{"id":1376,"date":"2024-01-28T07:34:30","date_gmt":"2024-01-28T07:34:30","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1376"},"modified":"2024-04-22T12:49:47","modified_gmt":"2024-04-22T12:49:47","slug":"hacktool-win32-backdoordiplomacy","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2024\/01\/28\/hacktool-win32-backdoordiplomacy\/","title":{"rendered":"Hacktool.Win32.BackdoorDiplomacy"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> HackTool
\nDestruction Level:<\/strong> High
\nPrevalence:<\/strong> Moderate<\/p>\n

<\/h3>\n

Malware Name(s)<\/h3>\n
    \n
  • Hacktool.Win32.BackdoorDiplomacy (Padvish )<\/li>\n
  • Win32\/Korplug.A (Eset)<\/li>\n
  • Backdoor.Win32.Gulpix.ab (Kaspersky)<\/li>\n
  • Trojan:Win32\/Plugx.B (Microsoft )<\/li>\n<\/ul>\n

    <\/h3>\n

    What is HackTool?<\/h3>\n

    Hacktools are tools designed to facilitate intrusion. These tools can be used by an intruder to siphon data from the victim organization\u2019s network. These tools are commonly used to siphon the validation information of sensitive victim servers. For example, an intruder can use hacktools to guess passwords based on Brute Force attacks. In some cases, to escalate access levels and exploit existing vulnerabilities, hackTools are used. In general, hack tools can crash the computer and network security barriers and provide various capabilities to infiltrate systems.<\/p>\n

    <\/h3>\n

    What is\u00a0BackdoorDiplomacy <\/em>malware?<\/em><\/h3>\n

    BackdoorDiplomacy malware is classified as a Remote Access Tool (RAT), offering intruders the capability to take full control over a victim’s system. This sophisticated malware comprises a set of plugins that afford attackers an extensive array of features, including:<\/p>\n

      \n
    • Making modifications to files and folders<\/li>\n
    • Logging all keystrokes on the computer keyboard<\/li>\n
    • Capturing the victim’s screen<\/li>\n
    • Executing files or commands<\/li>\n
    • Accessing the database within the victim’s system and executing SQL queries on it<\/li>\n<\/ul>\n

      <\/h2>\n

      Technical Review<\/h2>\n

      Indicators of Compromise (IoC)<\/h3>\n

      ?The presence of the \\AllUsersProfile%\\SxS% directory including the following files:<\/p>\n

        \n
      • Nv.exe<\/li>\n
      • NvSmartMax.dll<\/li>\n
      • NvSmart.chm or data files with varying extensions<\/li>\n
      • Files featuring the .plg extension<\/li>\n<\/ul>\n

        ?Additionally, The presence of an Autorun service, along with an entry for the existing executable (.exe) file within the path of the malware files.<\/p>\n

        <\/h3>\n

        Performance Description<\/h3>\n

        BackdoorDiplomacy malware files often contain a malicious library file and a data file, which is actually a compact and obscure PE (exe. file). BackdoorDiplomacy malware uses a technique called DLL Hijacking to execute itself (Autorun), in which malicious files are placed next to a clean executable file. The malicious malware library file is loaded by the clean exe. file, and in this way the data file is also loaded in the memory, decompressed, and executed, which ultimately leads to the execution of the malicious operation of the malware.
        \nA variant of this malware uses the legitimate Nv.exe file of the NVIDIA application to execute itself. Files related to this type of malware include the following:<\/p>\n\n\n\n\n\n\n
        File Name<\/td>\nDescription<\/td>\n<\/tr>\n
        Nv.exe<\/em><\/strong><\/td>\nLegitimate program associated with the NVIDIA application that inadvertently loads the malicious malware library file.<\/td>\n<\/tr>\n
        NvSmartMax.dll<\/strong> \u06cc\u0627\u00a0Max.dll<\/strong><\/em><\/td>\nMalicious library file of the BackdoorDiplomacy malware, designed to load and execute the data file.<\/td>\n<\/tr>\n
        NvSmart.chm<\/strong> \u06cc\u0627 Nv.mpc<\/strong><\/em><\/td>\nPseudo-code file that, in reality, is a compressed and obscured PE file containing the primary operations of the BackdoorDiplomacy malware.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

        <\/h4>\n

        Network Operation<\/h4>\n

        After execution, BackdoorDiplomacy malware initiates communication with its command and control servers. The method of communication with the remote server is determined by the initial configuration of the malware, allowing for connectivity over TCP, UDP, ICMP, or HTTP protocols. Once connected to its designated server, the malware proceeds to execute the corresponding plugins based on commands received from the attacker. The following is a list of servers associated with this malware:<\/p>\n

        \u25aa\ufe0fpicture[.]efanshion[.]com<\/em><\/span><\/p>\n

        \u25aa\ufe0fmail[.]popanalysis[.]com<\/em><\/span><\/p>\n

        \u25aa\ufe0fdl-adobe[.]com<\/em><\/span><\/p>\n

        <\/h4>\n

        Malware Plugins<\/h4>\n

        As previously discussed, the BackdoorDiplomacy malware comprises a set of plugins, each serving a distinct purpose. The following table delineates the respective objectives and commands executable within each plugin, providing an illustrative overview of the malware’s functionality.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
        Command<\/th>\nSubcommand<\/th>\nFunction<\/th>\n<\/tr>\n
        Option<\/strong><\/td>\n\n

        \u25aa\ufe0f0x2000<\/p>\n

        \u25aa\ufe0f0x2001<\/p>\n

        \u25aa\ufe0f0x2002<\/p>\n

        \u25aa\ufe0f0x2003<\/p>\n

        \u25aa\ufe0f0x2005<\/td>\n

        		\n
          \n
        • Locking (user’s system) workstation<\/li>\n
        • Force shutdown request<\/li>\n
        • Reboot the system<\/li>\n
        • System shutdown request (enables the user to perform activities before shutdown)<\/li>\n
        • Requesting to display the intruder’s desired messages on the screen<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Disk<\/strong><\/td>\n\n

        \u25aa\ufe0f0x3000<\/p>\n

        \u25aa\ufe0f0x3001<\/p>\n

        \u25aa\ufe0f0x3002<\/p>\n

        \u25aa\ufe0f0x300A<\/p>\n

        \u25aa\ufe0f0x3004<\/p>\n

        \u25aa\ufe0f0x3007<\/p>\n

        \u25aa\ufe0f0x300D<\/p>\n

        \u25aa\ufe0f0x300C<\/p>\n

        \u25aa\ufe0f0x300E<\/td>\n

        		\n
          \n
        • Request to count the number of drives<\/li>\n
        • Request to search for the desired file<\/li>\n
        • Request to recursively search the file<\/li>\n
        • Create a directory<\/li>\n
        • Request to read the file<\/li>\n
        • Request to write to the file<\/li>\n
        • Request to copy\/rename\/delete and move the desired file<\/li>\n
        • Create a new desktop and run a process in it<\/li>\n
        • Request for an ‘expanded environment string<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Screen<\/strong><\/td>\n\n

        \u25aa\ufe0f0x4000<\/p>\n

        \u25aa\ufe0f0x4004<\/p>\n

        \u25aa\ufe0f0x4005<\/p>\n

        \u25aa\ufe0f0x4006<\/p>\n

        \u25aa\ufe0f0x4100<\/td>\n

        		\n
          \n
        • Request remote capabilities for a desktop<\/li>\n
        • Send mouse events<\/li>\n
        • Send keyboard events<\/li>\n
        • Send CTRL-Alt-Delete<\/li>\n
        • Request to capture a screen shot at the moment<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Process<\/strong><\/td>\n\n

        \u25aa\ufe0f0x5000<\/p>\n

        \u25aa\ufe0f0x5001<\/p>\n

        \u25aa\ufe0f0x5002<\/td>\n

        		\n
          \n
        • Request to create a process<\/li>\n
        • Request to count running processes<\/li>\n
        • Terminate and kill a process<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Service<\/strong><\/td>\n\n

        \u25aa\ufe0f0x6000<\/p>\n

        \u25aa\ufe0f0x6001<\/p>\n

        \u25aa\ufe0f0x6002<\/p>\n

        \u25aa\ufe0f0x6003<\/p>\n

        \u25aa\ufe0f0x6004<\/td>\n

        		\n
          \n
        • Querying a service configuration<\/li>\n
        • Change the desired service configuration<\/li>\n
        • Request to start a service<\/li>\n
        • Request to control a service<\/li>\n
        • Request to delete a service<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Shell<\/strong><\/td>\n0x7002<\/td>\n\n
          \n
        • Request to run CMD<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Telnet<\/strong><\/td>\n0x7100<\/td>\n\n
          \n
        • Request to start the Telnet service<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        RegEdit<\/strong><\/td>\n\n

        \u25aa\ufe0f0x9000<\/p>\n

        \u25aa\ufe0f0x9001<\/p>\n

        \u25aa\ufe0f0x9002<\/p>\n

        \u25aa\ufe0f0x9003<\/p>\n

        \u25aa\ufe0f0x9004<\/p>\n

        \u25aa\ufe0f0x9005<\/p>\n

        \u25aa\ufe0f0x9006<\/p>\n

        \u25aa\ufe0f0x9007<\/td>\n

        		\n
          \n
        • Enumerate available registry keys<\/li>\n
        • Create the desired key<\/li>\n
        • Delete the desired registry key<\/li>\n
        • Copy the desired registry key<\/li>\n
        • Count the values in a specific registry key<\/li>\n
        • Set a value for a registry key<\/li>\n
        • Delete a value of a key<\/li>\n
        • Enter a value for the value of a key<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Nethood<\/strong><\/td>\n0xA000<\/td>\n\n
          \n
        • Request to count network resources<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Portmap<\/strong><\/td>\n0xB000<\/td>\n\n
          \n
        • Command to initiate port mapping<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        SQL<\/strong><\/td>\n\n

        \u25aa\ufe0f0xC000<\/p>\n

        \u25aa\ufe0f0xC001<\/p>\n

        \u25aa\ufe0f0xC002<\/td>\n

        		\n
          \n
        • Request information about data resources<\/li>\n
        • Request to receive information about its driver<\/li>\n
        • Execute SQL query<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Netstat<\/strong><\/td>\n\n

        \u25aa\ufe0f0xD000<\/p>\n

        \u25aa\ufe0f0xD001<\/p>\n

        \u25aa\ufe0f0xD002<\/td>\n

        		\n
          \n
        • Retrieve table of TCP connections<\/li>\n
        • Retrieve table of UDP connections<\/span><\/li>\n
        • Set a value in the TCP connection table.<\/span><\/li>\n<\/ul>\n<\/td>\n<\/tr>\n
        Keylogger<\/strong><\/td>\n0xE000<\/td>\n\n
          \n
        • Command to initiate the Keylogger thread<\/li>\n<\/ul>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

          <\/h2>\n

          How to deal with and clean the system?<\/strong><\/h2>\n

          \u2714\ufe0f\u00a0Padvish antivirus detects and removes this particular malware from your system. To proactively safeguard your system against such threats, it is advisable to consider caution and avoid clicking on suspicious links. Additionally, routinely scan email attachments and portable devices before saving\/inserting them into your system.<\/p>\n

          \u2714\ufe0f\u00a0Maintain the security of your system by consistently updating both your operating system and antivirus software to ensure the highest level of protection against evolving threats.<\/p>\n

           <\/p>\n","protected":false},"excerpt":{"rendered":"

          Overview Type: HackTool Destruction Level: High Prevalence: Moderate Malware Name(s) Hacktool.Win32.BackdoorDiplomacy (Padvish ) Win32\/Korplug.A (Eset) Backdoor.Win32.Gulpix.ab (Kaspersky) Trojan:Win32\/Plugx.B (Microsoft ) What is HackTool? Hacktools are tools designed to facilitate intrusion. These tools can be used by an intruder to siphon data from the victim organization\u2019s network. These tools are commonly used to siphon the validation…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47,48],"tags":[],"class_list":["post-1376","post","type-post","status-publish","format-standard","hentry","category-malware","category-hacktool"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1376"}],"version-history":[{"count":13,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1376\/revisions"}],"predecessor-version":[{"id":1546,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1376\/revisions\/1546"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1376"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1376"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}