cyber.hendryadrian.com
Threat Research · hunt.io

Researchers Identify Suspected Oyster Backdoor Infrastructure Using JARM and HTML Hashes

· Original article ↗

Summary

Hunt.io used a JARM fingerprint and HTML response hash to identify four suspected Oyster backdoor domains hosted on OVH, then corroborated findings with VirusTotal and CleanUp.dll connections.

Key points

  • Oyster, also known as Broomstick or CleanUpLoader, has been linked to malvertising campaigns impersonating popular software, including a Microsoft Teams installer.
  • The backdoor sends victim information to hard-coded command-and-control domains through HTTP POST requests.
  • Analysts combined a JARM fingerprint with the HTML response body hash for a webpage titled “Soon” to find infrastructure resembling domains previously reported by Rapid7.
  • The query returned seven IP addresses, including three previously reported by Rapid7 and four additional suspected infrastructure hosts on OVH SAS.
  • VirusTotal results linked CleanUp.dll samples to Oyster and showed the /api/connectivity path used to transmit victim information.
  • The article cautions that a VirusTotal score of zero does not establish that an IP address or domain is benign.

Article Details

Attack Vectors
  • Malvertising campaigns disguised Oyster backdoor as installers for popular software, including a Microsoft Teams installer.
  • CleanUp.dll and CleanUp30.dll attempted to communicate with hard-coded C2 domains.
  • The backdoor sends victim information to a C2 domain in an HTTP POST request.
Defensive Notes
  • Hunt.io used a query combining JARM fingerprint 15d3fd16d29d29d00042d43d000000ed1cf37c9a169b41886e27ba8fad60b0 with HTTP response body hash 0c90ad9910cfb37c9969e14388707ef765ef5e73 to identify suspected Oyster infrastructure.
  • The article cautions that a VirusTotal score of 0 does not establish that an IP or domain is benign.

Indicators of compromise

TypeIndicatorContext
DOMAINcodeforprofessionalusers[.]comDomain identified by the article's detection query as suspected Oyster backdoor infrastructure.
DOMAINdotnetisforchildren[.]comDomain identified by the article's detection query as suspected Oyster backdoor infrastructure.
DOMAINfirstcountryours[.]euDomain identified as suspected Oyster backdoor infrastructure and listed among domains contacted by a CleanUp.dll sample.
DOMAINpostmastersoriginals[.]comDomain identified by the article's detection query as suspected Oyster backdoor infrastructure.
DOMAINretdirectyourman[.]euDomain Rapid7 identified as a malicious C2 contacted by Oyster backdoor DLLs.
DOMAINsupfoundrysettlers[.]usDomain Rapid7 identified as a malicious C2 contacted by Oyster backdoor DLLs.
DOMAINwherehomebe[.]comDomain Rapid7 identified as a malicious C2 contacted by Oyster backdoor DLLs.
IPV4139[.]99[.]221[.]140IP identified by the article's detection query as suspected Oyster backdoor infrastructure.
IPV4149[.]248[.]79[.]62IP associated with the malicious C2 domain wherehomebe[.]com.
IPV4162[.]19[.]237[.]181IP identified by the article's detection query as suspected Oyster backdoor infrastructure.
IPV4193[.]43[.]104[.]208IP identified by the article's detection query as suspected Oyster backdoor infrastructure.
IPV4206[.]166[.]251[.]114IP associated with the malicious C2 domain retdirectyourman[.]eu.
IPV451[.]195[.]232[.]46IP identified by the article's detection query as suspected Oyster backdoor infrastructure.
IPV464[.]95[.]10[.]243IP associated with the malicious C2 domain supfoundrysettlers[.]us.
SHA10c90ad9910cfb37c9969e14388707ef765ef5e73HTTP response body hash used with the JARM fingerprint to identify suspected Oyster infrastructure.

MITRE ATT&CK

T1041 · Exfiltration Over C2 ChannelThe backdoor sends victim information to its C2 domain in an HTTP POST request.T1071.001 · Web ProtocolsThe backdoor communicates with its hard-coded C2 domain using HTTP POST requests.

Malware

BroomstickOyster backdoor, also known as Broomstick (IBM) and CleanUpLoader (RussianPanda – X), has been linked to malvertising campaigns mimicking popular software. On June 21st, Rapid7 described how attackers disguised theCleanUpLoaderOyster backdoor, also known as Broomstick (IBM) and CleanUpLoader (RussianPanda – X), has been linked to malvertising campaigns mimicking popular software. On June 21st, Rapid7 described how attackers disguised theOysterOyster backdoor, also known as Broomstick (IBM) and CleanUpLoader (RussianPanda – X), has been linked to malvertising campaigns mimicking popular software. On June 21st, Rapid7 described how attackers disguised the

Products

DefenderNotably, CleanUp.dll has been linked to the Oyster backdoor. Furthermore, additional files appear to spoof Microsoft's Defender, potentially indicating a campaign aimed at users seeking antivirus software.Microsoft Teamsmimicking popular software. On June 21st, Rapid7 described how attackers disguised the backdoor as a Microsoft Teams installer, targeting unsuspecting users.

Tools

Huntfind additional C2 servers. We will start with the first IP, 64.95.10[.]243, and see what can be found in Hunt.VirusTotalFigure 7: Screenshot of 193.43.104[.]208. Note ports 80 & 443 (link here)To further corroborate our findings associated with the Oyster backdoor, we can analyze the domains using VirusTotal.

Related Articles