forked from LexusWang/Aurora-demos
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path116.txt
More file actions
2 lines (2 loc) · 6.92 KB
/
Copy path116.txt
File metadata and controls
2 lines (2 loc) · 6.92 KB
1
2
Donot APT-C-35 Group Latest Attack Framework Disclosure
The Donot group (APT-C-35), also known as Donot, is a cyber espionage organization primarily targeting government agencies in countries surrounding India such as Pakistan and Sri Lanka to steal sensitive information. During our tracking of this group, we discovered that Donot has employed a series of new backdoor frameworks and repeatedly updated their programs. Based on component names used in these backdoor frameworks, we named it the "Jaca" framework. 01 Attack Process Our research indicates that Donot has maintained consistent attack procedures over the past two years. The initial stage involves delivering remote template injection documents or malicious macro documents via spear-phishing emails to target users. 02 Document Files The delivered RTF files are remote template injection documents containing obfuscated Unicode strings in the template. When opened, they load template files from remote servers. After template loading, the Equation Editor vulnerability CVE-2017-11882 is triggered, downloading shellcode from the server via shellcode. The shellcode detects the following drivers: Driver File Name | Associated Company klif.sys | Kaspersky aswsp.sys | Avast ehdrv.sys | Eset mfehidk.sys | McAfee 360AvFlt.sys | 360 Subsequently, it downloads Downloader to "%AppData%" and a decoy document "Document.doc" to "%Temp%", repairing Downloader's header data. Persistence is achieved through schtasks.exe. 03 Downloader The program contains two export functions. In the rds export function, it copies itself to "%Temp%" and creates scheduled tasks via COM component TaskScheduler, invoking another export function through rundll32.exe. After completion, it deletes the "discord" scheduled task and itself. The rdr export function uses COM component WbemLocator to check for "vmtoolsd.exe" or "vmacthlp.exe" processes to detect virtual machine environments. If detected, it exits. Device information is collected and communicated with servers through two interactions: First interaction sends data to "https://getsr.xyz/Supex/pingpong/W/o" with format: Name: CPU model >Caption: OS version >V:|||Username-ComputerName-GUID||||||W|||3|||Installed programs... Second interaction requests Downloader components from "https://getsr.xyz/Supex/aqero/W/o". Post-download, it deletes the gdrive scheduled task and performs self-deletion via BAT script. 04 Component Analysis We identified seven categories of components in Donot's "Jaca" framework, deployed via Downloader. Other components use parameter 1\0 passed by Downloader to control function execution. 01 Encryption Algorithms The framework employs multiple encryption methods: 1. AES+Base64 encryption for server communication and local storage with two sets of keys: KEY1:56 DE 87 34 DB EC 2D 78 66 23 98 3B CE 77 73 8E IV:1 0A 0B 0C 0D 0E 0F 09 08 07 06 05 04 03 02 01 AB KEY2:2D 8E 37 56 5C DB 4E E8 FD A9 55 CD BC 34 4E 5D IV2:0A 0B 0C 0D 0E 0F 09 08 07 06 05 04 03 02 01 AB Some samples replace '+' with '@' in Base64 encoding. 2. String encryption using character substitution for file paths and API names. 02 Component Downloader The malware connects to servers to request components. If failed, retrieves encrypted domain data from Google Drive links like https://drive.google[.]com/uc?export=download&id=1LkX7SEMTj9D2tWMS5v54082a23HgGLQ3. Component request format: Username-ComputerName-GUID|||J1|||J1 Components are separated by '|' with format: ComponentName>FileSize>DownloadFlag>ExportFunction>Parameters When detecting non-"JacaPM" filenames, downloads new Downloader and creates scheduled tasks for persistence, finally self-deleting via "recom.bat". 03 File Collection Targets specific extensions: pdf, doc, xls, ppt, docx, xlsx, pptx, docm, rtf, inp, xlsm, csv, odt, pps, vcf. Stores files in: C:\ProgramData\MJuego\namcod C:\ProgramData\MJuego\atad Files from C:\ are classified into .man (non-documents) and .doc (documents). D:\ files become DD.doc/DD.man. Encrypted as .rnm files using AES. Files >1MB are split into C:\ProgramData\MJuego\namcod\knuhc\CC.man.rnm\. Uses WinHttpAddRequestHeaders with headers containing: Host: getsr.xyz Connection: keep-alive Data transmission format: -----------------------------7e13623304142 Content-Disposition: form-data; name="file"; filename="encrypted.rnm" [Encrypted Data] File metadata stored in JacaInfo.dat and JacaModif.dat. Encrypted files saved to C:\ProgramData\MJuego\rvsatad\. 04 File Upload Uploads .rnm files from specified paths: Path | Module C:\ProgramData\MJuego\atadlk | Klog C:\ProgramData\MJuego\atadsrb | Brsdat C:\ProgramData\MJuego\pntscn | Scrsht C:\ProgramData\MJuego\atadbsu\nvr | usbd C:\ProgramData\MJuego\ataddrhs\nvr | shrdd Uses same WinHTTP headers and data format as file collection. 05 Browser File Collection Targets Firefox profiles: %AppData%\Mozilla\Firefox\Profiles\*\cert9.db %AppData%\Mozilla\Firefox\Profiles\*\key4.db %AppData%\Mozilla\Firefox\Profiles\*\logins.json Copies files to C:\ProgramData\MJuego\atadsrb\ as .rnm. 06 Keystroke Logging Creates two threads: Thread1 monitors keyboard/clipboard, Thread2 processes data. Stores logs in C:\ProgramData\MJuego\atadlk\ as .lk files, then AES-encrypted .rnm. Data format: [TIME] [WINDOW TITLE] [CONTENT] 07 Screenshot Capture Takes screenshots every 120 seconds, saves to C:\ProgramData\MJuego\pntscn\ as .jc files. Encrypted to .rnm and deleted after uploading 4 screenshots. 08 Removable Device Handling Creates mutexes and three threads. Detects WM_DEVICECHANGE messages for device insertion. Chain1: Uses ICMP to scan network hosts, enumerates shares via NetShareEnum, copies documents to C:\ProgramData\MJuego\ataddrhs\, encrypts to .rnm in \nvr\. Chain2: Copies removable device files to C:\ProgramData\MJuego\atadbsu\, encrypts to .rnm in \nvr\. Files >1MB split into \knuhc\. 05 Attribution Analysis Technical similarities with historical Donot activities include: 1. Matching data formats between current and previous campaigns 2. Path overlap: C:\ProgramData\MJuego\ matches prior Downloader paths 06 Framework Evolution Component name comparison across periods: 2021.6-Present | 2020.11-2021.5 | 2019.12-2020.10 yty Framework | Description igfcServicee.dll | JacaPM.dll | NumberAlgo.dll | Boothelp.exe | Component download/execution winlogup.dll | JacaUL.dll | COMEvent.dll | abode.exe | File upload winlogss.dll | JacaSP.dll | ScnPoint.dll | dspcheck.exe | Screenshot winlogdfl.dll | JacaDFIter.dll | Dormode.dll | vstservice.exe | File collection winlogkl.dll | JacaKL.dll | FrameCordi.dll | mdriver.exe | Keylogging winlogbw.dll | JacaBD.dll | SRCPolicy.dll | | Browser data theft winlogus.dll | JacaUSD.dll | | | USB device collection Post-2021 components show increased deception tactics: paths changed to C:\ProgramData\Microsoftt\, DLL prefixes from "Jaca" to "winlog". Early 2020 components used dual export functions and XOR-based string decryption. The Jaca framework employs dynamic API imports and encrypted function names, reducing analyst visibility compared to previous versions.