New Malware 'Rover' Targets Indian Ambassador to Afghanistan
Unit 42 reports a spearphishing attack delivering the custom Rover Trojan to India's Ambassador to Afghanistan, exploiting CVE-2010-3333 in Word.
On December 24, 2015, Unit 42 identified a targeted spearphishing email spoofing Indian Defence Minister Manohar Parrikar, sent to India's Ambassador to Afghanistan. The RTF attachment exploited CVE-2010-3333 in Microsoft Word to download a downloader from newsumbrella.net, which retrieved the Rover Trojan and DLL plugins from 46.166.165.254. Rover uses OpenCV for webcam capture, OpenAL for audio recording and libsndfile for audio files, with data exfiltration over its C2 channel; separate payload versions target Windows XP and later systems.
- Spoofed email posed as Indian Defence Minister commending the Ambassador's work.
- RTF attachment exploits CVE-2010-3333 to download the Rover downloader from newsumbrella.net.
- Rover uses OpenCV, OpenAL and libsndfile for webcam photos and audio recording.
- Distinct download variants target Windows XP and Vista-or-later with identical backdoor functionality.
- CVEs
- CVE-2010-3333
- ATT&CK
- T1566.001 Spearphishing AttachmentT1203 Exploitation for Client ExecutionT1105 Ingress Tool TransferT1041 Exfiltration Over C2 Channel
- Vendors
- MicrosoftPalo Alto Networks
- Products
- Microsoft WordOpenCVOpenAL
- Threat actors
- Rover operators
- Malware
- Rover
- Organizations
- Unit 42
- Countries
- IndiaAfghanistan
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | newsumbrealla.net | file systemupdateAPI.exe was no longer being hosted on the newsumbrealla[.]net domain. However, we have noticed the same domain hosting |
| domain | newsumbrella.net | ile exploits CVE-2010-3333 and downloads an executable from newsumbrella[.]net. The executable file downloaded from newsumbrella[.]net i |
| ipv4 | 46.166.165.254 | nloader which is used to call out to a server with the IP ' 46.166.165.254 ' and download the main Rover malware along with plugins us |
| md5 | 76429f8515768f9f5def697e71071f51 | l 80386, for MS Windows Architecture : 32 Bits binary MD5 : 76429f8515768f9f5def697e71071f51 SHA1 : d04ce934561934f758d77dfa944bd6743dd82cff SHA256: 775 |
| md5 | b5aa366f452feb9f4dff3c72157ca1f9 | LuO7bIWjRO5gjPNq:JarSKu6yzoF8rpAqXYv3XOgQLfnpLuOu imphash : b5aa366f452feb9f4dff3c72157ca1f9 Date : 0x5637227B [Mon Nov 2 08:44:43 2015 UTC] Language : |
| sha1 | d04ce934561934f758d77dfa944bd6743dd82cff | 2 Bits binary MD5 : 76429f8515768f9f5def697e71071f51 SHA1 : d04ce934561934f758d77dfa944bd6743dd82cff SHA256: 7757517ae6b4d513a57826f9ab65bd070d99d25ac526cfae3e9 |
From the original article
6 min read at unit42.paloaltonetworks.comOn December 24, 2015, Unit 42 identified a targeted attack, delivered via email, on a high profile Indian diplomat, an Ambassador to Afghanistan. The body and content of the email suggest that it was crafted and spoofed to look like it was sent by the current Defence Minister of India, Mr. Manohar Parrikar, commending the Ambassador on his contributions and success.
By Vicky Ray, Kaoru Hayashi · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.