DeathStalker Hacker Group’s New PowerPepper Malware Evade Antivirus Detection to Bypass Windows

Researchers uncovered a new Malvertising campaign PowerPepper from DeathStalker threat actor group that is active since 2012, and actively attacking various organizations around the world with financial motivation.

DeathStalker group does not fit under the traditional cybercrime group instead, researchers believe that the group is operating as a hack-for-hire service.

Attackers leveraged the anti-detection and antivirus evasion techniques to avoid detection and are used a method called “dead-drop resolvers” (DDRs) that helps attackers to host their obfuscated content hosted on major public web services like YouTube, Twitter, Reddit to target the victims.

PowerPepper considers a previously unknown implant that leveraged DNS over HTTPS as a C2 channel and spotted in wide that attacking various organizations in June 2020.

Attack using a spear phishing campaign to target the victims and using a Word document to drop the payload, and the malware has been continuously operating and developing.

PowerPepper Operation and Infection Process

Attackers cleverly operating the PowerPepper malware, and it is a Windows in-memory PowerShell backdoor that can execute remotely.

Also, it is leveraging various techniques such as detecting mouse movements, filtering the client’s MAC addresses, and adapting its execution flow to evade the AV detection and sandbox execution.

The command and control server using for this campaign based on the communications via DNS over HTTPS (DoH). inorder to establish a DoH request to a C2 server, PowerPepper initially tries to leverage Microsoft’s Excel as a Web client then comes back to PowerShell’s standard web client.

Attackers rely upon AES encryption to ensure the C2 communications content between the implant and servers is encrypted.

PowerPepper Delivery Chains

DeathStalker using two different types of Delivery Chain is Macro-based delivery chain and LNK-based delivery chain.

The macro-based delivery chain being uncovered back in July 2020 via a malicious Word document but the researchers unable to identify that how this malicious document has been distributed and believed that the item is either embedded as a spear-phishing email body or downloaded from a malicious link in a spear-phishing email as previously said.

According to Kaspersky’s report, the LNK-based delivery chain is a Windows shortcut file-based, and it is very much similar to macro-based, but there are two major changes.

  • the malicious macros logic is moved to malicious PowerShell scripts, and the first one is directly embedded in the shortcut file, so there are no more VBA macros;
  • the Word document from this chain is just a decoy and malicious files storage pack, and is downloaded from a remote location (a public file sharing service) instead of directly embedded somewhere.

There are 6 following tricks are used by this PowerPepper to perform the successful attacks which you can read detailed here.

  1. hide things in Word embedded shape properties (and make macro comments fun again)
  2.  use Windows Compiled HTML Help (CHM) files as archives for malicious files
  3. masquerade and obfuscate persistent files
  4. hide your implant between two ferns…
  5. get lost in Windows shell command translation
  6. kick start it all with a signed binary proxy execution

According to the tracking report, attackers are targeting several countries around the world, but the researchers could not precisely identify PowerPepper targets, but law and consultancy firms have been frequent targets of the actor.

Prevention Measures

  • Content hosts can regularly scan hosted files for malicious content, where regulations allow. 
  • Website owners and editors need to frequently and responsively update their CMS backends as well as associated plugins.
  • Ensure the protection on privileged and remote access, with client network address filtering, MFA and access logging on all backend endpoints.
  • Enterprise network users are strongly recommended to restrict script engine link PowerShell and  set up endpoint protection software on end-user computers and content servers.
  • Train employees and ensure them that they neveropen Windows shortcuts that were downloaded from a remote location or attached to an email, open attachments or click links in emails from unknown senders, or enable macros in documents from unverified sources.

Indicators of compromise

File hashes

IOCDescription
A4DD981606EA0497BF9995F3BC672951Malicious Word document (macro-based delivery chain)
871D64D8330D956593545DFFF069194EMalicious Word document (macro-based delivery chain)
81147EDFFAF63AE4068008C8235B34AFMalicious Windows shortcut (LNK-based delivery chain)
DFC2486DE9E0339A1B38BB4B9144EA83Malicious Word document (downloaded by LNK-based delivery chain)
74D7DF2505471EADEB1CCFC48A238AECMalicious CHM container
5019E29619469C74F2B826535C5A8BD8Malicious CHM container
B4790E70B1297215E0875CFC2A56648EMalicious CHM container
3A6099214F474C1501C110CE66033F3CMalicious VBS Loader
07308FBC3D10FD476F1898ECF6762437Malicious VBS Loader
1F77FBE4702F787A713D394B62D27B42Malicious VBS Loader
6E99F6DA77B0620E89F6E88D91198C32Malicious VBS Loader
5D04D246F3E5DA6A9347EC72494D5610Malicious startup launcher LNK
BA7AE1C73A78D8DC4B3779BD6A151791Malicious startup launcher LNK
1DC2B849A858BC479B1EF428491E0353Malicious startup launcher LNK
9D4066C57C6E1602CE33F15DC7F3841BPowerPepper steganography image (peppers)
6FF8A3D18A6EA930E87AC364379ECEC2PowerPepper steganography image (peppers)
871D64D8330D956593545DFFF069194EPowerPepper steganography image (peppers)
9CE299BBDD7FDBF9F30F8935C89D2877PowerPepper steganography image (ferns)
34F086AE78C5319FB64BF1CAE8204D1BPowerPepper steganography image (ferns)

Leave a Reply