Analyzing Nobelium's HTML Dropper - EnvyScout
TL;DR; In a recent incident, Nobelium (APT-29) used a HTML dropper to download a file and store it on the disk;
Analysis Summary:
[ASSUMPTION] Attacker sends a malicious HTML file or a link to the victim
[ASSUMPTION] Victim opens the file
There's a hardcoded string (~2.8 MB) that's converted from base64 to an Array Buffer
This array buffer (which is an ISO file) is written onto disk using Inbuilt API calls
This ISO file contains 3 files: an exe and 2 DLLs. While these were interesting, it's a story for another day.
Analysis In-Detail:
Moving On, they seem to be sending a beacon-ping (kind off like a Hi, someone clicked me) to their malicious URL along with the IP of the user and the user agent. I'm not sure why they were sending a request to IPIFY. I assume they wanted to get the current IP of the user but they're not really utilizing it. Seems like unfinished code (not surprised). However, this seems to be just a function and we'll have to see when this is actually called.
Further down, there seems to be a string (~2.8 MB) which is base64 encoded.
Below that is the function which is kind off the one which does all the magic; Again, not a JS expert but looks like they copied yet another code and this time from StackOverflow.
Combining both the pieces together, it looks like the JS is trying to put the base64 string into an array buffer and write to the disk using the previously discovered function. Dynamic analysis indicates that it's an ISO file containing possibly malicious samples.
This looks like a previously documented variant
References:
Last updated