Loading malware…
BBSRAT is a Windows remote access trojan associated with cyber-espionage activity, including campaigns targeting Mongolian government entities. It has been delivered through spearphishing with weaponized Microsoft Word documents, often exploiting CVE-2012-0158 and in some cases CVE-2014-1761. In observed campaigns, BBSRAT was either embedded directly in malicious documents or retrieved as a final payload by the Cmstar loader. Reporting has also noted possible historical relationships or code-level similarities with PhantomNet and other tooling clusters, but those links are not firmly established.
BBSRAT supports core backdoor and post-compromise functions including listing running processes, enumerating files and directories, deleting files and directories, querying Windows service configuration information, and starting, stopping, deleting, or modifying services. It has used HTTP and HTTPS GET/POST traffic for command and control, including compressed outbound data and custom encryption for data sent to its controllers.
On Windows systems, BBSRAT has been executed through DLL side-loading using a legitimate Citrix executable and has also been observed using process hollowing into a legitimate Windows process to conceal execution. Persistence has been established through Registry Run autostart mechanisms, and some samples used a mutex to enforce a single running instance. The malware is best characterized as an espionage-oriented backdoor used for stealthy remote access and host management on compromised Windows hosts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The attacks themselves followed a consistent playbook throughout the observed timeframe; using weaponized Microsoft Word documents initially containing an exploit for only CVE-2012-0158... All of the Microsoft Word documents leveraged in these attacks used the CVE-2012-0158 and CVE-2014-1761 exploits. | All of the weaponized documents except two executed the Cmstar loader... Once Cmstar was loaded onto the victim hosts, it would attempt to retrieve a final payload... those that were available were variants of BBSRAT. The two samples not using Cmstar simply had BBSRAT embedded directly into to the weaponized document.
The newer documents containing exploits for both vulnerabilities appeared to use a publically available PoC authored by ‘HCL’, with little to no modifications made... All of the Microsoft Word documents leveraged in these attacks used the CVE-2012-0158 and CVE-2014-1761 exploits. | All of the weaponized documents except two executed the Cmstar loader... Once Cmstar was loaded onto the victim hosts, it would attempt to retrieve a final payload... those that were available were variants of BBSRAT. The two samples not using Cmstar simply had BBSRAT embedded directly into to the weaponized document.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
いくつかのPhantomNetは図10のように、起動時にGlobal\\GlobalAcProtectMutexというMutexを作成します。これは過去にPalo Alto Networksによって報告されたBBSRATの特徴と類似しています。
24 distinct techniques documented for this family, organized by ATT&CK tactic.
All of the Microsoft Word documents leveraged in these attacks used the CVE-2012-0158 and CVE-2014-1761 exploits.
Weaponized Microsoft Word document found titled 'Путины урилга.doc' (Putin's Invitation). CVE-2012-0158 exploit used, dropping new variant of Cmstar.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The content repeatedly describes malware and threat actors establishing persistence by adding values under Registry Run keys such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and by placing shortcuts or files in Startup folders.
The initial dropper embedded in the weaponized document files were obfuscated using a subtraction cipher previously used to obfuscate strings in the NetTraveler malware family.
...while displaying a decoy document or a legitimate appearing document that is generated and presented to the user to make it appear that the weaponized document that had been executed was indeed, legitimate.
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code. APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes. Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.
The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.
The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.
"BBSRAT uses Expand to decompress a CAB file into executable content." / "Expand can be used to decompress a local or remote CAB file into an executable."
BBSRAT will ensure persistence by setting the following registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\comctl32 - rundll32.exe %APPDATA%\comctl32.dll, Enter
Examples in the content include 'DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules,' 'Molerats decompresses ZIP files once on the victim machine,' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'
Examples include: "ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header," "UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers," and "GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2."
Each of the samples collected via WildFire and VirusTotal contained significant overlaps in tactics used, tools used, as well as infrastructure for command and control channels.
The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.
Once Cmstar was loaded onto the victim hosts, it would attempt to retrieve a final payload... those that were available were variants of BBSRAT.
Examples include 'Dark Caracal's version of Bandook communicates ... using HTTP payloads Base64 encoded,' 'BBSRAT ... send ZLIB compressed data back to the C2 server,' and 'FRAMESTING ... from decompressed zlib data within the request's POST data.'
The content is a catalog of malware and threat groups that encrypt command-and-control communications using algorithms such as DES, AES, RC4, XOR, Blowfish, RSA, Camellia, RC2, RC6, and custom ciphers.
"3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode..."; "APT33 has used AES for encryption of command and control traffic."; "Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode)."; "Duqu ... data stream can be encrypted with AES-CBC."; "PoisonIvy uses the Camellia cipher to encrypt communications."
Examples include 'BeaverTail has used HTTP POST to exfiltrate data to C2 infrastructure,' 'LAMEHUG can use HTTP POST requests to exfiltrate data from compromised hosts to C2,' 'StealBit can use HTTP to exfiltrate files to actor-controlled infrastructure,' and 'SolarWinds Compromise ... used HTTP for C2 and data exfiltration.'
17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan with file and directory deletion capability.
Remote access trojan that persists via a Registry Run key, including through DLL side-loading of a legitimate executable.
Remote access trojan that uses Expand to decompress CAB files into executable content.
Remote access trojan using a custom algorithm to encrypt HTTP C2 data.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.