Moshen Dragon Side Loads Asia

The Malicious activities of Moshen Dragon came into the limelight targeting telecommunication service providers in Central Asia. There persisted few similarities between this new threat organization and RedFoxtrot and Nomad Panda.

Sentinel Labs says Moshen Dragon is a proficient hacking gang capable of modifying its approach based on the protections they’re up against. The hackers spend a lot of time attempting to sideload malicious Windows DLLs into antivirus programs, steal passwords to move laterally, and exfiltrate data from affected PCs.

Advertisements

Since the infection vector is unclear, Sentinel Lab focuses on antivirus misuse, which includes TrendMicro, Bitdefender, McAfee, Symantec, and Kaspersky products.

In general, antivirus programs operate with elevated capabilities on Windows, sideloading a malicious DLL onto their processes allows hackers to run malware on the computer with minimal constraints and perhaps avoid detection.

Impacket, a Python package designed to permit lateral movement and remote code execution via WMI, is deployed in this way by Moshen Dragon. Impacket also aids credential theft by adding an open-source program that logs the details of password change events on a domain in the “C:\Windows\Temp\Filter.log” file.

The threat group installs a passive loader that verifies that it is on the correct machine before activating by comparing the hostname to a hardcoded value. The threat actor creates a new DLL for the devices it targets, demonstrating its skill and diligence.

The loader intercepts incoming data with the WinDivert packet sniffer until it finds the string necessary for self-decryption, then unpacks and launches the payload (SNAC.log or bdch.tmp). The payloads contain PlugX and ShadowPad versions, two backdoors that several Chinese APTs have employed in recent times. The threat actor’s ultimate purpose is to steal data from as many systems as feasible.