Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Bookworm Trojan: A Model of Modular Architecture

Summary: Unit 42 discovered a previously unknown Trojan it named Bookworm while researching attacks on targets in Thailand, initially mistaken for a PlugX variant because of shared DLL side-loading and shellcode behavior but found to be functionally distinct. Bookworm carries only keylogging and clipboard theft as built-in capabilities, loads further modules from its command and control server, and uses Smart Installer Maker to deliver a self-extracting RAR that side-loads Loader.dll through legitimate Microsoft Malware Protection (MsMpEng.exe) or Kaspersky Anti-Virus (ushata.exe) executables.

What you should know: The Trojan keeps its supporting DLLs entirely in memory, calls their functions through structure offsets rather than direct references, and encrypts files and C2 traffic with multiple algorithms, so an analyst cannot use cross references to trace what Leader is calling without first rebuilding the structure by hand. Threat actors have so far deployed Bookworm primarily against targets in Thailand, and its ability to pull new modules from the C2 server means the keylogging and clipboard capture observed today is not the limit of what it can do on a compromised system.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related