Aria of Naikon Securelist

Our colleagues at PCO have assembled an excellent collection of studies on some of Naikon’s airways and activities, which we discovered in 2017 and reported on similarly in 2018. In addition to the results of their research, we summarise some of the results reported in June 2018 and publish them: Parking a new Naikon AR back door in Southeast Asia. This malware and activity is much of what Checkpoint researchers have discovered today.

APP Naikon first came to light in May 2015, when our public announcement first reported on the Group’s long-term presence in the APAC region and then described it in detail. Even when, after years of campaigning, the group ended a large part of their successful offensive, Nikon maintained a few split campaigns. A comparison of malware artifacts, functionality and targeting shows that the group will continue to conduct cyber-espionage campaigns in the South China Sea region in 2018.

Aria-Body of AR is a set of backdoors that support compilation data between January 2017 and February 2018. It is particularly difficult to recognize because most of this code works in memory, which is entered by other components of the charger without touching the plate. We trace part of this code base back to the exe and dll xsFunction modules, which have been used in Nykon operations since 2012, because their compiled modules implement a subset of the xsFunction functions. These new back door and related activities are likely to constitute an expansion or merger with the group’s Paradir operation. In the past, the Group has dealt with confidential communications and information of executive and legislative bodies, law enforcement agencies, administrative, military and intelligence services of the government in South East Asia. In many cases we have seen that these systems have already been targeted by PlugX and other malware. In this way, the group has grown slightly since 2015 and activities aimed at the same profiles will continue in 2018. We have identified at least half a dozen individual options for 2017 and 2018.

Technical Information

Apparently, the same code base has been reused by Nykon at least since 2012, and the most recent AR rear doors have been constructed from the same code. Their efforts are tightly clustered in previous and highly focused organizations, which gives confidence in the bundling of these resources and activities with the former Naikon.

The new Naikon AR back door is a dll, which is loaded into one of the many processes and allows remote access to the system. Attempts to download ARs have been identified in the processes with the executable images given here:

• windowssystem32svchost.exe
• c:windowssyswow64svchost.exe
• c:program files- windows ntaccessoriesservices.exe
• c:usersdellappdataroamingmicrosoftwindowsstart menuprogrammstartupacrobat.exe
• c:alphazavgiishost.exe

Since this AR code is entered into the processes, the Yara rule in the application is better executed against the dumps in the memory of the processes that support the master image in the list above. AR modules have also been observed in several other, including msiexec.exe processes.

Below you will find the characteristics of the oldest and newest known part of our collection.

When the dll is loaded, it stores the Windows class that invokes a particular Windows procedure with a removable disk, the CONNECT proxy server on the main C2, the IP address verification with checkip.amazonaws[…]com, and the subsequent interaction with C2. The process of some of the previous modules may involve collecting more or less information about the system before the first recall.

The latest version of the rear door uses a different window procedure to set up a collector based on an input device with unprocessed impacts. This keylogger functionality was introduced in malicious code in February 2018 and was not present in earlier versions.

The approximately 200 to 250 kb family of AR blacktops offers a set of familiar and slightly changing functions for each compiled module. Since Checkpoint addresses the same technical issues in its message, we provide this simple checklist:

• Continuous treatment
• Processing files and folders
• Recording in Keyscape mode
• Shell/process control
• Network activity, status list and network management
• Collection and management of system information
• Download management
• Windows administration
• Proliferation management
• Location/IP verification
• Communication over HTTP network

Compliance with earlier parts of Nykon

The Naikon components, which date from 2012, retain strong similarities with the existing Aria construction modules. Not only have some functions changed only slightly, but the same printing errors in the error record remain in their code base. Check out the old Naikon 2013 module and the new Naikon AR 2017 module.

It is clear that the basic code base is always used:

e09254fa4398fccd607358b24b918b63, Compound: 2013:09:10 09:00:15

c766e55c48a4b2e7f83bf8b6004fc51, Compilation : 2017:01:03 09:23:48

We thank the PCO researchers for providing further details on the story with Naikon for the public discussion.

For your information, here is some hash and a YARA rule. More information on incidents, infrastructure, CIOs and more detailed information has been provided and is available to our clients working with threat information (contact us at [email protected]).

Compromise figures

AR aria body dll
c766e55c48a4b2e7f83bf8b6004fc51
2ce4d68a120d76e703298f27073e1682

Chargers and associated malware Naikon
0ed1fa2720cdab23d969e60035f05d92
3516960dd711b668783ada34286507b9

Reviews – 2018 and followingTrojan.Win32.Generic.genTrojan.Win32.SEPEH.genDangerousObject.Multi.GenericBackdoor.Win64.Agent.h*Backdoor.Win32.Agent.m*Auto loading Trojan.Win32.Agent.x*Auto loading Trojan.

JARA rules

Rule apt_ZZ_Naikon_ARstrings : Naikon
{
meta:
copyright = Kaspersky
description = Naikon
hash = 2B4D3AD32C23BD492EA945EB8E59B758
date = 2020-05-07
version = 1.0.

Strings:
$a1 = Process settlement [PID=%d] successful!
$a2 = Process settlement [PID=%d] failed:%d] $a3 = Termination of tcp connection returned: %d! full word
$a4 = Directory [%s] will be returned:%d full word
$a5 = Directory [%s] will be deleted!
$a6 = Directory [%s] can be created!
$a7 = SHFileOperation [%s] is returned:%d
$a8 = SHFileOperation [%s] is successful!
$a9 = Terminate tcp connection successfully! full word
$a10 = Open process [PID=%d] Failed:%d full word
$a11 = ShellExecute [%s] return:%d full word
$a12 = ShellExecute [%s] is successful!
$a13 = First file search [%s] Error:%d
$a14 = Delete file [%s] successful!
$a15 = Create file [%s] Error:%d Wideband
$a16 = DebugAzManager Fulward ascii
$a17 = Create directroy [%s] Error:%d Fulward wider

m1 $ = TCPx86.dll Assault Width
$m2 = Assault Aria Body Assault Width

Status:
uint16(0) == 0x5A4D and
files size < 450000 and
(2 of ($a*) and 1 of ($m*))
}.

Rule apt_ZZ_Naikon_Codebase : Naikon
{
meta:
report = Naikon New AR Backdoor Deployment to Southeast Asia
description = Naikon typo
author = Kaspersky
copyright = Kaspersky
version = 1.0
date = 2018-06-28
last_modified = 2018-06-28.

Channels:
$a1 = Create Directroy [%s] failed: %d Width

Status:
uint16(0) == 0x5A4D and
files < 450000 and
$a1
}.