Who’s swimming in South Korean waters? Meet ScarCruft’s Dolphin | WeLiveSecurity

ESET
researchers
have
analyzed
a
previously
unreported
backdoor
used
by
the
ScarCruft
APT
group.
The
backdoor,
which
we
named
Dolphin,
has
a
wide
range
of
spying
capabilities,
including
monitoring
drives
and
portable
devices
and
exfiltrating
files
of
interest,
keylogging
and
taking
screenshots,
and
stealing
credentials
from
browsers.
Its
functionality
is
reserved
for
selected
targets,
to
which
the
backdoor
is
deployed
after
initial
compromise
using
less
advanced
malware.
In
line
with
other
ScarCruft
tools,
Dolphin
abuses
cloud
storage
services
–
specifically
Google
Drive
–
for
C&C
communication.

During
our
investigation,
we
saw
continued
development
of
the
backdoor
and
attempts
by
the
malware
authors
to
evade
detection.
A
notable
feature
of
earlier
Dolphin
versions
we
analyzed
is
the
ability
to
modify
the
settings
of
victims’
signed-in
Google
and
Gmail
accounts
to
lower
their
security,
most
likely
to
maintain
access
to
victims’
email
inboxes.

In
this
blogpost,
we
provide
a
technical
analysis
of
the
Dolphin
backdoor
and
explain
its
connection
to
previously
documented
ScarCruft
activity.
We
will
present
our
findings
about
this
new
addition
to
ScarCruft’s
toolset
at
the

AVAR
2022
conference.

ScarCruft
profile

ScarCruft,
also
known
as
APT37
or
Reaper,
is
an
espionage
group
that
has
been
operating
since
at
least
2012.
It
primarily
focuses
on
South
Korea,
but
other
Asian
countries
also
have
been
targeted.
ScarCruft
seems
to
be
interested
mainly
in
government
and
military
organizations,
and
companies
in
various
industries
linked
to
the
interests
of
North
Korea.

Dolphin
overview

In
2021,
ScarCruft
conducted
a
watering-hole
attack
on
a
South
Korean
online
newspaper
focused
on
North
Korea.
The
attack
consisted
of
multiple
components,
including
an
Internet
Explorer
exploit
and
shellcode
leading
to
a
backdoor
named
BLUELIGHT,
reported
by

Volexity
and

Kaspersky.

In
those
reports,
the
BLUELIGHT
backdoor
was
described
as
the
attack’s
final
payload.
However,
when
analyzing
the
attack,
we
discovered
through
ESET
telemetry
a
second,
more
sophisticated
backdoor,
deployed
on
selected
victims
via
BLUELIGHT.
We
named
this
backdoor
Dolphin
based
on
a
PDB
path
found
in
the
executable.

While
the
BLUELIGHT
backdoor
performs
basic
reconnaissance
and
evaluation
of
the
compromised
machine
after
exploitation,
Dolphin
is
more
sophisticated
and
manually
deployed
only
against
selected
victims.
Both
backdoors
are
capable
of
exfiltrating
files
from
a
path
specified
in
a
command,
but
Dolphin
also
actively
searches
drives
and
automatically
exfiltrates
files
with
extensions
of
interest
to
ScarCruft.

Figure
1
provides
an
overview
of
the
attack
components
leading
to
the
execution
of
the
Dolphin
backdoor.

Figure
1.
Overview
of
the
attack
components
leading
to
the
execution
of
the
Dolphin
backdoor

Dolphin
analysis

Analysis
of
Dolphin’s
components
and
their
capabilities
is
provided
in
the
following
section.

The
analysis
is
based
on
the
first
version
of
the
backdoor
that
we
found,
1.9
(based
on
a
string
found
in
the
code)
with
additional
information
about
changes
in
newer
versions.
A
summarized
description
of
the
version
changes
can
be
found
in
the

Dolphin
evolution
section.

Dolphin
installer

Ensuing
sections
describe
the
installer
and
loader
components
responsible
for
the
execution
of
the
Dolphin
backdoor
in
the
analyzed
attack
scenario.

It
is
worth
noting
that
this
installer
and
the
deployed
loader
are
not
exclusive
to
Dolphin,
and
were
previously
seen
used
with
other
ScarCruft
malware.

The
installer
shellcode
follows
these
main
objectives:

• Download
  and
  deploy
  a
  Python
  interpreter
• Generate
  and
  deploy
  a
  loading
  chain
  with
  its
  payload
• Ensure
  persistence
  of
  the
  loading
  chain

The
installer
downloads
a
CAB
file
from
OneDrive,
containing
a
legitimate
Python
2.7
interpreter.
The
CAB
is
unpacked
to

%APPDATA%,
and
depending
on
architecture,
the
interpreter
ends
up
in
one
of
the
following
directories:

• 
  %appdata%Python27(32)
• 
  %appdata%Python27(64)

The
installer
generates
two
file
paths
for
loading-chain
components,

<loader_step_1>
and

<loader_encrypted_step_2>,
with
the
format

<base_dir><inf_name><dll_name>.

<base_dir>
is
randomly
selected
from

• 
  %PROGRAMDATA%
• 
  %PUBLIC%
• 
  %APPDATA%Microsoft
• 
  %APPDATA%MicrosoftWindows
• 
  %LOCALAPPDATA%
• 
  %LOCALAPPDATA%Microsoft
• 
  %LOCALAPPDATA%MicrosoftWindows

<inf_name>
and

<dll_name>
are
randomly
selected
from
existing
filenames
(without
extension)
in

%windir%inf*.inf

and
%windir%system32*.dll.

To
generate
Step
1
of
Loader,
it
uses
a
script
template
that
is
filled
with
randomly
generated
names
(variables,
function).
The
template
with
generated
example
is
shown
in
Figure
2.

Figure
2.
Step
1
template
and
generated
example

The
script
is
then
written
to

<loader_step_1>.

Step
2
(embedded
in
the
installer)
containing
the
rest
of
the
loading
chain,
including
the
payload,
is
encrypted
with
a
one-byte
XOR
key
derived
from
the
current
time
and
written
to

<loader_encrypted_step_2>.

In
order
to
persist
the
start
of
the
loading
chain,
the
installer
sets
a
Run
registry
value:

HKCUSoftwareMicrosoftWindowsCurrentVersionRun<random_run_name>”%appdata%Python27({32|64})pythonw.exe”
“<loader_step_1>”
“<loader_encrypted_step_2>”

The

<random_run_name>
is
randomly
selected
from
existing
filenames
matching

%WINDIR%inf*.inf,
discarding
the

.inf
extension.

To
start
the
loading
chain
after
installation,
it
creates
a
one-time
scheduled
task.

Dolphin
loader

The
Dolphin
loader
consists
of
a
Python
script
and
shellcode.

Step
1,
the
Python
script,
reads
a
specified
file,
XOR-decrypts
its
contents,
and
executes
the
resulting
shellcode.

Step
2,
shellcode,
creates
a
host
process
(random
CLI
executable
from

%WINDIR%System32*.exe),
XOR-decrypts
further
shellcode
carried
within
itself,
and
injects
it
into
the
created
process.

Step
3,
another
shellcode,
XOR-decrypts
an
embedded
PE
file
–
the
Dolphin
backdoor
–
and
loads
and
executes
it
using
a
custom
PE
loader.

Dolphin
backdoor

Dolphin
is
a
backdoor
that
collects
information
and
executes
commands
issued
by
its
operators.
The
backdoor
is
a
regular
Windows
executable,
written
in
C++.
It
communicates
with
Google
Drive
cloud
storage,
which
is
used
as
its
C&C
server.

We
named
the
backdoor
Dolphin
based
on
a
PDB
path
found
in
the
executable:

D:DevelopmentBACKDOORDolphinx64ReleaseDolphin.pdb

Persistence

The
backdoor
periodically
checks
and
creates
its
own
persistence
by
making
sure
that
Step
1
of
the
loader
is
run
every
time
the
system
is
started,
via
a
registry
Run
value,
in
the
same
way
as
in
the
installer:

HKCUSoftwareMicrosoftWindowsCurrentVersionRun<random_run_name>”%appdata%Python27({32|64})pythonw.exe”
“<loader_step_1>”
“<loader_encrypted_step_2>”

Capabilities

The
following
basic
information
about
the
computer
and
the
backdoor
is
collected:

• Current
  backdoor
  configuration
• Username
• Computer
  name
• Local
  and
  external
  IP
  address
• List
  of
  installed
  security
  products
• RAM
  size
  and
  usage
• Result
  of
  check
  for
  debugger
  and
  other
  inspection
  tools
  (such
  as
  Wireshark)
• OS
  version
• Current
  time
• Malware
  version

Dolphin
downloads
commands,
issued
by
its
operators,
from
Google
Drive
storage
and
executes
them.
After
execution,
the
output
of
commands
is
uploaded.
Most
of
Dolphin’s
capabilities
are
controlled
through
commands.

The
most
relevant
capabilities
are
described
below.

File
exfiltration

By
default,
Dolphin
searches
all
non-fixed
drives
(USBs),
creates
directory
listings
and
exfiltrates
files
by
extension.
This
search
can
be
extended
to
fixed
drives
(HDDs),
via
dedicated
commands.

The
following
file
extensions
of
interest,
specific
to
media,
documents,
emails,
and
certificates,
are
specified
in
the
default
configuration:

jpg,
doc,
xls,
ppt,
hwp,
url,
csv,
pdf,
show,
cell,
eml,
odt,
rtf,
nxl,
amr,
3gp,
m4a,
txt,
msg,
key,
der,
cer,
docx,
xlsx,
pptx,
pfx,
mp3

Besides
this
automatic
search,
specific
files
can
be
exfiltrated.

In
the
newer
versions,
the
default
search
was
extended
to
fixed
drives.
The
command
to
get
specific
files
was
improved,
by
caching/storing
it
in
the
configuration
until
completion.

Portable
devices

Among
regular
drives,
Dolphin
also
searches
portable
devices
such
as
smartphones,
using
the
Windows
Portable
Device
(WPD)
API.
It
creates
directory
listings
and
exfiltrates
files.
This
functionality
appeared
to
be
under
development
in
the
first
version
we
found,
for
several
reasons:

• Relying
  on
  a
  hardcoded
  path
  with
  a
  username
  that
  likely
  doesn’t
  exist
  on
  the
  victim’s
  computer
• Missing
  variable
  initialization
  –
  some
  variables
  are
  assumed
  to
  be
  zero-initialized,
  or
  dereferenced
  as
  pointers
  without
  initialization
• Missing
  extension
  filtering

The
code
is
heavily
based
on
Microsoft’s
Portable
Devices
COM
API

code
sample.

Apart
from
automatic
search,
the
operators
can
specify
individual
files
to
be
exfiltrated
from
portable
devices.

In
newer
versions,
this
capability
was
finished
and
improved
by
adding
extension
filtering.
For
unknown
reasons,
the
command
to
retrieve
specific
files
from
portable
devices
was
removed.

Keylogging
and
screenshots

Dolphin
logs
keystrokes
for
windows
with
titles
containing
substrings
specified
in
its
configuration.
The
defaults
are

chrome
and

internet
explore
(sic).
This
is
done
via
the

GetAsyncKeyState
API,
with
keystrokes
being
logged
along
with
the
window
name
and
current
time.
Screenshots
are
also
taken
at
a
configurable
interval;
the
default
is
once
every
30
seconds.

Screenshots
and
keylogging
are
enabled
by
default,
and
can
be
toggled
via
a
command.

Shellcode

Dolphin
can
receive
shellcode
for
execution.
The
shellcode
is
stored
in
the
registry,
under
one
of
the
following
keys:

• 
  HKCUSoftwareMicrosoftWindowsCurrentVersionThemesClassic<random_number>
• 
  HKCUSoftwareMicrosoftOneDriveUpdate<random_number>
• 
  HKCUSoftwareMicrosoftWindowsCurrentVersionInternet
  SettingsHttpsSoftwareMicrosoftInternet
  ExplorerZone<random_number>
  (two
  subkeys
  as
  one,
  likely
  a
  coding
  error)

It
can
be
executed
either
locally
or
in
a
specified
separate
process
that
is
created
and
injected.

In
the
newer
versions,
the
shellcode
is
stored
in
files
instead
of
the
registry,
and
the
stored
shellcode
is
loaded
and
executed
on
Dolphin’s
startup,
which
was
not
the
case
in
version
1.9
(the
original
version
we
analyzed).

Shell
commands

Dolphin
can
execute
shell
commands;
this
is
done
via
the

popen
API
and
their
output
is
retrieved.

Stealing
credentials

Dolphin
can
retrieve
credentials
from
browsers
in
the
form
of
saved
passwords
and
cookies.
The
following
browsers
are
supported:

• 
  Chrome
• 
  Edge
• 
  Internet
  Explorer

In
version
2.2,
this
capability
was
removed,
presumably
to
avoid
detection.
It
was
later
restored
in
version
3.0,
but
in
a
different
form.
It
is
now
dynamically
received
from
the
C&C
in
the
form
of
shellcode.

Google
account

Another
one
of
Dolphin’s
commands
modifies
the
settings
of
the
currently
logged-in
Google
account,
lowering
its
security
relative
to
default
settings.
It
steals
the
existing
cookie
of
the
logged-in
account
from
the
browser
and
crafts
requests
that
modify
the
settings.

First,
it
enables
access
to
Gmail
via
the
IMAP
protocol
by
sending
an
HTTP
POST
request
to:

• 
  https://mail.google.com/mail/u/0/?ik=<GM_ID_KEY>&at=<GM_ACTION_TOKEN>&view=up&act=prefs

Then
it
enables
“less
secure
app
access”
by
sending
an
undocumented
RPC
request
via
an
HTTP
POST
to:

• 
  https://myaccount.google.com/_/AccountSettingsUi/data/batchexecute

These
modifications
are
referred
to
as
“thunder
access”
in
the
backdoor,
likely
being
a
reference
to
the
Thunderbird
email
client.
Accessing
their
victims’
inboxes
with
a
third-party
client
via
IMAP
probably
helps
ScarCruft
operators
maintain
access
to
the
victims’
emails
after
stealing
credentials,
which
may
not
be
enough
on
their
own,
due
to
Google’s
detection
of
suspicious
login
attempts.

This
feature
was
found
in
versions
1.9
and
2.0
of
the
backdoor;
it
is
not
present
in
versions
2.2
or
3.0.

Data
staging

Dolphin
exfiltrates
data
to
Google
Drive
storage,
staging
the
data
in
encrypted
ZIP
archives
before
upload.
The
backdoor
also
maintains
a
list
of
files
in
the
form
of
MD5
hashes,
in
order
to
avoid
uploading
the
same
file
multiple
times.
This
list
can
be
reset
via
a
dedicated
command.

Configuration

The
backdoor
contains
an
initial
default
configuration
that
is
persisted
on
first
run
and
loaded
on
subsequent
runs.
It
is
stored
in
the
file

%ProgramData%<variable_cfg_name>.inf,
where

<variable_cfg_name>
is
randomly
selected
from
existing
filenames
matching

%windir%inf*.inf.
The
content
is
encrypted
using
AES
CBC
with
random
16-byte
keys
and
IVs,
which
are
stored
at
the
file’s
beginning.
The
configuration
uses
JSON
format,
with
hash-like
keys.
An
example
of
a
decrypted
configuration
is
shown
in
Figure
3.

Figure
3.
Dolphin
backdoor
configuration

The
configuration
can
be
modified
through
commands.
It
contains,
among
others,
the
following:

• Encryption
  keys
• Credentials
  for
  Google
  Drive
  API
  access
• Window
  titles
  to
  keylog
• List
  of
  file
  extensions
  to
  exfiltrate

Dolphin
evolution

Since
the
initial
discovery
of
Dolphin
in
April
2021,
we
have
observed
multiple
versions
of
the
backdoor,
in
which
the
threat
actors
improved
the
backdoor’s
capabilities
and
made
attempts
to
evade
detection.
Figure
4
summarizes
the
versions
seen;
a
more
detailed
description
of
the
version
changes
is
provided
below.

Figure
4.
Dolphin
evolution
timeline

November
2021
–
version
2.0

Version
2.0
introduced
the
following
changes
to
the
version
found
in
April
2021:

• Dynamic
  resolution
  of
  suspicious
  APIs
  instead
  of
  static
  imports
  (for
  example
  
  GetAsyncKeyState)
  added
• Shellcode
  capability
  finished
  and
  improved
  • Persisted
    shellcode
    stored
    in
    files
    instead
    of
    registry
  • Persisted
    shellcode
    loaded
    and
    executed
    on
    Dolphin
    startup
    (previously
    missing)
• Portable
  device
  file
  exfiltration
  capability
  finished
  and
  improved
  • Exfiltration
    by
    extensions
    added
  • Recognition
    of
    internal
    memory
    and
    SD
    cards
    (from
    device
    ID)
    added
  • Command
    to
    get
    files
    from
    portable
    devices
    effectively
    a
    NOP
• Device/drive
  detection
  and
  file
  exfiltration
  improved
  • Dolphin
    now
    unconditionally
    creates
    directory
    listings
    and
    exfiltrates
    files
    by
    extension
    every
    30
    minutes
    for
    all
    drives
    and
    devices
    (fixed
    drives,
    removable
    drives,
    portable
    devices).
    Previously,
    it
    was
    just
    for
    removable
    drives;
    fixed
    drives
    were
    disabled
    by
    default
    and
    the
    code
    used
    for
    accessing
    portable
    devices
    was
    buggy
    and
    broken.

December
2021
–
version
2.2

Changes
introduced
in
version
2.2
focused
mainly
on
detection
evasion.
The
credential-stealing
capability
and
commands
related
to
it
–
the
credential
stealing
and
Google
account
commands
–
were
removed.
Most
strings
in
this
version
are
base64
encoded.

January
2022
–
version
3.0

In
version
3.0,
the
code
was
reorganized
and
classes
renamed,
with
capabilities
remaining
unchanged.
The
base64-encoded
strings
were
plaintext
again
in
this
version.
We
observed
the
following
additional
changes:

• Command
  to
  steal
  credentials
  restored
  in
  a
  different
  form;
  it
  now
  executes
  shellcode
  from
  the
  C&C
• Command
  to
  get
  files
  from
  portable
  devices
  completely
  removed
• Command
  to
  get
  files
  from
  drives
  is
  now
  cached/stored
  in
  the
  configuration
  until
  completion.
  If
  interrupted
  (for
  example
  by
  computer
  shutdown),
  it
  is
  done
  on
  the
  next
  run.
  This
  is
  also
  useful
  in
  the
  case
  of
  removable
  drives
  that
  may
  not
  be
  connected
  when
  the
  command
  is
  issued.
• Internet
  connection
  check
  added
  (https://www.microsoft.com);
  no
  malicious
  code
  is
  executed
  if
  offline

The
differences
between
versions
2.2
and
3.0,
especially
the
discrepancy
in
string
encoding,
suggest
the
possibility
that
the
versions
were
being
developed
in
parallel
by
different
people.

Conclusion

Dolphin
is
another
addition
to
ScarCruft’s
extensive
arsenal
of
backdoors
abusing
cloud
storage
services.
After
being
deployed
on
selected
targets,
it
searches
the
drives
of
compromised
systems
for
interesting
files
and
exfiltrates
them
to
Google
Drive.
One
unusual
capability
found
in
prior
versions
of
the
backdoor
is
the
ability
to
modify
the
settings
of
victims’
Google
and
Gmail
accounts
to
lower
their
security,
presumably
in
order
to
maintain
account
access
for
the
threat
actors.
During
our
analysis
of
multiple
versions
of
the
Dolphin
backdoor,
we
saw
continued
development
and
attempts
to
evade
detection.

IoCs

MITRE
ATT&CK
techniques

This
table
was
built
using

version
12
of
the
MITRE
ATT&CK
framework.

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts