IBM X-Force IRIS responded to an incident in a financial services customer in southeast Asia that we assess with high confidence was perpetrated by ITG03. During this engagement, IRIS was able to observe several unreported malware and tools used by ITG03 to conduct specific actions which indicate the adversary was interested in accessing the SWIFT environment of the institution. One tool, a listener backdoor, included a set of command capabilities that is virtually identical to other command sets we have analyzed in their custom-coded malware employed against different targets. Specifically, the commands for downloading and time-stomping files, secure file/directory deletion and the proxy capabilities in addition to the other commands are a strong signature of ITG03 custom trojans. The sample svchost.exe is a backdoor that listens to port 443 (SSL port). The port can be overridden by specifying a port number in the command line arguments using the -F parameter. The backdoor listens for and accepts commands from a C2 and contains the capabilities to remotely access files, processes, execute commands, and download and upload data. The binary can also connect to a remote server by specifying an address with the -C parameter.
Malware Hashes : MD5