CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020

TAINTEDSCRIBE has used FakeTLS for session authentication.

TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.

The TAINTEDSCRIBE command and execution module can perform target system enumeration.

TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.

The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.

Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.

TAINTEDSCRIBE can execute ProcessList for process discovery.

TAINTEDSCRIBE can enable Windows CLI access and execute files.

TAINTEDSCRIBE can delete files from a compromised host.

TAINTEDSCRIBE can change the timestamp of specified filenames.

TAINTEDSCRIBE can use DirectoryList to enumerate files in a specified directory.

TAINTEDSCRIBE can download additional modules from its C2 server.

TAINTEDSCRIBE can execute GetLocalTime for time discovery.

TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.

TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.

TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.

TAINTEDSCRIBE can use DriveList to retrieve drive information.