Analysis of DHS NCCIC Indicators

Summary

On January 15, 2014, the U.S. Department of Homeland Security National Cybersecurity and Communications Integration Center (DHS NCCIC) published Joint Indicators Bulletin INC-260425, which listed indicators related to two established threat groups.

The Dell SecureWorks Counter Threat Unit™ (CTU™ ) research team tracks threat groups by assigning them four-digit randomized numbers, and compiles information from external sources and from first-hand incident response observations. The first set of indicators released by the NCCIC are associated with TG-8223, an APT group that targets the media, government, and defense sectors. The second set of indicators released by the NCCIC originate from an intrusion by TG-2754, an APT group that targets the technology, government, and defense sectors. The CTU research team has been tracking both of these groups since 2006.

The majority of the released file hashes are associated with command-line file transfer and traffic proxy tools (BeepService, ONHAT proxy, LinseningSvr, and SimpleFileMover) that accept command-line arguments for network endpoints. The SvcInstaller tool is used to establish persistence for separate DLL files that are not included in the corpus. Some indicators also relate to DD Keylogger, jspRAT, and ZiyangRAT, which are remote access trojans (RATs) that include remote endpoints.

Tools and usage

CTU researchers analyzed the binary files associated with the hash indicators provided by the NCCIC and determined they were related to the following families of malware and tools:

• BeepService
• DD Keylogger
• jspRAT
• LinseningSvr
• ONHAT proxy
• SimpleFileMover
• SvcInstaller
• Ziyang RAT
• Airgapped malware

Given that the indicators are from multiple incidents, it is not possible to create an accurate timeline or sequence for each tool's usage. The following sections briefly describe each family and include indicators associated with the referenced samples.

BeepService

The BeepService family of malware is used to create a reverse shell that connects to a specific command and control (C2) server controlled by the attacker. BeepService requires the attacker to specify the following arguments on the command line:

> malware.exe [targetIP] [C2IP] [C2port] [RC4key] [Process to inject into] [service name] [filename]  

The malware is configured with default values that are overwritten by the options provided on the command line. Shellcode is injected into the specified process on the target system. The BeepService malware does not establish persistence and does not automatically start when the computer restarts. The specified [service name] and [filename] are for temporary use and are both deleted after the shellcode has been injected into the configured process. The malware encrypts its communication to the C2 server using the RC4 algorithm and the [RC4key] specified on the command line.

Indicators

CTU researchers analyzed the BeepService indicators in Table 1.

Table 1. Indicators for the BeepService malware.

DD Keylogger

DD Keylogger, sometimes referred to as Toyecma, was first observed in May 2013 and was used regularly through August 2013 to target economic and monetary policy groups. This malware is distributed via spearphishing emails that contain EXE or SCR attachments masquerading as innocuous document files. DD Keylogger can record keyboard activity on a compromised system and then transmit that data to an attacker-controlled system. It can also download a second-stage payload typically known as the Mswab/Aumlib RAT, which gives remote attackers complete control of a compromised system.

Indicators

CTU researchers analyzed the DD Keylogger indicators in Table 2. The domains and IP addresses listed in the indicators table may contain malicious content, so consider the risks before opening them in a browser.

Table 2. Indicators for the DD Keylogger malware.

Table 3 describes the relationships between the indicators listed in Table 2.

Table 3. Relationships between DD Keylogger indicators.

jspRAT

jspRAT is a JavaServer pages (JSP) web-based backdoor that can manipulate files and directories. The malware can also run arbitrary Windows commands. jspRAT requires the victim's system to be running a JSP-enabled service such as the Apache Tomcat open source web server. Communications take place over HTTP and may not be encrypted depending on the server's configuration.

Indicators

CTU researchers analyzed the jspRAT indicators in Table 4.

Table 4. Indicators for the jspRAT malware.

LinseningSvr

LinseningSvr is used to transmit arbitrary fixed-size data chunks over an unencrypted channel. It sends or receives data from a user-specified IP address and port, in clear text. The password is obscured with an MD5 hash. The tool requires the attacker to specify the following arguments on the command line:

> malware.exe [local port] [password]

When LinseningSvr is executed, it opens a socket on the specified port and waits for connections. When a remote user connects, LinseningSvr reads any two bytes sent and then attempts to read from a local file named "c:\1". If this file exists, LinseningSvr sends the hashed password and 36 bytes from the file to the remote system as shown in Figures 1 and 2. LinseningSvr then attempts to delete the file and reports a "Deleted c:\1" message if successful. The tool requires appropriate permissions to successfully execute the delete function. If LinseningSvr cannot delete the file, it displays a message that the file could not be deleted. Due to a bug in the tool, the message that the file could not be deleted is followed by an inaccurate message that the file was deleted.

Figure 1. LinseningSvr sending hashed password and 36 bytes of data. (Source: Dell SecureWorks)

Figure 2. System receiving hashed password and 36 bytes from LinseningSvr. (Source: Dell SecureWorks)

The server also reads up to 272 bytes from the remote client. The first 16 bytes must be the same as the 16-byte hashed password. Sent data is written to the c:\2 file. LinseningSvr then repeats a loop of sleep and continues checking for the c:\1 file. If the bytes do not match, the message "Password is Wrong!" is printed to the server console.

Indicators

CTU researchers analyzed the LinseningSvr indicators in Table 5.

Table 5. Indicators for the LinseningSvr malware.

ONHAT proxy

The ONHAT proxy redirects network traffic on a compromised host using SOCKS5 technology. The ONHAT proxy has similar functionality as the HTRAN malware, although the layout of the code is slightly different. The CTU research team believes ONHAT proxy is a variant of HTRAN.

ONHAT has no persistence functionality and is invoked by a command-line tool using arguments. If arguments are not provided, ONHAT attempts to read stored values from environment variables. The malware stores arguments that have been invoked from the command line in environment variables. These arguments may include port number that the proxy feature listens on.

Internal strings and error messages frequently use the phrase "ONHAT". However, the environment variables use the phrase "TAHNO" (ONHAT backwards) when storing settings.

Indicators

CTU researchers analyzed the ONHAT proxy indicators in Table 6.

Table 6. Indicators for the ONHAT proxy.

SimpleFileMover

SimpleFileMover is used to transmit arbitrary files over an encrypted channel. It sends or receives a specified file to or from an arbitrary IP address and port, encrypted with a key that is set at the command line. The following is the syntax for the command line:

> malware.exe [destinationIP] [port #] ['p' or 'g'] [filename] [RC4key]  

When the tool is invoked with the 'p' option, the malware sends a local file specified by [filename] to the remote system on the port specified. The 'g' option retrieves a file from the remote system and saves it to [filename]. In most samples analyzed by CTU researchers, the entire transaction is encrypted with the RC4 algorithm. The RC4 key is also specified at the command line. One version of the analyzed samples takes only four arguments, omitting the [RC4key] option because it does not implement crypto functions. This clear text version also produces verbose error messages.

CTU researchers have also analyzed the corresponding server component for this attack tool. The server component listens for connections from SimpleFileMover clients and then receives or transmits files as requested by the client malware. The following command-line syntax starts the server:

> malware.exe [port #] [RC4key]  

If the listening port is not specified at the command line, the server listens by default on port 8080. If the RC4 key is omitted, SimpleFileMover defaults to '123'.

Indicators

CTU researchers analyzed the SimpleFileMover indicators in Table 7.

Table 7. Indicators for the SimpleFileMover malware.

SvcInstaller

The SvcInstaller tool can install or uninstall itself as a Windows service, and it must be run as administrator. The SvcInstaller executable includes functionality to create a thread that loads a Dynamic Link Library (DLL) configured by the threat actor. This DLL includes two command-line options:

• -i (install service)
• -u (uninstall service)

The startup type of the malicious service is set "Automatic," and the two known versions of this malicious service are named "MSSPrv" and "UPSmgr". SvcInstaller installs either MSSPrv or UPSmgr, and the installed service attempts to masquerade as a legitimate service by using similar display names (see Tables 8 and 9).

Table 8. Comparison of SwPrv (legitimate) and MSSPrv (malicious) services.

Table 9. Comparison of UPS (legitimate) and UPSmgr (malicious) services.

Indicators

CTU researchers analyzed the SvcInstaller indicators in Table 10.

Table 10. Indicators for the SvcInstaller malware.

Ziyang RAT

The Ziyang family of malware is used to provide remote access to a compromised system. When executed, Ziyang connects to a C2 server's domain name or IP address and port value, which have been encoded in the malware, to receive instructions and send information. Ziyang can be used to upload, download, delete, or run files; search for files; list directory contents; and run commands on the compromised system.

Ziyang uses a custom binary protocol to communicate with a C2 server. Packets include a 16-byte header, followed by a compressed, encrypted payload. The header contains the following fields:

• Four-byte command string XOR-encoded with 0x9862ED7A
• Payload size
• Random DWORD used as part of the payload crypto key
• Hard-coded value from malware that may indicate a software version or specific campaign

The following example is network traffic generated by the Ziyang RAT:

0000   2a ae 2b dc 34 00 00 00 46 5d 45 2b 9d 64 b5 39  0010   fa 4d 15 07 1a 38 50 0b 1f fc 39 0e 23 7f 77 32  0020   32 6f f5 5d 1e 7c 41 52 ab c5 30 59 b1 51 07 6f  0030   0e 18 58 2d 63 9a 03 7f 6b 41 0c 4d 35 70 02 35  0040   31 27 2e 7b    0xdc2bae2a ^ 0x9862ED7A = 'PCID'  

The Ziyang RAT can use the decoded command strings listed in Table 11.

Table 11. Ziyang RAT command strings.

Indicators

CTU researchers analyzed the Ziyang indicators in Table 12. The domains and IP address listed in the indicators table may contain malicious content, so consider the risks before opening them in a browser. Some of the Ziyang RAT indicators have also been observed with the Ixeshe family of malware, which is an HTTP-based RAT.

Table 12. Indicators for the Ziyang RAT.

Airgapped malware

The malware samples in this group were constructed to control systems in situations where network communications are not possible or desired, such as an airgapped environment. Removable media transferred between compromised systems transports specially encrypted command files and moves files and captured data between the malware's agent modules and controller module.

One sample in this malware group, identified as the control module, monitors removable media insertion on the infected system. The module then attempts to execute its commands to collect harvested data and queue additional tasks and files for the agent modules. It can also selectively infect additional removable media by adding files and AutoRun configurations to the media. This module is hard-coded to self-terminate and clean up associated files when launched after June 21, 2013, so the specific version of this tool described in the NCCIC release is probably not on any systems running as of this publication.

The "agent" samples in this malware group are data collection and system control modules. The agent receives command files and then executes commands associated with data collection, binary execution, and other arbitrary system commands. The specific agent versions referenced in the NCCIC release are hard-coded to terminate and remove themselves from compromised systems when launched after hard-coded dates. The agent module that appears to be the most current and associated with the controller referenced in the NCCIC release has a self-termination date of May 31, 2013. The older agent module has a self-termination date of December 30, 2012. These dates suggest that these specific modules are probably not on any systems running as of this publication.

Agent modules can collect the following types of data:

• Computer and operating system details
• Network configuration
• User account information
• Directory listings for local and network drives on connected systems
• Domain or workgroup information
• Primary and backup domain controller information
• Arbitrary files from local and remote systems

Indicators

The modules do not contain any network indicators. These tools are most likely used in conjunction with other malware or remote access mechanisms, or rely on physical access. CTU researchers analyzed the airgapped malware indicators in Table 13.

Table 13. Common indicators for airgapped malware.