Rewterz Threat Alert – “Hack-for-hire” DeathStalker Using New PowerPepper Implant

Severity

High

Analysis Summary

DeathStalker has leveraged several malware strains and delivery chains across the years, from the Python and VisualBasic-based Janicab, to the PowerShell-based Powersing, passing by the JavaScript-based Evilnum. DeathStalker also consistently leveraged anti-detection and antivirus evasion techniques, as well as intricate delivery chains, that would drop lots of files on target’s file systems. This particular malware has found stealthier evasion tactics. On the obfuscation front, the malware uses DNS over HTTPS as a communication channel, in order to hide communications with command-and-control (C2) behind legitimate-looking traffic. PowerPepper regularly polls the C2 server for commands to execute. The implant sends TXT-type DNS requests (with DoH or plain DNS requests if the later fails) to the name servers (NS) that are associated with a malicious C2 domain name. The server replies with a DNS response, embedding an encrypted command.

PowerPepper also adds steganography to the list of evasion techniques, which is the practice of hiding data inside images. In this case, the malicious code is embedded in what appears to be regular pictures of ferns or peppers (hence the name), and it is then extracted by a loader script. The loader is disguised as a verification tool from identity services provider GlobalSign. 
It uses custom obfuscation, with parts of its malicious delivery scripts hidden in Word-embedded objects. Communications with the implant and servers are encrypted and the usage of trusted, signed scripts makes it difficult for the antivirus software to recognize the implant as malicious at startup. The first variant of PowerPepper emerged in the wild in mid-July 2020, as dropped from a Word Document that had been submitted on a public multiscanner service. PowerPepper was cultivated to execute remote shell commands sent by DeathStalker operators, which are aimed at stealing sensitive business information.

Impact

• Detection Evasion
• Unauthorized Code Execution
• Theft of Sensitive Business Information
• Data Exfiltration

Indicators of Compromise

Domain Name

• allmedicalpro[.]com
• mediqhealthcare[.]com
• gofinancesolutions[.]com

From Email

• a[.]christy_inbox@outlook[.]com

Hostname

• mailsigning[.]pythonanywhere[.]com
• mailsignature[.]pythonanywhere[.]com
• mailservices[.]pythonanywhere[.]com
• mailservice[.]pythonanywhere[.]com
• globalsignature[.]pythonanywhere[.]com
• footersig[.]pythonanywhere[.]com

MD5

• 3a6099214f474c1501c110ce66033f3c
• 871d64d8330d956593545dfff069194e
• 5d04d246f3e5da6a9347ec72494d5610

SHA-256

• fbb033af9efb9ab5b83978fc35e518e2f4018406589656ff6616e42b76526f18
• 46afa83e0b43fdb9062dd3e5fb7805997c432dd96f09ddf81f2162781daaf834
• 4b59fa6daeaaedace0c7eb5201dd21041de5c09f4d5d38e0f8e9eb2bbda9444a

SHA1

• 0ce862f8b50deda047e78789e8d74c610c61ad15
• 158ffa8f372674159c1a4338807032e8de1d2ff8
• ace1a579e77615abb9740b4ea234376b8a4d39af

URL

• https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYejBpdekg1WUCM9M?e=UkhU10
• https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYe1ulhtazjNVvCqY?e=WptVTC
• https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYeePNerfsAWK0qVY?e=e4SsYM
• https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYdifkocKujNavvjY?e=hhuBV8
• https[:]//www[.]gsn-nettoyage[.]com/wp-snapshots/etoken[.]php
• https[:]//www[.]gsn-nettoyage[.]com/wp-snapshots/btoken[.]php
• https[:]//www[.]gsn-nettoyage[.]com/wp-snapshots/1[.]docx
• https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYdcbz1YwTJRkOxP4?e=u5wtbX
• https[:]//1drv[.]ws/w/s!AvXRHBXCKmvYd1921tVEMKWaCUs?e=MyoVNF

Remediation

• Block the threat indicators at their respective controls.
• Do not download files attached in untrusted emails.
• Do not download and execute untrusted files from random sources on the internet.