March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Recent Mustang Panda Activity
June 3, 2020
Rewterz Threat Advisory – Multiple Vulnerabilities in Mozilla Firefox and ESR
June 3, 2020
Rewterz Threat Alert – Recent Mustang Panda Activity
June 3, 2020
Rewterz Threat Advisory – Multiple Vulnerabilities in Mozilla Firefox and ESR
June 3, 2020
Severity
Medium
Analysis Summary
Researchers have published an analysis of the Team9 (aka Bazar) backdoor and loader. The infection begins with a loader, two variants of which were analyzed previously. The earlier variant downloads the backdoor using Windows BITS, which is no longer the case. Additionally the strings are not encrypted and the Windows API functions are not loaded dynamically. After ensuring no existing infections are present, the loader establishes persistence using a Registry Run key. It then covers its tracks by deleting itself via a batch file. The victim host’s architecture is identified and the associated backdoor component is downloaded from one of two hard-coded C2 servers. If the downloaded version is 32-bit, it is injected into calc.exe using process hollowing. Otherwise it is written to disk and executed. The newer variant of the loader operates similarly but adds in string encryption and dynamic loading of the Windows API functions. Process injection now occurs with both architectures; svchost, explorer, and cmd are the target processes. Additional persistence mechanisms are implemented including scheduled tasks, Winlogon hijacking, and Startup folder shortcuts. The analysis of the downloaded backdoors shows C2 communication occurs over ports 80 and 443. It is capable of receiving commands that allow for system information collection, downloading and execution of files and scripts, file exfiltration, and more.
Impact
- Data exfiltration
- Information theft
- Exposure of sensitive data
Indicators of Compromise
SHA-256
- 4F258184D5462F64C3A752EC25FB5C193352C34206022C0755E48774592B7707
- B10DCEC77E00B1F9B1F2E8E327A536987CA84BCB6B0C7327C292F87ED603837D
- 363B6E0BC8873A6A522FE9485C7D8B4CBCFFA1DA61787930341F94557487C5A8
- F4A5FE23E21B6B7D63FA2D2C96A4BC4A34B40FD40A921B237A50A5976FE16001
- A0D0CFA8BF0BC5B8F769D8B64EAB22D308B108DD8A4D59872946D69C3F8C58A5
- 059519E03772D6EEEA9498625AE8B8B7CF2F01FC8179CA5D33D6BCF29D07C9F4
- 0F94B77892F22D0A0E7095B985F30B5EDBE17AB5B8D41F798EF0C708709636F4
- 2F0F0956628D7787C62F892E1BD9EDDA8B4C478CF8F1E65851052C7AD493DC28
- 37D713860D529CBE4EAB958419FFD7EBB3DC53BB6909F8BD360ADAA84700FAF2
- 3400A7DF9EC3DC8283D5AC7ACCB6935691E93FEDA066CC46C6C04D67F7F87B2B
- 5974D938BC3BBFC69F68C979A6DC9C412970FC527500735385C33377AB30373A
- C55F8979995DF82555D66F6B197B0FBCB8FE30B431FF9760DEAE6927A584B9E3
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.