Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Farseer: Previously Unknown Malware Family bolsters the Chinese armoury

Summary: Unit 42 discovered a previously unknown Windows malware family it named Farseer, with over 30 unique samples seen across the past two and a half years, mostly in 2017 and a handful in 2018. Farseer uses DLL sideloading of legitimate signed binaries such as bscmake.exe to load its encrypted payload sys.dll, beacons to pre-configured C2 servers including tcpdo[.]net, and shares infrastructure with HenBox, PlugX, Poison Ivy, Zupdax and 9002.

What you should know: The same infrastructure and shared registrant 46313@QQ[.]COM tie Farseer to Poison Ivy, Zupdax and a 2016 9002 Trojan, so a single C2 domain like tcpdo[.]net can indicate an actor with a broad, multi-family toolkit rather than one piece of malware.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related