State hackers use new PowerShell backdoor in Log4j assaults

Hackers believed to be a part of the Iranian APT35 state-backed group (aka ‘Charming Kitten’ or ‘Phosphorus’) has been noticed leveraging Log4Shell assaults to drop a brand new PowerShell backdoor.

The modular payload can deal with C2 communications, carry out system enumeration, and finally obtain, decrypt, and cargo extra modules.

Log4Shell is an exploit for CVE-2021-44228, a essential distant code execution vulnerability in Apache Log4j disclosed in December.

In line with researchers from Verify Level, APT35 was among the many first to leverage the vulnerability earlier than targets had a chance to use safety updates, scanning for weak techniques mere days after its public disclosure.

Verify Level, who has been following these makes an attempt, attributes the exploit exercise to APT35 because the risk actor’s assaults have been swiftly arrange utilizing beforehand uncovered infrastructure recognized for use by the group.

Nevertheless, as a part of their analysis, the analysts additionally noticed one thing new within the type of a PowerShell modular backdoor named ‘CharmPower.’

A modular backdoor for a number of duties

The exploitation of CVE-2021-44228 ends in operating a PowerShell command with a base64-encoded payload, finally fetching the ‘CharmPower’ module from an actor-controlled Amazon S3 bucket.

This core module can carry out the next principal capabilities:

• Validate community connection – Upon execution, the script waits for an energetic web connection by making HTTP POST requests to google.com with the parameter hello=hello.
• Fundamental system enumeration – The script collects the Home windows OS model, laptop identify, and the contents of a file Ni.txt in $APPDATA path; the file is presumably created and stuffed by totally different modules that shall be downloaded by the primary module.
• Retrieve C&C area – The malware decodes the C&C area retrieved from a hardcoded URL hxxps://s3[.]amazonaws[.]com/doclibrarysales/3 positioned in the identical S3 bucket from the place the backdoor was downloaded.
• Obtain, decrypt, and execute follow-up modules.

The core module retains sending HTTP POST requests to the C2 that both go unanswered or obtain a Base64 string which initiates the downloading of a further PowerShell or C# module.

‘CharmPower’ is answerable for decrypting and loading these modules, and these then set up an impartial channel of communication with the C2.

The listing of modules to be despatched to the contaminated endpoint is generated robotically primarily based on the fundamental system information retrieved by CharmPower throughout the reconnaissance section.

The extra modules despatched by the C2 are the next:

• Purposes – Enumerates uninstall registry values and makes use of the “wmic” command to determine which purposes are put in on the contaminated system.
• Screenshot – Captures screenshots in accordance with a specified frequency and uploads them to an FTP server utilizing hardcoded credentials.
• Course of – Grabs operating processes through the use of the tasklist command.
• System info – Runs the “systeminfo” command to collect system info. Has many extra instructions however are commented out.
• Command Execution – Distant command execution module that includes Invoke-Expression, cmd, and PowerShell choices.
• Cleanup – Module to take away all traces left within the compromised system, like registry and startup folder entries, recordsdata, and processes. It is dropped on the very finish of the APT35 assaults.

Similarities with previous backdoors

Verify Level observed similarities between ‘CharmPower’ and an Android spyware and adware utilized by APT35 previously, together with implementing the identical logging capabilities and utilizing an similar format and syntax.

Additionally, the “Stack=Overflow” parameter in C2 communications is seen on each samples, which is a singular factor solely seen in APT35 instruments.

These code similarities and infrastructure overlaps allowed Verify Level to attribute the marketing campaign to APT35.

‘CharmPower’ is an instance of how rapidly subtle actors can reply to the emergence of vulnerabilities like CVE-2021-44228 and put collectively code from beforehand uncovered instruments to create one thing potent and efficient that may go previous safety and detection layers.