ShadowPad’s builder, CasperVMakerHTTPx86, is analyzed to reveal how attackers assemble ShadowPad components, how the loader chain operates, and how historical campaigns in Kyrgyzstan and Kazakhstan connect to a broader ShadowPad ecosystem. The study also maps the builder to known actors and explains its community dynamics, including the ShadowPad market and shared toolchains. #ShadowPad #CasperLoader #RoyalRoadRTF #Tick #APT41 #Rose #BARIUM #LEAD #Kyrgyzstan #Kazakhstan
Keypoints
- A ShadowPad builder named CasperVMakerHTTPx86 was discovered, featuring multiple configuration tabs (First, Install, Inject, Online, Proxy, DNS) and the ability to generate a ShadowPad EXE/DLL pair.
- The generated EXE (AppLaunch) loads mscoree.dll via DLL Side-Loading, while the DLL (Casper Loader) decodes and executes the ShadowPad shellcode stored internally.
- Past campaigns linked to these components include Kyrgyzstan (Apr 2023) and Kazakhstan (Nov 2022), where RTF decoys prompted file writes and a Cobalt Strike beacon.
- The Loader’s behavior shows XOR-based payload decoding, a pattern observed in ShadowPad samples generated with the builder.
- ShadowPad is described as commercial software sold to various threat groups, with connections to actors such as Tick (PLA) and APT41 (MSS-associated groups), and to the broader ShadowPad community including i-Soon leaks.
- The article provides IoCs (hashes and URLs) and notes ongoing research into the relationships among ShadowPad users and developers.
MITRE Techniques
- [T1574.001] DLL Side-Loading – The EXE file is a legitimate AppLaunch. It loads the mscoree.dll in the same directory via DLL Side-Loading. “The EXE file is a legitimate AppLaunch. It loads the mscoree.dll in the same directory via DLL Side-Loading.”
- [T1055] Process Injection – Casper Loader decodes and executes the ShadowPad shellcode stored internally, implying code execution within the process.
- [T1027.001] XOR Encoding – ShadowPad loaders generated by the builder are decoded using a custom XOR with constants. “these samples … are decoded using a custom XOR with constants.”
- [T1588.001] Acquire Capabilities: Tools – ShadowPad is commercial software sold to various targeted attack groups, indicating procurement of a tooling capability. “ShadowPad is commercial software sold for profit … ShadowPad is sold to various targeted attack groups.”
- [T1204] User Execution – Attacks involving RTF files prompted users to open documents, leading to decoys and subsequent file writes/executions. “Opening this RTF file with a vulnerable version of Microsoft Word displayed a decoy file … while simultaneously writing and executing several files to the disk.”
Indicators of Compromise
- [File Hash] CasperVMakerHTTPx86 – eb99580e0d90ee61b3e2e3bd8715c633 and b6d7c456423c871c7ffe418069a75c39055e4e3d023021c8b0885a02c7ce93c6
- [URL] IoC sheet with RoyalRoad/RTF references – https://nao-sec.org/jsac2020_ioc.html
- [URL] Kyrgyzstan-related attack posts – https://x.com/nao_sec/status/1648960199938707456
- [URL] Additional context post (aRtAGGI) – https://x.com/aRtAGGI/status/1649184131090087938
Read more: https://nao-sec.org/2024/06/building-caspers-shadow.html#fn:4