{"id":1132,"date":"2022-04-13T19:26:14","date_gmt":"2022-04-13T19:26:14","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1132"},"modified":"2024-01-17T12:14:50","modified_gmt":"2024-01-17T12:14:50","slug":"hacktool-win32-apt-ps","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2022\/04\/13\/hacktool-win32-apt-ps\/","title":{"rendered":"HackTool.Win32.APT- PS"},"content":{"rendered":"

\t

\r\n\t\t\n

Updated on 03-13-2022:<\/p>\n

On 03-11-2022 AFTA Center released a warning related to this set of malware as “detecting a new malware in infrastructure” and called it the “Dilemma” which is the same HackTool.Win32.QWipe and you can read its complete analysis as follows.<\/p>\n

Please refer to AFTA Center<\/a> to read the report.<\/p>\n

\t<\/div>\r\n\t\n

Technical details<\/h2>\n

1.1 Modules and malware operation sequences<\/h3>\n

This malware includes many modules, including executable programs and various scripts, each of which has its small task.
\nThe following is a list of malware files with a brief description of how they work.<\/p>\n\n\n\n\n\n\n\n\n\n\n
File Name<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
HackTool.Win32.PS_Backdoor<\/td>\nthe malware Backdoor file is used to execute the hacker’s command and to download\/upload arbitrary files<\/td>\n<\/tr>\n
HackTool.Win32.QWipe<\/td>\nWiping Hard-disk data, changing users’ passwords, deleting Windows backup files, etc.<\/td>\n<\/tr>\n
wint.bat<\/td>\nRun the scheduler task to run the msdskint.exe file service<\/td>\n<\/tr>\n
Lastfile<\/td>\nThe contents of the last corrupted file path<\/td>\n<\/tr>\n
HackTool.Win32.HttpBackdoor<\/td>\nAct as\u00a0HttpBackdoor to create a backdoor in the system and execute the intruder’s commands<\/td>\n<\/tr>\n
HackTool.Win32.HttpCallBackService<\/td>\nThe intruder’s HttpCallBackService tool to establish a connection with C&C servers<\/td>\n<\/tr>\n
HackTool<\/span>.Win32.PS_Distributor<\/td>\nHacker’s\u00a0HttpBackdoor tool distribution file<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 1 – Summary of malware payload performance<\/p>\n

1.1.1 \u00a0Description of HackTool.Win32.PS_Backdoor threat performance<\/h4>\n

This malware acts as a backdoor for the hacker. This file makes the remote command execution from the server possible for the hacker. Other features of this malware are it can download\/upload arbitrary files. The whole send\/receive data by this file happens through TLS packets.<\/p>\n

This malware creates 4 execution sockets along with a local address on the victim’s system and then eavesdropping the data on these sockets. If receiving data, it will send them to its remote server using the below address. The malware uses port 8443 to connect with its remote server. This port like port 443 uses the TLS encryption method to transact packets. Currently, this server is offline.<\/p>\n

Http:\/\/dropboxui[.]com:8443<\/a><\/p>\n

When using port 443, there’s no need to mention the port beside the domain address. But when using port 8443 it is necessary to note the port beside the domain address.<\/p>\n

In the following, we will explain each socket’s performance.<\/p>\n\n\n\n\n\n\n
Socket No.<\/strong><\/td>\nPerformance<\/strong><\/td>\n<\/tr>\n
127.0.0.1:62563<\/td>\nFor receiving each TLS packet on this socket, the malware creates a cmd.exe process by recalling the main_startshell function and when executing, it will end the cmd.exe process and once again eavesdrop. It seems like the malware uses this socket only to receive execution commands.<\/td>\n<\/tr>\n
127.0.0.1:36774<\/td>\nReceiving HTTP packets under TLS and recalling the main_starthttp function to download\/upload files.<\/td>\n<\/tr>\n
49151:[::] 0.0.0.0:49151<\/td>\nEstablishing a proxy server between this socket and the hacker’s remote server<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 2- The malware sockets and their performance<\/p>\n

1.1.2 wint.bat file performance<\/h4>\n

This file executes the malware Wiper service. This is a service with a fake Windows Taks Scheduler <\/strong>name which you can see they’ve used the word Taks<\/strong> instead of Task. <\/strong>This\u00a0Wiper file has been seen on different systems through the following routes as msdskint.exe and Dilemma.exe:<\/p>\n

c:\\windows\\ccmcache\\6\\msdskint.exe<\/strong><\/p>\n

c:\\programdata\\pcmr\\msdskint.exe<\/strong><\/p>\n

1.1.3\u00a0HackTool.Win32.QWipe performance\u00a0<\/span><\/h4>\n

This file is the Wiper that the hacker created which can receive arguments. If there was no entry argument, the file has also contain predefined arguments which use them during execution.<\/p>\n

The hacker packed this file using the “Eziriz.NET Reactor<\/strong>” tool to obfuscate the malware codes from the analyzer and the antivirus. In the following, you can read how it acts after being decoded.<\/p>\n

In the following table, you can view a list of receivable arguments by the Wiper malware with their performance.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Entry arguments<\/strong><\/td>\nPerformance<\/strong><\/td>\n<\/tr>\n
-wipe-exclude<\/td>\nThe routes which are placed after this argument will be added to the malware exclusion list so they can be untouched during Wiping activity.<\/td>\n<\/tr>\n
-light-wipe<\/td>\nTimes when malware buffer has been written on the victim’s system to execute wiping activity.<\/td>\n<\/tr>\n
-sessions<\/td>\nIt restarts and logs off all system active Sessions<\/td>\n<\/tr>\n
-delete-users<\/td>\nDeletes all entered user’s accounts with the argument itself<\/td>\n<\/tr>\n
-shadows<\/td>\nWipes all system backup versions<\/td>\n<\/tr>\n
-start-iis<\/td>\nRestarts the iis service<\/td>\n<\/tr>\n
-config<\/td>\nUndefined activities<\/td>\n<\/tr>\n
-processes<\/td>\nEnds all entered process with the argument itself<\/td>\n<\/tr>\n
Logs-<\/td>\nThe malware wipes all OS and Event Viewer logs using Windows wevtutil.exe and Enum<\/td>\n<\/tr>\n
-delete<\/td>\nFinally, it removes all wiped files from the system, if enters this argument (it will execute\u00a0Win32Native.DeleteFile file)<\/td>\n<\/tr>\n
-break-users<\/td>\nChanges the victim’s system passwords<\/td>\n<\/tr>\n
-wipe-only<\/td>\nWipes only the files on the entered routes<\/td>\n<\/tr>\n
-purge<\/td>\nIt’s the complete removal and its wiping procedure is different than the normal procedure.<\/td>\n<\/tr>\n
-passwords<\/td>\nUndefined activities<\/td>\n<\/tr>\n
-wipe-all<\/td>\nWiping all system drives<\/td>\n<\/tr>\n
-stop-iis<\/td>\nStoping iis service<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

Table 3- HackTool.Win32.QWipe malware performance<\/p>\n