Gazer
Associated Software Descriptions
| Name | Description |
|---|---|
| WhiteBear |
The term WhiteBear is used both for the activity group (a subset of G0010) as well as the malware observed. Based on similarities in behavior and C2, WhiteBear is assessed to be the same as S0168. [2][3] |
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1546 | .002 | 事件触发执行: Screensaver |
Gazer can establish persistence through the system screensaver by configuring it to execute the malware.[1] |
| Enterprise | T1573 | .001 | 加密通道: Symmetric Cryptography | |
| .002 | 加密通道: Asymmetric Cryptography | |||
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
Gazer can establish persistence by creating a .lnk file in the Start menu.[1][2] |
| .004 | 启动或登录自动启动执行: Winlogon Helper DLL |
Gazer can establish persistence by setting the value "Shell" with "explorer.exe, %malware_pathfile%" under the Registry key |
||
| .009 | 启动或登录自动启动执行: Shortcut Modification |
Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.[1][2] |
||
| Enterprise | T1071 | .001 | 应用层协议: Web Protocols | |
| Enterprise | T1480 | .002 | 执行保护: Mutual Exclusion |
Gazer creates a mutex using the hard-coded value |
| Enterprise | T1027 | .013 | 混淆文件或信息: Encrypted/Encoded File |
Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.[2] |
| Enterprise | T1070 | .004 | 移除指标: File Deletion |
Gazer has commands to delete files and persistence mechanisms from the victim.[1][2] |
| .006 | 移除指标: Timestomp |
For early Gazer versions, the compilation timestamp was faked.[1] |
||
| Enterprise | T1033 | 系统所有者/用户发现 | ||
| Enterprise | T1105 | 输入工具传输 | ||
| Enterprise | T1055 | 进程注入 |
Gazer injects its communication module into an Internet accessible process through which it performs C2.[1][2] |
|
| .003 | Thread Execution Hijacking |
Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.[1][2] |
||
| Enterprise | T1564 | .004 | 隐藏伪装: NTFS File Attributes |
Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.[1] |
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
Gazer can establish persistence by creating a scheduled task.[1][2] |
| Enterprise | T1553 | .002 | 颠覆信任控制: Code Signing |
Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."[1][2] |