Gray Rabbits and the Tale of a One-Click Backdoor

MITRE Techniques

• [T1059.007] JavaScript – Used to run the browser exploit on the attacker-controlled page and trigger code execution (‘The page contains a JavaScript exploit targeting any known V8 vulnerability’).
• [T1203] Exploitation for Client Execution – The victim only needed to click a crafted link to execute the attack chain (‘No user interaction beyond clicking the link was required’).
• [T1068] Exploitation for Privilege Escalation – The chain abused multiple software weaknesses to achieve remote code execution in the user context (‘chains three separate weaknesses into a single, one-click exploit’).
• [T1189] Drive-by Compromise – The browser was forced to navigate to attacker-controlled content through the custom protocol handler (‘navigates the browser directly to that URL’).
• [T1105] Ingress Tool Transfer – Shellcode downloaded 7z.exe, 7z.dll, and the payload blob from a staging server (‘fetched three files from a staging server’).
• [T1574.001] DLL Search Order Hijacking – The trojanized DLL was named as 7z.dll so it would be loaded by the legitimate 7z.exe from the same directory (‘it gets sideloaded and takes over execution’).
• [T1027] Obfuscated Files or Information – The loader used encrypted payloads, XOR decryption, and hashed API resolution to hinder analysis (‘encrypted payload’, ‘XOR-decrypts the entire embedded PE’).
• [T1497.001] Virtualization/Sandbox Evasion: System Checks – The loader counted processes and changed decryption behavior to fail in sandboxes (‘If the system has fewer than 50 processes … the actual count is kept’).
• [T1055] Process Injection – The shellcode and loader executed payload code in memory rather than as a normal file execution flow (‘copies the result into an RWX buffer … and executes it’).
• [T1106] Native API – The malware relied on Windows APIs such as CreateProcessA/W, VirtualAlloc, and SetFileInformationByHandle (‘resolves CreateProcessA’, ‘VirtualAlloc’, ‘SetFileInformationByHandle’).
• [T1071.001] Web Protocols – The C2 and exploit infrastructure used network-based web resources and URLs (‘mail.uaiubifas[.]top’, ‘https://attacker.com/exploit.html’).
• [T1095] Non-Application Layer Protocol – GRAYRABBIT used raw TCP sockets instead of TLS for command-and-control (‘Communication uses raw TCP sockets (not TLS)’).
• [T1036] Masquerading – The malicious DLL pretended to be a legitimate 7z.dll export set (‘masquerades as a legitimate 7z.dll’).
• [T1070.004] File Deletion: File Deletion via File System – The loader used NTFS Alternate Data Streams and disposition changes to remove itself (‘the file disappears from disk’).