Open Directory Reveals Sliver C2 Malware Chain Resembling Stargazer Goblin Tactics

Sep 24, 2024 · Original article ↗

Summary

Researchers analyzed an exposed directory containing a disguised shortcut, obfuscated scripts, and malware payloads including Sliver C2. The tactics resemble Stargazer Goblin activity, but the researchers say attribution is unconfirmed.

Key points

An exposed server hosted files disguised as graphic-design material, including a PDF-named shortcut that launched a hidden HTML/HTA chain.
Obfuscated VBScript and PowerShell downloaded and ran three binary payloads; one was configured to connect to Sliver C2 at the server's port 8888.
A separate obfuscated PowerShell script contained C# code to compress files, encrypt chunks with XOR, and upload them over HTTP to a private IP address.
The HTML page also contacted a school website in Chile; the referenced PHP file was unavailable during the investigation.
File types, delivery methods, and script-variable patterns resemble those reported in Stargazer Goblin campaigns, but the researchers found no direct evidence linking the activity to the group.
The researchers noted differences in execution methods and sophistication that could indicate another actor or an attempt to imitate known tactics.

Article Details

Attack Vectors: A .url shortcut disguised as a PDF downloads a decoy HTML page, which embeds an HTA file from the open directory.
The HTA runs obfuscated VBScript that invokes PowerShell to download and execute files from the directory.
The PowerShell script downloads three .bin files and pdfreader.exe to the Temp directory and runs pdfreader.exe.
A separate PowerShell script compresses files, encrypts them in chunks, and uploads them using HTTP POST requests to a private IP address.
The article says phishing or drive-by download may deliver the ZIP file, but this delivery method is an assumption.
Defensive Notes: Investigate and block the reported malicious open-directory infrastructure and its associated download paths, including the Sliver C2 port.
Inspect suspicious .url shortcuts, HTA files, obfuscated VBScript and PowerShell, and unexpected downloads or execution from temporary directories.
Monitor for shellcode execution in legitimate processes and HTTP POST uploads to the reported private-IP endpoint.
The authors caution that similarities to Stargazer Goblin are not sufficient for definitive attribution.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`books[.]bluerangers[.]site`	Domain reported resolving to the open-directory server.
IPV4	`10[.]162[.]221[.]3`	Private IP address used as the destination for the script's data-exfiltration uploads.
IPV4	`52[.]156[.]24[.]251`	Open-directory server hosting files the article identifies as malicious; port 8888 served as the Sliver C2.
SHA256	`44daec80b70c40d8a03b15d89ab8f85590551606063bc3b12a74498ac065cb44`	Hash listed for /lr/12bre356yh.bin, identified as a PyInstaller executable.
SHA256	`588abfb199a1f9a199c8cfe072b551f844289fd26d043b510915a4da8ed781f7`	Hash of the PowerShell script that downloads the .bin files and pdfreader.exe.
SHA256	`5a782ed1af8a937f691391479e38fef11b9e3e48c7efec832f2e42e801ec5756`	Hash of Logo_Modernism.hta, which contains obfuscated VBScript that downloads become.txt.
SHA256	`808ff1ef0360c8c58a523eccf8a6107b9905393fea2384f58e05ee3cee15ded4`	Hash listed for /lr/12bre356h.bin, identified as Sliver malware.
SHA256	`a738e4deae350b369aef566558c430fa3a8ac52dbdcb1f27a676fde9f7db9cbe`	Hash of the decoy HTML page containing an iframe that downloads Logo_Modernism.hta.
SHA256	`bfe8d4bf3ccf26321b9af67fe7baa33d27a88e03aeee7369b00ed3724c8a451b`	Hash listed for Archive.zip, which contained the deceptive PDF shortcut.
SHA256	`cdfb1afbd30b1eb484cc0e13caf2dd791429d8e9fbaedee77dce2a5a8e31e540`	Hash of the shortcut file identified as downloading Logo_Modernism.html.
SHA256	`d63d4a50460b6797eb177dc9728ba6454853250d0ee3b0e50d7d9e32882bcf4b`	Hash of /lr/12wefre356yh.bin, identified as a Win32 executable.
SHA256	`e64112efcfe916abad6d4c86b4cc14973e6f9b30694781190ca21d05b687029f`	Hash of code.ps1, identified as a data-exfiltration tool.
URL	`hxxp[:]//10[.]162[.]221[.]3:63434`	HTTP destination for chunked data uploads by the decoded exfiltration script.
URL	`hxxp[:]//52[.]156[.]24[.]251:8888`	Sliver C2 endpoint identified by the article.
URL	`hxxp[:]//52[.]156[.]24[.]251/become.txt`	Open-directory URL from which the HTA downloads PowerShell code used to retrieve the binary files.
URL	`hxxp[:]//52[.]156[.]24[.]251/lr/12bre356yh.bin`	Open-directory URL for a binary identified as a PyInstaller executable.
URL	`hxxp[:]//52[.]156[.]24[.]251/lr/12bre35yh.bin`	Open-directory URL for a binary described as containing shellcode.
URL	`hxxp[:]//52[.]156[.]24[.]251/lr/12wefre356yh.bin`	Open-directory URL for a binary described as containing shellcode.
URL	`hxxp[:]//52[.]156[.]24[.]251/lr/pdfreader.exe`	Open-directory URL for the executable downloaded and run by the PowerShell script.
URL	`hxxps[:]//cbmelipilla[.]cl/te/hhhh.php`	Specific PHP resource contacted by the decoy page; the article says the legitimate school site was likely compromised and the resource was unavailable at publication.