DLL
Side-LoadingThe downloader obtains and launches a vulnerable application so it
loads and executes the malicious DLL that contains the second stage.
PersistenceT1547.001Boot or Logon Autostart Execution: Registry Run Keys /
Startup FolderKorplug can persist via registry Run keys. T1053.005Scheduled
Task/Job: Scheduled TaskKorplug can persist by creating a scheduled task that
runs on startup. Defense EvasionT1140Deobfuscate/Decode Files or InformationThe
Korplug file is encrypted and only decrypted at runtime, and its configuration
data is encrypted with XOR. T1564.001Hide Artifacts: Hidden Files and
DirectoriesDirectories created during the installation process are set as hidden
system directories. T1564.003Hide Artifacts: Hidden WindowKorplug can run
commands on a hidden desktop. Multiple hidden windows are used during the
deployment process. T1070Indicator Removal on HostKorplug’s uninstall command
deletes registry keys that store data and provide persistence.
T1070.004Indicator Removal on Host: File DeletionKorplug can remove itself and
all created directories. T1070.006Indicator Removal on Host: TimestompWhen
writing to a file, Korplug sets the file’s timestamps to their previous values.
T1036.004Masquerading: Masquerade Task or ServiceScheduled tasks created for
persistence use legitimate-looking names. T1036.005Masquerading: Match
Legitimate Name or LocationFile and directory names match expected values for
the legitimate app that is abused by the loader. T1112Modify RegistryKorplug can
create, modify, and remove registry keys. T1027Obfuscated Files or
InformationSome downloaded files are encrypted and stored as hexadecimal
strings. T1027.005Obfuscated Files or Information: Indicator Removal from
ToolsImports are hidden by dynamic resolution of API function names.
T1055.001Process Injection: Dynamic-link Library InjectionSome versions of the
Korplug loader inject the Korplug DLL into a newly launched process.
T1620Reflective Code LoadingKorplug parses and loads itself into memory.
DiscoveryT1083File and Directory DiscoveryKorplug can list files and directories
along with their attributes and content. T1082System Information
DiscoveryKorplug collects extensive information about the system including
uptime, Windows version, CPU clock rate, amount of RAM and display resolution.
T1614System Location DiscoveryKorplug retrieves the system locale using
GetSystemDefaultLCID. T1016System Network Configuration DiscoveryKorplug
collects the system hostname and IP addresses. T1016.001System Network
Configuration Discovery: Internet Connection DiscoveryThe downloader pings
Google’s DNS server to check internet connectivity. T1033System Owner/User
DiscoveryKorplug obtains the current user’s username. T1124System Time
DiscoveryKorplug uses GetSystemTime to retrieve the current system time.
CollectionT1005Data from Local SystemKorplug collects extensive data about the
system it’s running on. T1025Data from Removable MediaKorplug can collect
metadata and content from all mapped drives. T1039Data from Network Shared
DriveKorplug can collect metadata and content from all mapped drives. Command
and ControlT1071.001Application Layer Protocol: Web ProtocolsKorplug can make
the initial handshake over HTTPS. T1095Non-Application Layer ProtocolC&C
communication is done over a custom TCP-based protocol. T1573.001Encrypted
Channel: Symmetric CryptographyC&C communication is encrypted using RC4.
T1008Fallback ChannelsThe Korplug configuration contains fallback C&C servers.
T1105Ingress Tool TransferKorplug can download additional files from the C&C
server. T1571Non-Standard PortWhen Hodur performs its initial handshake over
HTTPS, it uses the same port (specified in the configuration) as for the rest of
the communication. T1132.001Data Encoding: Standard EncodingKorplug compresses
transferred data using LZNT1. ExfiltrationT1041Exfiltration Over C2 ChannelData
exfiltration is done via the same custom protocol used to send and receive
commands.




Alexandre Côté Cyr
23 Mar 2022 - 09:00AM


SIGN UP TO RECEIVE AN EMAIL UPDATE WHENEVER A NEW ARTICLE IS PUBLISHED IN OUR
UKRAINE CRISIS – DIGITAL SECURITY RESOURCE CENTER

Submit


NEWSLETTER

Submit


SIMILAR ARTICLES

ESET Research

ESET RESEARCH PODCAST: FINDING THE MYTHICAL BLACKLOTUS BOOTKIT

ESET Research

ESET THREAT REPORT H1 2023

ESET Research

WHAT’S UP WITH EMOTET?

ESET Research

ANDROID GRAVITYRAT GOES AFTER WHATSAPP BACKUPS


DISCUSSION


 * Home
 * About Us
 * Contact Us

 * Sitemap
 * Our Experts
 * ESET

 * Research
 * How To
 * Categories

 * RSS Configurator

Privacy policy Legal information Manage cookies
Copyright © ESET, All Rights Reserved
Back to top

Your account, your cookies choice
We and our partners use cookies to give you the best optimized online
experience, analyze our website traffic, and serve you with personalized ads.
You can agree to the collection of all cookies by clicking "Accept all and
close" or adjust your cookie settings by clicking "Manage cookies". You also
have the right to withdraw your consent to cookies anytime. For more
information, please see our Cookie Policy.
Accept all and close
Manage cookies
Essential cookies
These first-party cookies are necessary for the functioning and security of our
website and the services you require. They are usually set in response to your
actions to enable the use of certain functionality, such as remembering your
cookie preferences, logging in, or holding items in your cart. You can´t opt out
of these cookies, and blocking them via a browser may affect site functionality.
Basic Analytical Cookies
These first-party cookies enable us to measure the number of visitors/users of
our website and create aggregated usage and performance statistics with the help
of our trusted partners. We use them to get the basic insight into our website
traffic and our campaign performance and to solve bugs on our website.
Advanced Analytical Cookies
These first or third-party cookies help us understand how you interact with our
website and each offered service by enriching our datasets with data from
third-party tools. We use these cookies to improve our website, services, and
user experience, find and solve bugs or other problems with them, and evaluate
our campaigns´ effectiveness.
Marketing cookies
These third-party cookies allow our marketing partners to track some of your
activities on our website (for example, when you download or buy our product) to
learn about your interests and needs and to show you more relevant targeted ads.
Accept and close
Back