Vault Viper: High Stakes, Hidden Threats

MITRE Techniques

• [T1059] Command and Scripting Interpreter – The actor used Visual Basic scripts to modify DNS resolver settings on Windows hosts: “Example of VBS script in use in 2010 to change player’s DNS resolvers” (Const STR_NEWDNS1 = “114.114.114[.]114” … objNIC.SetDNSServerSearchOrder Array(…)).
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys/Startup Folder – Installer adds UB-Launcher.exe to startup registry to achieve persistence and launch UBMaintenanceservice.exe at boot (“installer will then achieve persistence by adding ‘UB-Launcher.exe’ to the startup registry, which proceeds to run ‘UBMaintenanceservice.exe’”).
• [T1105] Ingress Tool Transfer – Installer downloads additional binaries and DLLs (Chrome installer and Application.7z) from actor-controlled domains (ac101[.]net and other domains) to %APPDATA%/local/UB before unpacking and installing them (“installer immediately checks the locale … before downloading the actual software … copying both to the %APPDATA%/local/UB folder”).
• [T1218] Signed Binary Proxy Execution – The software replaces legitimate Chrome.exe with UB-Launcher.exe and invokes chrome_elf.dll at runtime to run modified Chrome functionality (“replace the Chrome.exe binary by ‘UB-Launcher.exe,’ turning a legitimate Chrome installation into the ‘Universe Browser’ … chrome_elf.dll … invoked at runtime”).
• [T1056] Input Capture – Keylogging/Clipboard Monitoring – Universe Browser installs system hooks to monitor clipboard content and includes features consistent with key logging (“installer … introduces a number of persistent programs … changes to the network configurations … install system hooks to monitor clipboard content”).
• [T1071.001] Application Layer Protocol: Web Protocols – UBService and extensions route user traffic through SOCKS5 proxies and remote proxy infrastructure, and use HTTP(S) endpoints and Google Analytics to send unique hardware IDs (“generate … UID … sent to Google Analytics … derived keys … used to set up Secure Shell (SSH) connections … advertised as SOCKS5 proxies”).
• [T1562.001] Impair Defenses: Disable or Modify Tools – Universe Browser disables DevTools and chrome:// pages and removes many browser functionalities to hinder analysis (“Some Chrome functionality is disabled, including Dev Tools and chrome:// pages … nearly every setting is inaccessible”).
• [T1486] Data Encrypted for Impact / Encrypted Storage – UBService contains an encrypted SQLITE3 database and uses encrypted resources and keys hidden in 418 error pages and DNS TXT records to store and retrieve encrypted routing and configuration data (“large SQLITE3 table containing encrypted records” and “keys hidden on a 418 error page” used for decrypting updated routes).
• [T1102.001] Web Service: DNS – The actor uses DNS TXT records and domain naming conventions to distribute encrypted keys and configuration, and relies on DDGA and many domains to manage routing (“the service then queries several static, hardcoded domains for DNS TXT records … DDGA domains … several encrypted keys … used to decrypt the updated routes”).