MontysThree

The initial loader module is spread inside RAR self-extracting archives (SFX) with names related to employees’ phones list, technical documentation and medical test results... All of them seem like typical spear-phishing tricks.

For WebDAV communication, the developers simply use the “net use” Windows command.

LinkUpdate Persistence module is a Windows Quick Launch .lnk modifier. With this naive persistence method users would run the Loader module by themselves every time along with the browsers from the Windows Quick Launch toolbar.

LinkUpdate Persistence module is a Windows Quick Launch .lnk modifier. With this naive persistence method users would run the Loader module by themselves every time along with the browsers from the Windows Quick Launch toolbar.

The malware includes a set of C++ modules used for persistence, obtaining data from a bitmap with steganography... In case of HTTP GET/POST requests, the malware would receive a steganography bitmap picture...

There are no lures, only PE files (masquerading a .pdf or .doc file)...

On execution, the SFX script calls the Open() function... in the %TEMP% directory and deletes it.

To decrypt the kernel module the initial loader uses a custom algorithm... the kernel concatenates them and decrypts them with a custom XOR-based algorithm.

The XML configuration contains valuable data... fingerprinting the target using its OS version, process list... SysInfoIoControl() Handler of “SysInfo” task with SCREENSHOT, INFO and TASKLIST subcommands

The XML configuration contains valuable data... such as fingerprinting the target using its OS version... SysInfoIoControl() Handler of “SysInfo” task with SCREENSHOT, INFO and TASKLIST subcommands

MontysThree is configured to search for specific Microsoft Office and Adobe Acrobat documents stored in current documents directories and on removable media.

In a separate Window procedure, the malware monitors if a USB device is plugged in, searching for files of interest.

The XML configuration contains valuable data... capturing screenshots... SysInfoIoControl() Handler of “SysInfo” task with SCREENSHOT

The third 3DES key is also stored in the .data section in its encrypted form; this key is used to decrypt an embedded .cab archive containing the XML config.

Depending on the arguments transmitted from the kernel module, the module may upload or download content using RDP, WebDAV, Citrix and HTTP protocols. In case of HTTP GET/POST requests...

The module is able to make requests through RDP and Citrix in a naive way using legitimate clients.

Depending on the arguments transmitted from the kernel module, the module may upload or download content using RDP, WebDAV, Citrix and HTTP protocols.

Communications encryption The encryption algorithm is RSA... All methods used for external communications first decrypt the HttpTransport module and use it to transmit the corresponding data RSA-encrypted.

The malware includes... network communications with major legitimate public cloud services such as Google, Microsoft and Dropbox... Downloading data from Google and Dropbox public services using user tokens is implemented in HttpTransport as well.