Full Report
ESET researchers have discovered SprySOCKS for Windows, FishMonger’s backdoor weaponizing a kernel driver for advanced stealthiness
Analysis Summary
# Tool/Technique: SprySOCKS (Windows Variants: WIN_DRV and WIN_PLUS)
## Overview
SprySOCKS is an advanced backdoor traditionally associated with Linux environments. Recently discovered Windows variants (WIN_DRV and WIN_PLUS) demonstrate a significant evolution in the arsenal of the threat actor FishMonger. The malware is designed for long-term espionage, utilizing a sophisticated kernel driver to maintain stealth and bypass standard security monitoring tools.
## Technical Details
- **Type:** Malware family (Backdoor)
- **Platform:** Windows (Previously Linux)
- **Capabilities:** System reconnaissance, file manipulation, process/service management, keylogging, and kernel-level rootkit features.
- **First Seen:** Telemetry indicates activity between 2023 and 2024.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- [T1547.001 - Registry Run Keys / Startup Folder]
- **[TA0005 - Defense Evasion]**
- [T1014 - Rootkit]
- [T1564.001 - Hidden Files and Directories]
- [T1665 - Hide Infrastructure]
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1007 - System Service Discovery]
- [T1614.001 - System Location Discovery: System Language Discovery]
- **[TA0009 - Collection]**
- [T1056.001 - Keylogging]
- [T1115 - Clipboard Data]
- **[TA0011 - Command and Control]**
- [T1573.001 - Symmetric Cryptography (AES-128)]
- [T1008 - Fallback Channels (TCP, UDP, WebSocket)]
- [T1095 - Non-Application Layer Protocol]
## Functionality
### Core Capabilities
- **System Reconnaissance:** Collects CPU/memory info, privileges, system version, language, and time.
- **File Management:** Listing, creating, deleting, and transferring (upload/download) files.
- **Command Execution:** Interactive shell and over 30 hardcoded C&C commands.
- **Data Capture:** Integrated keylogger and clipboard monitoring.
- **Protocol Flexibility:** Supports TCP, UDP, and WebSockets for C&C communication.
### Advanced Features
- **Kernel-Level Stealth (WIN_DRV):** Uses a driver (RawWNPF) to hide active network connections, processes, registry keys, and files from the OS.
- **Traffic Diversion:** Diverts TCP traffic to allow operators to communicate with the backdoor through random ports, bypassing simple firewall rules and hiding the actual listening port.
- **Bootkit Integration:** Indications of UEFI bootkit usage (possibly CVE-2023-24932) to maintain persistence at the firmware level.
- **Traffic Masking:** Uses 128-bit AES encryption and Base64 encoding for C&C traffic.
## Indicators of Compromise
*Note: Specific hashes and detailed IOCs were truncated in the source text provided, but typical patterns for this malware include:*
- **File Names:** Drivers related to `RawWNPF`.
- **Network Indicators:** C2 servers communicating over non-standard ports (e.g., `hxxp[:]//[C2-IP-Address]:[Port]`).
- **Behavioral Indicators:**
- Loading of unsigned or vulnerable kernel drivers.
- Unexpected network traffic originating from kernel space or system processes.
- Modification of UEFI boot variables.
## Associated Threat Actors
- **FishMonger** (also known as Earth Lusca; linked to the Chinese contractor **I-SOON**).
## Detection Methods
- **Signature-based detection:** Scanning for the SprySOCKS Windows binaries and the "RawWNPF" kernel driver components.
- **Behavioral detection:**
- Monitoring for unauthorized modifications to the Windows Registry "Run" keys.
- Detecting API hooking or kernel-level process hiding.
- Identifying discrepancies between tool outputs (e.g., `netstat`) and raw network traffic.
- **Memory Forensics:** Searching for decrypted C2 configuration strings or the 128-bit AES keys in memory.
## Mitigation Strategies
- **Prevention measures:** Implement **UEFI Secure Boot** and ensure it is properly configured to prevent bootkit persistence.
- **Hardening recommendations:**
- Enable **Driver Signature Enforcement (DSE)** and **Windows Defender Application Control (WDAC)** to block unauthorized kernel drivers.
- Patch systems against **CVE-2023-24932** (Secure Boot bypass).
- Restrict administrative privileges to prevent the installation of services and drivers.
## Related Tools/Techniques
- **SprySOCKS (Linux version):** The original ELF-based predecessor.
- **ShadowPad:** Frequently used by similar Chinese APT groups.
- **BlackLotus:** A known UEFI bootkit that shares similar persistence goals.