Rewterz Threat Alert – Leviathan APT Campaign

Severity

Medium

Analysis Summary

An APT campaign targeting Malaysian users that they believe is being carried out by the Leviathan APT (aka ITG09, APT40). The initial lure document, likely sent via spear phishing emails. When opened, a remote template is downloaded in the background. The remote template, in turn, executes VBA macro code that is responsible for unpacking and executing two DLLs. The first DLL downloads a benign executable and a malicious DLL. The second DLL dropped by the VBA code runs the benign executable, which leads to the malicious DLL being executed due to DLL search order hijacking. The side-loaded DLL is a first-stage backdoor that downloads an additional file, decrypts it, executes it in memory, and deletes the downloaded file. Once running in memory, this additional file acts as a second-stage backdoor providing various capabilities, such as anti-debug checks, file discovery, upload, and download, establishing persistence, and command line execution. The C2 server is operated via dynamic DNS. Both the TTPs and string similarities within the payloads leads the researchers to believe this activity is being carried out by Leviathan.

Impact

• Exposure of sensitive data
• Information theft

Indicators of Compromise

SHA-256

• 523cbdaf31ddc920e5b6c873f3ab42fb791fb4c9d1f4d9e6a7f174105d4f72a1
• ab541df861c6045a17006969dac074a7d300c0a8edd0a5815c8b871b62ecdda7
• 145daf50aefb7beec32556fd011e10c9eaa71e356649edfce4404409c1e8fa30
• 93810c5fd9a287d85c182d2ad13e7d30f99df76e55bb40e5bc7a486d259810c8
• 925f404b0207055f2a524d9825c48aa511199da95120ed7aafa52d3f7594b0c9
• feca9ad5058bc8571d89c9d5a1eebce09e709cc82954f8dce1564e8cc6750a77
• 06a4246be400ad0347e71b3c4ecd607edda59fbf873791d3772ce001f580c1d3
• 77ef350639b767ce0a748f94f723a6a88609c67be485b9d8ff8401729b8003d2

Remediation

• Block all threat indicators at your respective controls.
• Always be suspicious about emails sent by unknown senders.
• Never click on the links/attachments sent by unknown senders
• Search for IOCs in your environment.