McAfee Sharpshooter December 2018

Rising Sun has collected data and files from a compromised host.

Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.

Rising Sun can detect network adapter and IP address information.

Rising Sun can test a connection to a specified network IP address over a specified port number.

Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.

Rising Sun can detect the username of the infected host.

During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.

Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.

Rising Sun can enumerate all running processes and process information on an infected machine.

Rising Sun has executed commands using `cmd.exe /c “<command> > <%temp%>\AM<random>. tmp” 2>&1`.

During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.

Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.

Rising Sun can delete files and artifacts it creates.

Rising Sun has used HTTP and HTTPS for command and control.

Rising Sun can detect the computer name and operating system.

Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.

During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.

During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including `LoadLibraryA()`, `GetProcAddress()`, and `CreateProcessA()`.

Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`.

Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.

During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.

During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\mssync.exe` on a compromised host.

During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.

Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.

Rising Sun can modify file attributes to hide files.

For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.

For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.

For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.

Rising Sun can detect drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.