{"id":6011,"date":"2021-02-10T09:40:54","date_gmt":"2021-02-10T17:40:54","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=6011"},"modified":"2024-04-26T13:20:54","modified_gmt":"2024-04-26T20:20:54","slug":"teardrop-malware","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/cyber-threat-advisory\/teardrop-malware\/","title":{"rendered":"Cyber Threat Advisory: TEARDROP Malware"},"content":{"rendered":"

Author: James Barnett<\/p>\n

TLP:WHITE<\/p>\n

1.\u00a0 \u00a0Executive Summary<\/h3>\n

On 8 February, the Cybersecurity and Infrastructure Security Agency (CISA) published a Malware Analysis Report (MAR) on malware related to the supply chain attack on SolarWinds\u2019 Orion platform that was discovered in December 2020.1<\/sup> Cybersecurity company FireEye has named this malware TEARDROP. The report details the analysis of a trojan backdoor that decrypts and executes an embedded payload – Cobalt Strike Beacon Implant (Version 4) – that enables the attacker to remotely control infected systems through an encrypted network tunnel.<\/p>\n

2.\u00a0 \u00a0Analysis<\/h3>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2.1.\u00a0 \u00a0 TEARDROP DLL<\/h4>\n

CISA reports that TEARDROP is a malicious 64-bit dynamic-link library (DLL) that decrypts and loads a malicious payload from an embedded code buffer. When executed, the malware attempts to read the first 64-bytes of a file named festive_computer.jpg<\/em> but it does not actually utilize the data it reads from this file and will continue executing even if the file doesn\u2019t exist. After attempting to read festive_computer.jpg<\/em>, the TEARDROP DLL uses an XOR cipher to decrypt and execute the Cobalt Strike Beacon Implant (Version 4) remote access tool (RAT) contained within its embedded code buffer. TEARDROP does not create any files during this process since the malware operates entirely within memory.<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2.2.\u00a0 \u00a0 Cobalt Strike<\/h4>\n

Cobalt Strike is a legitimate penetration testing tool that has become increasingly popular amongst threat actors due to its wide array of powerful features. Its capabilities include keylogging, taking screenshots, deploying additional payloads, exploiting system vulnerabilities to facilitate additional attacks, evading detection with various countermeasures, rapidly exfiltrating data through encrypted tunnels, and more.2<\/sup><\/p>\n

3.\u00a0 \u00a0Prevention and Mitigation<\/h3>\n

CISA provides the following list of best practices to strengthen the security of an organization. In addition, CISA references the publication from the National Institute of Standards and Technology (NIST), \u201cGuide to Malware Incident Prevention & Handling for Desktops and Laptops\u201d for more information on malware incident prevention and handling.3<\/sup><\/p>\n