Loading malware…
Elise is a Windows backdoor associated with the Lotus Blossom espionage cluster and also linked in reporting to Dragon Fish. It has been used in targeted intrusions against government and defense-related organizations, and has also been connected to broader espionage activity in Asia. Historical campaigns distributed Elise through spearphishing documents, including Microsoft Office exploit lures such as CVE-2012-0158, and later samples were delivered via malicious RTF documents exploiting Microsoft Office Equation Editor vulnerabilities including CVE-2018-0802.
Once executed, Elise performs host reconnaissance and environment checks before fully activating. Reported variants enumerate running processes, collect network configuration details with native system commands, and gather extensive host information including operating system, memory, disk, locale, timezone, user context, network adapters, and desktop files. Some samples include sandbox- and analysis-evasion checks such as process, MAC-address, disk-name, and VMware-related inspection.
Elise is capable of command execution, file upload and download, remote shell access, and data exfiltration. Exfiltrated data has been staged locally in at least some variants, then encoded in Base64 within HTTP cookie values and encrypted with RC4 before transmission. The malware has also been observed modifying browser proxy settings to facilitate communications.
For persistence, Elise can install itself as a Windows service and, if that fails, fall back to Registry Run-based autorun. Variants have also copied themselves as DLL or executable components and used rundll32 for execution. Defense-evasion behavior includes DLL injection into Internet Explorer and timestomping of created artifacts. Some variants support self-deletion through a remotely launched shell. Elise is best characterized as a long-running espionage backdoor used for persistent access, host survey, command execution, and covert data theft on compromised Windows systems.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The outcome: no it is not CVE-2017-11882 but rather CVE-2018-0802. CVE-2018-0802? This a second exploit also included in EQNEDT32.EXE which was detected in later December. | Recently we came across an interesting sample which seems to be related to Elise Malware. Elise is tight to the Dragon Fish and Lotus Blossom APT groups... In this blog post, we will dissect the latest version of Elise.
...a persistent spear-phishing campaign that exploited a Microsoft Office flaw (CVE-2012-0158) to distribute a backdoor dubbed Elise (aka Trensil) that's designed to execute commands and read/write files.
CVE-2018-0802 and CVE-2017-11882: Critical memory corruption vulnerabilities in the legacy Microsoft Office Equation Editor (EQNEDT32.EXE) used extensively during “Spring Dragon” campaigns...
CVE-2016-1019: A critical Adobe Flash Player vulnerability exploited through watering hole attacks and spoofed Flash installer sites to deliver the Elise backdoor...
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recently we came across an interesting sample which seems to be related to Elise Malware. Elise is tight to the Dragon Fish and Lotus Blossom APT groups... In this blog post, we will dissect the latest version of Elise.
Recently we came across an interesting sample which seems to be related to Elise Malware. Elise is tight to the Dragon Fish and Lotus Blossom APT groups... In this blog post, we will dissect the latest version of Elise.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Finally, in function 514D05, 5159AF and 515486 we find the download, upload and command execution handlers.
Examples include "admin@338 actors used the following commands ... dir c:\ >> %temp%\download", "BabyShark has used dir to search for 'programfiles' and 'appdata'", and "FIN13 has used the Windows dir command to enumerate files and directories in a victim's network."
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key... APT28 has deployed malware that has copied itself to the startup directory for persistence... FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.
actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.
Akira has used legitimate names and locations for files to evade defenses.
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe... BlackEnergy injects its DLL component into svchost.exe... ComRAT has injected its orchestrator DLL into explorer.exe... Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.
AdFind can extract subnet information from Active Directory; actors used ipconfig /all, netsh.exe, ifconfig, arp, route, nbtstat, and related APIs/commands to gather IP, MAC, DNS, DHCP, gateway, proxy, routing, ARP, and adapter information.
Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.
The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, BIOS, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, and WMI to gather host information. | Multiple entries explicitly state use of the Windows systeminfo command, e.g., 'BlackEnergy has used Systeminfo to gather the OS version...' and 'OilRig has run hostname and systeminfo on a victim.'
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.
The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
46 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Advanced malware delivered via an RTF Office lure exploiting Equation Editor vulnerability CVE-2018-0802. It drops and loads a PE file, injects the main payload into IExplorer.exe, performs multiple sandbox evasion checks, establishes persistence via an autostart key, can modify browser proxy settings, execute commands, download/upload data, and collect host reconnaissance data such as CPU, RAM, disk, OS version, username, locale, timezone, SID, tasks, network adapters, and desktop files.
Custom backdoor used by Lotus Blossom, historically delivered via spear-phishing; supports remote command execution, file transfer, and reconnaissance with persistence via registry and other techniques and HTTP-based C2.
Backdoor family historically used by Lotus Blossom prior to switching to Sagerunex.
An earlier custom backdoor used by Lotus Blossom (noted in 2012–2015-era spearphishing campaigns) to establish persistent access for espionage.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.