UDPGangster Campaigns Target Multiple Countries

MITRE Techniques

• [T1566.001 ] Phishing: Spearphishing Attachment – The campaign delivers malicious Word documents as attachments. [‘includes two attachments named seminer.doc and seminer.zip.’]
• [T1204.002 ] User Execution: Malicious File (Office Macros) – VBA macros run on Document_Open() to decode and drop payloads when users enable content. [‘Enable Content’ / ‘The macro uses the Document_Open() event to automatically execute’]
• [T1105 ] Ingress Tool Transfer – The macro drops and executes a payload that copies itself to AppData and can deploy additional payloads. [‘copying itself to %AppData%RoamingLow as SystemProc.exe’ / ‘Triggers the execution of additional payloads’]
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys and Startup Folder – Malware writes a Startup value under a HKCU registry key to establish persistence. [‘writing the path to the Startup value under the registry key:HKCUSOFTWAREMicrosoftWindowsCurrentVersionExplorerUser Shell.’]
• [T1059.003 ] Command and Scripting Interpreter: Windows Command Shell – The backdoor can launch remote commands via cmd.exe. [‘Launches remote command execution via cmd.exe’]
• [T1041 ] Exfiltration Over C2 Channel – UDPGangster can extract files from victims and send collected data to a remote C2 over UDP. [‘Extracts files from the victim’ / ‘sends the data to its C2 server at 157.20.182.75 over UDP port 1269.’]
• [T1071 ] Application Layer Protocol – C2 over UDP – The malware communicates with its command-and-control server using UDP to evade typical defenses. [‘communicates with its C2 server using the UDP protocol.’]
• [T1082 ] System Information Discovery – The malware collects host details (computer name, domain/workgroup, OS version, username) for profiling. [‘collects system details (computer name, domain/workgroup, OS version, and username)’]
• [T1027 ] Obfuscated Files or Information – The dropper decodes Base64-encoded content and the malware encodes data using an ROR-based transformation before exfiltration. [‘decoding Base64-encoded data from a hidden form field’ / ‘encodes them using an ROR-based transformation’]
• [T1497 ] Virtualization/Sandbox Evasion – The sample performs many sandbox/VM and debugger checks (CPU cores, RAM size, virtual NIC MAC prefixes, WMI/registry/driver/service/process checks, sandbox DLLs). [‘performs several checks to evade analysis: 1. Debugger detection… 2. CPU environment… 4. Virtual adapter MAC prefixes… 8. Sandbox detection’]