US-CERT- TA17-318A: HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL

[Netwörkheäd]

TA17-318A: HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL

[html]Original release date: November 14, 2017 | Last revised: November 22, 2017

      

Systems Affected

      

Network systems

      
      

Overview

      

This joint Technical Alert (TA) is the result of analytic efforts between the Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI). Working with U.S. government partners, DHS and FBI identified Internet Protocol (IP) addresses and other indicators of compromise (IOCs) associated with a remote administration tool (RAT) used by the North Korean government—commonly known as FALLCHILL. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on HIDDEN COBRA activity, visit https://www.us-cert.gov/hiddencobra">https://www.us-cert.gov/hiddencobra.

FBI has high confidence that HIDDEN COBRA actors are using the IP addresses—listed in this report's IOC files—to maintain a presence on victims' networks and to further network exploitation. DHS and FBI are distributing these IP addresses to enable network defense and reduce exposure to any North Korean government malicious cyber activity.

This alert includes IOCs related to HIDDEN COBRA, IP addresses linked to systems infected with FALLCHILL malware, malware descriptions, and associated signatures. This alert also includes suggested response actions to the IOCs provided, recommended mitigation techniques, and information on reporting incidents. If users or administrators detect activity associated with the FALLCHILL malware, they should immediately flag it, report it to the DHS National Cybersecurity and Communications Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and give it the highest priority for enhanced mitigation.

For a downloadable copy of IOCs, see:

• IOCs (https://www.us-cert.gov/sites/default/files/publications/TA-17-318A-IOCs.csv">.csv)
• IOCs (https://www.us-cert.gov/sites/default/files/publications/TA-17-318A-IOCs.xml">.stix)

NCCIC conducted analysis on two samples of FALLCHILL malware and produced a Malware Analysis Report (MAR). MAR-10135536-A examines the tactics, techniques, and procedures observed in the malware. For a downloadable copy of the MAR, see:

• MAR (https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-A_WHITE_S508C.pdf">.pdf)
• MAR IOCs (https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-A_WHITE_stix.xml">.stix)

      
      

Description

      

According to trusted third-party reporting, HIDDEN COBRA actors have likely been using FALLCHILL malware since 2016 to target the aerospace, telecommunications, and finance industries. The malware is a fully functional RAT with multiple commands that the actors can issue from a command and control (C2) server to a victim's system via dual proxies. FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware or as a file downloaded unknowingly by users when visiting sites compromised by HIDDEN COBRA actors. HIDDEN COBRA actors use an external tool or dropper to install the FALLCHILL malware-as-a-service to establish persistence. Because of this, additional HIDDEN COBRA malware may be present on systems compromised with FALLCHILL.

During analysis of the infrastructure used by FALLCHILL malware, the U.S. Government identified 83 network nodes. Additionally, using publicly available registration information, the U.S. Government identified the countries in which the infected IP addresses are registered.

Technical Details

FALLCHILL is the primary component of a C2 infrastructure that uses multiple proxies to obfuscate network traffic between HIDDEN COBRA actors and a victim's system. According to trusted third-party reporting, communication flows from the victim's system to HIDDEN COBRA actors using a series of proxies as shown in figure 1.

https://www.us-cert.gov/sites/default/files/publications/alert-graphic-01.png" style="width: 786px; height: 191px;" />

Figure 1. HIDDEN COBRA Communication Flow

FALLCHILL uses fake Transport Layer Security (TLS) communications, encoding the data with RC4 encryption with the following key: [0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82]. FALLCHILL collects basic system information and beacons the following to the C2:

• operating system (OS) version information,
• processor information,
• system name,
• local IP address information,
• unique generated ID, and
• media access control (MAC) address.

FALLCHILL contains the following built-in functions for remote operations that provide various capabilities on a victim's system:

• retrieve information about all installed disks, including the disk type and the amount of free space on the disk;
• create, start, and terminate a new process and its primary thread;
• search, read, write, move, and execute files;
• get and modify file or directory timestamps;
• change the current directory for a process or file; and
• delete malware and artifacts associated with the malware from the infected system.

Detection and Response

This alert's IOC files provide HIDDEN COBRA indicators related to FALLCHILL. DHS and FBI recommend that network administrators review the information provided, identify whether any of the provided IP addresses fall within their organizations' allocated IP address space, and—if found—take necessary measures to remove the malware.

When reviewing network perimeter logs for the IP addresses, organizations may find instances of these IP addresses attempting to connect to their systems. Upon reviewing the traffic from these IP addresses, system owners may find some traffic relates to malicious activity and some traffic relates to legitimate activity.

Network Signatures and Host-Based Rules

This section contains network signatures and host-based rules that can be used to detect malicious activity associated with HIDDEN COBRA actors. Although created using a comprehensive vetting process, the possibility of false positives always remains. These signatures and rules should be used to supplement analysis and should not be used as a sole source of attributing this activity to HIDDEN COBRA actors.

Network Signatures

alert tcp any any -> any any (msg:"Malicious SSL 01 Detected";content:"|17 03 01 00 08|";