This blog post comes from the Sandworm’s New Arsenal: Kapeka Backdoor Technical Analysis report. If you want to download it as a PDFclick here

Executive Summary

Kapeka’s victim profiling, marked by its rarity and high level of secrecy and complexity, indicates operations at the level of an Advanced Persistent Threat (APT). The Kapeka Backdoor is identified as malware attributed to the Sandworm group.

The Sandworm APT group is a cyber threat actor often associated with the Russian state, engaging in cyber espionage and espionage activities. The group uses numerous infiltration techniques, such as malware, backdoor entries, and malicious email campaigns, to gain access to targets. It is known that this group often develops specialized malware designed to achieve long-term access and comprehensive monitoring, thereby expanding its arsenal.

Kapeka, a highly advanced threat, can infiltrate the target system through dropper software, ensuring long-term persistence. Its capabilities include conducting reconnaissance on the infected system and user, gathering information, creating additional files on the target system to run payloads sent by the attacker, removing existing malware installations and configurations, and sending the collected information to a remote server controlled by the attacker using the RSA algorithm.

The implications of this malware are not limited to providing attackers with an early toolset. It also grants them long-term access to the victim’s network, potentially leading to severe and prolonged damage. This underscores the critical importance of understanding and mitigating this threat.

Scope

Filename	crdss.exe
Filetype	Win32 EXE
Written Language	C/C++
MD5	50b5582904fe34451f5cb2362e11cb24
SHA1	80fb042b4a563efe058a71a647ea949148a56c7c
SHA256	bd07fb1e9b4768e7202de6cc454c78c6891270af02085c51fce5539db1386c3f
First Seen / Detection Date	28.06.2022
Initial Infection Vector	Unknown

Filename	mexal.wll
Filetype	Win32 DLL
Written Language	C/C++
MD5	5294aaf2ff80547172ebb9e0bcb52e0f
SHA1	9bbde40cab30916b42e59208fbcc09affef525c1
SHA256	f30b9f6e913798ca52154c88725ee262a7bf92fe7caac1ae2e5147e457b9b08a
First Seen / Detection Date	28.06.2022
Initial Infection Vector	Dropper

Mitigation Strategies

Watch for unexpected or suspicious processes, especially those launched by rundll32 or cmd.exe, which Kapeka commonly uses for executing and maintaining persistence.

Limit administrative privileges for users. Kapeka attempts various operations that require elevated privileges. By applying the principle of least privilege, you can limit what can be executed with non-administrative accounts.

Kapeka DLL is saved in the \LOCALAPPDATA\Microsoft directory with a random name and a .wll file extension. The presence of files with .wll extension in the target directory should be checked.

Kapeka backdoor uses the registry’s Run Keys to ensure persistence. The records made on these keys must be monitored to observe Kapeka’s presence.

Kapeka Dropper creates a BAT file in the C:\Users\username\AppData directory responsible for deleting itself to leave no trace in the file system. BAT file is also named randomly. The presence of such a file in the target directory may indicate the presence of the dropper responsible for running the Kapeka DLL.

We do not currently have information about how the infection chain started or how the first access was obtained, but Sandworm can use techniques such as phishing emails, compromised accounts, and vulnerabilities detected in services open to the internet, with reference to the characteristics of the threat actor.

Conclusion

This report provides a detailed technical analysis of the Kapeka backdoor malware developed by the Sandowm group. The malware includes a series of sophisticated capabilities. Kapeka is notable for its ability to deeply infiltrate target systems and exfiltrate data and its remote command and control functions. Malware poses a serious threat, particularly to organizations with information security vulnerabilities.

Our analysis has thoroughly examined Kapeka’s code structure, communication protocols, and behavioral characteristics, providing critical insights into how the malware propagates. This information can assist organizations in developing more effective protective strategies. Notably, the malware’s stealth techniques necessitate enhancements in alert systems to make them more sensitive.

Kapeka backdoor is a testament to its operations’ sophistication and commitment to long-term persistence, traits that align with those of an Advanced Persistent Threat (APT) group. Its architecture, featuring a multi-stage deployment with both dropper and backdoor functionalities, allows it to conduct initial reconnaissance and maintain access to targeted systems undetected. Its ability to execute arbitrary commands, manage files, and communicate securely with its command-and-control servers equips it to carry out a wide range of malicious activities, from data theft to delivering secondary payloads.

This blog post comes from the Sandworm’s New Arsenal: Kapeka Backdoor Technical Analysis report. If you want to download it as a PDFclick here