Rewterz Threat Alert – GraphSteel and GrimPlant Malware – Active IOCs – Russian-Ukrainian Cyber Warfare

March 30, 2022

Severity

High

Analysis Summary

GraphSteel and GrimPlant Backdoors have been used in conducting cyberattacks on Ukrainian authorities. The backdoors allow threat actors to gain unauthorized access and control of the victim’s system. Government agencies in Ukraine received emails with the topic “Wage arrears” or “Заборгованість по зарплаті” with an excel file of the same name. While the file does contain legitimate statistics, it is also contains hex-coded data and macros. Once the macro is executed, it will decode the data, create a new executable file “Base-Update.exe” on the computer and execute it.

This file is a downloader developed using the GoLang programming language. The program will download and run another bootloader, which, in turn, will download and run malware GraphSteel and GrimPlant on your computer. – CERT-UA

These attacks have been attributed to UAC-0056 aka UNC2589, TA471, or SaintBear.

Impact

Information Theft and Espionage
Exposure of Sensitive Data

Indicators of Compromise

Filename

Wage arrears[.]xls
Заборгованість по зарплаті[.]xls
Base-Update[.]exe (GoDownloader)
java-sdk[.]exe (GoDownloader)
microsoft-cortana[.]exe (GraphSteel)

MD5

da305627acf63792acb02afaf83d94d1
06124da5b4d6ef31dbfd7a6094fc52a6
36ff9ec87c458d6d76b2afbd5120dfae
6b413beb61e46241481f556bb5cdb69c

SHA-256

c1afb561cd5363ac5826ce7a72f0055b400b86bd7524da43474c94bc480d7eff
9e9fa8b3b0a59762b429853a36674608df1fa7d7f7140c8fccd7c1946070995a
8ffe7f2eeb0cbfbe158b77bbff3e0055d2ef7138f481b4fac8ade6bfb9b2b0a1
c83d8b36402639ea3f1ad5d48edc1a22005923aee1c1826afabe27cb3989baa3

SHA-1

b4100aad572f619632ec28042a76c52ba2350acc
265a613ac405e6c3557e36a19f0ead2d18638cb0
9a3161c8570f1ca410038bed6e2aa297aebaf548
189f1879fcac60030dd3a751daae46a7444245f

URL

http[:]//194[.]31[.]98[.]124[:]443/i
http[:]//194[.]31[.]98[.]124[:]443/p
http[:]//194[.]31[.]98[.]124[:]443/m

Remediation

Block all threat indicators at your respective controls.
Search for IOCs in your environment.
Do not open emails from unknown or suspicious sources.