Background
Recently, QiAnXin Threat Intelligence Center captured a bait document designed specifically for Arabic users. It is an Office Word document with malicious macros embedded to drop and execute a backdoor packed by Enigma Virtual Box. The backdoor program has a built-in keyword list containing names of people or opera movies to communicate with C2, distributes control commands to further control the victim's computer device. After investigation, we suspect this attack is carried out by Molerats.
After sharing the relevant information through social channels[1], we found that the C2 domain was resolved to a server no longer controlled by the attacker just within a few days to avoid more attacks.
Activity Records of Molerats
The activity of Molerats (alias[2]: Gaza Hackers Team, Gaza cybergang, Operation Molerats, Extreme Jackal, Moonlight) could be traced back to early 2012. In January 2012, attackers who identified themselves as the "Gaza Hackers Team" struck the website of the Israel Fire and Rescue services[3]. The same year in October, a suspicious file was found to have been circulating on Israeli police department computers and hence decided to take all its computers offline temporarily[4]. The follow up analysis report from Trend Micro[5] pointed out that the malware being used in the attack was Xtreme RAT which could be used to steal information and receive commands from a remote attacker. They also discovered that Xtreme RAT variants had been used to target many other National government agencies[6], such as those in the United States, United Kingdom, Turkey, New Zealand and etc.
FireEYE reviewed the attack on Israeli police department in a report[7] released in 2013, associated this event to Gaza Hackers Team and named this group as Molerats. Besides that, some other malware such as Poison Ivy used by this attack group also got revealed. In another report[8] released in 2014, FireEYE said ”Molerats are not only aware of security researchers’ efforts in trying to track them but are also attempting to avoid using any obvious, repeating patterns that could be used to more easily track endpoints infected with their malware”.
Molerats became particularly active in Q2 2015, Kaspersky collected lots of related IoCs and pointed out staffs in IT (Information Technology) and IR (Incident Response) departments were their preferred targets[9].
ClearSky first discovered the group's activities on Operation DustSky in January 2016. The target attack got suspended for more than half a month since the first report[10] got released. After that, their malware were rewritten in C++ and targets also got switched from before in efforts to evade detection[11]. ClearSky also indicated that Molerats were not as cautious as before, leaving more clues, which in turn has led to conclude with fairly certainly that Hamas may have a hand behind this attack group.
In June 2017, QiAnXin Threat Intelligence Center discovered new malware[12] used by Molerats. The malicious payload, which got delivered through CVE-2017-0199 exploit, was completely generated by using the popular standard attack framework Cobalt Strike. Kaspersky came up with an update of Molerats in late October and mentioned a possible related Android mobile malware in the report[13].
Sample Analysis
Dropper（Macros）
| File Name | 1.doc |
| MD5 | 063a50e5e4b4d17a23ac8c8b33501719 |
| Author | Motb3A |
The captured bait document is an Office Word document written in Arabic with malicious VBA macros embedded. If macro get enabled, the malicious code is automatically executed when the victim opens the document.
The contents after translation are as follows.
Since the macro is encrypted, we extract the relevant macro code as follows:
The macro code could drop out and execute the wmsetup.vbs script in the %userprofile% directory.
wmsetup.vbs
The VBS script decodes the data through Base64, and then save the decoded data to %temp%/ihelp.exe.
Finally set the scheduled task to start ihelp.exe:
Backdoor（Ihelp.exe）
| File Name | ihelp.exe |
| MD5 | 46173adc26721fb54f6e1a1091a892d4 |
| Packer | Enigma Virtual Box |
The backdoor is packed by Enigma Virtual Box：
The corresponding C2 is encrypted and stored in the configuration blob. When get executed, the backdoor decrypts the blob to obtain the C2 address (smartweb9.com).
The domain name has been resolved to IP address 198.54.117.244 which could be a sinkhole, but the attacker's server (79.124.60.40) was still online. So we were able to directly connect to the attacker’s server and perform follow up investigations. According to the network traffic and related decompiled code, the backdoor uses the SFML library for network communication (a library for game development: https://github.com/SFML).
The backdoor constructs a formatted request through a built-in keyword table, with contents related to some names or opera movies. This approach looks similar to the one mentioned by Talos[14] previously.
| Jessie | Lilliana | Jocelynn | Londyn |
| Ari | Paloma | Carmen | Cassandra |
| Zachariah | Randy | Charlee | Demi |
| Annika | Brice | Alyssa | Erik |
| Ariel | Juniper | Moises | Jeremy |
| Hunter | Jaydon | Freya | Regina |
| Janelle | Lillian | Aniyah | Kenia |
| Estelle | Mara | Daisy | Guadalupe |
| Demetrius |
The request data fall into sub-blocks, and some of the data are encoded by Base64 before appending to related keyword.
The entire block is encrypted and Base64 encoded again when all sub-blocks are ready, and finally sent to C2 via HTTP POST request.
The data returned by C2 will then be received and decrypted. The decrypted data contains keyword Demi which is supposed to inform the client to upload the collected information.
The sample collects information, such as the user name and computer name, and a string similar to the UUID. Then encrypts and encodes the information in the same way and sends it back to C2.
The data returned from C2 may contain some configuration information. After processing the received data, the backdoor starts to acquire the attacker's instructions periodically in order to perform functions such as remote shell and file operations.
- Remote Shell
- File Operation
Sinkhole
Since QiAnXin Threat Intelligence Center shared related information on the social media immediately after discovering the sample[1], the C2 has been taken over by security company or related agency before February 10.
By querying VirusTotal, we find that the IP address (198.54.117.244) being used to take over the C2 domain is associated with a large number of malicious domains.
Through 360 threat analysis platform, it can be seen that both belong to a same domain name service provider.
Therefore, we have reason to believe that after the QiAnXin Threat Intelligence Center shared the information, the domain name service provider got notified by some relevant organizations to take over the C2 to avoid more attacks.
Attribution
After analyzing those samples, the attack was suspected to be carried out by Molerats APT with part of the associations as follows.
- Similarity in the bait document
Highly similar to some of the bait documents used by Kaza Cybergang (Molerats), which were disclosed by Kaspersky in 2017. Both are related to the Gaza region and Hamas.
- Similarity in the payload
Similar to those discovered by Kaspersky, the payloads are packed by Enigma Virtual Box and pretend to come from Microsoft.
- 被注释的下载地址
The URL got commented out in the macro is the same as the one mentioned in Kaspersky’s report[13].
Macro code from samples provided in Kaspersky’s report.
Based on the above information and some other internal related data, QiAnXin Threat Intelligence Center suspects Molerats APT group is the one that launched this attack.
Conclusion
The Molerats APT group has been in existence for a few years, and has carried out a large number of attacks by using a variety of public and privately owned malware. Attackers are actively improving their toolkit in an effort to minimize their exposure to security products and services.
This group is good at social engineering by sending various types of decoy documents to the target in the attack. The decoy documents usually execute subsequent code through malicious macro. Comparing with Office 0day, using macro needs more user interactions and could reduce the success rate, but this approach is still used by lots of attack groups considering the cost is much lower. It is recommended that users avoid to open documents from untrusted sources, and Office macro should be disabled by default.
Products of 360 ESG can protect users from this new malware, including QiAnXin Threat Intelligence Platform, SkyEye APT Detection and NGSOC.
IOC
| MD5 |
| 063a50e5e4b4d17a23ac8c8b33501719 |
| 46173adc26721fb54f6e1a1091a892d4 |
| C2 |
| smartweb9.com |
References
-
https://middle-east-online.com/en/cyber-war-gaza-hackers-deface-israel-fire-service-website
-
http://www.timesofisrael.com/how-israel-police-computers-were-hacked-the-inside-story/
-
http://blog.trendmicro.com/trendlabs-security-intelligence/xtreme-rat-targets-israeli-government/
-
http://blog.trendmicro.com/trendlabs-security-intelligence/new-xtreme-rat-attacks-on-usisrael-and-other-foreign-governments/
-
https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html
-
https://www.fireeye.com/blog/threat-research/2014/06/molerats-here-for-spring.html
-
https://securelist.com/blog/research/72283/gaza-cybergang-wheres-your-ir-team/
-
http://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf
-
http://www.clearskysec.com/wp-content/uploads/2016/06/Operation-DustySky2_-6.2016_TLP_White.pdf
-
https://ti.qianxin.com/blog/articles/gaza-cybergang-apt-sample/
-
https://securelist.com/gaza-cybergang-updated-2017-activity/82765/
-
https://blog.talosintelligence.com/2017/06/palestine-delphi.html