Tracking GhostNet: Investigating a Cyber ... - Nart Villeneuve

JR02-2009 Tracking GhostNet - PART TWO
37
The gh0st RAT tool attempts to connect to IP addresses of a DSL provider in Hainan, China:
• xxxxxxxxxxxx.broad.hk.hi.dynamic.163data.com.cn
• xxxxxxxxxxxx.broad.hk.hi.dynamic.163data.com.cn
• xxxxxxxxxxxx.broad.hk.hi.dynamic.163data.com.cn
• xxxxxxxxxxxx.broad.hk.hi.dynamic.163data.com.cn
• xxxxxxxxxxxx.broad.hk.hi.dynamic.163data.com.cn
• xxxxxxxxxxxx.broad.hk.hi.dynamic.163data.com.cn
After a successful connection, the attacker(s) proceed to issue commands on our infected
computer in real-time.
We found similar but unsuccessful connections to the same IP address range from some of the
infected computers we analysed and discovered that a rudimentary version of the web-based
administration interface contained only one infection from the same IP address range in Hainan.
In addition, one of the servers used to host the attacker(s)’ malicious files is a Government of
Hainan web server located in Hainan, and one of the control server interfaces we gained access
to is also located in Hainan. However, one should not rush to judgement concerning the identity
of the attacker(s) based on this location. The gh0st RAT software can be configured with a proxy
server; therefore it is possible that the attacker(s) were using a compromised system as a proxy to
hide their true location.
Command results
The Command Result page lists the commands issued through the Send Command page and the
status of those commands. Each entry in this interface shows what command was sent to the
infected computer, including the URL to the command server and the command file (the malicious
file disguised as an image). Upon the successful completion of a command, the relevant date, time,
and result are recorded. (See Fig. 11 - p. 38)
The Command Result page contains a column that displays the content sent back to the control
server from the infected computer. The command issued to retrieve this content in the Send
Command interface is labelled “Acquire System Information.” Even though we have been unable
to properly decode the content, 47 the plain text values in the binary content indicate that these
entries contain information about the infected computer (CPU, memory, operating system,
programmes installed) as well as file names of documents on the computer, presumably for later
retrieval. This information is likely used to determine which targets the attacker(s) will further
exploit and control using remote administration tools such as gh0st RAT.
47 The content is base64 encoded and XORed with values we have yet to identify.