main

Attack Types & VectorsSecurity

Micropsia Malware

July 25, 2018 — by Yair Tsarfaty69

Since June 2018, the Radware Threat Research team has monitored an ongoing APT against the Palestinian authority, featuring an updated version of the Micropsia malware with an advanced surveillance toolkit. This advanced persistent threat began in March 2017 and was reported by Cisco Talos and Check Point Software Technologies, infecting hundreds of machines thus far.

The latest Micropsia malware version analyzed in Radware’s research lab is the most sophisticated tool used by this APT group. It includes advanced surveillance features such as microphone recording, keylogging and document stealing from USB flash drives. It also resembles the old versions’ C2 communication behavior by including references to famous TV shows and characters. While the campaign and victims were selectively targeted, some instances contaminated machines in other countries as well (see below).

Infection Process

Attackers gathered intelligence and used social engineering to select their victims. They have sent spear phishing emails to email addresses of selected personas. The email contains an attached file that looked like a report from a known news agency with a malicious executable downloaded and activated in the background.

Malware Capabilities

Micropsia comes with an impressive arsenal of advanced surveillance features, allowing it to closely track the victim’s activity and control the victim’s operating system. Currently, the following capabilities exist in the analyzed binary:

  • Microphone recording
  • Document stealing from connected USB flash drives
  • Screen capturing
  • Keylogging
  • Document stealing from hard drive
  • Scanning all drives – full directory listing without filters
  • Get files by specific path
  • Download and execute an arbitrary executable
  • Update malware executable

Microphone Recording

The microphone recording capability is considered an advanced surveillance feature, which is a rare occurrence among widespread malware. That said, it might become common when initiating an APT attack. While the malware’s screen capturing and keylogging capabilities are set to ‘on’ by default, the recording feature requires an activation command from the C&C at intervals defined by the operator. Once activated, Micropsia begins recording using Win32 MCI (Media Control Interface), which provides a generic interface to nearly every kind of multimedia device.

Initiating a new recording or stopping a running one is accomplished by calling Winmm.mciSendString API. That controls the multimedia device. Micropsia operators control the recording duration via Delphi timers that allow it to perform a periodic recording. A new recording is initiated by executing the above API using the following string commands.

In the same way, stopping the recording and saving it to a file is achieved by executing the following.

USB Flash Drives for Document Stealing

Controlled by Micropsia operators, the malware is able to register to an event of USB volume insertion to detect new connected USB flash drives. This functionality is detailed in an old blog post. Once an event is triggered, Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt).

[You might also like: Stresspaint Malware Campaign Targeting Facebook Credentials]

Screen Capturing and Keylogging

Upon execution, the Micropsia malware takes screenshots every 90 seconds by calling to Gdi32.BitBlt API. This functionality is implemented by a Delphi timer which runs infinitely. Screenshots are saved as unencrypted files in JPEG format with a specific file name that contains the current timestamp (yyyy-mm-dd hh-nn-ss) with the hardcoded extension .his.

The screen capturing function contains incriminating strings which lead us to assume that this code was copied from a snippet published in delphimaster.ru forum. The keylogging module also starts automatically by recording every keystroke using the user32.GetKeyState API. It also deals with clipboard data when malware detects a key press combination of Ctrl+C. This module writes its output to a log file that also contains the current timestamp (yyyy-mm-dd hh-nn-ss) with the extension .slog.

Scan Drive and Fetch Files

Micropsia is able to perform a recursive directory listing on-demand for all volume drives available on the victim’s machine. It checks whether a volume drive exists by simply iterating all possible letters (from A to Z) and testing whether this directory exists. Malware operators are also able to fetch specific files from victim file system by their path.

Storage Management

Most of the malware capabilities mentioned above have outputs written to the file system which are later uploaded to the C2 server. Each module writes its own output in a different format, but surprisingly in a non-compressed and non-encrypted fashion. Micropsia’s developers decided to solve these issues by implementing an archiver component that executes the WinRAR tool. The malware first looks for an already installed WinRAR tool on the victim’s machine, searching in specific locations.

In the event a WinRAR tool is not found, Micropsia drops the RAR tool found in its Windows Portable Executable (PE) resource section to the file system.

Later, implemented as an infinite Delphi-based timer, every 15 minutes it creates RAR archives for each output type using the following command line:

RAR archives are encrypted using a hardcoded password (-hp switch) calculated during the malware initialization stage which is the result of MD5 on a hardcoded string (‘q5e9lqp’) which may be different in each malware campaign. In addition, the program uses a -df command line switch that deletes files after they are moved to the archive. Later, RAR archives are uploaded to the C2 server and afterwards they are deleted from the disk.

Next, the malware creates a new hidden directory with a hardcoded name “Recovery” under the Common AppData shell folder (C:\ProgramData\Recovery in Windows Vista and above). This directory is used to store all components’ outputs in a dedicated sub folder for each.

[You might also like: The Mikrotik RouterOS-Based Botnet]

C2 Communication
Malware C2 servers are stored hardcoded in binary and cannot be changed by operators dynamically, unless the malware’s executable binary is updated. In our binary, there are three hardcoded HTTPS URLs used for C2 communication. These C2 servers’ addresses were not seen in previous versions.

  • https//max-mayfield.com/api/white_walkers/
  • https//young-spencer.com/api/white_walkers/
  • https//192.169.6.59/api/white_walkers/

Besides encryption supplied by SSL, the hackers did not add an extra layer of encryption. Modern malware tends to encrypt its data to evade detection and make the binary research harder. Thus, communication can be monitored easily in a research environment using SSL termination proxy. Malware sets the User Agent string (hard-coded) for all of its communication to mimic Googlebot.

Bot Registration

As mentioned by the Cisco Talos Intelligence Group, after executing the Micropsia registers itself against the C2 server. As part of the bot registration phase, the malware creates a POST request that contains information of the bot ID (encoded in base64 contains OS hostname and username), OS version string, malware version (v4.0.0 in our case) and installed anti-virus information extracted using WMI queries. The C2 server responds with a JSON that confirms the bot registration and may instruct the malware to take additional steps. The JSON response contains the following keys:

Supported C2 Commands

Micropsia performs periodic GET requests to /api/white_walkers//requests. The C2 server responds with a JSON that contains keys instructing the malware to execute the next steps.

Not all key names that appear in the JSON response have a corresponding logic in the analyzed binary. The analyzed binary lists the supported C2 command names and their meaning.

Upload Stolen Information

Every two minutes the malware collects all RAR files of stolen information and uploads them to the C2 server using the POST method to the relevant URL based on the storage type.

Malware Protection

Attacking groups continuously create new malware and mutations with additional capabilities. Radware’s Malware Research Group will keep monitoring and analyzing new threats to provide protection to Radware customers.

Read “Five Ways Modern Malware Defeats Your Defenses And What You Can Do About It” to learn more.

Download Now

Yair Tsarfaty

Yair is a security researcher at Radware Research Lab with a decade of experience from the Israeli Intelligence Corps. Passionate about reverse engineering, cloud security and malware analysis.

69 comments

  • Pingback: Blog BSSI

  • Geek Squad Tech Support

    January 29, 2019 at 8:37 am

    Geek Squad Tech Support is a group of tech expert. The experts of geek squad team are capable of resolving various tech issues. In case of any tech help contact Geek Squad Tech Support.

    Reply

  • Dell Printer Support

    January 29, 2019 at 1:57 pm

    Dell Printer Support is a team of experts who takes care of your dell printer issue. Our support is capable of dealing with any dell printer glitches. In case you’re having issue with you dell printer contact dell Printer Support and get instant help.

    Reply

  • Dell Support

    January 30, 2019 at 10:58 am

    Dell Support is a team of experts who take care of your dell device issue. If face any problem with your device like your device is crashed, a device is not working properly or others then contact Dell Tech Support and get instant help.

    Reply

  • HP Support

    January 30, 2019 at 11:00 am

    HP Support is a group of experts who deals with every issue with your HP devices. These experts are proficient enough to give you the best of services. HP Support experts are quite efficient in giving repair services.

    Reply

  • mahjong Dimensions

    February 26, 2019 at 10:09 am

    Hey Thanks for such great article, I have an ancient game to play just from here play mahjong dimensions online without any charges.

    Reply

  • Jamess

    February 28, 2019 at 7:55 am

    Thanks, for sharing this blog.

    Reply

  • Mark

    March 8, 2019 at 11:33 am

    A small grouping of execs can handle you manually as a result of they’re absolute to offer the standard services. So, in the event that you face any issue along with your package you don’t need to go anywhere except us.

    Reply

  • QuickBooks Enterprise Support 1888-557-6950 offers industry-specific solutions, notably for contractors, manufacturing and wholesale, nonprofits, and retailers. Quickbooks Enterprise support stands unique in the market as it has got the best tool which can help us to fix our any kind of Quickbooks related issues. They help to resolve our problem quite instantly and easily.

    Reply

  • QuickBooks Enterprise Support 1888-557-6950 offers industry-particular arrangements, strikingly for temporary workers, assembling and discount, philanthropies, and retailers. Quickbooks endeavor bolster stands special in the market as it has the best instrument which can help us to settle our any sort of Quickbooks related issues. They help to determine our concern in a split second and effortlessly.

    Reply

  • QuickBooks Tech Support Number

    March 12, 2019 at 1:24 pm

    Will you be facing the issue with decision making? The amount of is it possible to earn in a month? You ought to predict this before. Many people are not used to this. We shall help most of the folks. What business are you having? Can it be raw material business? Would you cope with retail trade? Craftsmen also cope with your selection of revenue. Sometimes you do not forecast the specific budget. We now have experienced individuals to provide you with the figure. We’re going to also supply you with the figure of your respective budget which you yourself can get in the future from now. This will be only possible with QuickBooks support.

    Reply

  • QuickBooks Payroll Support Number

    March 14, 2019 at 5:19 am

    Numerous sorts of questions or QuickBooks related issue, at that point you are route the correct way. You simply give single ring at our without toll QuickBooks Payroll Support.we will enable you to right arrangement as indicated by your issue. We work on the web and can expel the specialized issues by means of remote access and when the issue happens we will settle the same.

    Reply

  • basketball games

    March 14, 2019 at 6:27 am

    Shine bright, shine bright. You’re perfect in my eyes

    Reply

  • QuickBooks Tech Support Number

    March 14, 2019 at 11:59 am

    At QuickBooks Support contact number, you will find solution each and every issue that bothers your projects and creates hindrance in running your company smoothly. Our team is oftentimes willing to allow you to while using the best support services you could possibly ever experience.

    Reply

  • QuickBooks Tech Support Number

    March 15, 2019 at 4:47 am

    You’ll be able to give us a call any moment for the moment support we tend to are accessible for you 24*7. Our talented team of professionals is invariably in a position to assist you whatever needs doing.

    Reply

  • HP Printer Support Phone Number

    March 18, 2019 at 6:54 pm

    Dial HP Printer Support Phone Number our qualified and experienced technical professional expert will connect to you who understand and identify the particular real cause and help you to get it fix at a really affordable price to make sure you wouldn’t normally face similar problems in forseeable future. We provide an exact, satisfactory and tangible solution.So why are you waiting? Call HP printer support number to get benefit of our extremely advanced and qualified skills of your specialists along with their instant support for all issues of HP Pinter for making sure a fast and continuous printing experience.

    Reply

  • HP Printer Tech Support Number

    March 18, 2019 at 6:59 pm

    Though there are numerous good features concerning HP printers, there are many loopholes or problems with respect to it. And some of you might not be familiar with the difficulties if it is happening.

    Reply

  • QuickBooks Tech Support Number

    March 20, 2019 at 6:46 am

    QuickBooks has given its utmost support to entrepreneurs in decreasing the price otherwise we’ve seen earlier, however, an accountant wont to help keep completely different accounting record files. Utilising the assistance of QuickBooks, users will maintain records like examining, recording and reviewing the complicated accounting procedures.

    Reply

  • HP support

    March 25, 2019 at 3:46 pm

    A great work. All the information in this post is really good.

    Reply

  • QuickBooks Unexpected Error 5

    April 2, 2019 at 8:09 am

    The issue will not cause any major problem to the working regarding the software but then it fills up the event logs and generates a “Red” error, which is annoying.

    Reply

  • QuickBooks Error 1935

    April 3, 2019 at 10:22 am

    If you still face the error again, proceed to the next phase.
    See Install QuickBooks in Selective Startup for detailed instructions.
    In the event that you continue to get the 1935 error, see repair or reinstall Microsoft .NET Framework and start the installation again.

    Reply

  • Dell support

    April 6, 2019 at 11:07 am

    For more information about Dell support please call at 1-855-515-5666.

    Reply

  • QuickBooks Error C=343

    April 8, 2019 at 6:28 am

    QuickBooks is an efficient software for many types of businesses. The various versions can focus on the particular needs of one’s business. QuickBooks Enterprise could be the version available for the large-scale businesses with several of its wonderful features such as ëmulti-monitor support,í the payroll liability payment reminder, the last because of stamps on the invoices, merging the seller records, etc.

    Reply

  • QuickBooks Error 15215

    April 8, 2019 at 7:12 am

    While downloading a payroll update, the procedure is interrupted with a message that the update cannot progress as a result of QuickBooks error 15215. This implies that the machine failed to verify the digital signature. In many cases, all updates except the maintenance release updates are installed. QuickBooks errors like error 15215, allow it to be burdensome for users to execute routine tasks and as a consequence disrupt regular workflow activities.

    Reply

  • QuickBooks Error 3371

    April 9, 2019 at 5:58 am

    Intuit has managed to make it compulsory to save all important QuickBooks data into the hard drive. Just in case you upgrade the body or trying to install QuickBooks in a unique system or trying change the hard drive, it’s possible that your particular license file got damaged or missing.

    Reply

  • QuickBooks Error 3371

    April 9, 2019 at 6:14 am

    Damaged MSXML component: MSXML is an essential component provided by Microsoft. It really is needed by QB desktop to run on your own system. If this gets damaged, it can cause difficulties in accessing this accounting software.

    Reply

  • QuickBooks Payroll Support

    April 9, 2019 at 6:22 am

    We were holding wonderful features supplied by QuickBooks payroll service and it has now much more fabulous features also.

    Reply

  • QuickBooks Error (-12 0)

    April 10, 2019 at 7:26 am

    QuickBooks Error code 12 0 often takes place when system settings are wrongly configured or irregularities into the Windows registry. QuickBooks Error code 12 0 can easily be fixed with a unique software configured to resolve common system registry issues.

    Reply

  • QuickBooks Enterprise Support Number

    April 11, 2019 at 4:38 am

    Here we will update you how you can obtain QuickBooks enterprise support telephone number or simple suggestions to connect QuickBooks enterprise customer support contact number.

    Reply

  • QuickBooks Error Code 6189,816

    April 11, 2019 at 7:35 am

    QuickBooks error code 6189 is basically a run-time error which you find when you’re looking to run QuickBooks or trying to open an organization file in your system. This means that the file, which one tries to open, is certainly not accessible. Although the message that appears with this specific error contains a couple of details, it is usually problematic for a person to find its exact cause and correct it.

    Reply

  • QuickBooks Support Number USA

    April 11, 2019 at 10:21 am

    QuickBooks is made to satisfy your every accounting needs and requirement with an excellent ease. This software grows with your business and perfectly adapts with changing business environment. Everbody knows you will find always two sides to a coin and QuickBooks isn’t any different. This software also throws some errors in the long run. Sometimes it becomes quite difficult to know that is using this error code or message. If that’s the case you should call our QuickBooks Support telephone number your can purchase in contact with our technical specialists in order to look for the fix of error instantly.

    Reply

  • QuickBooks POS Phone Number

    April 12, 2019 at 6:40 am

    There are many payroll options made available because of the online form of QuickBooks varying upon the need of accounting professionals and subscription plans.

    Reply

  • QuickBooks POS Phone Number

    April 12, 2019 at 6:40 am

    QuickBooks Payroll Support Phone Number as well provides all possible assist with the users to utilize it optimally. A person who keeps experience of experts has the ability to realize about the latest updates.

    Reply

  • QuickBooks Payroll Support Phone Number

    April 15, 2019 at 10:07 am

    Call QuickBooks payroll support to obtain assistance for all your QB payroll related problems. Our technical experts are always there to obtain your back for everything you needed for. What you need to do, just dial our toll-free QuickBooks Payroll support number .

    Reply

  • QuickBooks Tech Support Number

    April 15, 2019 at 10:40 am

    Are you currently scratching the head and stuck along with your QuickBooks related issues, you will end up only one click definately not our expert tech support team for your QuickBooks related issues. We site name, are leading tech support team provider for your entire QuickBooks related issues. Either it is day or night, we offer hassle-free tech support team for QuickBooks and its associated software in minimum possible time.

    Reply

  • imo for pc

    April 15, 2019 at 1:23 pm

    best online video calling application

    Reply

  • Our Professionals have designed services in a competent means so they will offer the required ways to the shoppers. we’ve got a tendency to at QuickBooks client Service are accessible 24*7 you simply need certainly to call our QuickBooks Support toll-free number that you can get in the marketplace on our website.

    Reply

  • QuickBooks Payroll Support Phone Number

    April 17, 2019 at 5:08 am

    With respect to the measurements of a particular business this is certainly owned by a person or entrepreneur, you can find three editions of this QuickBooks Payroll software product which delivers many automated functionalities so as to make your organization productive and efficient. Generally, the QuickBooks Payroll software product is available in listed here three variations: QuickBooks Basic Payroll, QuickBooks Enhanced Payroll, and QuickBooks Premium Payroll. You can easily choose from the three editions that may best suit your business and also make managing your online business and employees easier along with convenient.

    Reply

  • Intuit Enterprise Support Phone Number

    April 18, 2019 at 8:27 am

    This software program is likely to make life easy for all if you are taking proper care of most financial expenses and savings. The first Quicken software did not work as a “double-entry” accounting platform.

    Reply

  • helix jump

    April 18, 2019 at 8:48 am

    They are the magic ingredient, in my opinion. Thank you!

    Reply

  • QuickBooks Payroll Support Number

    April 19, 2019 at 4:55 am

    Can be executed every user task with QuickBooks Payroll Accounting software. Therefore you only need to install QuickBooks Payroll software and fetch the details, rest most of the essential calculation will undoubtedly be done automatically as a result of software.

    Reply

  • QuickBooks Error 15270

    April 22, 2019 at 7:45 am

    Navigate to manage Panel and head to User Accounts. Open User Account Controls and slide the option to “Never Notify” and click OK. Restart your personal computer.

    Reply

  • QuickBooks Error 15223

    April 22, 2019 at 10:05 am

    For those who have the error 15233 problem in your QuickBooks, the very best solution will be to re install your complete software utilising the clean install tool. It’s the simple process.

    Reply

  • QuickBooks Payroll Tech Support Number

    April 24, 2019 at 7:15 am

    Having employees in your company also signifies the growth of your business, which will be considered essential by many people business owners. Thus, when you’ve got employees in your company, another component that becomes equally essential can be your employees’ payroll. If you’re hiring an employee to operate for your needs, it’s also important to pay wages for them. In the event that business which you own has a great deal many employees, every one of them being given a certain task, you will need something more than just a mere book of accounts.

    Reply

  • long necklace for women

    May 18, 2019 at 5:37 am

    QuickBooks Basic Payroll, QuickBooks Enhanced Payroll, and QuickBooks Premium Payroll !!!!!! what are the differences between them? I have an online jewelry store. which one can I use?!

    Reply

  • Brother Printer Support

    May 27, 2019 at 3:42 pm

    Get 24/7 service by calling on Brother printer customer support toll-free phone number and troubleshoot all sorts of Brother printer related issues. Get the best help from experts.

    Reply

  • SEO Services India

    June 21, 2019 at 11:18 am

    Thanks for providing such a useful solution to avoid these kind of computer threats.

    Reply

  • jiowick

    June 22, 2019 at 11:16 am

    Great Post. Thanks for sharing this information.

    Reply

  • Love Doll

    July 1, 2019 at 1:22 pm

    Thanks For Sharing!!!!!!
    Buy Silicone Sex Doll from Online store at LoveDollPalace based US Company. Browse our collection of realistic, inflatable life-size love dolls. Order yours today!

    Reply

  • Toto4Dcc

    July 12, 2019 at 12:14 pm

    “Thanks for sharing anda really helpfull , i will recommended my friend to read this post
    Very interesting 🙂
    if u want more information like this, click my link maybe you will interest”

    ~~> Agen Togel Singapore <~~

    Reply

  • Hp Printer Support

    July 16, 2019 at 9:04 am

    HP provides many high-quality printers with extreme advance features to the customer. But like other electronic components, a user may face many issues with this device also; you can directly Call HP Printer Support. This number will directly connect you to our technical assistant. We have an experienced HP Support Team which provides an adequate solution to all our customers. HP Printer Telephone support team provides round the clock services; you can dial our toll-free HP Printer support Number and get the most reliable working solutions.

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *