Earth Preta Campaign Uses DOPLUGS to Target Asia

If the connection fails, the thread checks the value in registry (HKCU|HKLM)SystemCurrentControlSetControlNetworkVersion, which does not exist. Afterward, it creates and executes the batch script %temp%edg{value of QueryPerformanceCounter}.bat to collect the information of the victim.

%comspec% /q /c systeminfo >”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c ipconfig /all >>”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c netstat -ano >>”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c arp -a >>”%~dp0AE353BBEB1C6603E_E.dat”

%comspec% /q /c tasklist /v >>”%~dp0AE353BBEB1C6603E_E.dat”

del %0

The output data will then be encrypted and dropped to {USB_volume}:Usb Drive1.0 {value of SOFTWARECLASSESms-puCLSID}.dat.

This thread creates the mutex, USB_NOTIFY_BAT_H3_{USB_volume} for mark, which will be executed only under these conditions:

• When connection with https://www.microsoft.com fails
• When there is no value in System\CurrentControlSet\Control\Network\version (this registry is enabled when argument of cmd line = “-net”)

The thread will search all batch scripts inside the following folders:

• {USB_volume}:Usb Drive1.0p
• {USB_volume}:KasperskyUsb Drive1.0p
• {USB_volume}:.SystemDeviceUSB3.0Usb Drive1.0p

If the batch script name does not contain the strings tmpc_ or tmp_, the script will be decrypted via XOR algorithm, which is the same as the file encryption in the thread 2 subsection. The new batch will then be created in %temp%{value of QueryPerformanceCounter}.bat and executed by ShellExecuteW with the following contents:

{USB_volume}
cd “{USB_volume}:target folder”
{decrypted contents in batch file}
del %0

DOPLUGS backdoor behavior (Command and Control)

This behavior is the same as the original piece of DOPLUGS malware and is responsible for C&C communication, backdoor commands, and downloading the next-stage general type of the PlugX malware.

The following command line is executed to set up scheduled tasks to enable Wi-Fi connection:

• cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn “Security WIFI Script” /tr “netsh interface set interface “””Wireless Network Connection””” enabled” /ru SYSTEM /F&schtasks.exe /run /tn “Security WIFI Script” 
• cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn “Security WIFI2 Script” /tr “netsh interface set interface “””Wireless Network Connection 2″”” enabled” /ru SYSTEM /F&schtasks.exe /run /tn “Security WIFI2 Script” 
• cmd.exe /c schtasks.exe /create /sc minute /mo 30 /tn “Security WIFI3 Script” /tr “netsh interface set interface “””Wireless Network Connection 3″”” enabled” /ru SYSTEM /F&schtasks.exe /run /tn “Security WIFI3 Script”

Old variant

In addition to DOPLUGS, we hunted down several customized PlugX malware samples that are also equipped with the KillSomeOne module. Based on our investigation, this integration would have been active for three years, with the report published by Avira being the first to reveal this technique. The sample mentioned in Avira’s report is the first PlugX variant with the KillSomeOne module designed for spreading via USB.

The following table is a list of different PlugX malware types with integrate KillSomeOne variants:

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts