Illuminating the Etumbot APT backdoor - Revision history

Eric.freyssinet at 14:16, 5 August 2015

2015-08-05T14:16:37Z

← Older revision		Revision as of 14:16, 5 August 2015
Line 1:		Line 1:
	{{Publication		{{Publication
	\|Botnet=Etumbot		\|Botnet=Etumbot
			\|Campaign=APT12,
	\|Year=2014		\|Year=2014
	\|Date=2014-06-06		\|Date=2014-06-06

Eric.freyssinet at 17:29, 14 July 2015

2015-07-14T17:29:20Z

@@ Line 1: / Line 1: @@
 {{Publication
 |Type=White paper
 |Abstract=Etumbot is a backdoor used in targeted attacks since at least March 2011. Indicators suggest that Etumbot is associated with the Numbered Panda group, also known as IXEHSE, DynCalc, and APT12.  Although previous research has covered related malware, little has been publicly discussed regarding Etumbot’s capabilities.
@@ Line 16: / Line 15: @@
 A timeline containing distraction documents along with backdoor and dropper indicators to include MD5 hashes, Command & Control server information, file system and process artifacts are included herein. Some use of the HTran connection bouncer has been observed, indicating that selected C&C’s were simply compromised sites used to relay traffic elsewhere.
 }}

Eric.freyssinet: 1 revision imported

2015-02-07T14:30:34Z

1 revision imported

← Older revision	Revision as of 14:30, 7 February 2015
(No difference)

Eric.freyssinet at 15:07, 8 June 2014

2014-06-08T15:07:19Z

New page

{{Publication
|Type=White paper
|Link=http://www.arbornetworks.com/asert/2014/06/illuminating-the-etumbot-apt-backdoor/ www.arbornetworks.com
|NomRevue=ASERT Blog
|Date=2014
|Editor=Arbor Networks
|Year=2014-06-06
|Botnet=Etumbot
|Abstract=Etumbot is a backdoor used in targeted attacks since at least March 2011. Indicators suggest that Etumbot is associated with the Numbered Panda group, also known as IXEHSE, DynCalc, and APT12. Although previous research has covered related malware, little has been publicly discussed regarding Etumbot’s capabilities.

Indicators suggest that the Etumbot dropper is delivered via spear phishing and is contained inside an archive file intended to be of interest to the target. The attackers use the Unicode Right to Left Override technique and document icons to disguise malicious executable content as document files. Once the dropper is executed, the backdoor is activated and a distraction file of interest to the target is opened for viewing. ASERT has observed several Etumbot samples using distraction documents involving Taiwanese and Japanese topics of interest, and has also observed recent development activity which indicates that attack campaigns are ongoing.

Once installed, the backdoor connects to it’s Command & Control server and receives an encryption key. RC4 encryption, along with HTTP transactions intended to blend in with typical traffic are used for backdoor communications. Etumbot’s core functionality allows for the execution of commands and the capability to upload and download files.

Attackers attempt to obfuscate the malware by using a technique known as “byte strings”, also known as “string stacking”. Through the use of ASERT tools, these byte strings are deobfuscated and revealed herein.

A timeline containing distraction documents along with backdoor and dropper indicators to include MD5 hashes, Command & Control server information, file system and process artifacts are included herein. Some use of the HTran connection bouncer has been observed, indicating that selected C&C’s were simply compromised sites used to relay traffic elsewhere.
}}