T9000: Advanced Modular Backdoor Uses Complex Anti-Analysis Techniques
Summary: Unit 42 documented T9000, a backdoor variant of the T5000/Plat1 family that checks for 24 security products by registry value and adjusts its multi-stage installation to evade whichever are installed. The sample was dropped via an RTF file exploiting CVE-2012-1856 and CVE-2015-1641, and it captures encrypted data, takes screenshots of specific applications, targets Skype users, and steals files from removable media, with critical files stored in a directory named "Intel."
Why it matters: The malware runs checks at each stage to detect whether it is being analyzed and writes its presence into the AppInit_DLLs registry key so every user-mode process loads its ResN32.dll, meaning a single missed detection can spread persistence across the whole host. Unit 42 observed it in multiple targeted attacks against organizations based in the United States.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Mentions
- CVE-2012-1856CVE-2015-1641
- Related
- RTF Exploit Installs Italian RAT: uWarrior Cyber Risks ·CVE-2012-1856: Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021