Multiple ArtraDownloader Variants Used by BITTER to Target Pakistan
BITTER used three ArtraDownloader variants since 2015 to target Pakistan, China, and Saudi Arabia, deploying BitterRAT and exploiting CVE-2017-11882 in one wave.
Palo Alto Unit 42 documents ArtraDownloader, a previously unreported downloader family used by the suspected South Asian group BITTER, with three variants and roughly 80 unique samples dating back to February 2015. Between September 2018 and January 2019, BITTER used spearphishing documents hosted on compromised Pakistani websites to target Pakistan and, for the first time, Saudi Arabia; one RTF sample exploited the EQNEDT vulnerability CVE-2017-11882. The downloader retrieves BitterRAT over HTTP, uses simple registry keys for persistence, and byte-level string obfuscation. Infrastructure overlap with the previously reported MY24 InPage-exploit payload was also observed.
- Three ArtraDownloader variants identified, earliest compiled February 2015
- Targets Pakistan, China, and Saudi Arabia, including government organizations
- Downloader delivers BitterRAT via HTTP C2 with simple registry persistence
- One RTF payload exploited CVE-2017-11882 (EQNEDT)
- Infrastructure overlap with 2017 MY24 InPage payload activity
- CVEs
- CVE-2017-11882
- ATT&CK
- T1566.001 Spearphishing AttachmentT1203 Exploitation for Client ExecutionT1105 Ingress Tool TransferT1547.001 Registry Run Keys / Startup FolderT1027 Obfuscated Files or Information
- Vendors
- Palo Alto Networks
- Products
- BitterRAT
- Threat actors
- BITTER
- Malware
- ArtraDownloaderBitterRATMY24
- Victims
- Pakistan government
- Organizations
- Unit 42
- Countries
- PakistanSaudi ArabiaChina
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | almasoodgroup.com | ry 2019, an engineering and hydraulics company in Pakistan, almasoodgroup[.]com was observed hosting two AtraDownloader executables as we |
| domain | aroundtheworld123.net | nhexlify("6E7F7C827B71817572847C7F79713E3F403B7B7281"))) >> aroundtheworld123[.]net The malware proceeds to check to determine if the AVG sec |
| domain | cyberthreatalliance.org | s. For more information on the Cyber Threat Alliance, visit cyberthreatalliance.org. Appendix ArtraDownloader Malware Analysis – Variant 1 For |
| domain | frameworksupport.net | xFF) return out >> print(decode(“iudphzrunvxssruw1qhw”)) >> frameworksupport[.]net It proceeds to attempt to create the C:\intel\ directory, |
| domain | khurram.com | bles, which had the following names, were hosted on the URL khurram.com[.]pk/js/drvn and communicated with the domain nethosttalk[. |
| domain | kielsoservice.net | mmunicated with the domains info.viewworld71[.]com or hewle.kielsoservice[.]net. The RMMUN, Roots Metropolitan Model United Nations, is a |
| domain | nethosttalk.com | n Saudi Arabia. The malicious file communicated with the C2 nethosttalk[.]com. Around the same timeframe, two additional files (listed |
| domain | nsiagenthoster.net | om/js/cwqj and communicated with C2 domain thepandaservices.nsiagenthoster[.]net. The domain almasoodgroup[.]com appears to be a legitimat |
| domain | pdf.com | the domain nethosttalk[.]com for C2. Handling of Logistics.pdf[.]com Cyber security work shop.pdf[.]com Beginning on Nov 6, 20 |
| domain | viewworld71.com | traDownloader files that communicated with the domains info.viewworld71[.]com or hewle.kielsoservice[.]net. The RMMUN, Roots Metropolit |
| domain | wforc.pk | ed files with the following names hosted on the URL https://wforc[.]pk/js/. Internet Data Traffic Report – August 2018.docx PAF |
| domain | xiovo426.net | mpany’s domain communicated with command and control domain xiovo426[.]net. On 2 Jan 19, the file article_amy.doc was also uploaded |
| domain | zmwardrobe.com | on malicious documents that were downloaded from the domain zmwardrobe[.]com and subsequently executed a payload referred to as MY24. |
| md5 | 7cc0b212d1b8ceb808c250495d83bae4 | remainder of the analysis, the following file is used: MD5 7cc0b212d1b8ceb808c250495d83bae4 SHA1 d2c161ce52240b61d632607a2262890327d82502 SHA256 ef0cb0 |
| md5 | 8d42c01180be7588a2a68ad96dd0cf85 | remainder of the analysis, the following file is used: MD5 8d42c01180be7588a2a68ad96dd0cf85 SHA1 89a7861acb7983ad712ae9206131c96454a1b3d8 SHA256 0b2a79 |
| md5 | a1bdb1889d960e424920e57366662a59 | remainder of the analysis, the following file is used: MD5 a1bdb1889d960e424920e57366662a59 SHA1 177837d0fa5bfd274abe79d80a01cfe2374b4cd9 SHA256 f0ef42 |
| sha1 | 177837d0fa5bfd274abe79d80a01cfe2374b4cd9 | ing file is used: MD5 a1bdb1889d960e424920e57366662a59 SHA1 177837d0fa5bfd274abe79d80a01cfe2374b4cd9 SHA256 f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca |
| sha1 | 89a7861acb7983ad712ae9206131c96454a1b3d8 | ing file is used: MD5 8d42c01180be7588a2a68ad96dd0cf85 SHA1 89a7861acb7983ad712ae9206131c96454a1b3d8 SHA256 0b2a794bac4bf650b6ba537137504162520b67266449be979679 |
| sha1 | d2c161ce52240b61d632607a2262890327d82502 | ing file is used: MD5 7cc0b212d1b8ceb808c250495d83bae4 SHA1 d2c161ce52240b61d632607a2262890327d82502 SHA256 ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd9 |
| sha256 | 0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0 | d0cf85 SHA1 89a7861acb7983ad712ae9206131c96454a1b3d8 SHA256 0b2a794bac4bf650b6ba537137504162520b67266449be979679afbb14e8e5c0 Compile Timestamp 2019-01-07 07:13:47 UTC PDB String c:\Use |
| sha256 | ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57 | 83bae4 SHA1 d2c161ce52240b61d632607a2262890327d82502 SHA256 ef0cb0a1a29bcdf2b36622f72734aec8d38326fc8f7270f78bd956e706a5fd57 Compile Timestamp 2018-12-06 11:14:45 UTC Table 1 ArtraDown |
| sha256 | f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22 | 662a59 SHA1 177837d0fa5bfd274abe79d80a01cfe2374b4cd9 SHA256 f0ef4242cc6b8fa3728b61d2ce86ea934bd59f550de9167afbca0b0aaa3b2c22 Compile Timestamp 2018-07-30 09:18:37 UTC PDB String d:\C++ |
From the original article
12 min read at unit42.paloaltonetworks.com
Since at least 2015, a suspected South Asian threat grouping known as BITTER has been targeting Pakistan and Chinese organizations using variants of a previously unreported downloader. We have named this malware family ArtraDownloader based on a PDB string discovered within the samples. We’ve observed three variants of this downloader with the earliest timestamp of February 2015.
By Josh Grunzweig, Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.