The Chinese backdoor trojan PlugX has been used in a number of attacks on various targets over the years. It has followed a long, gradual development, and is now considered one of the “usual suspects” whenever a Chinese-originated intrusion is indicated.
The basic layout is that its main code is contained in a binary blob, which is loaded and executed in various different setups. The blob can be contained as a resource in an executable, but perhaps the most common configuration is that the blob is in a separate file which is loaded and executed by a helper library (DLL). This mechanism has been well described in this fantastic paper from Computer Incident Response Center Luxembourg.
One of its party tricks is that it uses legitimate applications as its inadvertent helpers. It does this by distributing PlugX as an archive which contains (at least) three files:
1. One innocent application which loads some additional library. This application is always digitally signed.
2.One malicious library, named so that it is accidentally loaded by the innocent application in 1. This library loads:
3. A binary PlugX blob, using a non-executable name.
There is no shortage of innocent, signed applications that load local libraries by name without checking that these libraries are what they claim to be. Over time, PlugX has at least used:
nvsmart.exe, from nVidia. Loads nvsmartmax.dll
rc.exe, from Microsoft. Loads rcdll.dll
xlmin.exe, from ShenZhen Thunder Networking Technologies. Loads dl_peer_id.dll
oinfop11.exe, from Microsoft. Loads oinfop11.ocx
msidb.exe, from Microsoft. Loads msi.dll
mcvsmap.exe, from McAfee. Loads mcutil.dll
mcinsupd.vxe, from McAfee. Loads mytilus3.dll
hkcmd.exe, from Intel. Loads hccutils.dll
chrome_frame_helper.exe, from Google. Loads chrome_frame_helper.dll
360.exe, from Qihoo 360. Loads d3dx81ab.dll
mas_wlmmon.exe, from Trend Micro. Loads mas_wlmhook.dll
qqbrowserupdateservice.exe, from Tencent, Inc. Loads pdh.dll
We recently found another combination.
The initial dropper (md5 d0d2079e1ab0e93c68da9c293918a376) is a Word document saved as “Single File Web Page” (*.mht), which contains an exploit for a well known vulnerability; CVE-2012-0158.
It is designed to trigger extraction and execution of a malicious executable (md5 cc1a806d25982acdb35dd196ab8171bc). This is a signed WinRAR SFX archive.
Signed executables
The digital signature belongs to “Hohhot Handing Trade and Business Co., Ltd.”, a company seemingly located in the Chinese region of Inner Mongolia (not the sovereign state). The signature still validates, but we have requested revocation.
CN = Hohhot Handing Trade and Business Co., Ltd.
O = Hohhot Handing Trade and Business Co., Ltd.
L = Hohhot
S = Inner Mongolia
C = CN
Issuer: Thawte Code Signing CA – G2
Serial: 6ed2450ceac0f72e73fda1727e66e654
This archive contains the following three files:
sbiedll.dll
helper.url
iehelper.exe
iehelper.exe belongs to Sandboxie Ltd, and when executed it loads the malicious library sbiedll.dll. The PlugX encrypted blob code is located in helper.url.
Unusually, the malicious sbiedll.dll is also digitally signed. This signature belongs to “Beijing Baoyi Interaction Technology Development Co.,Ltd.”
This is a fairly old signature which no longer validates, on account of having timed out of its validity period.
Issuer: VeriSign Class 3 Code Signing 2010 CA
Serial: 021babf0f0b8e5df2e5dbd7b379bd3b1
A number of other samples are also signed with this certificate. These belong to a different family – apparently named SkyEagle -which will not be covered in this paper.
Configuration
PlugX blob modules come in different versions. The earliest were trivially encrypted with an initial static decryptor. Then versions occurred with variable decryptors, where the decryptor contained garbage instructions. In current variations, decryption occurs in two layers; with an initial layer of simple arithmetic decoding, followed by a slightly more complex algorithm as documented before.
Above: The initial xor 0x90 decoding loop.
The decoded configuration looks like this:
The Command&Control servers and ports (ppt.bodologetee.com, 8080)
The registration information of the bodologetee.com domain shows:
This registration information is interesting, as it can be dug a bit into. First of all, the registration information has changed a bit over time. Going back to initial registration, we see that the domain was registered by one Li Li, aka bluce_nan@yahoo.com. This is highly likely the same registrant, as the same combination has been used for the domain yahoomesseges.com:
Yahoomesseges.com is a domain which has been used as Command&Control domain for the malware known as Vidgrab, also known as EvilGrab. See research from Trend Micro on this family.
(Related hashes : 576aa3655294516fac3c55a364dd21d8 and 73b6df33cf24889a03ecd75cf5a699b3.)
There are also apparently overlapping data uncovered by Zscaler connecting to previous online scam and phishing activity.
Target
The only information we have on the target is connected with the lure document shown when the dropper executes. This looks like this:
This appears to refer to Arjia Rinpoche’s Cancer Care Treatment Center for Mongolian Children being built in Ulanbataar – which is in the sovereign nation of Mongolia. It seems a pretty likely assumption that the target is Mongolian or interested in Mongolian matters. It is also possible that the target is Tibetan, as Tibet as target has been well documented in many attacks before and Arjia Rinpoche is a prominent Tibetan monk and teacher.
Similarities with other attacks
Attacks on Mongolian targets have been seen before. ThreatConnect documented the use of the known Comment Crew/APT1 malware Barkiofork (aka WARP) in the “PEACEFUL” targeted attack campaign.
In this case, the malware (6ab333c2bf6809b7bdc37c1484c771c5) is configured to connect to three domains:
mongolia.regionfocus.com
peaceful.linkpc.net
mseupdate.strangled.net
As also mentioned in the ThreatConnect paper, it is quite straightforward to expand this infrastructure to cover more domains. For example, the Barkiofork sample 606a3279d855f122ea3b34b0eb40c33f is similarly configured:
ssupdate.regionfocus.com
peaceful003.linkpc.net
mongolia.regionfocus.com
This is however another place where PlugX shows up. The PlugX samples [198fd054105ad89a93e401d8f59320d1, cc7b091b94c4f0641b180417b017fec2] were configured to use these domains:
peaceful.linkpc.net
mongolia.regionfocus.com
centralasia.regionfocus.com
peaceful.swordwind.net OR usa.regionfocus.com
Conclusion
This attack is consistent with what we have previously seen from some very active Chinese players. These use a number of overlapping malwares, domains and methods that makes it hard to determine whether the attackers belong to one group or several, and whether they share or hire methods and infrastructure.
It does however seem clear that Mongolia has become an attractive target for Chinese hackers. There are now several documented malware campaigns that seem to indicate this.
This article belongs to a series called “The Chinese Malware Complexes”. More articles are forthcoming.
