1. Home
  2. Software
  3. PingPull

PingPull

PingPull is a remote access Trojan (RAT) written in Visual C++ that has been used by GALLIUM since at least June 2022. PingPull has been used to target telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.[1]

ID: S1031
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Contributors: Yoshihiro Kori, NEC Corporation; Pooja Natarajan, NEC Corporation India; Manikantan Srinivasan, NEC Corporation India
Version: 1.0
Created: 09 August 2022
Last Modified: 24 October 2022
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

PingPull can collect data from a compromised host.[1]
Enterprise T1036 .004 伪装: Masquerade Task or Service

PingPull can mimic the names and descriptions of legitimate services such as iphlpsvc, IP Helper, and Onedrive to evade detection.[1]
Enterprise T1543 .003 创建或修改系统进程: Windows Service

PingPull has the ability to install itself as a service.[1]
Enterprise T1573 .001 加密通道: Symmetric Cryptography

PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.[1]
Enterprise T1140 反混淆/解码文件或信息

PingPull can decrypt received data from its C2 server by using AES.[1]
Enterprise T1059 .003 命令与脚本解释器: Windows Command Shell

PingPull can use cmd.exe to run various commands as a reverse shell.[1]
Enterprise T1071 .001 应用层协议: Web Protocols

A PingPull variant can communicate with its C2 servers by using HTTPS.[1]
Enterprise T1132 .001 数据编码: Standard Encoding

PingPull can encode C2 traffic with Base64.[1]
Enterprise T1083 文件和目录发现

PingPull can enumerate storage volumes and folder contents of a compromised host.[1]
Enterprise T1070 .006 移除指标: Timestomp

PingPull has the ability to timestomp a file.[1]
Enterprise T1082 系统信息发现

PingPull can retrieve the hostname of a compromised host.[1]
Enterprise T1016 系统网络配置发现

PingPull can retrieve the IP address of a compromised host.[1]
Enterprise T1041 通过C2信道渗出

PingPull has the ability to exfiltrate stolen victim data through its C2 channel.[1]
Enterprise T1095 非应用层协议

PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.[1]
Enterprise T1571 非标准端口

PingPull can use HTTPS over port 8080 for C2.[1]

Groups That Use This Software

ID Name References
G0093 GALLIUM

[1]

References

  1. Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.