Rewterz Threat Alert – Hard Pass: Declining APT34’s Invite to Join Their Professional Network

Severity

High

Analysis Summar

A phishing campaign conducted by APT34, an Iranian-nexus threat actor. Three key attributes caught with this particular campaign:

• Masquerading as a member of Cambridge University to gain victims’ trust to open malicious documents,

• The usage of LinkedIn to deliver malicious documents,

• The addition of three new malware families to APT34’s arsenal.

A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests, TONEDEAF supports collecting system information, uploading and downloading of files, and arbitrary shell command execution. When executed, this variant of TONEDEAF wrote encrypted data to two temporary files – temp.txt and temp2.txt – within the same directory of its execution.

Retracing the steps preceding exploit detection, it was identified that System.doc was dropped by a file named ERFT-Details.xls. Combining endpoint- and network-visibility, to correlate that ERFT-Details.xls originated from the URL http://www.cam-research-ac[.]com/Documents/ERFT-Details.xls. Network evidence also showed the access of a LinkedIn message directly preceding the spreadsheet download.

Impact

• Arbitrary shell command execution
• Exposure of sensitive information

Indicators of Compromise

IP(s) / Hostname(s)

185[.]15[.]247[.]154

URLs

• http[:]//185[.]15[.]247[.]154/free/second[.]php
• http[:]//185[.]15[.]247[.]154/free/uploadFiles/
• http[:]//offlineearthquake[.]com/
• http[:]//offlineearthquake[.]com/download?id=bom&n=000
• http[:]//offlineearthquake[.]com/download?id=bov&n=000
• http[:]//offlineearthquake[.]com/download?id=LXq&n=000
• http[:]//offlineearthquake[.]com/file/6H3/P86[.]dll?id=Zwh&n=000
• http[:]//offlineearthquake[.]com/upload?id=bwd&n=
• http[:]//www[.]cam-research-ac[.]com/Documents/Cambridge_employment_form[.]zip
• offlineearthquake[.]com
• www[.]cam-research-ac[.]com
• c[.]cdn-edge-akamai[.]com
• cam-research-ac[.]com

Malware Hash (MD5/SHA1/SH256)

• 021a0f57fe09116a43c27e5133a57a0a
• 2175299818a00a5dbcc1d96c3ef4cdca4e94052a22f08fcf8e982d0548a7bff0
• 50fb09d53c856dcd0782e1470eaeae35
• 6eca9c2b7cf12c247032aae28419319e
• 9fff498b78d9498b33e08b892148135f
• b338baa673ac007d7af54075ea69660b
• caf418cbf6a9c4e93e79d4714d5d3b87
• d8abe843db508048b4d4db748f92a103

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders.