Loading malware…
Foudre is a Windows first-stage downloader and reconnaissance implant used by the Iranian-linked cyberespionage actor Infy, also known as Prince of Persia. Observed since August 2017, it profiles compromised systems and helps operators select victims for deeper exploitation. Its capabilities include collecting system and user information, recording and transmitting keystrokes, stealing browser credentials, manipulating files, and establishing persistence. For selected high-value victims, Foudre downloads and executes Tonnerre, a separate second-stage surveillance implant.
Foudre is distributed through phishing emails and malicious Office documents. Campaigns have used Persian-language lures, macro-enabled Word and Excel documents, and spreadsheets containing embedded executables. Installation chains use self-extracting archives and DLL-based components, sometimes accompanied by decoy documents or media.
Foudre locates command-and-control infrastructure through domain generation algorithms and authenticates servers using RSA signature verification before trusting them. This authentication complicates server impersonation and sinkholing. Successive versions have changed domain-generation logic and implementation details to reduce detection. Operators can selectively upgrade or remove infections after assessing a victim's value.
Foudre supports espionage targeting Iranian dissidents and other political targets, as well as government and private-sector entities. Associated campaigns have affected victims in Iran, Europe, Iraq, Turkey, India, and Canada.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Forms of malware identified as part of the latest Prince of Persia campaign include Foudre, a first stage malware loader
14 distinct techniques documented for this family, organized by ATT&CK tactic.
During the first half of 2020, new versions of Foudre emerged with new documents designed to lure victims... the malware would run a macro once the victim closes the document.
The second installation stage creates a link and runs its persistence mechanism: A scheduled task for helper.exe -ex <machine GUID in hex>.
The malicious document contains macros and an embedded rar sfx executable. When opened, the macros will run and will execute the embedded exe.
When the victim opens the document, a macro extracts the embedded package to the temp directory as fwupdate.temp and executes it after the document closes.
Setup=rundll32.exe conf3616.dll f8755 d530
When the victim opens the document, a macro extracts the embedded package to the temp directory as fwupdate.temp and executes it after the document closes.
Since the backdoor is designed to work on x86 and x64 Windows machines, threat actors were likely betting that victims would download and open the archive.
The second installation stage creates a link and runs its persistence mechanism: A scheduled task for helper.exe -ex <machine GUID in hex>.
The second installation stage creates a link and runs its persistence mechanism: A scheduled task for helper.exe -ex <machine GUID in hex>.
The sample is a RAR SFX self-extracting installer that contains 2 dlls and a jpg
<time_string> has this format: “<year>-<month>-<day>--<hour>-<minute>-<second>”
Finally, for command and control and exfiltration, Iranian-linked groups most commonly rely on application layer protocols (T1071), such as HTTP
A GET request is made to http://<cnc>//2016/?c=<computer_name>&u=<username>&v=<malware_version>&f=<base_folder>&mi=<machine_guid>&t=<time_string>
After connecting to the C2, Foudre downloads an encrypted self-extracting archive (SFX), and then decrypts and runs it... Tonnerre uses this C2 to... Download updates.
Like Foudre, Tonnerre uses a DGA to find its C2... Similar to Foudre, Tonnerre uses a DGA to find its C2, and verifies it as a valid server using an RSA signature.
Then, a DGA is used to get a responsive cnc; the DGA is similar to the Foudre’s DGA, but it uses other TLDs
135 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.