What We Do
How We Do
Resources
Company
Partners
Get Started
Blog

eSentire Threat Intelligence Malware Analysis: PINGPULL RAT

BY eSentire Threat Response Unit (TRU)

June 20, 2022 | 9 MINS READ

Attacks/Breaches

Threat Intelligence

Threat Response Unit

TRU Positive/Bulletin

Want to learn more on how to achieve Cyber Resilience?

TALK TO AN EXPERT

IN THIS POST

PINGPULL is a Remote Access Tool (RAT) that is used as a new backdoor variant that allows threat actors to encrypt communications and provides admin-level control over the host devices. It has been known to target several public and private organizations across Russia, Europe, Southeast Asia, and Africa.

Backdoors provide attacker(s) with a number of advantages including: (a) remote access to the victim’s machine, (b) the ability to execute, upload, modify files on the victim’s machine, and (c) exfiltrate data to the attackers’ machine by encrypted communication channels. In addition, a backdoor allows the attacker(s) to hide in legitimate network traffic and circumvent perimeter defenses. Backdoors are typically installed after successfully compromising a system. A common infection vector for backdoors is through exploiting a vulnerability.

This malware analysis delves deeper into the technical details of how the PINGPULL RAT functions and our security recommendations to protect your organization from being exploited.

Key Takeaways

  • PINGPULL comes with ICMP and HTTPs backdoors; both versions of backdoors provide the payload encryption using AES and RSA algorithms.
  • Persistence mechanism is achieved via service creation.
  • The backdoor has multiple functionalities including timestomping*, file, directory creation and deletion, file copy, file move, disk drive enumeration, file enumeration.
    • Timestomping is an anti-forensics technique used to modify the timestamps of a file, often to mimic files that are in the same folder.
  • PINGPULL backdoor has anti-debugging and evasion techniques.
  • To secure your organization against PINGPULL, eSentire’s Threat Response Unit (TRU) team recommends:

Case Study

On May 28th, 2022, eSentire's Threat Response Unit (TRU) team was notified by a government partner about the new backdoor variant named PINGPULL. The new Remote Access Tool (RAT) comes in two versions – Internet Control Message Protocol (ICMP) and Hypertext Transfer Protocol (HTTP) and is being abused by an advanced persistent threat actor (APT) group to encrypt communications and perform administrative control over the hosts. The backdoor is known to target government and telecommunications industries based in Russia, Europe, Southeast Asia, and Africa. The initial access vector is known to be publicly available exploits for common vulnerabilities such as Log4j.

Technical Analysis of PINGPULL

The backdoor we analyzed is a lightweight 64-bit ICMP backdoor (MD5: 255dffb6d619ba7ffe5602e6ff64e03c) 113KB in size. The compiler date is Sep 10, 2021, which is the day after the first sample was submitted on VirusTotal from Vietnam.

The ICMP backdoor is using run-time dynamic linking to load the Dynamic Link Libraries (DLLs) and stack strings to evade detections (Figure 1). Dynamic linking is very common with malwares. Instead of accessing the libraries during the program startup, the malware can load the libraries during the runtime.

Figure 1: Run-time dynamic linking and stack strings


In our sample, the backdoor loads the Advapi32.dll library with the function LoadLibraryA, then it retrieves the address of functions (OpenSCManagerA, OpenServiceA) from the DLL by calling GetProcAddress function. The mentioned functions allow the backdoor to open or check for an existing service. If the service does not exist, PINGPULL leverages functions such as CreateServiceA and StartServiceA that creates and starts the service accordingly to maintain the persistence on the infected host (Figure 2).

Figure 2: Leveraging Advapi32.dll to create and start the service


The service name created is Iph1psvc and the display name used to identify the service is IP He1per with the description shown in Figure 3.

Figure 3: Service creation and description


It should be noted that the backdoor is trying to masquerade itself under a legitimately looking service iphlpsvc (IP Helper) by changing a few characters. The legitimate iphlpsvc service is also known as an Internet Protocol helper service that allows the users to configure and modify network configuration (Figure 4). The malicious service points to the backdoor executable in the binary path.

Figure 4: The backdoor is attempting to masquerade under a legitimate service


PINGPULL can create and terminate the processes by leveraging the CreateProcessA, CreateProcessAsUserA (this function allows the process to be run in a security context of the specific user), and TerminateProcess functions.

The backdoor has an anti-debugging check. If the sample detects the debugger, it terminates the process (Figure 5).

Figure 5: Anti-debugging check


The malware can also modify or change the timestamp of the created file by using SystemTimeToFileTime function to retrieve the FILETIME and SYSTEMTIME structures. With the handle to the created file obtained via CreateFileA API and FILETIME structure, the backdoor can leverage SetFileTime function to modify the timestamp, this technique is also known as timestomping (Figure 6).

FILETIME structure:

typedef struct _FILETIME {
  DWORD dwLowDateTime;
  DWORD dwHighDateTime;
} FILETIME, *PFILETIME, *LPFILETIME;

SYSTEMTIME structure:

typedef struct _SYSTEMTIME {
  WORD wYear;
  WORD wMonth;
  WORD wDayOfWeek;
  WORD wDay;
  WORD wHour;
  WORD wMinute;
  WORD wSecond;
  WORD wMilliseconds;
} SYSTEMTIME, *PSYSTEMTIME, *LPSYSTEMTIME;
Figure 6: Timestomping capabilities


PINGPULL, like other RATs, is able to manipulate the files and directories by creating and deleting directories and files, and through file copy, file move, and file enumeration.

The backdoor creates the directory using SHCreateDirectoryExA function after performing the checks if the directory already exists. If the error code returns 80 (ERROR_FILE_EXISTS) and 183 (ERROR_ALREADY_EXISTS), the error exception is thrown (Figure 7).

Figure 7: Directory creation


PINGPULL performs drive enumeration from A to Z by using the BITTEST function that returns the value of a specific bit in a binary value. GetLogicalDrives function returns the bitmask that represents available disk drives: Bit position 0 represents drive A, bit position 1 represents drive B, and so on (Figure 8).

Figure 8: Drive enumeration

Command and Control (C2) Communication

The backdoor utilizes recvfrom() and sendto() functions to receive and send data on sockets over ICMP communication. Within the function responsible for communication with the C2 server, the backdoor retrieves the hostname of the infected computer and the IP address by leveraging GetComputerNameA and gethostbyname() functions.

The ICMP connections are initialized every one second with the C2 server using the following query codes:

The observed ping requests sent to C2 server are 121 bytes in length including 79 bytes of payload data. The data is being sent out has the following format:

PROJECT_<backdoor_name>_<hostname>_<hexadecimal_value_of_the_IP>
total=0
current=0 

The total and current parameters are likely used for the amount of data being transferred over an active communication channel with the C2 server.

ICMP tunneling (covert communication between two hosts using echo request and echo reply) is used by the backdoor to evade detections, since it does not require ports for communications, the analysts will not be able to detect the suspicious connections by running the commands to display network connections such as netstat. ICMP tunnelling can be detected by thoroughly inspecting network traffic with tools like Wireshark. It’s worth mentioning that the attacker(s) can also encrypt the ICMP payloads for evasion purposes.

PINGPULL is leveraging Microsoft Enhanced RSA and AES Cryptographic Provider to encrypt ICMP payloads with AES and RSA algorithms as shown in Figure 9.

Figure 9: The backdoor is using Microsoft Enhanced RSA and AES Cryptographic Provider to encrypt the payloads


The HTTPs version of the backdoor (MD5: 61496042ac5d53a99dcf52a0fde41867) is also using Microsoft Enhanced RSA and AES Cryptographic Provider to encrypt the traffic, it also appends the user-agent Mozilla/4.0 (compatible) to the POST requests.

The filenames used by the backdoor:

How eSentire is Responding

Our Threat Response Unit (TRU) combines threat intelligence obtained from research and security incidents to create positive security outcomes for our customers. We are taking a holistic response approach to combat modern cybersecurity threats by deploying countermeasures, such as:

Our detection content is supported by investigation runbooks, ensuring our 24/7 Cyber SOC Analysts respond rapidly to any intrusion attempts related to a known malware Tactics, Techniques, and Procedures (TTPs). In addition, TRU closely monitors the threat landscape and constantly addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from eSentire’s Threat Response Unit (TRU) 

We recommend implementing the following controls to help secure your organization against the PINGPULL RAT:

While the TTPs used by adversaries grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack paths utilized by threat actor(s) requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.

eSentire’s TRU is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Appendix

Indicators of Compromise

Name Indicators
ICMP Backdoor b4dd22013aefae6f721f0b67be61dc91
ICMP Backdoor 1a96767957e193c45b1bf642f3293350
ICMP Backdoor d58c5fe6a5b5b3d494bae50d1df310f5
HTTPs Backdoor 61496042ac5d53a99dcf52a0fde41867
HTTPs Backdoor 7e01d776a0eb044a11bf91f3a68ce6f5
C2 v2[.]hinitial[.]com
C2 v3[.]hinitial[.]com
C2 v4[.]hinitial[.]com
C2 t1[.]hinitial[.]com
C2 hinitial[.]com
C2 df[.]micfkbeljacob[.]com
C2 jack[.]micfkbeljacob[.]com
C2 affidavits7[.]exportadoralambari[.]com

Yara Rules

import "pe"
rule PINGPULL_backdoor {
    meta:
        author = "eSentire TI"
        date = "05/24/2022"
        version = "1.0"
    strings:
        $a1 = {68 69 6E 69 74 69 61 6C 2E 63 6F 6D}
        $a2 = {50 52 4F 4A 45 43 54 5F 25 73 5F 25 73 5F}
        $a3 = {74 6F 74 61 6C 3D}
        $a4 = {49 50 20 48 65 31 70 65 72}
        $a5 = "Iph1psvc"
    condition:
        3 of ($a*) and (filesize<200KB)
        and (uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f)    
}
eSentire Threat Response Unit (TRU)
eSentire Threat Response Unit (TRU)

The eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your organization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7 Security Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and works as an extension of your security team to continuously improve our Managed Detection and Response service. By providing complete visibility across your attack surface and performing global threat sweeps and proactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending your organization against known and unknown threats.

Read the Latest from eSentire