SYMBOLCOMMON_NAMEaka. SYNONYMS
win.8t_dropper (Back to overview)

8.t Dropper

aka: 8t_dropper, RoyalRoad

Actor(s): Hellsing, Ice Fog, Pirate Panda, RANCOR, TA428, Tick, Tonto Team, Karma Panda


8T_Dropper has been used by Chinese threat actor TA428 in order to install Cotx RAT onto victim's machines during Operation LagTime IT. According to Proofpoint the attack was developed against a number of government agencies in East Asia overseeing government information technology, domestic affairs, foreign affairs, economic development, and political processes. The dropper was delivered through an RTF document exploiting CVE-2018-0798.

References
2020-09-16RiskIQJon Gross
@online{gross:20200916:riskiq:da4b864, author = {Jon Gross}, title = {{RiskIQ: Adventures in Cookie Land - Part 2}}, date = {2020-09-16}, organization = {RiskIQ}, url = {https://community.riskiq.com/article/56fa1b2f}, language = {English}, urldate = {2020-09-23} } RiskIQ: Adventures in Cookie Land - Part 2
8.t Dropper Chinoxy Poison Ivy
2020-08-19RiskIQJon Gross, Cory Kennedy
@online{gross:20200819:riskiq:94e5ccf, author = {Jon Gross and Cory Kennedy}, title = {{RiskIQ Adventures in Cookie Land - Part 1}}, date = {2020-08-19}, organization = {RiskIQ}, url = {https://community.riskiq.com/article/5fe2da7f}, language = {English}, urldate = {2020-09-23} } RiskIQ Adventures in Cookie Land - Part 1
8.t Dropper Chinoxy
2020-06-03Kaspersky LabsGReAT, Mark Lechtik, Giampaolo Dedola
@online{great:20200603:cycldek:ed9a830, author = {GReAT and Mark Lechtik and Giampaolo Dedola}, title = {{Cycldek: Bridging the (air) gap}}, date = {2020-06-03}, organization = {Kaspersky Labs}, url = {https://securelist.com/cycldek-bridging-the-air-gap/97157/}, language = {English}, urldate = {2020-06-03} } Cycldek: Bridging the (air) gap
8.t Dropper NewCore RAT PlugX USBCulprit Hellsing
2020-03-21MalwareLab.plMaciej Kotowicz
@online{kotowicz:20200321:royal:da8fd16, author = {Maciej Kotowicz}, title = {{On the Royal Road}}, date = {2020-03-21}, organization = {MalwareLab.pl}, url = {https://blog.malwarelab.pl/posts/on_the_royal_road/}, language = {English}, urldate = {2020-03-24} } On the Royal Road
8.t Dropper
2020-03-20Medium SebdravenSébastien Larinier
@online{larinier:20200320:new:3da1211, author = {Sébastien Larinier}, title = {{New version of chinoxy backdoor using COVID19 alerts document lure}}, date = {2020-03-20}, organization = {Medium Sebdraven}, url = {https://medium.com/@Sebdraven/new-version-of-chinoxy-backdoor-using-covid19-document-lure-83fa294c0746}, language = {English}, urldate = {2020-03-26} } New version of chinoxy backdoor using COVID19 alerts document lure
8.t Dropper Chinoxy
2020-03-12Check PointCheck Point Research
@online{research:20200312:vicious:3218bb8, author = {Check Point Research}, title = {{Vicious Panda: The COVID Campaign}}, date = {2020-03-12}, organization = {Check Point}, url = {https://research.checkpoint.com/2020/vicious-panda-the-covid-campaign/}, language = {English}, urldate = {2020-03-13} } Vicious Panda: The COVID Campaign
8.t Dropper BYEBY Enfal Korlia Poison Ivy
2020-03-11Virus BulletinGhareeb Saad, Michael Raggi
@online{saad:20200311:attribution:3efcc0a, author = {Ghareeb Saad and Michael Raggi}, title = {{Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers}}, date = {2020-03-11}, organization = {Virus Bulletin}, url = {https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-attribution-object-using-rtf-object-dimensions-track-apt-phishing-weaponizers/}, language = {English}, urldate = {2020-03-13} } Attribution is in the object: using RTF object dimensions to track APT phishing weaponizers
8.t Dropper
2020-03-04CrowdStrikeCrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f, author = {CrowdStrike}, title = {{2020 CrowdStrike Global Threat Report}}, date = {2020-03-04}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf}, language = {English}, urldate = {2020-07-24} } 2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT31 APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER
2019-09-22Check Point ResearchCheck Point Research
@online{research:20190922:rancor:e834f67, author = {Check Point Research}, title = {{Rancor: The Year of The Phish}}, date = {2019-09-22}, organization = {Check Point Research}, url = {https://research.checkpoint.com/2019/rancor-the-year-of-the-phish/}, language = {English}, urldate = {2020-03-04} } Rancor: The Year of The Phish
8.t Dropper Cobalt Strike
2019-07-23ProofpointMichael Raggi, Dennis Schwarz, Proofpoint Threat Insight Team
@online{raggi:20190723:chinese:804ec1c, author = {Michael Raggi and Dennis Schwarz and Proofpoint Threat Insight Team}, title = {{Chinese APT “Operation LagTime IT” Targets Government Information Technology Agencies in Eastern Asia}}, date = {2019-07-23}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/chinese-apt-operation-lagtime-it-targets-government-information-technology}, language = {English}, urldate = {2019-12-20} } Chinese APT “Operation LagTime IT” Targets Government Information Technology Agencies in Eastern Asia
8.t Dropper Cotx RAT TA428
2019-01-03m4n0w4r
@online{m4n0w4r:20190103:another:2f48120, author = {m4n0w4r}, title = {{Another malicious document with CVE-2017–11882}}, date = {2019-01-03}, url = {https://tradahacking.vn/another-malicious-document-with-cve-2017-11882-839e9c0bbf2f}, language = {Vietnamese}, urldate = {2020-03-11} } Another malicious document with CVE-2017–11882
8.t Dropper
2018-11-03m4n0w4r
@online{m4n0w4r:20181103:l:d496fbd, author = {m4n0w4r}, title = {{Là 1937CN hay OceanLotus hay Lazarus …}}, date = {2018-11-03}, url = {https://tradahacking.vn/l%C3%A0-1937cn-hay-oceanlotus-hay-lazarus-6ca15fe1b241}, language = {Vietnamese}, urldate = {2020-03-11} } Là 1937CN hay OceanLotus hay Lazarus …
8.t Dropper
2018-07-31Medium SebdravenSébastien Larinier
@online{larinier:20180731:malicious:571d2df, author = {Sébastien Larinier}, title = {{Malicious document targets Vietnamese officials}}, date = {2018-07-31}, organization = {Medium Sebdraven}, url = {https://medium.com/@Sebdraven/malicious-document-targets-vietnamese-officials-acb3b9d8b80a?}, language = {English}, urldate = {2020-03-04} } Malicious document targets Vietnamese officials
8.t Dropper
Yara Rules
[TLP:WHITE] win_8t_dropper_auto (20200817 | autogenerated rule brought to you by yara-signator)
rule win_8t_dropper_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-08-17"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.8t_dropper"
        malpedia_rule_date = "20200817"
        malpedia_hash = "8c895fd01eccb47a6225bcb1a3ba53cbb98644c5"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb38 ff7010 ff15???????? ff75f8 a3???????? }
            // n = 5, score = 100
            //   eb38                 | jmp                 0x3a
            //   ff7010               | push                dword ptr [eax + 0x10]
            //   ff15????????         |                     
            //   ff75f8               | push                dword ptr [ebp - 8]
            //   a3????????           |                     

        $sequence_1 = { 03bd08ffffff 8d8c39c8fbd3e7 8bf9 c1e714 c1e90c 0bf9 }
            // n = 6, score = 100
            //   03bd08ffffff         | add                 edi, dword ptr [ebp - 0xf8]
            //   8d8c39c8fbd3e7       | lea                 ecx, [ecx + edi - 0x182c0438]
            //   8bf9                 | mov                 edi, ecx
            //   c1e714               | shl                 edi, 0x14
            //   c1e90c               | shr                 ecx, 0xc
            //   0bf9                 | or                  edi, ecx

        $sequence_2 = { 80650b00 894df8 8b5df8 3813 7506 8a5d0b }
            // n = 6, score = 100
            //   80650b00             | and                 byte ptr [ebp + 0xb], 0
            //   894df8               | mov                 dword ptr [ebp - 8], ecx
            //   8b5df8               | mov                 ebx, dword ptr [ebp - 8]
            //   3813                 | cmp                 byte ptr [ebx], dl
            //   7506                 | jne                 8
            //   8a5d0b               | mov                 bl, byte ptr [ebp + 0xb]

        $sequence_3 = { 8819 5b 0fb602 99 f7fb }
            // n = 5, score = 100
            //   8819                 | mov                 byte ptr [ecx], bl
            //   5b                   | pop                 ebx
            //   0fb602               | movzx               eax, byte ptr [edx]
            //   99                   | cdq                 
            //   f7fb                 | idiv                ebx

        $sequence_4 = { 33c0 8dbd6cfbffff 899568fbffff 6a0a f3ab 8955d0 }
            // n = 6, score = 100
            //   33c0                 | xor                 eax, eax
            //   8dbd6cfbffff         | lea                 edi, [ebp - 0x494]
            //   899568fbffff         | mov                 dword ptr [ebp - 0x498], edx
            //   6a0a                 | push                0xa
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   8955d0               | mov                 dword ptr [ebp - 0x30], edx

        $sequence_5 = { e23d ed 3d1b3edd3e 203f 5a 3f }
            // n = 6, score = 100
            //   e23d                 | loop                0x3f
            //   ed                   | in                  eax, dx
            //   3d1b3edd3e           | cmp                 eax, 0x3edd3e1b
            //   203f                 | and                 byte ptr [edi], bh
            //   5a                   | pop                 edx
            //   3f                   | aas                 

        $sequence_6 = { 40 803c3e00 8945f4 0f8500ffffff 5f 5e }
            // n = 6, score = 100
            //   40                   | inc                 eax
            //   803c3e00             | cmp                 byte ptr [esi + edi], 0
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   0f8500ffffff         | jne                 0xffffff06
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_7 = { 8d854cfeffff 57 50 6802020000 ff15???????? }
            // n = 5, score = 100
            //   8d854cfeffff         | lea                 eax, [ebp - 0x1b4]
            //   57                   | push                edi
            //   50                   | push                eax
            //   6802020000           | push                0x202
            //   ff15????????         |                     

        $sequence_8 = { ebe0 80a0c0e96e0000 40 3bc6 72be }
            // n = 5, score = 100
            //   ebe0                 | jmp                 0xffffffe2
            //   80a0c0e96e0000       | and                 byte ptr [eax + 0x6ee9c0], 0
            //   40                   | inc                 eax
            //   3bc6                 | cmp                 eax, esi
            //   72be                 | jb                  0xffffffc0

        $sequence_9 = { c645f0f6 c645f174 c645f256 c645f344 59 bef4624000 8dbd28ffffff }
            // n = 7, score = 100
            //   c645f0f6             | mov                 byte ptr [ebp - 0x10], 0xf6
            //   c645f174             | mov                 byte ptr [ebp - 0xf], 0x74
            //   c645f256             | mov                 byte ptr [ebp - 0xe], 0x56
            //   c645f344             | mov                 byte ptr [ebp - 0xd], 0x44
            //   59                   | pop                 ecx
            //   bef4624000           | mov                 esi, 0x4062f4
            //   8dbd28ffffff         | lea                 edi, [ebp - 0xd8]

    condition:
        7 of them and filesize < 147456
}
Download all Yara Rules