Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Pivot on Google Code C2 Reveals Additional Malware

Summary: Unit 42 pivoted on command-and-control indicators from earlier Google Code attacks against East Asia and found a sample downloaded June 18 from Korean IP 211.233.89.182 via FTP that VirusTotal had not flagged as malware. The file, named "p", carried Microsoft-themed metadata but a PDB path reading E:\logic\projects\evil-codes\bin\xVirusDll.pdb and a Chinese (Simplified) language code, and used eight-byte rolling XOR encoding to conceal two files, the second being pluginWinPswLogger.dll, a Windows credential stealer whose variants date back to 2009.

What you should know: The implant writes captured local and network logon credentials, including matching passwords, to a log file in clear text, and it needs administrative privileges that a prior implant or weak Windows configuration can supply. Unit 42 traced the code to Logic.Yan's freely available Google Code repositories uploaded February 12, 2012, meaning a decade-old codebase is still being repurposed against at least one actor's objectives.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related