ShadowPad Modular Malware Platform Used by Chinese Hackers in High-profile Attacks

A very sophisticated and modular backdoor, ShadowPad has been discovered recently by the cybersecurity analysts of Pwc and Secureworks security firm that is actively used by the Chinese threat actors to perform high-profile attacks.

This sophisticated malware came into the spotlight in the year 2017, and it caught the eyes of the security analysts when the malware has been used in two software supply-chain.

While this sophisticated malware is being decrypted by the hackers in the memory using a custom decryption algorithm.

Who is Bronze Atlas, aka Barium?

This group is known under different names in the industry of security, and that’s why we have listed the names that are detected:-

• APT41
• Axiom
• Barium
• Wicked Panda
• Winnti

The APT41 has executed different kinds of attacks and has attacked several organizations. In the initial stage of the ShadowPad attack, the threat actors have been traced as Bronze Atlas, aka Barium.

ShadowPad

After doing a proper investigation it’s been asserted that the ShadowPad is a RAT that is being used by the threat actors to implement shell commands and extra payloads.

The threat actors have initiated the attacks, where the ShadowPad is being processed on the infected or compromised systems of their targets.

So, there is no doubt that ShadowPad is deployed through a method known as DLL sideloading, and here the threat actors generally deliver all kinds of malicious code as a DLL.

Malicious DLL loader

However, the malicious DLL loader exports one apparently function named “log” this function generally helps to write a given string to %TEMP%\log.txt, and not only this, but it also does the exporting in its entry point function.

• SHA-256: a8e5a1b15d42c4da97e23f5eb4a0adfd29674844ce906a86fa3554fc7e58d553
• Filename: log.dll
• File type: Win32 DLL
• File size: 209,408 bytes
• Compilation timestamp: 31/07/2020 08:08:43

Encoding algorithm

While there are some encoding algorithms, which is a stream cipher that generally takes a 32-bit value. Not only this, but we have mentioned the encoding algorithm below:-

• Multiplies the current seed by 17;
• Subtracts the 32-bit constant value 0x443246ba from the seed;
• Stocks the result as the seed for the next iteration; and,
• Aggregates each byte of the resultant seed to give the final XOR byte to utilize with the current encoded byte.

This type of malware payload is generally deployed to a host either encrypted within the DLL loader or embedded inside a separate file along with a DLL loader.

These types of attacks are quite popular, and sophisticated dues to which they do a lot of damage too. So, in this, it is very important to stay alerted and protected from this kind of malware attack.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates.