ABCloader (Dropper) – Malware

Overview

ABCloader is a sophisticated and elusive malware variant that has been observed in targeted cyberattacks, particularly those attributed to the newly identified APT group Actor240524. Discovered during a series of spear-phishing campaigns aimed at Azerbaijani and Israeli diplomats, ABCloader represents a new threat in the cybercriminal arsenal. The malware is delivered through a Word document embedded with a malicious macro, luring victims into executing the payload by prompting them to enable content. Once activated, ABCloader decrypts and loads its malicious payload, which includes the ABCsync Trojan. This malware’s primary purpose is to execute a series of complex functions, such as stealing sensitive information, modifying files, and communicating with a command-and-control (C2) server to receive remote instructions.

The design and operation of ABCloader show advanced techniques for evading detection and analysis. It employs various anti-sandbox and anti-debugging methods to hinder forensic efforts, including API encryption, hardware breakpoint detection, and screen resolution checks. These countermeasures suggest that the malware is specifically designed to avoid being detected by cybersecurity tools and analysts. Additionally, ABCloader is capable of dynamically decrypting and executing its payloads, including loading the ABCsync Trojan, which is responsible for carrying out the more damaging operations like stealing files and executing remote shell commands.

Targets

Public Administration

How they operate

Initial Infection and Execution

ABCloader typically gains access to its target systems through phishing emails, a method that remains one of the most effective vectors for initial infection. These emails often contain malicious attachments, such as Word documents, which leverage macros to execute the malware. Once the user opens the attachment and enables macros, the malware is triggered. The macro code is designed to drop a PowerShell or VBScript script that initiates the main payload of ABCloader.

The script often obfuscates its contents, using base64 encoding or other encryption methods to make detection by security tools more difficult. Upon execution, the script decrypts and runs the ABCloader payload, which may be delivered in the form of an executable file or a dynamic-link library (DLL). This payload is the core of the attack, designed to carry out various malicious activities ranging from credential theft to establishing persistent access to the infected system.

Persistence Mechanisms

One of the hallmarks of ABCloader is its ability to maintain a foothold on the infected machine. The malware employs several persistence techniques to ensure it remains active even after system reboots. A common method involves modifying the system’s registry to create autostart entries, which ensures the malware is automatically executed during system startup. These entries can be located in registry keys that are specifically designed to load programs at logon, such as HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Another persistence mechanism used by ABCloader is the manipulation of startup directories or task scheduler entries. These techniques allow the malware to automatically reload if it is removed or terminated by the user or antivirus software. The malware’s persistence strategy ensures that it can continuously operate without requiring repeated user intervention.

Evasion and Obfuscation

ABCloader employs a variety of evasion techniques to avoid detection by both security analysts and automated defense systems. One of its primary strategies is code obfuscation. The malware uses encryption to hide its payload and evade detection by traditional signature-based antivirus tools. For example, the initial payload might be encrypted in such a way that it only decrypts when executed, making it more difficult to detect in its dormant state.

Furthermore, ABCloader makes use of fileless execution tactics, where it minimizes its footprint on disk by running directly from memory. This reduces the chances of detection by traditional file-scanning methods and allows the malware to operate in stealth mode. By staying memory-resident, ABCloader can execute commands and collect data without leaving easily traceable artifacts on the file system.

Command and Control (C2) Communication

After gaining access to the system, ABCloader establishes a communication channel with its command-and-control (C2) server. This communication is often conducted over HTTPS or other application-layer protocols, providing an encrypted and secure means of sending and receiving commands. ABCloader’s C2 server can issue a wide range of commands to the infected machine, including commands to download additional payloads, execute further exploitation activities, or exfiltrate sensitive data.

The use of encrypted channels ensures that the malware can bypass network monitoring tools, which might otherwise be able to detect suspicious outbound traffic. By mimicking legitimate encrypted traffic, ABCloader is able to covertly exfiltrate data from the infected machine to the attacker’s remote infrastructure. This data could include sensitive files, user credentials, and other valuable information that can be used for further exploitation or sold on the black market.

Data Exfiltration and Additional Payloads

One of the primary goals of ABCloader is to facilitate data theft. As it establishes communication with its C2 server, the malware exfiltrates stolen data, typically using the same encrypted communication channels. The exfiltrated data may include a variety of sensitive information such as login credentials, financial data, and personally identifiable information (PII), which can be used for identity theft, further cyber-attacks, or sold to other cybercriminal groups.

In some cases, ABCloader will download additional payloads from the C2 server after the initial infection. These payloads can range from other forms of malware, such as ransomware or keyloggers, to tools that escalate the attacker’s privileges or extend the attack’s reach across the network. By continuously pulling down new payloads, ABCloader ensures that the attack can evolve and adapt to new security measures, thereby keeping the victim’s systems compromised for as long as possible.

Conclusion

ABCloader is a highly adaptive and resilient malware strain that leverages modern attack techniques to infiltrate, persist, and exfiltrate data from infected systems. Its use of phishing for initial access, obfuscation for evasion, and encrypted C2 communication channels for data exfiltration makes it particularly difficult to detect and neutralize. Organizations must remain vigilant against ABCloader and similar threats by employing advanced threat detection solutions, training users to recognize phishing attempts, and regularly updating security defenses.

MITRE Tactics and Techniques

Initial Access (TA0001)

Phishing (T1566)

ABCloader is primarily delivered through spear-phishing emails, often containing malicious attachments like Word documents with embedded macros. These documents entice users to enable macros, triggering the infection process.

Execution (TA0002)

Scripting (T1064)

Once the macro is activated by the victim, it runs a script that drops and executes the ABCloader malware. The script is used to decrypt and load the malware payload.

User Execution (T1203)

The initial execution of the malware depends on the user enabling macros or performing actions that execute the embedded malicious script in the document.

Persistence (TA0003)

Boot or Logon Autostart Execution (T1547)

ABCloader may employ techniques for maintaining persistence on the infected system, ensuring that it remains active even after a system reboot. This could involve creating registry keys or placing components in the startup directory.

Privilege Escalation (TA0004)

Exploitation for Privilege Escalation (T1068)

In some cases, the malware may attempt to exploit known vulnerabilities to elevate privileges on the infected system, enabling it to perform more privileged operations.

Defense Evasion (TA0005)

Obfuscated Files or Information (T1027)

ABCloader uses encryption and obfuscation techniques to hide its payloads and evade detection by security tools. The malware dynamically decrypts and executes code, making it harder for analysts to detect.

Indicator Removal from Tools (T1070)

To avoid detection, ABCloader may remove traces of its activities, such as clearing event logs or deleting files used in the attack chain.

Command and Control (TA0011)

Application Layer Protocol (T1071)

ABCloader communicates with its command-and-control (C2) server using application-layer protocols like HTTP/S, often encrypted to evade detection and monitoring.

Encrypted Channel (T1071.001)

The communication between ABCloader and the C2 server is encrypted, ensuring that attackers can send commands and exfiltrate data securely.

Exfiltration (TA0010)

Exfiltration Over C2 Channel (T1041)

ABCloader is capable of exfiltrating stolen data back to the attackers via the encrypted C2 communication channel. This stolen data can include sensitive files and credentials.

Reference: 

• New APT Group Actor240524: A Closer Look at Its Cyber Tactics Against Azerbaijan and Israel