1. Home
  2. Software
  3. ShadowPad

ShadowPad

ShadowPad is a modular backdoor that was first identified in a supply chain compromise of the NetSarang software in mid-July 2017. The malware was originally thought to be exclusively used by APT41, but has since been observed to be used by various Chinese threat activity groups. [1][2][3]

ID: S0596
ⓘ
Associated Software: POISONPLUG.SHADOW
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.2
Created: 23 March 2021
Last Modified: 26 March 2023

Associated Software Descriptions

Name Description
POISONPLUG.SHADOW

[4]
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1112 修改注册表

ShadowPad can modify the Registry to store and maintain a configuration block and virtual file system.[3][5]
Enterprise T1568 .002 动态解析: Domain Generation Algorithms

ShadowPad uses a DGA that is based on the day of the month for C2 servers.[2][3][4]
Enterprise T1140 反混淆/解码文件或信息

ShadowPad has decrypted a binary blob to start execution.[3]
Enterprise T1071 .001 应用层协议: Web Protocols

ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.[3]
.002 应用层协议: File Transfer Protocols

ShadowPad has used FTP for C2 communications.[3]
.004 应用层协议: DNS

ShadowPad has used DNS tunneling for C2 communications.[3]
Enterprise T1132 .002 数据编码: Non-Standard Encoding

ShadowPad has encoded data as readable Latin characters.[2]
Enterprise T1027 混淆文件或信息

ShadowPad has encrypted its payload, a virtual file system, and various files.[2][5]
.011 Fileless Storage

ShadowPad maintains a configuration block and virtual file system in the Registry.[3][5]
Enterprise T1070 移除指标

ShadowPad has deleted arbitrary Registry values.[3]
Enterprise T1082 系统信息发现

ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.[3]
Enterprise T1033 系统所有者/用户发现

ShadowPad has collected the username of the victim system.[3]
Enterprise T1124 系统时间发现

ShadowPad has collected the current date and time of the victim system.[3]
Enterprise T1016 系统网络配置发现

ShadowPad has collected the domain name of the victim system.[3]
Enterprise T1105 输入工具传输

ShadowPad has downloaded code from a C2 server.[2]
Enterprise T1057 进程发现

ShadowPad has collected the PID of a malicious process.[3]
Enterprise T1055 进程注入

ShadowPad has injected an install module into a newly created process.[3]
.001 Dynamic-link Library Injection

ShadowPad has injected a DLL into svchost.exe.[3]
Enterprise T1095 非应用层协议

ShadowPad has used UDP for C2 communications.[3]
Enterprise T1029 预定传输

ShadowPad has sent data back to C2 every 8 hours.[2]

Groups That Use This Software

ID Name References
G0081 Tropic Trooper

[1]
G0131 Tonto Team

[6]
G0096 APT41

[4][1]
G0143 Aquatic Panda

Aquatic Panda used ShadowPad as a remote access tool to victim environments.[7]
G1006 Earth Lusca

[5]
G0060 BRONZE BUTLER

[1]

References

  1. Insikt Group. (2021, February 28). China-Linked Group RedEcho Targets the Indian Power Sector Amid Heightened Border Tensions. Retrieved March 22, 2021.
  2. GReAT. (2017, August 15). ShadowPad in corporate networks. Retrieved March 22, 2021.
  3. Kaspersky Lab. (2017, August). ShadowPad: popular server management software hit in supply chain attack. Retrieved March 22, 2021.
  4. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  1. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
  2. Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.
  3. CrowdStrike. (2023). 2022 Falcon OverWatch Threat Hunting Report. Retrieved May 20, 2024.