Full Report
The key to success for Campo Loader, Hancitor, IcedID, and QBot
Analysis Summary
# Tool/Technique: Campo Loader (and associated 2021 delivery chains)
## Overview
Campo Loader is a specialized downloader used primarily as an initial stage in infection chains to deliver more potent payloads such as Hancitor, IcedID, and QBot. Its purpose is to verify the victim environment, evade detection, and fetch secondary malware. The article highlights how this loader and similar delivery mechanisms (like fake software sites and phishing) serve as the "keys to success" for major malware families.
## Technical Details
- **Type:** Malware family (Downloader)
- **Platform:** Windows
- **Capabilities:** Payload delivery, environment fingerprinting, evasion, and command-and-control (C2) communication.
- **First Seen:** Early 2021 (active throughout 2021)
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.001 - Phishing: Spearphishing Attachment]
- [T1566.002 - Phishing: Spearphishing Link]
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- [T1059.003 - Command and Scripting Interpreter: Windows Command Shell]
- **[TA0005 - Evasion]**
- [T1027 - Obfuscated Files or Information]
- [T1497 - Virtualization/Sandbox Evasion]
- **[TA0011 - Command and Control]**
- [T1105 - Ingress Tool Transfer]
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Payload Acquisition:** Downloads secondary binaries (DLLs or EXEs) from hardcoded URLs.
- **Fingerprinting:** Collects system information (OS version, architecture) to ensure the target is suitable for the next stage.
- **Execution:** Uses `rundll32.exe` or direct shell execution to launch the downloaded payloads.
### Advanced Features
- **Pharma-Spam Integration:** Utilization of diverse infrastructure, including fake "pharma" sites and malicious "honey miner" or VPN clones, to lure users into downloading the loader.
- **Dynamic C2 Infrastructure:** Uses a revolving list of domains and IPs, often hosted on VPS providers, to avoid static IP blocking.
## Indicators of Compromise
### File Hashes (SHA256)
- `cd4164aee2890fbdf1b61b3b09a37b8857f6b3c87ceef29a573d34782598d976`
- `53f16cc3aa9b674651f2e69e02f1c91849123e8a98cb7a850c56ed23c8e89efd`
- `9c203cd2e56cce3e484bd447470c21cff9e9163ee4095d23413ecf6a81ec48c2`
- `c6677e676ec1049bb877a7ea6c424d7505e0b5ecfb4c1a2f049e008fb0eb17de`
- `38713d11d588217d0e86ba3ea8a8dd550c368dad3b910a1aa72aa74fa325a7ae`
### Network Indicators (Defanged)
- **C2/Payload Domains:**
- `deciopywlon[.]com`
- `hotaiddeal[.]su`
- `yourmedsquality[.]su`
- `goodherbwebmart[.]com`
- `honeyminer[.]live`
- `huvpn[.]com`
- **IP Addresses (BRChecker/Admin Panels):**
- `109.248.11[.]85`
- `109.248.203[.]202`
- `185.186.142[.]32`
- `195.123.241[.]180`
## Associated Threat Actors
- While specific named groups like TA544 have been linked to these payloads historically, the report focuses on the operators of the **Campo Loader** and **BRChecker** infrastructure who act as "Initial Access Brokers" for:
- **Hancitor** operators
- **IcedID** (BokBot) affiliates
- **QBot** (QuakBot) operators
## Detection Methods
- **Signature-based:** Detect the specific import hash and string obfuscation patterns within the Campo Loader PE files.
- **Behavioral:** Monitor for `rundll32.exe` or `regsvr32.exe` making outbound network connections to uncommon TLDs (.su, .live, .xyz).
- **Network:** Alert on traffic to known fake Sparkasse banking domains or suspicious Amazon S3 buckets hosting executables.
## Mitigation Strategies
- **Endpoint Protection:** Use EDR solutions to block unsigned executables running from `%APPDATA%` or `%TEMP%` directories.
- **Mail Security:** Implement strict attachment filtering (blocking .js, .vbs, .zip containing executables) and URL rewriting.
- **Web Filtering:** Block access to newly registered domains (NRDs) and suspicious TLDs like `.su`.
- **User Training:** Educate users on the risks of "freeware" VPNs and suspicious banking alerts that lead to third-party downloads.
## Related Tools/Techniques
- **Hancitor:** Often the immediate follow-up payload to Campo Loader.
- **BRChecker:** An administrative tool/panel used by the threat actors for tracking infections.
- **Phishing/SEO Poisoning:** The primary techniques used to drive traffic to the Campo Loader download links.