Earth Preta Spear-Phishing Governments Worldwide

The attackers use the stolen documents as decoys to trick the targeted organizations working with Myanmar government offices into downloading and executing the malicious files. The victimology covers a broad range of organizations and verticals worldwide, with a higher concentration in the Asia Pacific region. Apart from the government offices with collaborative work in Myanmar, subsequent victims included the education and research industries, among others. In addition to decoy topics covering ongoing international events concerning specific organizations, the attackers also lure individuals with subject headings pertaining to pornographic materials.
Earth Preta uses spear-phishing emails as its first step for intrusion. As aforementioned, some of the emails’ subjects and contents discuss geopolitical topics, while others might contain sensational subjects. Analysts observed that all the emails Analysts analyzed had the Google Drive links embedded in them, which points to how users might be tricked into downloading the malicious archives. The file types of the archives include compressed files such as .rar, .zip, and .jar, to name a few. Upon accessing the links, Analysts learned that the archives contain the malware TONEINS, TONESHELL, and PUBLOAD malware families.
We analyzed the contents of the emails and observed that a Google Drive link is used as a lure for victims. The email’s subject might be empty or might have the same name as the malicious archive. Rather than add the victims’ addresses to the email’s “To” header, the threat actors used fake emails. Meanwhile, the real victims’ addresses were written in the “CC” header, likely to evade security analysis and slow down investigations. Using open-source intelligence (OSINT) tool GHunt to probe those Gmail addresses in the “To” section, Analysts found these fake accounts with little information in them.

Moreover, Analysts observed that some of the senders might be compromised email accounts from a specific organization. Victims might be convinced that these mails were sent from trusted partners, increasing the chances that recipients will select the malicious links.
We also found some decoy documents linked to the organizations related to or working with Myanmar government entities. The first decoy’s file name is Assistance and Recovery(china).exe, while another decoy .PDF document with title, that can be translated as “Embassy of the Republic of Myanmar” was observed in a compressed file named Assistance and Recovery(china).rar. Allegedly, this is a document containing the ambassador’s report in rough meeting schedules between the embassies of Myanmar and China.

We observed at least three types of arrival vectors as the intrusions’ entry points, including over 30 lure archives around the world distributed via Google Drive links, Dropbox links, or other IP addresses hosting the files. In most of the archives Analysts collected, there are legitimate executables, as well as the sideloaded DLL. The names of the archives and the decoy documents vary in each case. In the following sections, Analysts take some of them as examples and share the TTPs of each.

Inside the archive, the “~” file is a lure document. The executable Increasingly confident US is baiting China.exe is a legitimate executable (originally named adobe_licensing_wf_helper.exe, which is the Adobe Licensing WF Helper). This executable will sideload the malicious libcef.dll and trigger the export function cef_api_hash.

When executed for the first time, the executable tries to install the malware by copying the .exe file and moving libcef.dll (detected by Trend Micro as Trojan.Win32.PUBLOAD) to Both .exe and .dll files will be renamed C:UsersPublicPicturesadobe_wf.exe and C:UsersPublicPictureslibcef.dll, respectively. Additionally, “~” is renamed as 05-09-2022.docx and dropped to the Desktop.

The malicious archive contains three files: New Word Document.lnk, putty.exe, and CefBrowser.dll. In particular, the DLL and executable files are placed in multiple layers of folders named “_”.
The threat actor utilizes the .lnk file to install the malicious files by decompressing the archive file with WinRAR. The full command line is as follows.

%ComSpec% /c “______putty.exe||(forfiles /P %APPDATA%…. /S /M Desktop.rar /C “cmd /c (c:progra~1winrarwinrar.exe x -inul -o+ @path||c:progra~2winrarwinrar.exe x -inul -o+ @path)&&______putty.exe”)”

Pputty.exe is masquerading as a normal executable; its original file name is AppXUpdate.exe. When it is executed, it sideloads CefBrowser.dll and executes the main routine in its export function, CCefInterface::SubProcessMain. It also abuses schtasks for persistence.

There are also fake file extensions.
libcef.dll (detected by Trend Micro as Trojan.Win32.TONEINS) is an installer for the next-stage malware. It copies two files with names starting with “~”, in this case, ~$20220817.docx and ~$20220617(1).docx to . Both files have fake file extensions and masquerade as the temporary files generated while opening Microsoft Office software.

In this campaign, Analysts identified the following malware used, namely PUBLOAD, TONEINS, and TONESHELL.

PUBLOAD is a stager that can download the next-stage payload from its command-and-control (C&C) server. This malware was first disclosed by Cisco Talos in May 2022.

Once the .dll is executed, it first checks if the same process is already running by calling OpenEventA. According to the tweet posted by Barberousse, some noteworthy event names are identified as usernames of other cybersecurity researchers on Twitter, such as “moto_sato”, “xaacrazyman_armyCIAx,” and “JohnHammondTeam.” It is important to note that these researchers have nothing to do with PUBLOAD but were simply and intentionally mentioned by the threat actors in the binaries.

PUBLOAD creates a directory in and drops all the malware, including the malicious DLL and the legitimate executable, into the directory. It then tries to establish persistence in one of the following ways:

1. Adding a registry run key

cmd.exe /C reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Graphics /t REG_SZ /d “Rundll32.exe SHELL32.DLL,ShellExec_RunDLL “C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe”” /f

2. Creating a schedule task

schtasks.exe /F /Create /TN Microsoft_Licensing /sc minute /MO 1 /TR C:\Users\Public\Libraries\Graphics\AdobeLicensing.exe

PUBLOAD malware decrypts the shellcode in AES algorithm in memory. The shellcode is invoked by creating a thread or using different APIs. The APIs can accept an argument of a callback function, working as an alternative to trigger the shellcode. Analysts observed several leveraged APIs including GrayStringW, EnumDateFormatsA, and LineDDA, and can be considered as a technique to bypass antivirus monitoring and detection.

The decrypted PUBLOAD shellcode collects the computer name and the username as the payload of the first beacon. The payload will then be encrypted with the predefined RC4 (Rivest Cipher 4) key. As of this writing, all the stagers Analysts have seen so far share the same key.

After the encryption, the stager uses a specific byte sequence as its packet’s header. It prepends the magic bytes “17 03 03” and the payload size before the encrypted data.

The stager also checks if the response packet has the same magic header, “17 03 03”. If so, the downloaded payload in memory will be treated as a piece of shellcode and will be executed directly.

Trojan.Win32.TONEINS is the installer for TONESHELL backdoors. The installer drops the TONESHELL malware to the %PUBLIC% folder and establishes the persistence for it. TONEINS malware usually comes in the lure archives, and in most cases, the name of the TONEINS DLL is libcef.dll. The malicious routine is triggered via calling its export function cef_api_hash.

The TONEINS malware is obfuscated, likely to slow down malware analysis. It contains a lot of junk codes in its control flow and has plenty of useless XOR instructions as though to imply that these are used to decode strings. Upon checking, Analysts found that these obfuscated codes were reused from an open-source repository.

The installer establishes the persistence for TONESHELL backdoors by using the following schtasks command:

schtasks /create /sc minute /mo 2 /tn “ServiceHub.TestWindowStoreHost” /tr “C:UsersPublicPicturesServiceHub.TestWindowStoreHost.exe” /f

Based on our observations, the file names for the dropped TONESHELL malware differ in case, and so do the names of the scheduled tasks. After persistence is established, TONESHELL then copies the legitimate executable and the malicious DLL to the %PUBLIC% folder, wherein both files have names that start with “~” in the lure archive.

The TONESHELL malware is the main backdoor used in this campaign. It is a shellcode loader that loads and decodes the backdoor shellcode with a 32-byte key in memory. In the earlier version of TONESHELL, it has the capabilities from TONEINS malware, including establishing persistence and installing backdoors. However, the more recent version of TONESHELL is a standalone backdoor without any installer capabilities (such as the file ~$Talk points.docx). It is also obfuscated in a similar fashion to TONEINS malware, indicating that the actors continue to update the arsenal and separate the tools in order to bypass detection.

In order to make sure that the TONESHELL is installed correctly, Backdoor.Win32.TONESHELL first checks if the process path matches the expected one. If so, the malicious code could be triggered by the custom exception handler.

Interestingly, the adversary hides the actual code flow with the implementation of custom exception handlers. Different exception handlers will be invoked based on the result of the process name check, continuing the malicious routine by triggering the exception with the call _CxxThrowException. After it is invoked, the C++ runtime will find the corresponding exception handler from the ThrowInfo structure all the way down to the CatchProc member in the _msRttiDscr structure, which contains the real malicious codes. In this sample, the exception handler is located at the offset 0x10005300. This technique not only hides the execution flow but also stops the execution of the analyst’s debugger.

Looking at more recent TONESHELL samples, Analysts noticed that a new anti-sandbox technique is added compared to the earlier versions. The newer versions invoke the GetForegroundWindow API twice and check if there is any window switch. If the environment is a sandbox, both calls will get the same window handle because there is no human interaction involved in most sandboxes, resulting in the foreground window not changing. In addition, as an anti-sandbox and delayed execution technique, the malicious routine can only be triggered if the foreground window has already been switched for the fifth time.

After the malicious exception handler is triggered, it starts to decode the next-stage TONESHELL shellcode. To decode the shellcode, it first decodes a 32-byte key in XOR operations with 0x7D, and the key will then be used to decode the shellcode body.