New malware variant has “radio silence” mode to evade detection

The Sharp Panda cyber-espionage hacking group is concentrating on high-profile authorities entities in Vietnam, Thailand, and Indonesia with a brand new model of the ‘Soul’ malware framework.

The actual malware was beforehand seen in espionage campaigns concentrating on vital Southeast Asian organizations, attributed to varied Chinese language APTs.

Check Point recognized a brand new marketing campaign utilizing the malware that began in late 2022 and continues by 2023, using spear-phishing assaults for preliminary compromise.

The usage of the RoyalRoad RTF equipment, C2 server addresses, and the hacker’s working hours allowed Verify Level to attribute the most recent espionage operation to state-backed Chinese language hackers. The TTPs and instruments are in step with beforehand seen actions by Sharp Panda.

An infection chain

The brand new Sharp Panda marketing campaign makes use of spear-phishing emails with malicious DOCX file attachments that deploy the RoyalRoad RTF equipment to try to use older vulnerabilities to drop malware on the host.

On this case, the exploit creates a scheduled activity after which drops and executes a DLL malware downloader, which in flip fetches and executes a second DLL from the C2 server, the SoulSearcher loader.

This second DLL creates a registry key with a worth that accommodates the ultimate compressed payload after which decrypts and hundreds the Soul modular backdoor into reminiscence, serving to it evade detection from antivirus instruments operating on the breached system.

Soul particulars

Upon execution, the principle module of the Soul malware establishes a reference to the C2 and waits for extra modules that can lengthen its performance.

The brand new model analyzed by Verify Level incorporates a “radio silence” mode which permits the risk actors to specify the particular hours of the week that the backdoor mustn’t talk with the command and management server, more likely to evade detection throughout the sufferer’s working hours.

“That is a sophisticated OpSec characteristic that enables the actors to mix their communication circulate into common site visitors and reduce the probabilities of community communication being detected.” defined Verify Level.

Furthermore, the brand new variant implements a customized C2 communication protocol that makes use of varied HTTP request strategies, together with GET, POST, and DELETE.

Assist for a number of HTTP strategies offers the malware flexibility, as GET is used for retrieving knowledge, POST for submitting knowledge.

Soul’s communication with the C2 begins by registering itself and sending sufferer fingerprinting knowledge ({hardware} particulars, OS kind, time zone, IP deal with), after which it enters an infinite C2 contacting loop.

The instructions it could obtain throughout these communications concern loading extra modules, amassing and resending enumeration knowledge, restarting the C2 communication, or exiting its course of.

Verify Level didn’t pattern extra modules which may carry out extra specialised capabilities comparable to file actions, knowledge exfiltration, keylogging, screenshot capturing, and so forth.

The Soul framework was first seen within the wild in 2017 and subsequently tracked all through 2019 in Chinese language espionage campaigns carried out by risk actors with no apparent hyperlinks to Sharp Panda.

Regardless of the overlaps in using the software, Verify Level’s current findings present that Soul continues to be beneath lively improvement and deployment.