Mikroceen: Spying backdoor leveraged in high‑profile networks in Central Asia | WeLiveSecurity

Mikroceen: Spying backdoor leveraged in high‑profile networks in Central Asia

ESET researchers dissect a backdoor deployed in attacks against multiple government agencies and major organizations operating in two critical infrastructure sectors in Asia

ESET researchers dissect a backdoor deployed in attacks against multiple government agencies and major organizations operating in two critical infrastructure sectors in Asia

In this joint blogpost with fellow researchers from Avast, we provide a technical analysis of a constantly developed RAT that has been used in various targeted campaigns against both public and private subjects since late 2017. We observed multiple instances of attacks involving this RAT, and all of them happened in Central Asia. Among the targeted subjects were several important companies in the telecommunications and gas industries, and governmental entities.

Moreover, we connect the dots between the latest campaign and three previously published reports: Kaspersky’s Microcin against Russian military personnel, Palo Alto Networks’ BYEBY against the Belarussian government and Checkpoint’s Vicious Panda against the Mongolian public sector. Also, we discuss other malware that was typically a part of the attacker’s toolset together with the RAT. We chose the name Mikroceen to cover all instances of the RAT, in acknowledgement of Kaspersky’s initial report on the family. The misspelling is intentional, in order to avoid the established microbiological notion, but also to have at least phonemic agreement.

Clustering

First let’s discuss the clustering of Mikroceen, which is a simple RAT, and show our reasons for thinking reports from Kaspersky, Palo Alto Networks and Checkpoint write about the same specific malware family (among other malicious tools mentioned). Figure 1 provides a comparison of the decryption loop that is used for configuration data consisting of the C&C domain, a name and a password associated with each sample of the RAT. The loop is practically the same and it is implemented in three copies in a row. Checkpoint also discussed the similarities of the HTTP headers in the data sections between BYEBY and Vicious Panda, and a shared logging message V09SS0lO that base64 decodes to WORKIN. The encoded string is also present in Microcin.

Figure 1. Part of the code used to decipher internal data; the exported DLL name is at the bottom

In the section Attackers’ arsenal below we also compare the command grammars of the RAT’s features and typical error messages that are logged during execution with its previous instances. To support the evidence, the preferred provider of the attackers’ infrastructure and the most typical malware simultaneously found on the compromised networks. All these clues should evoke strong confidence that it’s the same malware family.

Timeline & victimology

Figure 2 sketches the evolution how the threat was tracked in time. As we mentioned earlier, the Central Asian region joined Russia, Belarus and Mongolia as areas with victims of Mikroceen intrusions. These victims were not desktop users, but endpoints in corporate networks where a higher level of security is expected.

Figure 2. Timeline of events related to Mikroceen

Figure 3. The recent campaigns in Central Asia surrounded by the previously reported ones

Attackers’ arsenal

Let us describe the tools the attackers used in their campaign in Central Asia. Unfortunately, we were unable to discover how they got into the compromised networks.

RAT (client-side backdoor)

Once the intruders establish a foothold on a victim machine, the code in Figure 4 serves to install the RAT on the system. Note the parameter start= auto, which establishes the malware’s persistence after a reboot.

Figure 4. Installation batch code

As we mentioned earlier, each bot comes with configuration data: C&C, client name and client password. The name of the bot appears in the server-side interface. What is quite unusual is that an operator needs to authenticate by entering the client’s password in order to control the client. We can only speculate about the purpose, but it could serve as protection against botnet takeover, in case a competing actor or law enforcement seize their infrastructure. So, we see that certain effort was put on the security of the client-server connection. Moreover, the client can connect directly to the C&C server or route the traffic via a proxy, which could be useful – especially in corporate networks. The connection is further secured by a certificate and this is a feature that distinguishes Mikroceen from the legion of backdoors we have seen since previously.

Mikroceen uses the same basic features as already described Palo Alto Networks about BYEBY. The grammar of commands is quite specific, because each command is truncated to 6 letters and then base64 encoded. That results an 8-letter incomprehensible word in the code. While in previous cases the encoding was straightforward, in the campaign in Central Asia there’s additional unknown encryption layer added. The connection of the 8-letter words with the commands in that case was done by agreement on the code level.

CommandMicrocin, BYEBY, Vicious PandaMikroceen
hello!aGVsbG8hAmbZDkEx
GOODBYR09PREJZeYTS5IwW
BYE BYQllFIEJZbo7aO8Nb
DISCONRElTQ09O6GEI6owo
LIST DTElTVCBEKi0Swb7I
STARTCU1RBUlRD h71RBG8X
COMMANQ09NTUFO5fdi2TfG
TRANSF + (UPLOAD, DOWNLO)VFJBTlNG + (VVBMT0FE, RE9XTkxP)J8AoctiB + (QHbU0hQo, hwuvE43y)
EXECUTRVhFQ1VUgRQ7mIYr

Table 1. Command grammar of various instances of the RAT

During execution, the client logs debug messages in a temporary file. This varies among various Mikroceen instances. Table 2 provides a comparison of these messages from case to case and gives additional evidence that links the instances of Mikroceen.

 MicrocinBYEBYVicious PandaMikroceen
32-bit64-bit
Folder% CSIDL_COMMON_DOCUMENTS%%TEMP%% CSIDL_COMMON_DOCUMENTS%%TEMP%%TEMP%
Filename7B296FB0.CABvmunisvc.cab5E8C6FF0.CAB7B296FB0.CABW52G86ST.TMP
Keywords at mainV09SS0lO
U3RhcnQ=
V09SS0lO
U3RhcnQ=
V09SS0lO
U3RhcnQ=
V09SS0lOGvFa8Sei
Keyword at connectZGlyZWN0ZGlyZWN0ZGlyZWN0wfZ155bJwfZ155bJ

Table 2. Logging messages in a temporary file

Simultaneously occurring malware

The previous reports always mention a wide arsenal of tools that are used in the attacks. In our case it was the same – not just Mikroceen, but other malware as well. Here are the three most important tools we observed in the compromised networks.

Lateral movement via Mimikatz

The attackers used their implementation of Mimikatz, delivered via a two-stage mechanism: the first stage was a dropper usually called installer.exe or Yokel64.exe, which dropped the main payload with an indicative external DLL name mktz64.dll in the second stage. While Mikroceen has never come with debug information, here we can see the string E:\2018_\MimHash\mimikatz\Bin\mktzx64.pdb

Figure 5. A PDB string in the Mimikatz payload

Mimikatz is an open source project by French security researcher Benjamin Delpy, developed since 2007. It’s a robust tool that, among other things, can bypass various Windows authentication schemes, basically by dumping credential data from the Windows Local Security Account database. It’s mainly used by red teams in IT security but also misused across the spectrum of APT actors, e.g. Lazarus Group, Telebots, Okrum etc. After running it in a test virtual environment, its output is (the incorrect spaces before the commas are in the original):

Lateral movement via WMI

The attackers use an additional tool to spread in the hosting network. This time they leverage Windows Management Instrumentation (WMI). All relevant data is needed as the file’s name, as during the execution it expects @@<ComputerName>,<UserName>,<Password>,.exeIn the first step, a console to a remote computer is established, where the connection is identified by <ComputerName> and authenticated with (<UserName>, <Password>). Afterwards, proxy security is set to the strict level, which means arguments of each remote procedure call are encrypted and the server’s access to local resources is allowed. Then WMI is used again to retrieve the Win32_Process class, which in turn is used to create a process with given parameters. When all the work is done, the tool terminates itself.

Gh0st RAT

This infamous, old RAT was created around 2008. In this instance it was found as rastls.dll on the compromised systems, while the exported DLL name is usually svchost.dll. It tries to connect with https://yuemt.zzux[.]com:443, which resolves to an IP address in China. This is an exception with no explanation, because the server doesn’t belong to any of the C&C providers used by Mikroceen. From our point of view, it seems redundant to use this additional backdoor, whose capacity is fully provided by Mikroceen itself.

To recognize this backdoor, one observes the string Gh0st within the binary. The character string uwqixgze} is used as a placeholder for the C&C domain.­

Figure 6. Gh0st RAT malware (fragment)

C&C panel (server-side interface)

The previous reports already mention the poor operational security of the attackers (their open directories were observed by Kaspersky and Checkpoint), and the actors behind continue to leak tools not necessarily leveraged on the victims’ side. We were able to get our hands on an older version of RAT’s control panel.  On the lower part of Figure 7 there’s a graphical interface through which all bots are commanded. It is very minimalistic, which may be due to an older version from 2017, but still, just compare it with the greater than 10-year-old panel of Gh0st RAT. There’s not much improved since, visually or functionally, so the introduction of SSL connections seems like the main shift between the projects (the text box for “CN Name” on the figure). It seems that the operators of the botnet are content customers of Vultr services, a child company of Choopa LLC, as their operational infrastructure is mostly hosted there, and this was also observed in the Vicious Panda campaign by Checkpoint. This is a bullet-proof provider, documented by researchers from Cisco as early as 2015.


Figure 7. Interfaces for controlling bots: Gh0st RAT (2008) vs. Mikroceen’s interface (2017)

Conclusion

We have presented the analysis of a custom implementation of a client-server model developed for spying purposes. The malware developers put great effort into the security and robustness of the connection with their victims and the operators managed to penetrate high-profile corporate networks. Moreover, they have a larger toolset of attack tools at their disposal and their projects are under constant development, mostly visible as variations in obfuscation.

Indicators of Compromise (IoCs)

Here are the hashes of samples described in the article. Additional IoCs collected from the attacks can be found on ESET’s GitHub or Avast’s GitHub.

SHATimestampDescriptionESET detection name
d215bb8af5581b31f194248fc3bd13d999a5991c2016-06-29 00:34:42Microcin (Kaspersky)
7771e1738fc2e4de210ac06a5e62c534
Win32/Mikroceen.A
7a63fc9db2bc1e9b1ef793723d5877e6b4c566b82017-07-06 08:15:31BYEBY (PANW) 383a2d8f421ad2f243cbc142e9715c78f867a114b037626c2097cb3e070f67d6Win32/Mikroceen.B
2f80f51188dc9aea697868864d88925d64c26abc2017-01-28 11:33:43Vicious Panda (Checkpoint)Win32/Mikroceen.C
302cf1a90507efbded6b8f53e380591a3eaf6dcb2019-04-25 01:15:40Mikroceen 32-bitWin32/Mikroceen.H
21ffd24b8074d7cffdf4cc339d1fa8fe892eba272018-12-10 07:46:25Mikroceen 64-bitWin64/Mikroceen.C
5192023133dce042da8b6220e4e7e2e0dcb000b32019-03-11 12:14:09MimikatzWin64/Riskware.Mimikatz.AQ
c18602552352fee592972603262fe15c2cdb215a2015-03-16 03:29:39Lateral Movement via WMIWin32/HackTool.Agent.NEZ
4de4b662055d3083a1bccf2bc49976cdd819bc012015-12-31 03:10:15Gh0st RATWin32/Farfli.CSY

References

MITRE ATT&CK techniques

TacticIDNameDescription
ExecutionT1035Service ExecutionThe RAT is configured to run as a service at startup via sc.exe.
T1059Command-Line InterfaceThe RAT can execute a command line.
T1064ScriptingThe attackers used batch scripts for malware installation and execution.
T1105Remote File CopyThe RAT can download files to the victim’s machine
T1106Execution through APIThe RAT launches the Windows console via CreateProcess.
PersistenceT1050New ServiceThe RAT is executed automatically
Defense EvasionT1136MasqueradingThe RAT disguises itself as various types of legitimate services.
T1140Deobfuscate/Decode Files or InformationThe commands of the RAT and some of its components are encoded/encrypted.
DiscoveryT1082System Information DiscoveryThe RAT sends information, like the version of the operating system to be displayed, in operator’s panel.
T1016System Network Configuration DiscoveryThe RAT collects network information, including host IP address and proxy information.
T1033System Owner/User DiscoveryThe RAT sends information, like the username to be displayed, in operator’s panel.
Credential AccessT1103Credential DumpingMimikatz is used in the attack.
Command and ControlT1032Standard Cryptographic ProtocolThe RAT uses SSL for encrypting C2 communications.
T1043Commonly Used PortThe RAT uses port 443.
T1071Standard Application Layer ProtocolThe RAT uses the Schannel implementation of SSL.
T1001Data ObfuscationThe RAT’s interface controls the client with obfuscated commands.
T1030Proxy ConnectionThe RAT has a proxy option that masks traffic between the malware and the remote operators.
ExfiltrationT1041Exfiltration Over Command and Control ChannelThe operator of the RAT can download any desired file from a victim.
CollectionT1113Screen CaptureThe RAT can capture the victim’s screen.

Discussion