Researchers discovered a new malware attacker against the government and private organizations from Chinese cyber espionage group APT10 using previously unknown malware with a new set of unique activities.
Based on telemetry data, attackers launching two different loader variants and various other payloads with similar Tactics, Techniques that were used for other attacks by APT10.
APT 10 hacking group targeting mostly commercial activities including aviation, satellite and maritime technology, industrial factory automation, automotive supplies, laboratory instruments, banking, and finance industries.
Recently two Chinese hackers who are behind the APT10 Hacking Group charged for compromising Intellectual Property and Confidential Business Information from government agencies NASA & other 45 US Tech giants.
Threat actors using typosquatting domain names similar to real, legitimate tech companies to trick victims and inject the payload to the target machine.
APT10 Malware Infection Process
Initially, Once the dropper variants entered into the system, they deliver different payloads with the help of following files.
- jjs.exe – legitimate executable
- jli.dll – malicious DLL
- msvcrt100.dll – legitimate Microsoft C Runtime DLL
- svchost.bin – binary file
Researchers also discovered PlugX and Quasar, Two different remote access trojan among these variants.
“PlugX is a modular structured malware that has many different operational plugins such as communication compression and encryption, network enumeration, files interaction, remote shell operations and more.”
During the first stage of the infection process, a loader starts abusing the legitimate executable process ( jjs.exe ) and inject the malicious DLL inside, a method is known as DLL Side-Loading.
According to Ensilo Research, “The malicious DLL maps the data file, svchost.bin, to memory and decrypt it. The decrypted content is a shellcode that is injected into svchost.exe and contains the actual malicious payload.”
The first variant delivers both PlugX and Quasar and the downloaded payload is a modified Quasar RAT to extract passwords from the victim machine using an addition called SharpSploit , a .NET post-exploitation library written in C#.
Another PlugX collects information about the infected machine such as the computer name, username, OS version, RAM usage, network interfaces, and resources.
Researcher uncovered the APT10 attackers using C&C servers located in South Korea and some of the mentioned domain mappings were recently updated. Also, the certificate embedded in the Quasar sample.
41542d11abf5bf4a18332e9c4f2c8d1eb5c7e5d4298749b610d86caaa1acb62c (conhost.exe downloader jli.dll)
29b0454db88b634656a3fc7c36f318b126a83ae8fb7f73fe9ff349a8f8536c7b (conhost.exe downloader svchost.bin)
02b95ef7a33a87cc2b3b6fd47db03e711045974e1ecf631d3ba9e076e1e374e9 (PlugX jli.dll)
e0f91da52fdc61757f6a3f276ae77b01d2d1cc4b3743629c5acbd0341e5de80e (PlugX svchost.bin)
f13536685206a94a8d3938266f100bb2dffa740a202283c7ea35c58e6dbbb839 (PlugX jli.dll)
c8d86e9f486d23285b744279812ef9047a0908e39656c2ea4cdf3e182f80e11d (PlugX svchost.bin)
.NET Downloader (conhost.exe):
Download Free E-book to learn about complete Enterprise Security Implementation & Mitigation Steps – Download Free-Ebook Here.