Outdoor Malware Andariel Targets Korean Companies

MITRE Techniques

• [T1117] Regsvr32 – Used to load a DLL from a specific path via Regsvr32.exe; “a routine was simply inserted to execute a DLL from a specific path using the Regsvr32.exe process.”
• [T1055] Process Injection – Xctdoor injects into processes such as ‘taskhost.exe’, ‘taskhostex.exe’, ‘taskhostw.exe’, and ‘explorer.exe’.
• [T1105] Ingress Tool Transfer – The malware downloads and executes additional payloads from external sources; “downloading and executing additional payloads from an external source.”
• [T1071.001] Web Protocols – C2 communication uses HTTP; “Xctdoor communicates with the C&C server using the HTTP protocol.”
• [T1082] System Information Discovery – Backdoor transmits username, computer name, and PID; “transmits basic information such as the username, computer name, and the malware’s PID.”
• [T1113] Screen Capture – Screen capture is supported by Xctdoor; “screenshot capture” appears among its functions.
• [T1056] Input Capture – Keylogging capability is present; “keylogging” is listed as an information theft function.
• [T1115] Clipboard Data – Clipboard logging capability is present; “clipboard logging” is listed as an information theft function.
• [T1027] Obfuscated/Compressed Files and Information – Xctdoor’s communications and payloads are encoded/encrypted (Base64) as part of its packet handling; “packet encryption employs the Mersenne Twister (mt19937) algorithm and the Base64 algorithm.”