The decompressed data consists of various key/value pairings that represent important strings used by Reaver An example of this decompressed data can be seen below:       RA@10001=ole32.dllRA@10002=CoCreateGuidRA@10003=Shlwapi.dllRA@10004=SHDeleteKeyARA@10005=wininet.dllRA@10006=InternetOpenA[TRUNCATED]RA@10288=%s\%sRA@10289=CMD.EXERA@10290=%s=RA@10311=\%sctr.dllRA@10312=\uc.datRA@10313=ChangeServiceConfig2ARA@10314=QueryServiceConfig2A     When the malware wishes to retrieve one of these decoded strings, it will simply call a function with an integer argument that is responsible for providing it For example, calling this function with an argument of ‘10001’ would retrieve a string of ‘ole32.dll’ The DllEntryPoint function proceeds to attempt to obtain the SeDebugPrivilege privilege, and also calls WSAStartup for future network activity When the CPlApplet function is loaded, it will begin by decompressing an embedded configuration using the same compression algorithm used previously This may be either a campaign identifier, or perhaps a malware versioning string The malware proceeds to check to see if the original dropped malware file exists The following example Python code shows how this encryption takes place:       c = 0out = ""for d in data:  out += chr((ord(d) ^ ((c % 256) + 92)) & 0xFF)  c += 1     After this data is exfiltrated, the malware expects 8 bytes of data that contains two DWORDs These DWORDs contain both a major command and a sub-command Specifically, Reaver to date has used www.tashdqdxp[.]com for C2, which overlaps with www.weryhstui[.]com, another C2 used by SunOrcal samples during the same timeframe Both domains have resolved to 98.126.156[.]210 Several of those same SunOrcal samples were also using www.fyoutside[.]com as an additional C2.  This led to further C2 ties within SunOrcal samples, to include samples beaconing to www.olinaodi[.]com; all of this is shown below in Figure 3 The latter has been previously reported in activity targeting Hong Kong democracy activists and that activity is in turn tied to a report targeting Tibetan, Hong Kong, and Taiwanese activists, and another blog about targeting Taiwanese activists Figure 3 Chart showing overlaps between Reaver and SunOrcal All IOCs are in the appendix at the end of this blog Conclusion The attackers behind SunOrcal, whose activity dates to at least 2013 and possibly 2010, remain active and are still developing new custom malware to use against their targets The new malware, Reaver, appears to have been in the wild since late 2016 with less than a dozen known samples, among which there are three variants It is also unique in the fact that its final payload is in a CPL file, a technique which Palo Alto Networks has seen with only 0.006% of all malware samples we have analyzed The attackers used both families concurrently from late last year through November 2017 and there is some C2 infrastructure overlap between the two families, as well as links to historical reporting We will continue to monitor these attackers for new activity and report as appropriate Palo Alto Networks customers are protected by the following:  Wildfire and Traps identifies both malware families as malicious The C2 domains are blocked via Threat Prevention AutoFocus customers can monitor activity using this malware with the following tags:  Reaver SunOrcal     Appendix SHA2556 – Reaver.v1 d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666   SHA2556 – Reaver.v2 98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c 05ddbd0506ec95fb460b3994e5b21cdb0418ba4aa406374ca1b91249349b7640   SHA2556 – Reaver.v3 18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92 c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d 9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b 26c234c73e2c3448589c7d4a0cf17f615ad3666541a4e611e2d8b77637205bcf ae9f158e4886cfdbfb4f1b3b25707d05f6fd873d0be9d8e7334a2c28741228ee 1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1 c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c 1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1   SHA256 – SunOrcal 799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac 81d887fefdbb0219647991c2b7bddf45c2fede4dc6fc18408f1706e0279615b2 58312fb742ce881e040e1b5b8555f00a402b8dd4fc886acaae2f862040b3bfc5 38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f  C2 domains and IP addresses www.tashdqdxp[.]com www.weryhstui[.]com www.fyoutside[.]com   www.olinaodi[.]com 104.148.70[.]217 98.126.156[.]210
Below is an instruction that describes a task, paired with an input that provides further context. Write a response that appropriately completes the request. ### Instruction: List the MITRE techniques contained in the text. ### Input: The decompressed data consists of various key/value pairings that represent important strings used by Reaver An example of this decompressed data can be seen below:       RA@10001=ole32.dllRA@10002=CoCreateGuidRA@10003=Shlwapi.dllRA@10004=SHDeleteKeyARA@10005=wininet.dllRA@10006=InternetOpenA[TRUNCATED]RA@10288=%s\%sRA@10289=CMD.EXERA@10290=%s=RA@10311=\%sctr.dllRA@10312=\uc.datRA@10313=ChangeServiceConfig2ARA@10314=QueryServiceConfig2A     When the malware wishes to retrieve one of these decoded strings, it will simply call a function with an integer argument that is responsible for providing it For example, calling this function with an argument of ‘10001’ would retrieve a string of ‘ole32.dll’ The DllEntryPoint function proceeds to attempt to obtain the SeDebugPrivilege privilege, and also calls WSAStartup for future network activity When the CPlApplet function is loaded, it will begin by decompressing an embedded configuration using the same compression algorithm used previously This may be either a campaign identifier, or perhaps a malware versioning string The malware proceeds to check to see if the original dropped malware file exists The following example Python code shows how this encryption takes place:       c = 0out = ""for d in data:  out += chr((ord(d) ^ ((c % 256) + 92)) & 0xFF)  c += 1     After this data is exfiltrated, the malware expects 8 bytes of data that contains two DWORDs These DWORDs contain both a major command and a sub-command Specifically, Reaver to date has used www.tashdqdxp[.]com for C2, which overlaps with www.weryhstui[.]com, another C2 used by SunOrcal samples during the same timeframe Both domains have resolved to 98.126.156[.]210 Several of those same SunOrcal samples were also using www.fyoutside[.]com as an additional C2.  This led to further C2 ties within SunOrcal samples, to include samples beaconing to www.olinaodi[.]com; all of this is shown below in Figure 3 The latter has been previously reported in activity targeting Hong Kong democracy activists and that activity is in turn tied to a report targeting Tibetan, Hong Kong, and Taiwanese activists, and another blog about targeting Taiwanese activists Figure 3 Chart showing overlaps between Reaver and SunOrcal All IOCs are in the appendix at the end of this blog Conclusion The attackers behind SunOrcal, whose activity dates to at least 2013 and possibly 2010, remain active and are still developing new custom malware to use against their targets The new malware, Reaver, appears to have been in the wild since late 2016 with less than a dozen known samples, among which there are three variants It is also unique in the fact that its final payload is in a CPL file, a technique which Palo Alto Networks has seen with only 0.006% of all malware samples we have analyzed The attackers used both families concurrently from late last year through November 2017 and there is some C2 infrastructure overlap between the two families, as well as links to historical reporting We will continue to monitor these attackers for new activity and report as appropriate Palo Alto Networks customers are protected by the following:  Wildfire and Traps identifies both malware families as malicious The C2 domains are blocked via Threat Prevention AutoFocus customers can monitor activity using this malware with the following tags:  Reaver SunOrcal     Appendix SHA2556 – Reaver.v1 d560f44188fb56d3abb11d9508e1167329470de19b811163eb1167534722e666   SHA2556 – Reaver.v2 98eb5465c6330b9b49df2e7c9ad0b1164aa5b35423d9e80495a178eb510cdc1c 05ddbd0506ec95fb460b3994e5b21cdb0418ba4aa406374ca1b91249349b7640   SHA2556 – Reaver.v3 18ac3b14300ecfeed4b64a844c16dccb06b0e3513d0954d6c6182f2ea14e4c92 c0f8bb77284b96e07cab1c3fab8800b1bbd030720c74628c4ee5666694ef903d 9213f70bce491991c4cbbbd7dc3e67d3a3d535b965d7064973b35c50f265e59b 26c234c73e2c3448589c7d4a0cf17f615ad3666541a4e611e2d8b77637205bcf ae9f158e4886cfdbfb4f1b3b25707d05f6fd873d0be9d8e7334a2c28741228ee 1fcda755e8fa23d27329e4bc0443a82e1c1e9a6c1691639db256a187365e4db1 c906250e0a4c457663e37119ebe1efa1e4b97eef1d975f383ac3243f9f09908c 1813f10bcf74beb582c824c64fff63cb150d178bef93af81d875ca84214307a1   SHA256 – SunOrcal 799139b5278dc2ac24279cc6c3db44f4ef0ea78ee7b721b0ace38fd8018c51ac 81d887fefdbb0219647991c2b7bddf45c2fede4dc6fc18408f1706e0279615b2 58312fb742ce881e040e1b5b8555f00a402b8dd4fc886acaae2f862040b3bfc5 38ea33dab0ba2edd16ecd98cba161c550d1036b253c8666c4110d198948329fb cb7c0cf1750baaa11783e93369230ee666b9f3da7298e4d1bb9a07af6a439f2f  C2 domains and IP addresses www.tashdqdxp[.]com www.weryhstui[.]com www.fyoutside[.]com   www.olinaodi[.]com 104.148.70[.]217 98.126.156[.]210 ### Response: .