New Python-Based Payload MechaFlounder Used by Chafer
Unit 42 identified MechaFlounder, a new Python backdoor used by the Chafer group to target a Turkish government entity via HTTP-based C2.
Unit 42 reports that in November 2018 the Chafer group targeted a Turkish government entity, reusing the win10-update[.]com infrastructure reported earlier in 2018 by ClearSky. The new secondary payload, tracked as MechaFlounder, is Python compiled with PyInstaller and acts as a backdoor supporting file upload/download and command execution. It beacons over HTTP using anomalous GET requests containing the username and hostname, suggesting a custom C2 server rather than a standard web server. Code overlap with OilRig's Clayside VBScript was noted, but Chafer and OilRig remain tracked as separate groups.
- MechaFlounder is a PyInstaller-compiled Python backdoor used by Chafer
- Beacons sent via HTTP to win10-update[.]com with anomalous URL structure
- Supports file upload/download and command execution on compromised hosts
- Possible Turkish Scholarship-themed infrastructure observed for collection operations
- Code overlap with OilRig's Clayside VBScript; groups still tracked separately
- Vendors
- Unit 42
- Malware
- MechaFlounderClayside
- Victims
- Turkish government entity
- Organizations
- ClearSky
- Countries
- Turkey
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | eseses.tk | ri[.]tk xn--mgbfv9eh74d[.]com (تلگرام[.]com) ytb[.]services eseses[.]tk |
| domain | turkiyeburslari.gov.tr | irrors the legitimate Turkish Scholarship government domain turkiyeburslari[.]gov[.]tr, also resolved to this IP and may likely have been used |
| domain | turkiyeburslari.tk | ly associated with Chafer activity. Of interest, the domain turkiyeburslari[.]tk, which mirrors the legitimate Turkish Scholarship governm |
| domain | win10-update.com | rted earlier in 2018 by Clearsky , specifically, the domain win10-update[.]com. While we lack visibility into the initial delivery mecha |
| domain | win7-update.com | report win10-update[.]com 185.177.59[.]70 134.119.217[.]87 win7-update[.]com turkiyeburslari[.]tk xn--mgbfv9eh74d[.]com (تلگرام[.]com) |
| domain | xn--mgbfv9eh74d.com | ]70 134.119.217[.]87 win7-update[.]com turkiyeburslari[.]tk xn--mgbfv9eh74d[.]com (تلگرام[.]com) ytb[.]services eseses[.]tk |
| domain | ytb.services | m turkiyeburslari[.]tk xn--mgbfv9eh74d[.]com (تلگرام[.]com) ytb[.]services eseses[.]tk |
| ipv4 | 134.119.217.87 | not observed in this activity. In February 2018, IP address 134.119.217[.]87 resolved to win10-update[.]com and several other domains |
| ipv4 | 185.177.59.70 | f this attack, we did observe a secondary payload hosted on 185.177.59[.]70, the IP address to which this domain resolved at the time |
| sha256 | 0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff | [.]com/update.php?req=<redacted>&m=d This payload, (SHA256: 0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff), which we are tracking as MechaFlounder, was developed in |
| sha256 | 1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1 | hows a VBScript run by an OilRig delivery document (SHA256: 1b2fee00d28782076178a63e669d2306c37ba0c417708d4dc1f751765c3f94e1) on the left compared to a Chafer AutoIT script (SHA256: 33 |
| sha256 | 332fab21cb0f2f50774fccf94fc7ae905a21b37fe66010dcef6b71c140bb7fa1 | e1) on the left compared to a Chafer AutoIT script (SHA256: 332fab21cb0f2f50774fccf94fc7ae905a21b37fe66010dcef6b71c140bb7fa1) on the right, which have colored boxes surrounding code ov |
From the original article
9 min read at unit42.paloaltonetworks.com
In November 2018 the Chafer threat group targeted a Turkish government entity reusing infrastructure that they used in campaigns reported earlier in 2018 by Clearsky , specifically, the domain win10-update[.] com. While we lack visibility into the initial delivery mechanism of this attack, we did observe a secondary payload hosted on 185.
By Brittany Barbehenn · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.