The Able Desktop Supply Chain Attack

What happened

ESET reports that two trojanized installers and a compromised update system spread the malware. ESET dates the first trojanized installer to December 2017 in its timeline, and later installers to May 2018 onward. It dates the update system compromise to June 2020 or earlier, and a shift to the Tmanger backdoor to July 2020. ESET published its report on 10 December 2020.

The update mechanism downloaded executables over HTTPS to %USERPROFILE%\Documents\Able\Able Desktop.exe.

The attackers used DLL side-loading. They ran legitimate signed programs from security vendors, and those programs loaded the malicious DLLs:

• IntgStat.exe (Symantec) loaded pcalocalresloader.dll
• Siteadv.exe (McAfee) loaded siteadv.dll
• Thinprobe.exe (Symantec) loaded thinprobe.dll

These DLLs decoded an XOR-encoded payload stored in thumb.db or thumbs.db. The payloads were the HyperBro backdoor, associated with LuckyMouse, the Korplug (PlugX) remote access tool, and the Tmanger remote access tool, associated with TA428. ESET says the links between these groups suggest shared access, shared tools or organizational ties.

Affected versions

ESET names no version numbers. The affected items are the trojanized Able Desktop installers from 2018 and the updates delivered by the compromised update system.

• Trojanized installers: December 2017 and May 2018 onward
• Compromised update system: June 2020 or earlier

Indicators of compromise

ESET lists these in its public IOC repository.

• Trojanized Able Desktop SHA-1: 0B0CF4ADA30797B0488857F9A3B1429F44335FB6 and B51835A5D8DA77A49E3266494A8AE96764C4C152
• Payload loader SHA-1: 23A227DD9B77913D15735A25EFB0882420B1DE81
• HyperBro SHA-1: 8FFF5C6EB4DAEE2052B3578B73789EB15711FEEE and 6477783B302F4D893271F5522110650EB2C50BD1
• Korplug SHA-1: 5D066113534A9E31F49BEFDA560CF8F8890496D0
• Tmanger SHA-1: ED6CECFDAAEB7F41A824757862640C874EF3F7AE
• Domain: developer.firefoxapi.com
• IP addresses: 45.77.173.124, 45.77.55.145, 139.180.208.225
• Files: pcalocalresloader.dll, siteadv.dll, thinprobe.dll, thumb.db and thumbs.db in an Able Desktop folder

How to check

Look for the side-loaded DLLs next to Able Desktop files, and hash them.

Get-ChildItem -Path C:\ -Recurse -Include pcalocalresloader.dll,siteadv.dll,thinprobe.dll -ErrorAction SilentlyContinue | Get-FileHash -Algorithm SHA1

Compare the output with the SHA-1 values above. Search network logs for developer.firefoxapi.com and the three IP addresses.

What to do now

1. Isolate any machine with a match and treat it as compromised.
2. Remove the DLL and the encoded thumb.db files, and rebuild the machine.
3. Block the domain and IP addresses.
4. Rotate credentials that the machine used.
5. Do not accept updates from Able Desktop until the vendor confirms a clean update channel.

Vigilance compares the version you trust with a new one and reports the file that gained a new capability. Here new side-loading DLLs and encoded payload files appeared inside the package. See all attacks.

What Vigilance showed

Vigilance compares the version you trust with the new one and names the file that gained a new capability. The block below is rebuilt from the public reports in the words Vigilance prints. It is not a captured scan, because the malicious release is not redistributed.

files scanned: 59 (1 Added)

HEADS UP  1 file can now do things the old version could not. The rest changed and gained nothing.

NEW FILE   pcalocalresloader.dll
           It runs other programs and runs a hidden, encoded command.

Sources

1. welivesecurity.com/2020/12/10/luckymouse-ta428-compromise-able-desktop/
2. github.com/eset/malware-ioc/blob/master/stealthytrident/README.adoc