SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tonedeaf (Back to overview)

TONEDEAF

Actor(s): APT34


TONEDEAF is a backdoor that communicates with Command and Control servers using HTTP or DNS. Supported commands include system information collection, file upload, file download, and arbitrary shell command execution. When executed, this variant of TONEDEAF wrote encrypted data to two temporary files – temp.txt and temp2.txt – within the same directory of its execution.

References
2021-04-08CheckpointCheck Point Research
@online{research:20210408:irans:127f349, author = {Check Point Research}, title = {{Iran’s APT34 Returns with an Updated Arsenal}}, date = {2021-04-08}, organization = {Checkpoint}, url = {https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/}, language = {English}, urldate = {2021-04-09} } Iran’s APT34 Returns with an Updated Arsenal
DNSpionage SideTwist TONEDEAF
2020-01-30IntezerPaul Litvak, Michael Kajiloti
@online{litvak:20200130:new:e013fd0, author = {Paul Litvak and Michael Kajiloti}, title = {{New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset}}, date = {2020-01-30}, organization = {Intezer}, url = {https://intezer.com/blog-new-iranian-campaign-tailored-to-us-companies-uses-updated-toolset/}, language = {English}, urldate = {2020-02-03} } New Iranian Campaign Tailored to US Companies Utilizes an Updated Toolset
TONEDEAF VALUEVAULT
2019-07-18FireEyeMatt Bromiley, Noah Klapprodt, Nick Schroeder, Jessica Rocchio
@online{bromiley:20190718:hard:7a6144e, author = {Matt Bromiley and Noah Klapprodt and Nick Schroeder and Jessica Rocchio}, title = {{Hard Pass: Declining APT34’s Invite to Join Their Professional Network}}, date = {2019-07-18}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html}, language = {English}, urldate = {2019-12-20} } Hard Pass: Declining APT34’s Invite to Join Their Professional Network
LONGWATCH PICKPOCKET TONEDEAF VALUEVAULT
Yara Rules
[TLP:WHITE] win_tonedeaf_auto (20201023 | autogenerated rule brought to you by yara-signator)
rule win_tonedeaf_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tonedeaf"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bc3 46 d1e8 33d2 8bc8 }
            // n = 5, score = 400
            //   8bc3                 | mov                 eax, ebx
            //   46                   | inc                 esi
            //   d1e8                 | shr                 eax, 1
            //   33d2                 | xor                 edx, edx
            //   8bc8                 | mov                 ecx, eax

        $sequence_1 = { f645e41f 7405 e8???????? 8b46fc 3bc6 }
            // n = 5, score = 400
            //   f645e41f             | test                byte ptr [ebp - 0x1c], 0x1f
            //   7405                 | je                  7
            //   e8????????           |                     
            //   8b46fc               | mov                 eax, dword ptr [esi - 4]
            //   3bc6                 | cmp                 eax, esi

        $sequence_2 = { 84c9 75f3 8bf3 8a03 }
            // n = 4, score = 400
            //   84c9                 | test                cl, cl
            //   75f3                 | jne                 0xfffffff5
            //   8bf3                 | mov                 esi, ebx
            //   8a03                 | mov                 al, byte ptr [ebx]

        $sequence_3 = { 83fe23 7605 e8???????? 8bf0 56 e8???????? 83c404 }
            // n = 7, score = 400
            //   83fe23               | cmp                 esi, 0x23
            //   7605                 | jbe                 7
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_4 = { c745dc00000000 33c0 660fd645d4 33db 8945d8 895dd4 }
            // n = 6, score = 400
            //   c745dc00000000       | mov                 dword ptr [ebp - 0x24], 0
            //   33c0                 | xor                 eax, eax
            //   660fd645d4           | movq                qword ptr [ebp - 0x2c], xmm0
            //   33db                 | xor                 ebx, ebx
            //   8945d8               | mov                 dword ptr [ebp - 0x28], eax
            //   895dd4               | mov                 dword ptr [ebp - 0x2c], ebx

        $sequence_5 = { 84c9 75f3 8bf3 8a03 43 84c0 }
            // n = 6, score = 400
            //   84c9                 | test                cl, cl
            //   75f3                 | jne                 0xfffffff5
            //   8bf3                 | mov                 esi, ebx
            //   8a03                 | mov                 al, byte ptr [ebx]
            //   43                   | inc                 ebx
            //   84c0                 | test                al, al

        $sequence_6 = { 732f 8b0f 8bc1 2bc6 48 83f801 }
            // n = 6, score = 400
            //   732f                 | jae                 0x31
            //   8b0f                 | mov                 ecx, dword ptr [edi]
            //   8bc1                 | mov                 eax, ecx
            //   2bc6                 | sub                 eax, esi
            //   48                   | dec                 eax
            //   83f801               | cmp                 eax, 1

        $sequence_7 = { 57 8d5101 6690 8a01 41 84c0 }
            // n = 6, score = 400
            //   57                   | push                edi
            //   8d5101               | lea                 edx, [ecx + 1]
            //   6690                 | nop                 
            //   8a01                 | mov                 al, byte ptr [ecx]
            //   41                   | inc                 ecx
            //   84c0                 | test                al, al

        $sequence_8 = { 75f3 8bf3 8a03 43 84c0 }
            // n = 5, score = 400
            //   75f3                 | jne                 0xfffffff5
            //   8bf3                 | mov                 esi, ebx
            //   8a03                 | mov                 al, byte ptr [ebx]
            //   43                   | inc                 ebx
            //   84c0                 | test                al, al

        $sequence_9 = { 33db 8945d8 895dd4 8945dc }
            // n = 4, score = 400
            //   33db                 | xor                 ebx, ebx
            //   8945d8               | mov                 dword ptr [ebp - 0x28], eax
            //   895dd4               | mov                 dword ptr [ebp - 0x2c], ebx
            //   8945dc               | mov                 dword ptr [ebp - 0x24], eax

    condition:
        7 of them and filesize < 851968
}
Download all Yara Rules