SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tonedeaf (Back to overview)

TONEDEAF

Actor(s): APT34


TONEDEAF is a backdoor that communicates with Command and Control servers using HTTP or DNS. Supported commands include system information collection, file upload, file download, and arbitrary shell command execution. When executed, this variant of TONEDEAF wrote encrypted data to two temporary files – temp.txt and temp2.txt – within the same directory of its execution.

References
2021-04-08CheckpointCheck Point Research
@online{research:20210408:irans:127f349, author = {Check Point Research}, title = {{Iran’s APT34 Returns with an Updated Arsenal}}, date = {2021-04-08}, organization = {Checkpoint}, url = {https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/}, language = {English}, urldate = {2021-04-09} } Iran’s APT34 Returns with an Updated Arsenal
DNSpionage SideTwist TONEDEAF
2020-01-30IntezerPaul Litvak, Michael Kajiloti
@online{litvak:20200130:new:e013fd0, author = {Paul Litvak and Michael Kajiloti}, title = {{New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset}}, date = {2020-01-30}, organization = {Intezer}, url = {https://intezer.com/blog-new-iranian-campaign-tailored-to-us-companies-uses-updated-toolset/}, language = {English}, urldate = {2020-02-03} } New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
TONEDEAF VALUEVAULT
2019-07-18FireEyeMatt Bromiley, Noah Klapprodt, Nick Schroeder, Jessica Rocchio
@online{bromiley:20190718:hard:7a6144e, author = {Matt Bromiley and Noah Klapprodt and Nick Schroeder and Jessica Rocchio}, title = {{Hard Pass: Declining APT34’s Invite to Join Their Professional Network}}, date = {2019-07-18}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html}, language = {English}, urldate = {2019-12-20} } Hard Pass: Declining APT34’s Invite to Join Their Professional Network
LONGWATCH PICKPOCKET TONEDEAF VALUEVAULT
Yara Rules
[TLP:WHITE] win_tonedeaf_auto (20220808 | Detects win.tonedeaf.)
rule win_tonedeaf_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-08-05"
        version = "1"
        description = "Detects win.tonedeaf."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonedeaf"
        malpedia_rule_date = "20220805"
        malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71"
        malpedia_version = "20220808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a6b 57 ff15???????? 6880000000 }
            // n = 4, score = 400
            //   6a6b                 | push                0x6b
            //   57                   | push                edi
            //   ff15????????         |                     
            //   6880000000           | push                0x80

        $sequence_1 = { 84c9 75f3 8bf3 8a03 43 84c0 75f9 }
            // n = 7, score = 400
            //   84c9                 | test                cl, cl
            //   75f3                 | jne                 0xfffffff5
            //   8bf3                 | mov                 esi, ebx
            //   8a03                 | mov                 al, byte ptr [ebx]
            //   43                   | inc                 ebx
            //   84c0                 | test                al, al
            //   75f9                 | jne                 0xfffffffb

        $sequence_2 = { 8bc3 46 d1e8 33d2 8bc8 }
            // n = 5, score = 400
            //   8bc3                 | mov                 eax, ebx
            //   46                   | inc                 esi
            //   d1e8                 | shr                 eax, 1
            //   33d2                 | xor                 edx, edx
            //   8bc8                 | mov                 ecx, eax

        $sequence_3 = { 84c9 75f3 8bf3 8a03 }
            // n = 4, score = 400
            //   84c9                 | test                cl, cl
            //   75f3                 | jne                 0xfffffff5
            //   8bf3                 | mov                 esi, ebx
            //   8a03                 | mov                 al, byte ptr [ebx]

        $sequence_4 = { 8d7601 884c32ff 84c9 75f3 8bf3 8a03 43 }
            // n = 7, score = 400
            //   8d7601               | lea                 esi, [esi + 1]
            //   884c32ff             | mov                 byte ptr [edx + esi - 1], cl
            //   84c9                 | test                cl, cl
            //   75f3                 | jne                 0xfffffff5
            //   8bf3                 | mov                 esi, ebx
            //   8a03                 | mov                 al, byte ptr [ebx]
            //   43                   | inc                 ebx

        $sequence_5 = { 46 d1e8 33d2 8bc8 }
            // n = 4, score = 400
            //   46                   | inc                 esi
            //   d1e8                 | shr                 eax, 1
            //   33d2                 | xor                 edx, edx
            //   8bc8                 | mov                 ecx, eax

        $sequence_6 = { 2bf1 8bc3 46 d1e8 33d2 8bc8 }
            // n = 6, score = 400
            //   2bf1                 | sub                 esi, ecx
            //   8bc3                 | mov                 eax, ebx
            //   46                   | inc                 esi
            //   d1e8                 | shr                 eax, 1
            //   33d2                 | xor                 edx, edx
            //   8bc8                 | mov                 ecx, eax

        $sequence_7 = { 75f3 8bf3 8a03 43 84c0 }
            // n = 5, score = 400
            //   75f3                 | jne                 0xfffffff5
            //   8bf3                 | mov                 esi, ebx
            //   8a03                 | mov                 al, byte ptr [ebx]
            //   43                   | inc                 ebx
            //   84c0                 | test                al, al

        $sequence_8 = { 2bc6 83f801 732f 8b0f }
            // n = 4, score = 400
            //   2bc6                 | sub                 eax, esi
            //   83f801               | cmp                 eax, 1
            //   732f                 | jae                 0x31
            //   8b0f                 | mov                 ecx, dword ptr [edi]

        $sequence_9 = { 33c0 660fd645d4 33db 8945d8 895dd4 }
            // n = 5, score = 400
            //   33c0                 | xor                 eax, eax
            //   660fd645d4           | movq                qword ptr [ebp - 0x2c], xmm0
            //   33db                 | xor                 ebx, ebx
            //   8945d8               | mov                 dword ptr [ebp - 0x28], eax
            //   895dd4               | mov                 dword ptr [ebp - 0x2c], ebx

    condition:
        7 of them and filesize < 851968
}
Download all Yara Rules