Rewterz Threat Alert – APT MustangPanda – Active IOCs

Severity

High

Analysis Summary

Researchers have identified recent Mustang Panda activity that involves the use of DLL side-loading to deliver PlugX. The initial infection vector is an executable downloaded from a remote URL. The executable is responsible for installing the malware by dropping the required files (a DLL loader, a legitimate binary, and the PlugX payload) onto the system. The legitimate binary is the Adobe CEF Helper and is vulnerable to DLL side-loading. When the installer runs the legitimate binary, the dropped DLL is loaded. This DLL is the loader for the final payload. First, it reads a hardcoded .dat file that contains the XOR key for decrypting the final payload, then it performs the decryption and loads the malware into memory. Once running in memory, the PlugX payload is able to decrypt its configuration data, which includes its installation location, the XOR key for C2 communication, and any C2 addresses and ports.

Impact

• Information Theft
• Exposure of Sensitive Data

Indicators of Compromise

File Name

• MOFCOM Constitution and policies zip
• SiteAdv[.]dll

IP

• 103[.]159[.]132[.]70

MD5

• e9101cee85038bb0f306ef83bc36523c
• 4efd3d2f09f17dae19f1d5b967ec9949

SHA-256

• 8f07bd408838182a0328ea44156ad47dd5b6ccdcfbd53209717d555ed69adedc
• 03c5f4cd4a0889f436cd1ac2634b2c76732ce7f280e294ab3a19e8c1e957f101

SHA-1

• 4a6edb973747bce4512f635a076cb47b1b934a83
• b8cd43f605eab84838ed36943752c4ffc167f647

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders