Full Report
ReversingLabs expanded the published hashes into a staging server, five stagers, two lure files and the domain-to-server links.
Analysis Summary
# Threat Actor: Unidentified (Associated with Staging Server 192[.]142[.]52[.]31)
## Attribution & Identity
**Actor Identification:** The provided data does not explicitly name a known APT or cybercriminal group, but characterizes an organized threat actor utilizing a multi-stage infection chain.
**Aliases:** None explicitly identified in the text.
**Known Associations:** The actor shows toolchain overlap with generic malicious families but maintains a distinct infrastructure footprint.
## Activity Summary
The actor conducted a campaign involving a sophisticated multi-stage delivery pipeline. The operation utilized two specific lure files (shortcuts) to initiate a chain of five PowerShell stagers. These stagers were designed to establish persistence and download a final backdoor payload. The activity was characterized by the use of a central staging server and a network of phishing domains to facilitate the attack.
## Tactics, Techniques & Procedures
- **Phishing/Social Engineering:** Use of lure files (LNK/Shortcuts) to initiate the infection.
- **Multi-stage Loading:** A sequence of five PowerShell stagers to obfuscate intent and bypass detection.
- **Persistence:** Implementation of stagers specifically labeled for entry and context maintenance (`stage2_entry`, `stage2_ctx`).
- **Command and Control (C2):** Use of specific URI paths for data collection and tasking (e.g., `/WZ` paths).
- **Defense Evasion:** Use of generic filenames like `svchost32.exe` for payloads and PowerShell obfuscation.
- **MITRE ATT&CK Mapping:**
- **T1547.001:** Boot or Logon Autostart Execution (Registry Run Keys/Startup Folder)
- **T1059.001:** Command and Scripting Interpreter: PowerShell
- **T1204.002:** User Execution: Malicious File
## Targeting
- **Sectors:** Information suggests broad interest, but specific industries were not explicitly named in the technical snippet.
- **Geography:** Global infrastructure was utilized; specific victim locations were not disclosed.
- **Victims:** Unknown/General.
## Tools & Infrastructure
- **Malware Families:**
- PowerShell-based stagers (Variant A and Variant B identified via ssdeep).
- A specific backdoor payload (identified by imphash and RHA similarity).
- `svchost32.exe` (malicious masquerading).
- **Infrastructure:**
- **Staging Server:** `192[.]142[.]52[.]31`
- **Domains:** Eight phishing domains (referenced but not listed individually in the text).
- **C2/Traffic:** 38 unique URLs used by the stagers for stage transitions and data collection (`m=collecting...`, `m=key_abe_s...`).
## Implications
The actor demonstrates a high level of operational discipline by utilizing segmented stagers to separate the initial compromise from the final payload delivery. This modular approach allows the actor to swap backdoors or modify C2 infrastructure without rebuilding the entire delivery chain. The overlap with "generic" toolsets suggests the actor may be trying to blend into background noise or is utilizing common crimeware components to complicate attribution.
## Mitigations
- **Script Block Logging:** Enable PowerShell Script Block Logging (Event ID 4104) to capture the de-obfuscated code used by the five stagers.
- **LNK Monitoring:** Monitor for suspicious `.lnk` files originating from email attachments or internet downloads, particularly those spawning `powershell.exe` or `cmd.exe`.
- **Network Filtering:** Block outbound traffic to the known staging IP `192[.]142[.]52[.]31` and audit logs for the specific URI patterns (`/WZ`, `stage2_entry`).
- **Endpoint Detection:** Deploy EDR rules to alert on non-standard processes (like `svchost32.exe`) running from user-writable directories (e.g., `AppData` or `Temp`).