Cyble – Fake Telegram Site Delivering RAT Aimed At Chinese Users

MITRE Techniques

• [T1566] Phishing – The fake Telegram download page lures users into installing a malicious MSI rather than the legitimate app. ‘The fake website redirects users to Telegram’s official website to download applications … However, the fake website downloads a malicious graphical MSI installer when a user selects the application to install on Windows.’
• [T1204] User Execution – The user executes the malicious MSI to begin installation. ‘After executing the malicious MSI file, an installer window in Chinese is launched to install the application on Windows systems.’
• [T1543.003] Create or Modify System Process: Windows Service – Persistence via a service, then re-launch after reboot. ‘The malware waits for the command from the Command and Control (C&C) server and performs the following malicious activities: … persistence by creating a service for ComSvcInst.exe, which again starts mpclien.dll after the system reboots.’
• [T1548.002] Abuse Elevation Control Mechanism: Bypass User Account Control – Privilege escalation using Uac.reg to bypass UAC. ‘The malware has the code to execute a .reg file, namely Uac.reg, which will be downloaded from the C&C server. Our research indicates that the malware could have used the Uac.reg file to modify the registry keys to bypass User Access Control (UAC).’
• [T1574.002] Hijack Execution Flow: DLL Side-Loading – The legitimate MpCmdRun.exe loads a malicious mpclient.dll. ‘The MpCmdRun.exe is a Windows defender component that usually loads a legitimate file mpclient.dll. In this case, the Threat Actor has replaced the legitimate mpclient.dll with a malicious file.’
• [T1056.001] Keylogging – The malware monitors applications and performs keylogging. ‘The malware can monitor applications and perform keylogging activity in the victim’s machine. The code snippet that the malware uses to perform keylogging activities is shown below.’
• [T1071] Command and Control: Application Layer Protocol – C2 communications to receive commands and download payloads. ‘The malware waits for the command from the Command and Control (C&C) server and performs the following malicious activities: … can download additional payloads from the remote server based on the commands received from the C&C server.’