Article Content Malware Analysis Before we begin the analyses, I’d like to clarify on some of the terms used Stage1 - Typically the first contact or entry point for malware.  This is the first part of the malware to arrive on a system SMB Malware - Any malware that uses the SMB protocol to spread.  SMB is typically used for file sharing between printers and other computers, however in recent years malware authors have been able to leverage this protocol to remotely infect hosts RAT - Remote Access Trojan.  This type of malware allows for the complete control of an infected computer Gh0stRAT - An open source RAT used primarily by Chinese actors A more detailed analysis of the standard Gh0stRAT can be found here Despite being a Gh0stRAT sample, this variant is very different than your standard Gh0stRAT sample.  One of the most noticeable differences is the use of encryption over the entire TCP segment, as a way for it to evade detection.  Additionally, this seems to be a lightweight version of Gh0stRAT, as it only has 12 commands, compared to the 73 for a full Gh0stRAT sample; 3 of those commands are undocumented.  Also, unlike most samples that I receive on my honeypot, this sample did not start as a DLL that communicates to a distribution server in order to download the stage1.  Instead, dropped on my honeypot was a full exe that served as the dropper Network Traffic Format During my analysis of the sample,  I was able to enumerate not only the opcode commands, but also the format of the proprietary protocol, allowing me to send my own commands to the sample.  First, just like the Gh0st in the dshell paper from SANS, the decrypted protocol consists of a 5 byte header (ngLGX), a 4byte packet length field, and finally another 4 byte uncompressed length field.  This is where the similarity ends as the Opcode and the data are compressed using ZLib, instead of just the data.  Additionally, the entire packet is encrypted with an algorithm making visual analysis of the Wireshark data challenging.  However, as the packet header is static, you can use the encrypted header as an identifier, like I did in my script.  The encrypted header is: “\xEA\xEE\xCC\xD3\xB8” and is unchanged throughout the malware’s runthrough Available Opcodes As this sample is more of a lightweight version of Gh0stRAT, it only uses 12 commands, which are below along with their corresponding opcodes Opcode   Function Number   Name     0x00   0   Command_Actived     0x01   1   Command_Keylog_offline     0x02   1   Command_Keylog_offline     0x10   1   Command_Keylog_offline     0x1A   1   Command_Keylog_offline     0x1F   1   Command_Keylog_offline     0x20   1   Command_Keylog_offline     0x21   2   Command_Session     0x22   3   Command_Remove     0x23   4   Command_Down_Exec     0x24   5   Command_Update_Server     0x25   6   Command_Clean_Event     0x26   7   Command_Open_URL_Hide     0x27   8   Command_Open_URL_Show     0x28   9   Command_Rename_Host     0x2a   10   Command_Rename_Remark     0x2b   11   Command_Execute     0x2c   12   Command_Create&Inject     0x2d   1   Command_Keylog_offline     0x45   1   Command_Keylog_offline     0x49   1   Command_Keylog_offline     Command Definitions While I tried to make the command names easily understandable based on the name, I will take some time to explain what each of the commands do: Command_Actived: Uses InterlockedExchange to activate/deactivate the sample Command_Session:  This command was the first command that I enumerated and first obtains the SeShutdownPrivilege before calling ExitWindowsEx to perform a variety of tasks, based on the data segment(It is treated as a flag) of the Gh0stRAT protocol Command Option   Flag     EWX_Logoff   0x00     EWX_Shutdown   0x01     EWX_Reboot   0x02     EWX_Poweroff   0x08     EWX_RestartApps   0x40     EWX_HybridShutdown   0x00400000     Command_Remove: This command takes filenames as an argument and searches for the filename before deleting it from the system Command_Open_URL_Hide:   This command covertly opens a supplied URL Command_Open_URL_Show:  Using Internet Explorer, this command takes a URL as an argument and opens a new Internet Explorer session, connecting to the supplied URL *Command_Rename_Host: This command opens the malware’s Services key and adds the term “Host” to the Key Command_Rename_Remark:  This command opens the malware’s Services key and adds the term “Remark” to the Key *Command_Execute: This command executes a dropped file (n.d.) Gh0st in the dshell (Tech.) Sans Rights to tools Screenshot 1 was created using  Wireshark.  Wireshark uses the GNU Public License V2 Screenshot 2 was created using GHIDRA, an open source tool released by the NSA Screenshot 3 was created using wxHexEditor.  wxHexEditor uses the GNU Public License V2 Screenshot 4 was created using a tool that I wrote.  I give AT&T and its affiliates permission to use my tool.
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: Article Content Malware Analysis Before we begin the analyses, I’d like to clarify on some of the terms used Stage1 - Typically the first contact or entry point for malware.  This is the first part of the malware to arrive on a system SMB Malware - Any malware that uses the SMB protocol to spread.  SMB is typically used for file sharing between printers and other computers, however in recent years malware authors have been able to leverage this protocol to remotely infect hosts RAT - Remote Access Trojan.  This type of malware allows for the complete control of an infected computer Gh0stRAT - An open source RAT used primarily by Chinese actors A more detailed analysis of the standard Gh0stRAT can be found here Despite being a Gh0stRAT sample, this variant is very different than your standard Gh0stRAT sample.  One of the most noticeable differences is the use of encryption over the entire TCP segment, as a way for it to evade detection.  Additionally, this seems to be a lightweight version of Gh0stRAT, as it only has 12 commands, compared to the 73 for a full Gh0stRAT sample; 3 of those commands are undocumented.  Also, unlike most samples that I receive on my honeypot, this sample did not start as a DLL that communicates to a distribution server in order to download the stage1.  Instead, dropped on my honeypot was a full exe that served as the dropper Network Traffic Format During my analysis of the sample,  I was able to enumerate not only the opcode commands, but also the format of the proprietary protocol, allowing me to send my own commands to the sample.  First, just like the Gh0st in the dshell paper from SANS, the decrypted protocol consists of a 5 byte header (ngLGX), a 4byte packet length field, and finally another 4 byte uncompressed length field.  This is where the similarity ends as the Opcode and the data are compressed using ZLib, instead of just the data.  Additionally, the entire packet is encrypted with an algorithm making visual analysis of the Wireshark data challenging.  However, as the packet header is static, you can use the encrypted header as an identifier, like I did in my script.  The encrypted header is: “\xEA\xEE\xCC\xD3\xB8” and is unchanged throughout the malware’s runthrough Available Opcodes As this sample is more of a lightweight version of Gh0stRAT, it only uses 12 commands, which are below along with their corresponding opcodes Opcode   Function Number   Name     0x00   0   Command_Actived     0x01   1   Command_Keylog_offline     0x02   1   Command_Keylog_offline     0x10   1   Command_Keylog_offline     0x1A   1   Command_Keylog_offline     0x1F   1   Command_Keylog_offline     0x20   1   Command_Keylog_offline     0x21   2   Command_Session     0x22   3   Command_Remove     0x23   4   Command_Down_Exec     0x24   5   Command_Update_Server     0x25   6   Command_Clean_Event     0x26   7   Command_Open_URL_Hide     0x27   8   Command_Open_URL_Show     0x28   9   Command_Rename_Host     0x2a   10   Command_Rename_Remark     0x2b   11   Command_Execute     0x2c   12   Command_Create&Inject     0x2d   1   Command_Keylog_offline     0x45   1   Command_Keylog_offline     0x49   1   Command_Keylog_offline     Command Definitions While I tried to make the command names easily understandable based on the name, I will take some time to explain what each of the commands do: Command_Actived: Uses InterlockedExchange to activate/deactivate the sample Command_Session:  This command was the first command that I enumerated and first obtains the SeShutdownPrivilege before calling ExitWindowsEx to perform a variety of tasks, based on the data segment(It is treated as a flag) of the Gh0stRAT protocol Command Option   Flag     EWX_Logoff   0x00     EWX_Shutdown   0x01     EWX_Reboot   0x02     EWX_Poweroff   0x08     EWX_RestartApps   0x40     EWX_HybridShutdown   0x00400000     Command_Remove: This command takes filenames as an argument and searches for the filename before deleting it from the system Command_Open_URL_Hide:   This command covertly opens a supplied URL Command_Open_URL_Show:  Using Internet Explorer, this command takes a URL as an argument and opens a new Internet Explorer session, connecting to the supplied URL *Command_Rename_Host: This command opens the malware’s Services key and adds the term “Host” to the Key Command_Rename_Remark:  This command opens the malware’s Services key and adds the term “Remark” to the Key *Command_Execute: This command executes a dropped file (n.d.) Gh0st in the dshell (Tech.) Sans Rights to tools Screenshot 1 was created using  Wireshark.  Wireshark uses the GNU Public License V2 Screenshot 2 was created using GHIDRA, an open source tool released by the NSA Screenshot 3 was created using wxHexEditor.  wxHexEditor uses the GNU Public License V2 Screenshot 4 was created using a tool that I wrote.  I give AT&T and its affiliates permission to use my tool. ### Response: .