DarkHydruns APT Group targets government entities in the middle eats with weaponized excel documents that delivers a new variant of RogueRobin trojan and can establish communication with C2 server through DNS tunnel and Google Drive API.
The campaign uses a weaponized Excel document with macro enabled(xlsm) to deliver the malware, once the user open the document and after clicking “Enable Content” the macro executes immediately.
Once the macro executed it drops a HTA(12-B-366.txt) in the temp directory, which will drops a pwershell script to “WINDOWSTEMP.ps1” and the powershell script concstenates several strings together to drop the backdoor “OfficeUpdateService”.
360’s Threat Intelligence Center first observed the campaign on January 9 and the backdoor developed through C# similar to the original RogueRobin payload.
According to Palo Alto Networks’ Unit 42 research, RogueRobin includes number of stealth functions that checks whether it is executed in the sandbox environment by checking for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system.
As like the previous versions of RogueRobin, it uses DNS tunnels to communicate with the C2 server and retrives command from the server. The C2 server responds to query types from Trojan with an unique identifier.
The new variant of RogueRobin uses alternative command and control channel that uses the Google Drive API for communicating with C2 server.
“RogueRobin uploads a file to the Google Drive account and continually checks the file’s modification time to see if the actor has made any changes to it. The actor will first modify the file to include a unique identifier that the Trojan will use for future communications.”
