TwoFace Propose Change

Actor(s): OilRig, APT34

According to Unit42, TwoFace is a two-staged (loader+payload) webshell, written in C# and meant to run on webservers with ASP.NET. The author of the initial loader webshell included legitimate and expected content that will be displayed if a visitor accesses the shell in a browser, likely to remain undetected. The code in the loader webshell includes obfuscated variable names and the embedded payload is encoded and encrypted. To interact with the loader webshell, the threat actor uses HTTP POST requests to the compromised server.

The secondary webshell, which we call the payload, is embedded within the loader in encrypted form and contains additional functionality that we will discuss in further detail. When the threat actor wants to interact with the remote server, they provide data that the loader will use to modify a decryption key embedded within the loader that will be in turn used to decrypt the embedded TwoFace payload. Commands supported by the payload are execution of programs, up-, download and deletion of files and capability to manipulate MAC timestamps.

References

Yara Rules

rule asp_twoface_w0 {
	meta:
		author = "jaime.blasco@alienvault.com"
		tlp = "WHITE"
		reference = "https://researchcenter.paloaltonetworks.com/2017/07/unit42-twoface-webshell-persistent-access-point-lateral-movement/"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/asp.twoface"
        malpedia_version = "20190503"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

	strings:
		$header = "<%@ Page Language="
		$var1 = "pwd=t[\"pwd\"];"
		$var2 = "pro=t[\"pro\"];"
		$var3 = "cmd=t[\"cmd\"];"
		$xvar1 = "pwd=fb(t[\"pwd\"]);"
		$xvar2 = "pro=fb(t[\"pro\"]);"
		$xvar3 = "cmd=fb(t[\"cmd\"]);"		

	condition:
		$header and ((all of ($var*)) or (all of ($xvar*)))
}