Rewterz Threat Alert – SideWinder APT Active in South Asia

Severity

High

Analysis Summary

The SideWinder group has become infamous for targeting the South Asian region and its surrounding countries. A server is being used to deliver a malicious LNK file and host multiple credential phishing pages. These pages were copied from their victims’ webmail login pages and subsequently modified for phishing. Further activities are propagated via spear-phishing attacks. In addition, multiple Android APK files were also found on the phishing server.
The group’s targets include multiple government and military units, mainly in Nepal and Afghanistan. After the gathered credentials are sent, some of the phishing pages will redirect victims to different documents or news pages. The themes and topics of these pages and documents are related to either Covid-19 or recent territory disputes between Nepal, Pakistan, India, and China. Furthermore, it seems that these lures are distributed via phishing links. Several different samples from the campaign include:

• An LNK file that downloads an RTF file and drops a JavaScript file
• A ZIP file containing an LNK file, which downloads an HTA file (with JavaScript)
• An RTF file that drops a JavaScript file
• A PDF file with an embedded JavaScript stream
• A DOCX file with an external link to an OLE object (RTF file), which contains and drops a JavaScript file

Moreover, the Android applications still seem to be under the initial development phase as they are basic, still use the default Android icons, and have no practical function for users. Two applications among them are named “My First APP” and “Opinion Poll,” that seemingly have no malicious behavior.

Impact

• Credential Theft
• Unauthorized Access
• Information Theft

Indicators of Compromise

Domain Name

• ms-trace[.]net
• fqn-cloud[.]net
• cdn-sop[.]net
• ap-ms[.]net

Filename

• India reaction after new pak map[.]pdf
• Ambassador Yanchi Conversation with Nepali_Media[.]pdf

Hostname

• www[.]mfa[.]filesrvr[.]net
• www[.]google[.]gov-pok[.]net
• webmail[.]ntc[.]net[.]np
• webmail[.]mpt[.]net[.]mm
• webmail[.]mohe[.]gov[.]af
• webmail[.]mohe[.]gov-af[.]org
• trojan[.]w97m[.]cve20170199[.]fail
• mail[.]qcharity[.]org
• mail[.]ppmo[.]gov[.]np
• mail[.]parliament[.]gov[.]np
• mail[.]nsc[.]gov[.]af
• mail[.]nsc[.]gov-af[.]org
• mail[.]nrb[.]gov[.]np
• mail[.]nepalpolice[.]gov[.]np
• mail[.]nepalarmy[.]mil[.]np
• mail[.]nepal[.]gov[.]np
• mail[.]nea[.]org[.]np
• mail[.]ncp[.]org[.]np
• mail[.]moha[.]gov[.]np
• mail[.]moha[.]gov-np[.]org
• mail[.]mofa[.]gov[.]np
• mail[.]mof[.]gov[.]np
• mail[.]mod[.]gov[.]np
• mail[.]kmg[.]com[.]np
• mail[.]doe[.]gov[.]np
• mail[.]defence[.]lk
• mail[.]caanepal[.]gov[.]np
• mail[.]arg[.]gov[.]af
• mail[.]arg[.]gov-af[.]org
• mail[.]apf[.]gov[.]np
• mail-ntcnetnp[.]serveftp[.]com
• mail-nscaf[.]myftp[.]org
• mail-nrborg[.]hopto[.]org
• mail-nepalpolicegovnp[.]duckdns[.]org
• mail-nepalpolicegov[.]hopto[.]org
• mail-nepalgovnp[.]duckdns[.]org
• mail-nepalarmymilnp[.]duckdns[.]org
• mail-ncporgnp[.]hopto[.]org
• mail-mofgovnp[.]hopto[.]org
• mail-mofagovnp[.]zapto[.]org
• mail-mofagovnp[.]hopto[.]org
• mail-mfagovcn[.]hopto[.]org
• mail-kmgcom[.]ddns[.]net
• mail-apfgovnp[.]ddns[.]net
• mail-apfgavnp[.]hopto[.]org
• imail[.]aop[.]gov[.]af
• imail[.]aop[.]gov-af[.]org
• brep[.]cdn-edu[.]net

MD5

• e95250efc80a819201bafb0905224837
• 8b41762ba6f5e51ec3960b2b5a87ef2c
• c52aff7bb5316b6da7d4d05b710a4744
• 2ab8b6a95cb874c715125e7ff8cbebd5
• e24e51ec170b2341ef90321640fef797
• 791c97b239f26a714b63dd5c43300b41
• ce59a5bec8064176708209b58ddc3a8b
• 1afb77b2f0ef2e082b37d9ff4b2e7e78

SHA-256

• ed5e1d6e914de64a203f2f32ab95176fc7efff3a520915971d5fe748e79d611c
• ab7c1967bf1fefdffde93626b78eb30994655ab02f59e0adb0935e3e599a953f
• 96bf8f579acb8d9d0ff116d05fdadef85953f11e5b2e703041fdae0abf5b75dc
• 799260b992c77e2e14f2d586665c570142d8425864455cab5f2575015cd0b87a
• 75c158cea14e338c8d9d32ed988c7032da9ae6d54f5b1126ed6a83f71b9e03bf
• 7238f4e5edbe0e5a2242d8780fb58c47e7d32bf2c4f860c88c511c30675d0857
• 34446f7f60f730fcca145155d10d1aff0a1153b085836df38313772cd03c8d70
• 2548a819e4c597ba5958d2d18baa544452948e5b00271570192ccd79abe88e8d
• 1cbec920afe2f978b8f84e0a4e6b757d400aeb96e8c0a221130060b196ece010

SHA1

• e799cea407a8a8448061555d8375c544593c5744
• 3f4925d4dae214db46aa61cf868a32cf88f64e10
• 1612fcc304097e815b02fe6bcb7705d9159def5d
• 62a27e2ca05ac946782e2021a583f6f91ad0dcd7
• 0ecccc959f8e84d8b5aeff4cbbaca589fb762610
• d6066b94968ba76864f930eda55267549eae7f9c
• 5c66173e8e064bb8743460ba01ec8656bf19880b
• b44bcffb9845a2c19c44ac5899221c2185cae111
• de25d70ab9da6c1af580932d07bedd17e77a9a29

Remediation

• Block the threat indicators at their respective controls.
• Do not download files attached in untrusted emails.
• Do not enter credentials on login pages that you’re unintentionally redirected to.
• Enable multi-factor authentication where possible.