Rewterz Threat Alert – OpenCarrot Malware Identified in Financial Sector

Severity

High

Analysis Summary

IBM X-Force IRIS responded to an incident in a financial services customer in southeast Asia that we assess with high confidence was perpetrated by ITG03. During this engagement, IRIS was able to observe several unreported malware and tools used by ITG03 to conduct specific actions which indicate the adversary was interested in accessing the SWIFT environment of the institution. One tool, a listener backdoor, included a set of command capabilities that is virtually identical to other command sets we have analyzed in their custom-coded malware employed against different targets. Specifically, the commands for downloading and time-stomping files, secure file/directory deletion and the proxy capabilities in addition to the other commands are a strong signature of ITG03 custom trojans. The sample svchost.exe is a backdoor that listens to port 443 (SSL port). The port can be overridden by specifying a port number in the command line arguments using the -F parameter. The backdoor listens for and accepts commands from a C2 and contains the capabilities to remotely access files, processes, execute commands, and download and upload data. The binary can also connect to a remote server by specifying an address with the -C parameter.

Impact

Financial loss

Indicators of Compromise

Malware Hashes : MD5

• 02361636b6510a3c56611085c72
• ef79fef7cb50c58204fe9f20e60c1e2543102
• 559fab985ccc9e66f8c9b283915c59bf
• 5b4b30bb05355ae497e1b0bf3d8f153f
• dc7af3f4f4e567ea6af8fb72692738e1

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.