Rewterz Threat Alert – APT C-23 aka AridViper Active in Middle East Region – Active IOCs
December 28, 2021Rewterz Threat Advisory – CVE-2021-44832 – Apache Log4j
December 29, 2021Rewterz Threat Alert – APT C-23 aka AridViper Active in Middle East Region – Active IOCs
December 28, 2021Rewterz Threat Advisory – CVE-2021-44832 – Apache Log4j
December 29, 2021Severity
High
Analysis Summary
Researchers have identified recent Mustang Panda activity that involves the use of DLL side-loading to deliver PlugX. The initial infection vector is an executable downloaded from a remote URL. The executable is responsible for installing the malware by dropping the required files (a DLL loader, a legitimate binary, and the PlugX payload) onto the system. The legitimate binary is the Adobe CEF Helper and is vulnerable to DLL side-loading. When the installer runs the legitimate binary, the dropped DLL is loaded. This DLL is the loader for the final payload. First, it reads a hardcoded .dat file that contains the XOR key for decrypting the final payload, then it performs the decryption and loads the malware into memory. Once running in memory, the PlugX payload is able to decrypt its configuration data, which includes its installation location, the XOR key for C2 communication, and any C2 addresses and ports
Impact
- Information Theft
- Exposure of Sensitive Data
Indicators of Compromise
- imac[.]afp@gmail[.]com
Filename
- AFP SRDP Strategic Concept Plan[.]zip
IP
- 103[.]15[.]28[.]208
MD5
- a1c010659ea4b06461d5a99d16a91f24
- 793d0e610ecac2da4a8b07ff2ff306ac
SHA-256
- 262c6ad46bacd268900008d6cd32ea5bcfe032ffc0bf82e838e234cdca374d64
- df84d6c284dd39c2bfed6f8eb26149a4154396c27de50595ed5d80b428930dcd
SHA-1
- e757ae1761ab2531bba2c8db350a2017ed3d1174
- dc479c9002ba733165171f2179d7beadbc64b305
Remediation
- Always be suspicious about emails sent by unknown senders.
- Never click on links/attachments sent by unknown senders.
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.