eSentire Threat Intelligence Malware Analysis: PINGPULL RAT

PINGPULL is a Remote Access Tool (RAT) that is used as a new backdoor variant that allows threat actors to encrypt communications and provides admin-level control over the host devices. It has been known to target several public and private organizations across Russia, Europe, Southeast Asia, and Africa.

Backdoors provide attacker(s) with a number of advantages including: (a) remote access to the victim’s machine, (b) the ability to execute, upload, modify files on the victim’s machine, and (c) exfiltrate data to the attackers’ machine by encrypted communication channels. In addition, a backdoor allows the attacker(s) to hide in legitimate network traffic and circumvent perimeter defenses. Backdoors are typically installed after successfully compromising a system. A common infection vector for backdoors is through exploiting a vulnerability.

This malware analysis delves deeper into the technical details of how the PINGPULL RAT functions and our security recommendations to protect your organization from being exploited.

Case Study

On May 28^th, 2022, eSentire's Threat Response Unit (TRU) team was notified by a government partner about the new backdoor variant named PINGPULL. The new Remote Access Tool (RAT) comes in two versions – Internet Control Message Protocol (ICMP) and Hypertext Transfer Protocol (HTTP) and is being abused by an advanced persistent threat actor (APT) group to encrypt communications and perform administrative control over the hosts. The backdoor is known to target government and telecommunications industries based in Russia, Europe, Southeast Asia, and Africa. The initial access vector is known to be publicly available exploits for common vulnerabilities such as Log4j.

Technical Analysis of PINGPULL

The backdoor we analyzed is a lightweight 64-bit ICMP backdoor (MD5: 255dffb6d619ba7ffe5602e6ff64e03c) 113KB in size. The compiler date is Sep 10, 2021, which is the day after the first sample was submitted on VirusTotal from Vietnam.

The ICMP backdoor is using run-time dynamic linking to load the Dynamic Link Libraries (DLLs) and stack strings to evade detections (Figure 1). Dynamic linking is very common with malwares. Instead of accessing the libraries during the program startup, the malware can load the libraries during the runtime.

In our sample, the backdoor loads the Advapi32.dll library with the function LoadLibraryA, then it retrieves the address of functions (OpenSCManagerA, OpenServiceA) from the DLL by calling GetProcAddress function. The mentioned functions allow the backdoor to open or check for an existing service. If the service does not exist, PINGPULL leverages functions such as CreateServiceA and StartServiceA that creates and starts the service accordingly to maintain the persistence on the infected host (Figure 2).

The service name created is Iph1psvc and the display name used to identify the service is IP He1per with the description shown in Figure 3.

It should be noted that the backdoor is trying to masquerade itself under a legitimately looking service iphlpsvc (IP Helper) by changing a few characters. The legitimate iphlpsvc service is also known as an Internet Protocol helper service that allows the users to configure and modify network configuration (Figure 4). The malicious service points to the backdoor executable in the binary path.

PINGPULL can create and terminate the processes by leveraging the CreateProcessA, CreateProcessAsUserA (this function allows the process to be run in a security context of the specific user), and TerminateProcess functions.

The backdoor has an anti-debugging check. If the sample detects the debugger, it terminates the process (Figure 5).

The malware can also modify or change the timestamp of the created file by using SystemTimeToFileTime function to retrieve the FILETIME and SYSTEMTIME structures. With the handle to the created file obtained via CreateFileA API and FILETIME structure, the backdoor can leverage SetFileTime function to modify the timestamp, this technique is also known as timestomping (Figure 6).

FILETIME structure:

typedef struct _FILETIME {
  DWORD dwLowDateTime;
  DWORD dwHighDateTime;
} FILETIME, *PFILETIME, *LPFILETIME;

SYSTEMTIME structure:

typedef struct _SYSTEMTIME {
  WORD wYear;
  WORD wMonth;
  WORD wDayOfWeek;
  WORD wDay;
  WORD wHour;
  WORD wMinute;
  WORD wSecond;
  WORD wMilliseconds;
} SYSTEMTIME, *PSYSTEMTIME, *LPSYSTEMTIME;

PINGPULL, like other RATs, is able to manipulate the files and directories by creating and deleting directories and files, and through file copy, file move, and file enumeration.

The backdoor creates the directory using SHCreateDirectoryExA function after performing the checks if the directory already exists. If the error code returns 80 (ERROR_FILE_EXISTS) and 183 (ERROR_ALREADY_EXISTS), the error exception is thrown (Figure 7).

PINGPULL performs drive enumeration from A to Z by using the BITTEST function that returns the value of a specific bit in a binary value. GetLogicalDrives function returns the bitmask that represents available disk drives: Bit position 0 represents drive A, bit position 1 represents drive B, and so on (Figure 8).

Command and Control (C2) Communication

The backdoor utilizes recvfrom() and sendto() functions to receive and send data on sockets over ICMP communication. Within the function responsible for communication with the C2 server, the backdoor retrieves the hostname of the infected computer and the IP address by leveraging GetComputerNameA and gethostbyname() functions.

The ICMP connections are initialized every one second with the C2 server using the following query codes:

• Type 0 = Echo Reply
• Type 8 = Echo Request

The observed ping requests sent to C2 server are 121 bytes in length including 79 bytes of payload data. The data is being sent out has the following format:

PROJECT_<backdoor_name>_<hostname>_<hexadecimal_value_of_the_IP>
total=0
current=0 

• - the name of the backdoor executable
• - system name
• - hexadecimal value of the IP address, for example the value 0xC0A80A0C which represents 192.168.10.12.

The total and current parameters are likely used for the amount of data being transferred over an active communication channel with the C2 server.

ICMP tunneling (covert communication between two hosts using echo request and echo reply) is used by the backdoor to evade detections, since it does not require ports for communications, the analysts will not be able to detect the suspicious connections by running the commands to display network connections such as netstat. ICMP tunnelling can be detected by thoroughly inspecting network traffic with tools like Wireshark. It’s worth mentioning that the attacker(s) can also encrypt the ICMP payloads for evasion purposes.

PINGPULL is leveraging Microsoft Enhanced RSA and AES Cryptographic Provider to encrypt ICMP payloads with AES and RSA algorithms as shown in Figure 9.

The HTTPs version of the backdoor (MD5: 61496042ac5d53a99dcf52a0fde41867) is also using Microsoft Enhanced RSA and AES Cryptographic Provider to encrypt the traffic, it also appends the user-agent Mozilla/4.0 (compatible) to the POST requests.

The filenames used by the backdoor:

• ru.youta.exe
• sqlservers.exe
• khcamgsm.exe
• ServerMannger.exe

How eSentire is Responding

Our Threat Response Unit (TRU) combines threat intelligence obtained from research and security incidents to create positive security outcomes for our customers. We are taking a holistic response approach to combat modern cybersecurity threats by deploying countermeasures, such as:

• Implementing threat detections to identify malicious command execution and exploitation attempts, as well as ensuring that eSentire has visibility, and detections in place across eSentire MDR for Endpoint and MDR for Network.

• Performing global threat hunts for indicators associated with PINGPULL across our global customer base.

Our detection content is supported by investigation runbooks, ensuring our 24/7 Cyber SOC Analysts respond rapidly to any intrusion attempts related to a known malware Tactics, Techniques, and Procedures (TTPs). In addition, TRU closely monitors the threat landscape and constantly addresses capability gaps and conducts retroactive threat hunts to assess customer impact.

Recommendations from eSentire’s Threat Response Unit (TRU) 

We recommend implementing the following controls to help secure your organization against the PINGPULL RAT:

• Confirm that all devices are protected with Endpoint Detection and Response (EDR) solutions.
• Address security issues in Active Directory: thoroughly review and secure SYSVOL permissions, patch any known vulnerabilities, and implement Least-Privilege Administrative Models.

• Implement a comprehensive vulnerability management program that includes continuous awareness of the threat landscape, vulnerability scanning to understand which systems are inadvertently exposed, and disciplined patch management.
  • Prioritize the patching of any external-facing devices and applications on an ongoing basis.
  • Conduct regular vulnerability scans to ensure your team is staying on top of patching and identifying all known vulnerabilities.

While the TTPs used by adversaries grow in sophistication, they lead to a certain level of difficulties at which critical business decisions must be made. Preventing the various attack paths utilized by threat actor(s) requires actively monitoring the threat landscape, developing, and deploying endpoint detection, and the ability to investigate logs & network data during active intrusions.

eSentire’s TRU is a world-class team of threat researchers who develop new detections enriched by original threat intelligence and leverage new machine learning models that correlate multi-signal data and automate rapid response to advanced threats.

If you are not currently engaged with an MDR provider, eSentire MDR can help you reclaim the advantage and put your business ahead of disruption.

Learn what it means to have an elite team of Threat Hunters and Researchers that works for you. Connect with an eSentire Security Specialist.

Appendix

• https://docs.microsoft.com/en-us/windows/win32/api/
• https://attack.mitre.org/techniques/T1070/006/

Indicators of Compromise

Yara Rules

import "pe"
rule PINGPULL_backdoor {
    meta:
        author = "eSentire TI"
        date = "05/24/2022"
        version = "1.0"
    strings:
        $a1 = {68 69 6E 69 74 69 61 6C 2E 63 6F 6D}
        $a2 = {50 52 4F 4A 45 43 54 5F 25 73 5F 25 73 5F}
        $a3 = {74 6F 74 61 6C 3D}
        $a4 = {49 50 20 48 65 31 70 65 72}
        $a5 = "Iph1psvc"
    condition:
        3 of ($a*) and (filesize<200KB)
        and (uint16(0) == 0x5A4D or uint32(0) == 0x4464c457f)    
}