Lost soul aside trademark code#

Lost soul aside trademark code#

It was compiled in October 2017 and used revised code from public repositories and other malware leaked online, such as: This is the backdoor used in the earliest phase by the threat actor. Names of mutexes, events, and file mappings.Data structure similarity, such as the configuration structure.DynamiCall import obfuscation from the leaked source code of the notorious Hacking Team’s.Several characteristics are common in all of the components we found:

Furthermore, related samples such as loaders and their payloads were compiled within seconds of each other. This is partly because the time distribution of the collected samples correlates with our understanding of the components’ capabilities and their sightings in the wild. Side note: This timeline is based on compilation timestamps, and although these can be tampered with, in the case of this malware framework, we consider them to be authentic. They have significantly transformed over time, and their configuration artifacts shed light on possible Soul module capabilities.Īside from the backdoors, additional tools were used, such as keyloggers and a custom-compiled 7zr tool (reduced standalone 7-zip).Ī complete timeline of the various components is depicted below, beginning in 2017 with the first keylogger and backdoor and ending with the recent SoulSearcher variants found in November 2021. Since the beginning of 2020, we have detected increasingly intricate SoulSearcher variants, some of which support loading multiple modules from the registry. Instead of dropping the payload to disk, the compressed module is stored in the registry and is loaded in-memory.

Its loader, which we dubbed SoulSearcher, changed as well. Within a year, the backdoor’s code was refactored and had custom code added to it, completing its transformation into what we refer to as a Soul module. The backdoor is embedded as a compressed blob in its dropper executable, which writes it to disk and runs it. In the earliest phase, the attackers used a backdoor that incorporated code of the open-source Gh0st RAT and NetBot Attacker tools, albeit with considerable modifications. Impact: Collects sensitive information and executes additional malicious modules

This blog will examine the different components of this malware and their progression over time, thereby mapping the evolution of the Soul malware framework. Over time, custom code was added, components were upgraded, capabilities expanded, the code became neater, and modularity increased. Reverse engineering the samples has allowed us to observe the progression of the development of this malware throughout the years. We have now uncovered a sample of the module and a plethora of components and variants dating as far back as 2017. It is never written to disk, rendering it unlikely to appear in datasets like VirusTotal.Īnd so, we embarked on a journey to hunt for the lost module. The module is stored as a compressed blob with a custom header in the registry. The reason the module was difficult to find became apparent after analyzing its loader. What piqued our curiosity most was the mention of a DLL payload loaded from the registry that had yet to be discovered. It discusses an unknown threat actor conducting an espionage campaign in Southeast Asia using a new custom malware arsenal. A threat report published by Symantec in October 2021 recently caught our attention.