“Threat Actors Exploit Recent Election Results”

Recently, we saw a tweet about a document claiming to be reporting about the recent  “Indian Election Results”. On analysis, we found that it was dropping a “Crimson RAT” payload. This RAT, mostly used by the Transparent Tribe APT, is capable of stealing credentials and other sensitive information. While checking the IOC’s related to this Crimson RAT, we also noticed that there was another Excel file which was disguised as “Syllabus of a University in Delhi”. 

This blog gets into the technical details of this document having a Crimson RAT payload.

Transparent Tribe APT

Transparent Tribe, a group believed to operate out of Pakistan, has been active since 2013. Their primary focus is on infiltrating diplomatic, defence, and research entities located in India and Afghanistan. This time election results were used as a bait to target Indian netizens.

Technical Details

The initial vector was a .docm file which has by default macro enabled setting. This document file contains embedded files, which includes the “Crimson RAT” payload and the Election results document.

After extracting the macro contents from the document using olevba, it copies the files into the folder named Data(sec)(min).

Here, it checks for the Office version and decodes the embedded files using oleobject7, oleobject10 and oleobject11. All the three files contain a base64 encoded zip file having the “Crimson RAT” payload.

In the revdbndfile function, it reads contents of one of the oleobject.bin and converts it into a string. The Decabav6f function (seen in Fig 5) is used to convert the base64 encoded string into a byte array by setting its datatype as base64. The BirvTrving function (seen in Fig 5) is later used to convert it back into a string by iterating through each byte.

After decoding the base64 string, it is written to the Appdata folder. It then copies and decompresses it into the Documents folder as a screensaver file “hacrvidth vibev.scr” and executes it.

Simultaneously, it executes another embedded doc file(oleobject3.bin), which is actually the decoy file having the election results of Uttarakhand.

As said, another Excel file disguised as the syllabus of a university also drops the same Crimson RAT. Here is the content of the decoy file.

Crimson RAT

The payload, on execution, sleeps for about 25 minutes, so as to hinder sandboxing. It then adds a run registry of the current user with a random hardcoded name for persistence.

Once again, it sleeps for about 20 minutes before it tries to connect to its C2 from the hardcoded domain and IP. If the payload does not connect to the attacker, the process exits.

On connecting to the C2 server, the command and data to the process (getsEtype Func) are sent. The malware then modifies the commands by inserting an integer value 5 before the 4^th character and executing the code by comparing with the received commands. If the attacker sends a null command, the process exits.

 These are the following C2 commands which could be executed.

By using these commands, they can access all the files, pictures, system info, the running processes from the system. It also has the capability to delete the files in the system and also to download additional payloads and execute them.

The discovery of malware disguised as a “Lok Sabha Election Results” document from India, underscores the tricky strategies employed by cyber attackers. As cyber threats continue to evolve, staying informed and proactive is essential to protect against such deceptive and potentially disruptive attacks. At K7 Labs, we provide robust detection for these RATs and other day-to-day threats. We recommend using a dependable security solution like “K7 Total Security” and keeping it up-to-date to safeguard your devices effectively.

IOCs

C2

Domain: waqers[.duckdns[.com

IP: 94.72.105.227

Decoy

Election Decoy – 24fc6cacfbf0f87d2a24be7361c78c76

Syllabus Decoy – 4166a122e5eac964ba9f4b22e2881052

The post Threat actors target recent Election Results appeared first on K7 Labs.