¡El futuro de Zero Trust y de SASE es ahora! Regístrese ahora

cerrar
cerrar
  • Servicio de seguridad Productos Edge chevron

    Protéjase contra las amenazas avanzadas y en la nube y salvaguarde los datos en todos los vectores.

  • Borderless SD-WAN chevron

    Proporcione con confianza un acceso seguro y de alto rendimiento a cada usuario remoto, dispositivo, sitio y nube.

  • Secure Access Service Edge chevron

    Netskope SASE proporciona una solución SASE nativa en la nube, totalmente convergente y de un único proveedor.

La plataforma del futuro es Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG) y Private Access for ZTNA integrados de forma nativa en una única solución para ayudar a todas las empresas en su camino hacia el Servicio de acceso seguro Arquitectura perimetral (SASE).

Todos los productos
Vídeo de Netskope
Next Gen SASE Branch es híbrida: conectada, segura y automatizada

Netskope Next Gen SASE Branch converge Context-Aware SASE Fabric, Zero-Trust Hybrid Security y SkopeAI-Powered Cloud Orchestrator en una oferta de nube unificada, marcando el comienzo de una experiencia de sucursal completamente modernizada para la empresa sin fronteras.

Obtenga más información sobre Next Gen SASE Branch
Personas en la oficina de espacios abiertos.
Diseño de una arquitectura SASE para Dummies

Obtenga un ejemplar gratuito del único manual que necesitará sobre diseño de una arquitectura SASE.

Obtenga el eBook
Adopte una arquitectura de borde de servicio de acceso seguro (SASE)

Netskope NewEdge es la nube privada de seguridad más grande y de mayor rendimiento del mundo y ofrece a los clientes una cobertura de servicio, un rendimiento y una resiliencia incomparables.

Más información sobre NewEdge
NewEdge
Tu red del mañana

Planifique su camino hacia una red más rápida, más segura y más resistente diseñada para las aplicaciones y los usuarios a los que da soporte.

Obtenga el whitepaper
Tu red del mañana
Netskope Cloud Exchange

Cloud Exchange (CE) de Netskope ofrece a sus clientes herramientas de integración eficaces para que saquen partido a su inversión en estrategias de seguridad.

Más información sobre Cloud Exchange
Vídeo de Netskope
Cambie a los servicios de seguridad en la nube líderes del mercado con una latencia mínima y una alta fiabilidad.

Más información sobre NewEdge
Lighted highway through mountainside switchbacks
Habilite de forma segura el uso de aplicaciones de IA generativa con control de acceso a aplicaciones, capacitación de usuarios en tiempo real y la mejor protección de datos de su clase.

Descubra cómo aseguramos el uso generativo de IA
Habilite de forma segura ChatGPT y IA generativa
Soluciones de confianza cero para implementaciones de SSE y SASE

Más información sobre Confianza Cero
Boat driving through open sea
Netskope logra la alta autorización FedRAMP

Elija Netskope GovCloud para acelerar la transformación de su agencia.

Más información sobre Netskope GovCloud
Netskope GovCloud
  • Recursos chevron

    Obtenga más información sobre cómo Netskope puede ayudarle a proteger su viaje hacia la nube.

  • Blog chevron

    Descubra cómo Netskope permite la transformación de la seguridad y las redes a través del servicio de seguridad (SSE).

  • Eventos & Workshops chevron

    Manténgase a la vanguardia de las últimas tendencias de seguridad y conéctese con sus pares.

  • Seguridad definida chevron

    Todo lo que necesitas saber en nuestra enciclopedia de ciberseguridad.

Podcast Security Visionaries

Galletas, no bizcochos
La anfitriona Emily Wearmouthas se sienta con los expertos David Fairman y Zohar Hod para discutir el pasado, el presente y el futuro de las cookies de Internet.

Reproducir el pódcast
Podcast: Galletas, no galletas
Últimos blogs

Cómo Netskope puede habilitar el viaje de Zero Trust y SASE a través de las capacidades del borde del servicio de seguridad (SSE).

Lea el blog
Sunrise and cloudy sky
SASE Week 2023: ¡Su viaje SASE comienza ahora!

Sesiones de repetición de la cuarta SASE Week.

Explorar sesiones
SASE Week 2023
¿Qué es Security Service Edge (SSE)?

Explore el lado de la seguridad de SASE, el futuro de la red y la protección en la nube.

Más información sobre el servicio de seguridad perimetral
Four-way roundabout
Ayudamos a nuestros clientes a estar preparados para cualquier situación

Ver nuestros clientes
Woman smiling with glasses looking out window
El talentoso y experimentado equipo de servicios profesionales de Netskope proporciona un enfoque prescriptivo para su exitosa implementación.

Más información sobre servicios profesionales
Servicios profesionales de Netskope
La comunidad de Netskope puede ayudarlo a usted y a su equipo a obtener más valor de los productos y las prácticas.

Acceder a la Netskope Community
La comunidad de Netskope
Asegure su viaje de transformación digital y aproveche al máximo sus aplicaciones en la nube, web y privadas con la capacitación de Netskope.

Infórmese sobre Capacitaciones y Certificaciones
Group of young professionals working
  • Empresa chevron

    Le ayudamos a mantenerse a la vanguardia de los desafíos de seguridad de la nube, los datos y la red.

  • Por qué Netskope chevron

    La transformación de la nube y el trabajo desde cualquier lugar han cambiado la forma en que debe funcionar la seguridad.

  • Liderazgo chevron

    Nuestro equipo de liderazgo está firmemente comprometido a hacer todo lo necesario para que nuestros clientes tengan éxito.

  • Partners chevron

    Nos asociamos con líderes en seguridad para ayudarlo a asegurar su viaje a la nube.

Apoyar la sostenibilidad a través de la seguridad de los datos

Netskope se enorgullece de participar en Vision 2045: una iniciativa destinada a crear conciencia sobre el papel de la industria privada en la sostenibilidad.

Descubra más
Apoyando la sustentabilidad a través de la seguridad de los datos
La más Alta en Ejecución. Más Avanzada en Visión.

Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.

Obtenga el informe
Netskope ha sido reconocido como Líder en el Gartner® Magic Quadrant™ de 2023 en SSE.
Pensadores, constructores, soñadores, innovadores. Juntos, ofrecemos soluciones de seguridad en la nube de vanguardia para ayudar a nuestros clientes a proteger sus datos y usuarios.

Conozca a nuestro equipo
Group of hikers scaling a snowy mountain
La estrategia de venta centrada en el partner de Netskope permite a nuestros canales maximizar su expansión y rentabilidad y, al mismo tiempo, transformar la seguridad de su empresa.

Más información sobre los socios de Netskope
Group of diverse young professionals smiling

A Look at the Nim-based Campaign Using Microsoft Word Docs to Impersonate the Nepali Government

Dec 20 2023

Resumen

Threat actors often employ stealthy attack techniques to elude detection and stay under the defender’s radar. One way they do so is by using uncommon programming languages to develop malware. Using an uncommon programming language to develop malware provides several benefits, including:

  • Evading some signature based detections
  • Impeding analysis by malware analysts that are unfamiliar with the language
  • Limited community detection and published analysis

Netskope recently analyzed a malicious backdoor written in Nim, which is a relatively new programming language. Netskope Threat labs has observed an increase in Nim-based malware over the past year and expects Nim-based malware to become more popular as attackers continue to modify existing Nim-based samples. One of the highest-profile Nim-based malware families was the Dark Power ransomware, which began spreading in the wild earlier this year.

This blog post provides a breakdown of a recent targeted threat that uses Word document bait to deliver a Nim backdoor. 

Delivery Method

A malicious Word document was used to drop the Nim backdoor. The document was sent as an email attachment, where the sender claims to be a Nepali government official sending security arrangements. Despite the security controls placed around macros in Office files, we are still seeing APT-attributed malware using them to drop their payload, like the Menorah malware we analyzed a couple of months ago.

Initially opening the file will show a blank document with an instruction to enable macros. When the user clicks “Enable Content,” the auto-trigger routine (Document_Open) in the code will execute. Once the main function is called, the code is executed through additional VBA functions inside the document.

Malicious Word file prior enabling macro

Defense Evasion

To help bypass AV and static based detections, the VBA project is password protected and macros are obfuscated using the Chr( ) VBA function and string concatenation. The VBA code is split into the four subroutines in the image below.

sch_task is a function that creates a VBscript named “OCu3HBg7gyI9aUaB.vbs” that will serve as the chain trigger. Initially, the VBscript is created in the AppData startup folder (C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OCu3HBg7gyI9aUaB.vbs) and is set as a hidden file. Oddly, some variables are initialized in one function, but then utilized in a different function/s, which could be meant to confuse static analysis. Some strings referring to directories and libraries are split and then concatenated to evade static detection. 

VBA code for sch_task routine.

hide_cons is a function to create another VBScript named “skriven.vbs,” which will be used by “8lGghf8kIPIuu3cM.bat” as a shell to run other scripts. More detailed info about this batch script is found below. Again, some strings referring to directories and libraries are split and then concatenated.

VBA code for hide_cons routine.

read_shell is a function that creates the payload named conhost.exe, which is inside a ZIP archive. As can be seen from the screenshot below of the macro code, it assembles the ZIP from an array of decimals (by converting each to byte) stored in the “UserForm1” object. The resulting byte array is the actual ZIP file and is dropped to  C:\Users\<user>\AppData\Local\Microsoft\conhost.zip

VBA code for read_shell routine.
UserForm1 Containing Decimal/Bytes.

vb_chainis a function mainly for creating “8lGghf8kIPIuu3cM.bat”, which will be the stage of infection before the final payload. Exact file paths are generated by the VBA macro before writing to the batch file.

vb_chain code snapshot.

Dropped Files Summary:

e2a3edc708016316477228de885f0c39.doc drops:

  • OCu3HBg7gyI9aUaB.vbs (C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OCu3HBg7gyI9aUaB.vbs)
  • skriven.vbs (C:\Users\<user>\AppData\Local\skriven.vbs)
  • conhost.zip (C:\Users\<user>\AppData\Local\Microsoft\conhost.zip)
  • 8lGghf8kIPIuu3cM.bat (C:\Users\<jack>\AppData\Local\8lGghf8kIPIuu3cM.bat) drops these in C:\Users\<user>\AppData\Local:
    • unzFile.vbs
    • unz.vbs
    • 2L7uuZQboJBhTERK.bat
    • 2BYretPBD4iSQKYS.bat
    • d.bat
    • e.bat

Nim Backdoor

The Word document drops a malicious backdoor named “conhost.exe”. The malware is written in Nim and was likely compiled on September 20, 2023. Nim is a statically typed compiled programming language. Its versatility shines through its ability to be compiled to C, C++, or JavaScript, coupled with a Pythonic syntax for a developer-friendly experience.

The backdoor runs within the same privilege as the current user logged in. It’s looking to continue its ploy that the file was from a Nepali authority by imitating government domains for its C&C server ([.]govnp[.]org). When this backdoor is left undetected, users are at risk of having attackers gaining remote access.

Even though the C2 servers are no longer accessible at the time of analysis, we were still able to extrapolate some of its behaviors, which can be seen below.

Anti-analysis Technique

The malware performs a simple background check before connecting to its command and control server. Initially, the Nim backdoor spawns a command prompt to run tasklist.exe and checks for any processes running from its list of known analysis tools. The backdoor will terminate itself shortly if it sees any of the analysis tools from the list running.

Processes the backdoor avoids

Command and control through web protocol

Once the backdoor confirms there are no analysis tools running, it will spawn another command prompt instance to get the machine’s hostname, then connect to its C&C server. It encrypts the hostname with a function named bakery. The encrypted hostname is encoded twice in base64, spliced behind a randomly chosen C&C server URL, and then concatenated with the “.asp” suffix at the end to obtain the URL of the final command. The command delivered by the C&C server is obtained through an HTTP GET request. 

Response data from GET contains the command from the C&C server. If the response data is different from the last time it was fetched, it means that the C&C server has issued a new command. Otherwise it will be dormant and keep requesting the command from the C&C server. Decryption of response data (command) is done by the confectionary function, then concatenated with cmd /c to execute the command. The execution result is also sent back to the server through a GET request. The key used for encryption and decryption is “NPA”, which may be an abbreviation of NP (Nepal) Agent.

Screenshot of network traffic specific to the sample.

The sample contacts the following C2 hosts:

  • mail[.]mofa[.]govnp[.]org
  • nitc[.]govnp[.]org
  • mx1[.]nepal[.]govnp[.]org
  • dns[.]govnp[.]org

Persistence through Startup Folder and Scheduled Task

To retain access on the machine, a VBscript named “OCu3HBg7gyI9aUaB.vbs”  is placed in the startup folder. The script will initially confirm an internet connection using WMI’s “Win32_PingStatus” class to ping https://www.google[.]com. If successful, it will run a batch file named “8lGghf8kIPIuu3cM.bat”.

The main task of the batch file “8lGghf8kIPIuu3cM.bat” is to drop files that will further unpack and create a scheduled task for the payload. The batch file will create more scripts that will carry out these subtasks:

  • unz.vbs is used for decompressing the executable out from the archive into the same directory
  • unzFile.vbs creates unz.vbs
  • 2L7uuZQboJBhTERK.bat is just for chaining; runs unzFile.vbs then runs 2BYretPBD4iSQKYS.bat
  • 2BYretPBD4iSQKYS.bat is just for chaining; runs unz.vbs then runs d.bat
  • d.bat creates a scheduled task of the unpacked payload (conhost.exe) then runs e.bat
  • e.bat deletes itself and the other scripts created by 8lGghf8kIPIuu3cM.bat

The batch file named “d.bat” creates a scheduled task to attain another persistent execution of the malware on the target machine. The scheduled task is named “ConsoleHostManager” as seen in the below screenshot.

Screenshot for Scheduled Task created.

Netskope Detection

Netskope Advanced Threat Protection provides proactive coverage against zero-day and APT samples of malicious Office documents using both our static analysis engines and cloud sandbox. The following screenshot shows the detection for e2a3edc708016316477228de885f0c39, indicating it was detected by Netskope Cloud Sandbox, Netskope Advanced Heuristic Engine, and Netskope Threat Intelligence.

Conclusión

Malware written in uncommon programming languages puts the security community at a disadvantage as researchers and reverse engineers’ unfamiliarity can hamper their investigation. Nim is one of the young programming languages increasingly abused by malware authors. Aside from its familiar syntax, its cross-compilation features allow attackers to write one malware variant and have it cross-compiled to target different platforms. Netskope Threat Labs will continue monitoring the usage of unpopular programming languages.

IOCs

MD5
e2a3edc708016316477228de885f0c39
777fcc34fef4a16b2276e420c5fb3a73
EF834A7C726294CE8B0416826E659BAA
32C5141B0704609B9404EFF6C18B47BF

SHA-1
3aa803baf5027c57ec65eb9b47daad595ba80bac
5D2E2336BB8F268606C9C8961BED03270150CF65
4CAE7160386782C02A3B68E7A9BA78CC5FFB0236
0599969CA8B35BB258797AEE45FBD9013E57C133

SHA-256
b5c001cbcd72b919e9b05e3281cc4e4914fee0748b3d81954772975630233a6e
696f57d0987b2edefcadecd0eca524cca3be9ce64a54994be13eab7bc71b1a83
88FA16EC5420883A9C9E4F952634494D95F06F426E0A600A8114F69A6127347F
1246356D78D47CE73E22CC253C47F739C4F766FF1E7B473D5E658BA1F0FDD662

Network
mail[.]mofa[.]govnp[.]org
nitc[.]govnp[.]org
mx1[.]nepal[.]govnp[.]org
dns[.]govnp[.]org

Thank you to Juan Diego Huet for helping analyze the sample files and contributing to this blog.

author image
Ghanashyam Satpathy
Ghanashyam Satpathy is a Principal Researcher with the Netskope Efficacy team, which drives the detection effectiveness. His background is building threat detection products using AI/ML technology for cloud and endpoint security.
author image
Jan Michael Alcantara
Jan Michael Alcantara is an experienced incident responder with a background on forensics, threat hunting, and incident analysis.

Stay informed!

Subscribe for the latest from the Netskope Blog