In the following sections, ThreatLabz provides a technical analysis of Abyssos version 2.4F, including its obfuscation methods, anti-analysis techniques, network protocol, and supported commands.
Abyssos uses common obfuscation methods as an anti-analysis measure. ThreatLabz identified the following techniques:
vmtoolsd.exevmwaretray.exevmwareuser.exeVBoxService.exeVBoxTray.exeVBoxControl.exexenservice.exeprl_tools.exeqemu-ga.exespice-vdagent.exevdservice.exeFurthermore, Abyssos uses a set of different intermediate representation (IR) passes to obfuscate the binary code. ThreatLabz assesses with medium-to-high confidence that Abyssos developers use open-source LLVM-based obfuscators to achieve these results. Overall, we have observed different obfuscation passes including:
ANALYST NOTE: Not all samples identified implement the anti-analysis techniques. For example, the most recent version of Abyssos does not include them.
Before executing its core functionality and features, Abyssos performs the following initialization steps:
_Admin or _User depending on the current user rights. Interestingly, Abyssos checks if the command line includes the parameter --elevated. This parameter appends the string _Admin to the Abyssos mutex name regardless if the current user actually has administrator privileges. The mutex name is hardcoded in the binary and follows the format Global\[UUID4]. For example Global\68AA60E5-6C45-4C01-9F0E-E25FC57C652F.HELLO|%s|%s|%s|%s|%s|v2.4F|%s|%s|%s. PING to the C2 server every few seconds and waits for a network command to execute. Any incoming packet is received and parsed on the previously created thread.Abyssos primarily uses AES in GCM mode with a hardcoded 32-byte key for encrypting both incoming and outgoing network data. The only exception is for the encrypted Abyssos modules, which have an additional layer of encryption using either AES-CBC (with a 16-byte key/IV) or using a bitwise XOR operation (as described later in Table 2).
The Abysoss network packet structure is shown below.
#pragma pack(push, 1)
struct network_packet
{
uint32_t data_size;
uint8_t unknown_flag; // Unknown, set to `1` by default
uint8_t iv[12];
uint8_t* data;
uint8_t aes_tag[16];
};
#pragma pack(pop)
Abyssos supports a plethora of network commands. The two tables below describe each command's name and functionality along with any supported parameters.
ANALYST NOTE: Abyssos uses the pipe character “|” to delimit network command parameters. For example, the network command PM_KILL|1234 terminates the process with PID 1234.
Network Command Name | Description |
|---|---|
PONG | Response to the |
DISCONNECT | Abyssos stops execution. |
HVNC_START | Starts a VNC session with a screen width/height as an optional parameter. The default screen settings are 1920x1080. |
HVNC_STOP | Stops the VNC session. |
HVNC_INPUT | Simulates mouse movement and keyboard in the VNC session. |
HVNC_CLONE_START | Copies a specified browser's folders/data (e.g. cookies) in the fontconfigs folder located under the Windows temporary directory. |
HVNC_PROG | Starts a specified application under the VNC session. These applications must already be present on the host, since Abyssos does not download them. The list of supported applications and their corresponding parameters are:
|
HVNC_MAXIMIZE | Displays the maximized VNC window. |
SYSINFO | Gets system host information. This includes:
|
DNS_ADD | Adds a new (specified) record to the Windows |
DNS_DEL | Deletes the specified record from the Windows |
FM_COPY | Locally copies a file/directory. |
CLIPBOARD_START | Starts a thread that intercepts clipboard data every second. |
CLIPBOARD_STOP | Stops the clipboard interception thread. |
UAC_BYPASS_FODHELPER | User Account Control (UAC) bypass method via the Windows |
UAC_BYPASS_ICMLUAUTIL | UAC bypass method via COM interface |
GRABBER_START | Creates a thread that scans and collects specified directories/files based on parameters. The available parameters are:
|
GRABBER_STOP | Stops the grabber thread. |
PM_LIST | Collects information about the system's running processes. The process information includes:
|
PM_START | Creates a thread that collects the system's running process information every 3 seconds. |
PM_STOP | Stops the system's process information collection thread. |
PM_KILL | Terminates a process by PID. |
PM_SUSPEND | Suspends a process by PID. |
PM_RESUME | Resumes a suspended process by PID. |
SHUTDOWN | Shuts down the compromised host. |
REBOOT | Reboots the host. |
SLEEP | Puts the compromised system in sleep mode. |
RESTART | Restarts Abyssos. |
PF_START | Creates a thread that collects active TCP/UDP connections along with their associated processes every 2 seconds. |
PF_STOP | Stops the thread that collects active TCP/UDP connections. |
PF_KILL | Terminates a process by PID. The only difference with PM_KILL is that this command requires an extra (unknown) parameter. |
FM_LIST | Lists files and directories along with their associated metadata in the specified directory. |
FM_DEL | Deletes a file/directory. |
FM_GET | Uploads a specified file from the compromised host to the C2. |
FM_EXEC | Executes an already existing file on the compromised system. |
FM_ARCHIVE | Compresses the files of a specified directory into a ZIP archive and sends them to the C2 server. The ZIP archive is stored in-memory only. |
FM_ADDTOARCHIVE | Same as |
FM_PUT | Downloads a file from the C2 server on to the host. |
REMOTEDESKTOP_START | Creates a new thread that starts a screen recorder. |
REMOTEDESKTOP_STOP | Stops screen recorder thread. |
REMOTEDESKTOP_SETQ | Sets the quality (number of pixels) of any screenshots/images taken from the screen recorder. |
KEYLOGGER_GETLOGS | Reads the captured keystrokes obtained from the keylogger by reading the hardcoded file |
EXECURL | Downloads and executes a file. Abyssos will try to delete this file 5 seconds after it has been executed. |
EXECURL_AES_HOL | Downloads encrypted shellcode and injects it into a specified process (by name). Abyssos decrypts the encrypted payload using AES-CBC. The network packet contains a 16-byte value that is used for both the AES key and IV. The downloaded file is deleted after the code injection. |
EXECLOCAL_HEX | Receives a Windows executable file as a hex string and executes it. The downloaded file is deleted after it is executed. |
EXECLOCAL_AES_HOL | Same as |
AESHOL_DLL | Same as |
SELF_DELETE | Abyssos deletes itself using the Windows shell command |
C2CMD | Starts a remote shell session (using |
Table 1: Network commands supported by Abyssos.
The table below describes the Abyssos modules (although they were not available at the time of our analysis) and decryption methods.
Network Command Name | Description | Decryption Method |
|---|---|---|
KEYLOGGER | Likely a keylogger module written to disk under the Windows temporary folder with a randomly generated filename and the prefix | Bitwise XOR with key |
RECOVERY | Possibly a Chrome credentials harvester module. The module is stored under the Windows temporary folder with a randomly generated filename and the prefix | Bitwise XOR with key |
RECOVERY_GECKO | Likely a module that recovers Firefox credentials. The module is stored under the Windows temporary folder with a randomly generated filename and the prefix | Bitwise XOR with key |
SENDTXT | Unknown purpose. The downloaded module is written to the Windows temporary folder with a randomly generated filename and the prefix | Bitwise XOR with key |
SENDTXT2 | Unknown purpose. The downloaded module is written to the Windows temporary folder with a randomly generated filename and the prefix | Bitwise XOR with key |
HDRPFILE | Unknown purpose. The downloaded module is written to the Windows temporary folder with a randomly generated filename and the prefix | Decrypted using AES-CBC with the key and IV |
DCFINDER | Likely a module that scans the network to locate the Domain Controller. The downloaded module is written to the Windows temporary folder with a randomly generated filename and the prefix | Decrypted using AES-CBC with the key and IV |
VULNSCAN | Likely a module that scans the network or compromised host for vulnerabilities. The downloaded module is written to the Windows temporary folder with a randomly generated filename and the prefix | Decrypted using AES-CBC with the key and IV 1234567890abcdef. |
ELEVATE_SYS_TOKEN | Likely a module to escalate token privileges to | Decrypted using AES-CBC with the key and IV |
DATASCAN | Unknown purpose. The encrypted module is stored under the Windows temporary folder location with a random filename with the suffix | Decrypted using AES-CBC with the key and IV |
GRABCOOKIES | Likely a module that recovers browser cookies. The module is stored under the Windows temporary folder with a randomly generated filename and the prefix | Bitwise XOR with key |
RDPWRAP | This module may be related to the open source library | Decrypted using AES-CBC with the key and IV |
Table 2: Abyssos network commands requiring external modules.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。