Unit 42 BackConfig May 2020

BackConfig has used compressed and decimal encoded VBS scripts.

BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.

BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.

BackConfig can download and run batch files to execute commands on a compromised host.

BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.

BackConfig has the ability to remove files and folders related to previous infections.

BackConfig has the ability to use HTTPS for C2 communiations.

BackConfig has the ability to gather the victim's computer name.

BackConfig has the ability to identify folders and files related to previous infections.

BackConfig can download and execute additional payloads on a compromised host.

BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.

BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.

BackConfig has used a custom routine to decrypt strings.

Patchwork has used BITS jobs to download malicious payloads.

Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.

BackConfig has compromised victims via links to URLs hosting malicious content.

Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.

BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.

BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.

Patchwork has used spearphishing with links to deliver files with exploits to initial victims.

Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.