Turla Outlook Backdoor

Improvement: the backdoor can execute PowerShell commands by leveraging Empire PSInject.

Table 2 shows the different functions: ... 0x24 Run shell command

In that case, the following modifications are made in the Windows registry: HKCU\Software\Classes\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066} ...

Table 2 shows the different functions: ... 0x25 Create process

For function 0x29, Turla developers copied code from the Empire project PSInject. It allows them to run PowerShell code in a special executable called a PowerShell Runner, without calling powershell.exe.

Table 2 shows the different functions: ... 0x25 Create process

For function 0x29, Turla developers copied code from the Empire project PSInject. It allows them to run PowerShell code in a special executable called a PowerShell Runner, without calling powershell.exe.

First, the backdoor always deletes all the emails that are sent to or received from the attacker.

In order to install the backdoor, attackers execute the DLL export called Install or register it using regsvr32.exe.

In that case, the following modifications are made in the Windows registry: HKCU\Software\Classes\CLSID\{49CBB1C7-97D1-485A-9EC1-A26065633066} ...

First, it steals emails by forwarding all outgoing emails to the attackers.

The backdoor implements many different commands, from file exfiltration to execution of commands. ... 0x23 Put file

At regular intervals, the backdoor sends a report to the attacker’s email address. It contains some unique identifiers such as the MAC address, the full log file and the command results, if any.

Second, it uses email messages as a transport layer for its Command & Control (C&C) protocol. Data, such as files requested via a command of the backdoor, is exfiltrated in specially-crafted PDF documents attached to emails

However, you may notice that it also forwards each outgoing email to the attacker’s email address, [redacted]@gmx[.]com. GMX is a popular, free email service.