Volexity Patchwork June 2018

QuasarRAT has a module for performing remote desktop access.

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.

QuasarRAT has a built-in keylogger.

Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.

Patchwork used Visual Basic Scripts (VBS) on victim machines.

QuasarRAT can communicate over a reverse proxy using SOCKS5.

QuasarRAT can download files to the victim’s machine and execute them.

QuasarRAT can perform webcam viewing.

Patchwork has used watering holes to deliver files with exploits to initial victims.

Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.

QuasarRAT can obtain passwords from FTP clients.

A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.

QuasarRAT can obtain passwords from common FTP clients.

QuasarRAT can obtain passwords from common web browsers.

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.

QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.

Patchwork has obtained and used open-source tools such as QuasarRAT.

Patchwork has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.