Let It Ride: The Sofacy Group’s DealersChoice Attacks Continue
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2015-7645 | Arbitrary Code Execution in Adobe Flash Player via Crafted SWF Files | — | 65% | KEVRansomware | — KEV |
| CVE-2016-7255 | Win32k Local Privilege Escalation in Windows Vista Through Windows 10 and Server 2016 | 7.8 | 81% | KEVRansomwarePoC ×5 | KEV |
| CVE-2016-7855 | Use-After-Free RCE in Adobe Flash Player (Windows, macOS, Linux) | 8.8 | 25% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | adobeupgradeflash.com | tlkwarn[.]com 2016-11-11 fradblec@centrum.cz First stage C2 adobeupgradeflash[.]com 2016-11-22 nuevomensaje@centrum.cz First stage C2 globalr |
| domain | akamaisoftupdate.com | 4fae4a6d20e5f3afc3bc153b6968d6e), which uses a C2 server of akamaisoftupdate[.]com. Show Your Hand: Decoy Documents Six documents were colle |
| domain | appservicegroup.com | of apptaskserver[.]com, with differing backup C2 domains of appservicegroup[.]com and joshel[.]com. Ace in the Hole: Analyzing Victim Finge |
| domain | apptaskserver.com | ariants of the Seduploader tool share a common C2 domain of apptaskserver[.]com, with differing backup C2 domains of appservicegroup[.]co |
| domain | carbon2u.com | nameservers commonly associated with the Sofacy group, ns*.carbon2u[.]com and ns*.ititch[.]com. The domain akamaisoftupdate[.]com r |
| domain | globalresearching.org | ash[.]com 2016-11-22 nuevomensaje@centrum.cz First stage C2 globalresearching[.]org 2016-11-18 carroz.g@mail.com Six second stage C2 domains |
| domain | globaltechresearch.org | ftupdate[.]com 2016-10-26 mahuudd@centrum.cz Seduploader C2 globaltechresearch[.]org 2016-11-21 morata_al@mail.com Seduploader C2 researchcont |
| domain | ititch.com | ssociated with the Sofacy group, ns*.carbon2u[.]com and ns*.ititch[.]com. The domain akamaisoftupdate[.]com revealed additional ar |
| domain | joshel.com | th differing backup C2 domains of appservicegroup[.]com and joshel[.]com. Ace in the Hole: Analyzing Victim Fingerprinting In the |
| domain | microsoftsecurepolicy.org | ail address revealed that it had also been used to register microsoftsecurepolicy[.]org, which using passive DNS data we found had resolved to 40 |
| domain | postlkwarn.com | ly operational and active C2 servers (versiontask[.]com and postlkwarn[.]com) that followed the exact steps we outlined in the blog; l |
| domain | researchcontinental.org | research[.]org 2016-11-21 morata_al@mail.com Seduploader C2 researchcontinental[.]org 2016-12-02 Sinkholed Much like the first stage C2 domains |
| domain | securityprotectingcorp.com | ecorpind[.]com 2016-10-25 yasiner@myself.com First stage C2 Securityprotectingcorp[.]com 2016-08-19 ottis.davis@openmailbox.org First stage C2 Pos |
| domain | uniquecorpind.com | gistered by unique registrant emails. Versiontask[.]com and Uniquecorpind[.]com appear to be completely new infrastructure, not sharing a |
| domain | updmanager.net | e discovered 89.45.67.189, which previously had resolved to updmanager[.]net, a well reported domain in use by the Sofacy group. The d |
| domain | versiontask.com | nce discovered two fully operational and active C2 servers (versiontask[.]com and postlkwarn[.]com) that followed the exact steps we ou |
| ipv4 | 40.112.210.240 | ]org, which using passive DNS data we found had resolved to 40.112.210.240, a sinkhole with several other Sofacy group associated doma |
| ipv4 | 89.45.67.189 | g to 89.45.67.20. On the same class C subnet, we discovered 89.45.67.189, which previously had resolved to updmanager[.]net, a well |
| ipv4 | 89.45.67.20 | DNS data, we discovered akamaisoftupdate[.]com resolving to 89.45.67.20. On the same class C subnet, we discovered 89.45.67.189, wh |
| sha256 | 137185866649888b7b5b6554d6d5789f7b510acd7aff3070ac55e2250eb88dab | 9fa702a4223aa2c2318f38d5fe6eba68c645bc0c41c3d8b6f935eab3f64 137185866649888b7b5b6554d6d5789f7b510acd7aff3070ac55e2250eb88dab 73ea2ccec2cbf22d524f55b101d324d89077e5718922c6734fef9578712 |
| sha256 | 1579c7a1e42f9e1857a4d1ac966a195a010e1f3d714d68c598a64d1c83aa36e4 | 09d9bbdc7f1d2c8846dcfc4292b3e2642301d9c59130f58e21abb0001be 1579c7a1e42f9e1857a4d1ac966a195a010e1f3d714d68c598a64d1c83aa36e4 c5a389fa702a4223aa2c2318f38d5fe6eba68c645bc0c41c3d8b6f935ea |
| sha256 | 1f81609d9bbdc7f1d2c8846dcfc4292b3e2642301d9c59130f58e21abb0001be | 827c3a312d018ef4fcbfc7cb5205c9e827391bfe6eab697cc96412d938e 1f81609d9bbdc7f1d2c8846dcfc4292b3e2642301d9c59130f58e21abb0001be 1579c7a1e42f9e1857a4d1ac966a195a010e1f3d714d68c598a64d1c83a |
| sha256 | 3bb47f37e16d09a7b9ba718d93cfe4d5ebbaecd254486d5192057c77c4a25363 | load delivered by the C2 server is a loader Trojan (SHA256: 3bb47f37e16d09a7b9ba718d93cfe4d5ebbaecd254486d5192057c77c4a25363) that installs a variant of Seduploader (SHA256: 4cbb0e3601 |
| sha256 | 3ff1332a84d615a242a454e5b29f08143b1a89ac9bd7bfaa55ba0c546db10e4b | 713cf442716eac3f8c95da8d631aab2072ba44b17dda86873e462e10421 3ff1332a84d615a242a454e5b29f08143b1a89ac9bd7bfaa55ba0c546db10e4b The two variants of the Seduploader tool share a common C2 |
| sha256 | 45a4a376cb7a36f8c7851713c7541cb7e347dafb08980509069a078d3bcb1405 | d50eac9399914090f1edc2bda9ac1079edff4528078549c824c4d023ff9 45a4a376cb7a36f8c7851713c7541cb7e347dafb08980509069a078d3bcb1405 Figure 4 DealersChoice HTTP request to obtain a malicious S |
| sha256 | 4cbb0e3601242732d3ea7c89b4c0fd1074fae4a6d20e5f3afc3bc153b6968d6e | 77c4a25363) that installs a variant of Seduploader (SHA256: 4cbb0e3601242732d3ea7c89b4c0fd1074fae4a6d20e5f3afc3bc153b6968d6e), which uses a C2 server of akamaisoftupdate[.]com. Show Yo |
| sha256 | 5dd3066a8ee3ab5b380eb7781c85e4253683cd7e3eee1c29013a7a62cd9bef8c | s and decrypts an embedded DLL that it saves to the system. 5dd3066a8ee3ab5b380eb7781c85e4253683cd7e3eee1c29013a7a62cd9bef8c fa8b4f64bff799524f6059c3a4ed5d169e9e7ef730f946ac7ad8f173e82 |
| sha256 | 73ea2ccec2cbf22d524f55b101d324d89077e5718922c6734fef95787121ff22 | 5866649888b7b5b6554d6d5789f7b510acd7aff3070ac55e2250eb88dab 73ea2ccec2cbf22d524f55b101d324d89077e5718922c6734fef95787121ff22 DealersChoice C2s: Versiontask[.]com Uniquecorpind[.]com Se |
| sha256 | 82213713cf442716eac3f8c95da8d631aab2072ba44b17dda86873e462e10421 | variant of Sofacy’s tool that uses the Carberp source code. 82213713cf442716eac3f8c95da8d631aab2072ba44b17dda86873e462e10421 3ff1332a84d615a242a454e5b29f08143b1a89ac9bd7bfaa55ba0c546db |
| sha256 | c42a0d50eac9399914090f1edc2bda9ac1079edff4528078549c824c4d023ff9 | sed in October 2016 in Adobe Security Bulletin APSA15-05 ). c42a0d50eac9399914090f1edc2bda9ac1079edff4528078549c824c4d023ff9 45a4a376cb7a36f8c7851713c7541cb7e347dafb08980509069a078d3bc |
| sha256 | c5a389fa702a4223aa2c2318f38d5fe6eba68c645bc0c41c3d8b6f935eab3f64 | 7a1e42f9e1857a4d1ac966a195a010e1f3d714d68c598a64d1c83aa36e4 c5a389fa702a4223aa2c2318f38d5fe6eba68c645bc0c41c3d8b6f935eab3f64 137185866649888b7b5b6554d6d5789f7b510acd7aff3070ac55e2250eb |
| sha256 | c993c1e10299162357196de33e4953ab9ab9e9359fa1aea00d92e97e7d8c5f2c | 5, the server responded with a compressed SWF file (SHA256: c993c1e10299162357196de33e4953ab9ab9e9359fa1aea00d92e97e7d8c5f2c) that exploited that very vulnerability. Finally, when we i |
| sha256 | f5d3e827c3a312d018ef4fcbfc7cb5205c9e827391bfe6eab697cc96412d938e | 855 vulnerability Indicators of Compromise Document Hashes: f5d3e827c3a312d018ef4fcbfc7cb5205c9e827391bfe6eab697cc96412d938e 1f81609d9bbdc7f1d2c8846dcfc4292b3e2642301d9c59130f58e21abb0 |
| sha256 | fa8b4f64bff799524f6059c3a4ed5d169e9e7ef730f946ac7ad8f173e8294ed8 | 66a8ee3ab5b380eb7781c85e4253683cd7e3eee1c29013a7a62cd9bef8c fa8b4f64bff799524f6059c3a4ed5d169e9e7ef730f946ac7ad8f173e8294ed8 In both cases, the DLL saved to the system is a variant of |
From the original article
8 min read at unit42.paloaltonetworks.com
Recently, Palo Alto Networks Unit 42 reported on a new exploitation platform that we called “DealersChoice” in use by the Sofacy group (AKA APT28, Fancy Bear, STRONTIUM, Pawn Storm, Sednit). As outlined in our original posting, the DealersChoice exploitation platform generates malicious RTF documents which in turn use embedded OLE Word documents. These embedded OLE Word documents then contain embedded Adobe Flash (.
By Bryan Lee · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.