Recent Winnti Infrastructure and Samples

On July 17, 2017, we detected a malicious document in VirusTotal exploiting CVE-2017-0199. By pivoting off of the infrastructure we learned that it is related to Winnti, a Chinese threat actor that is mostly targeting the gaming industry. Below we outline initial findings.

The malicious file, named curriculum vitae.rtf (58c66b3ddbc0df9810119bb688ea8fb0) was uploaded from Turkey. Its content is presented below (we redacted personally identifiable information):

When the document is opened, it downloads and runs a file from the following URL:

http://54.245.195[.]101/test.rtf

Which contains a short VBS script:

The script downloads and runs an executable (a4b2a6883ba0451429df29506a1f6995) from the following URL:

http://54.245.195[.]101/shell.exe

Which uses backup.aolonline[.]cc as command and control server.

Indicators of compromise

Pivoting on IPs, code signing certificates, and domain registration details, we found further parts of the infrastructure, some got back to 2015. Most of them have been tagged as relating to “Casper aka LEAD” in a public PassiveTotal project by Cylance (However, we could not find a public report). Most sample were detected by Proofpoint as “ETPRO TROJAN Casper/LEAD DNS Lookup” (this signature was published in May 03, 2017).

The Maltego graph below depicts the relationship among the indicators (click to enlarge):

The indicators are available on PassiveTotal.