MalwareExploits 1 CVE

BalkanDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2018-20250Path Traversal in WinRAR ACE Archive ExtractionExploited in the wild

We’ve discovered a new version of BalkanDoor with a new method for execution/installation: an exploit of the WinRAR ACE vulnerability (CVE-2018-20250). In some of the latest samples of BalkanDoor detected in 2019, the malware is distributed as an ACE archive, disguised as a RAR archive, specially crafted to exploit the WinRAR ACE vulnerability (CVE-2018-20250). | We’ve discovered an ongoing campaign in the Balkans spreading two tools having a similar purpose: a backdoor and a remote access trojan we named, respectively, BalkanDoor and BalkanRAT.

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

BalkanRAT uses cmd.exe to execute files... BalkanDoor uses cmd.exe to create a remote shell.

T1106Native APIEvidence1

BalkanRAT uses ShellExecuteExW and LoadLibrary APIs to execute other malware components.

T1203Exploitation for Client ExecutionEvidence1

the malware is distributed as an ACE archive, disguised as a RAR archive ... specially crafted to exploit the WinRAR ACE vulnerability (CVE-2018-20250).

T1204User ExecutionEvidence1

The malware is disguised as PDF documents with misleading names, in order to entice the intended victim to click on it.

Privilege Escalation

1 technique

T1134Access Token ManipulationEvidence1

BalkanDoor is able to create a process under the security context of a different user... BalkanRAT is able to impersonate the logged-on user.

Stealth

2 techniques

T1036MasqueradingEvidence1

BalkanDoor can be installed as a service with names mimicking legitimate Windows services.

T1134Access Token ManipulationEvidence1

BalkanDoor is able to create a process under the security context of a different user... BalkanRAT is able to impersonate the logged-on user.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

BalkanRAT collects the computer name and the language settings from the compromised machine. BalkanDoor collects the computer name from the compromised machine.

Collection

1 technique

T1113Screen CaptureEvidence1

BalkanDoor can capture screenshots of the compromised machine.

Command and Control

3 techniques

T1008Fallback ChannelsEvidence1

The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience.

T1071Application Layer ProtocolEvidence1

BalkanDoor uses HTTP or HTTPS for network communication.

T1090ProxyEvidence1

If the connection is not successful, the backdoor is capable of using the user-configured proxy on the victim’s computer and repeating the connection attempt.

INDICATORS OF COMPROMISE

IOCs tracked for this family

58 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

25 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app7 years ago

hash.sha1●●●●●●●●●●●●View more in app7 years ago

uri●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Aug 14, 2019

Businesses in the Balkans under fire from a double-barreled weapon

A backdoor used in a long-running Balkan malspam campaign targeting financial departments. It installs as a Windows service, communicates with hardcoded C2 servers over HTTP/HTTPS, supports remote shell, file download/execute, screenshot capture, and can unlock the Windows logon screen without a password. It was also distributed via exploitation of the WinRAR ACE vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching58

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

BalkanDoor

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2018-20250Path Traversal in WinRAR ACE Archive ExtractionExploited in the wild

via eset welivesecurity blogwelivesecurity.com

MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

BalkanRAT uses cmd.exe to execute files... BalkanDoor uses cmd.exe to create a remote shell.

T1106Native APIEvidence1

BalkanRAT uses ShellExecuteExW and LoadLibrary APIs to execute other malware components.

T1203Exploitation for Client ExecutionEvidence1

the malware is distributed as an ACE archive, disguised as a RAR archive ... specially crafted to exploit the WinRAR ACE vulnerability (CVE-2018-20250).

T1204User ExecutionEvidence1

The malware is disguised as PDF documents with misleading names, in order to entice the intended victim to click on it.

Privilege Escalation

1 technique

T1134Access Token ManipulationEvidence1

BalkanDoor is able to create a process under the security context of a different user... BalkanRAT is able to impersonate the logged-on user.

Stealth

2 techniques

T1036MasqueradingEvidence1

BalkanDoor can be installed as a service with names mimicking legitimate Windows services.

T1134Access Token ManipulationEvidence1

BalkanDoor is able to create a process under the security context of a different user... BalkanRAT is able to impersonate the logged-on user.

Discovery

1 technique

T1082System Information DiscoveryEvidence1

BalkanRAT collects the computer name and the language settings from the compromised machine. BalkanDoor collects the computer name from the compromised machine.

Collection

1 technique

T1113Screen CaptureEvidence1

BalkanDoor can capture screenshots of the compromised machine.

Command and Control

3 techniques

T1008Fallback ChannelsEvidence1

The backdoor can connect to any of the C&Cs from a hardcoded list – a measure to increase resilience.

T1071Application Layer ProtocolEvidence1

BalkanDoor uses HTTP or HTTPS for network communication.

T1090ProxyEvidence1

If the connection is not successful, the backdoor is capable of using the user-configured proxy on the victim’s computer and repeating the connection attempt.

INDICATORS OF COMPROMISE

IOCs tracked for this family

58 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

14 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

19 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

25 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app7 years ago

hash.sha1●●●●●●●●●●●●View more in app7 years ago

uri●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

eset welivesecurity blogNews

Aug 14, 2019

Businesses in the Balkans under fire from a double-barreled weapon

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching58

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.