CHOPSTICK

They also send emails purportedly containing links to news items, but instead linking to malware drop sites that install toolkits onto the target's computer.

Among other things, it uses zero-day exploits, spear phishing and malware to compromise targets.

Figure 2. Main attack methods and malware used by the Sednit group since 2014... Email attachments

The hackers used a spear phishing attack, directing emails to the false URL electronicfrontierfoundation.org.

Together with the help of above mentioned tools, the group gained access to the file system and registry; enumerate network resources; create processes... | It used a downloader tool that FireEye dubbed " SOURFACE ", a backdoor labelled " EVILTOSS " that gives hackers remote access and a flexible modular implant called " CHOPSTICK " to enhance functionality of the espionage software.

RemoteShell 0x1302 Executes supplied commands in Linux command-line interpreter /bin/sh

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution. | Many malware families store configuration, payloads, encryption keys, C2 addresses, or other operational data in Registry keys, such as QakBot storing configuration in a randomly named subkey under HKCU\Software\Microsoft and PolyglotDuke writing encrypted JSON configuration files to the Registry.

The threat group implements counter-analysis techniques to obfuscate their code. They add junk data to encoded strings, making decoding difficult without the junk removal algorithm.

Examples include: “ComRAT has encrypted and stored its orchestrator code in the Registry…”, “ShadowPad maintains a configuration block and virtual file system in the Registry.”, and “QakBot can store its configuration information…under HKCU\Software\Microsoft.”

APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll".

Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks. Bisonal can check to determine if the compromised system is running on VMware. Bumblebee has the ability to perform anti-virtualization checks. CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution. RTM can detect if it is running within a sandbox or other virtualized analysis environment. Saint Bear contains several anti-analysis and anti-virtualization checks.

CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it. Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads. Operation Spalax threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.

The content repeatedly describes threat actors and malware modifying, creating, deleting, or storing data in Windows Registry keys and values for persistence, configuration storage, defense evasion, credential access, privilege escalation, and execution. | Many malware families store configuration, payloads, encryption keys, C2 addresses, or other operational data in Registry keys, such as QakBot storing configuration in a randomly named subkey under HKCU\Software\Microsoft and PolyglotDuke writing encrypted JSON configuration files to the Registry.

Consistent with GRU techniques and 'methods of persistence' identified by computer forensic investigators in other intrusions, the hackers again used X-Agent to log keystrokes, take screenshots, and gather system data; used a lateral-movement tool called RemCom; and used Mimikatz, a credential-harvesting tool.

Xagent is a modular backdoor with spying functionalities such as keystroke logging and file exfiltration... RemoteKeylogger 0x1002 Logs keystrokes

Together with the help of above mentioned tools... access stored credentials...

The content repeatedly describes malware and threat actors querying, enumerating, searching, reading, or checking Windows Registry keys and values, e.g., "ADVSTORESHELL can enumerate registry keys," "APT41 queried registry values to determine items such as configured RDP ports and network configurations," and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

Together with the help of above mentioned tools, the group gained access to the file system and registry; enumerate network resources...

5 List directories ... 22 List files and directories

20 Map network resources

Agent Tesla has the ability to perform anti-sandboxing and anti-virtualization checks. Bisonal can check to determine if the compromised system is running on VMware. Bumblebee has the ability to perform anti-virtualization checks. CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution. RTM can detect if it is running within a sandbox or other virtualized analysis environment. Saint Bear contains several anti-analysis and anti-virtualization checks.

CHOPSTICK includes runtime checks to identify an analysis environment and prevent execution on it. Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads. Operation Spalax threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.

An arrow representing the malicious fils moving laterally through the network. | The graphic indicates three methods of APT 29 tradecraft, including remote execution, file transmission, and keylogging

Xagent is a modular backdoor with spying functionalities such as keystroke logging and file exfiltration... RemoteKeylogger 0x1002 Logs keystrokes

The GRU had used malware called 'X-Agent' to take screenshots and capture the key strokes of a DCCC employee who had authorization to access the DNC network.

These actors set up operational infrastructure to obfuscate their source infrastructure, host domains and malware for targeting organizations, establish command and control nodes, and harvest credentials and other valuable information from their targets.

The source code contains two different channel implementations, one over HTTP and one over email... HttpChannel::getRawPacket() method is implemented as a HTTP GET request... sendRawPacket() is an HTTP POST request.

The Xagent backdoor can communicate with its C&C server over email with a custom protocol... MailChannel... SMTP to send emails and POP3 to receive emails (over TLS)

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.

APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.

LOAD_NEW_MODULE Instantiates an IAgentModule object from the given data, and registers this new module with the kernel... LOAD_NEW_CHANNEL Instantiates an IAgentChannel object from the given data... Sedreco plugin comes as a Windows DLL... downloading and execution of those plugins can be requested by the C&C server with command number 1

The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.

The Xagent backdoor can communicate with its C&C server over email with a custom protocol... messages are sent and received as attachments to emails... Sedreco core threads store the output generated by a command execution in the outbound file... periodically transmitted in bulk to the server.