Dual-Platform Backdoor from a South Asian Threat Group: StealthServer

In my ongoing monitoring of cyber threats in South Asia, I’ve encountered a series of advanced persistent threat (APT) activities. This region has long been a hotspot for sophisticated cyberattacks, with various groups ramping up their operations in terms of frequency and technical complexity. Starting from early July, I’ve captured multiple new malware samples targeting both Windows and Linux platforms. These files often masquerade as legitimate documents related to meetings, procurement, or similar topics, such as “Meeting_Ltr_ID1543ops.pdf.desktop” or “PROCUREMENT_OF_MANPORTABLE_&_COMPAC.pdf.desktop”. When executed, they appear to open a harmless PDF to deceive the user, while the actual malicious payload runs silently in the background. The decoy PDFs typically cover themes like politics, military affairs, or conferences, all tied to a specific South Asian country.

1. Evasion and Anti-Analysis:

1. • Anti-Debug/Anti-Sandbox: Runs commands like tasklist /fi “imagename eq %s*” | find /i “%s” to scan for processes containing strings such as “VMware”, “VirtualBox”, “QEMU”, “Xen”, “Hyper-V”, “Parallels”, “KVM”, “Virtual”, “vbox”, or “vmware”. Also calls IsDebuggerPresent() and checks PEB DebugFlag. Scans for directories like “C:\analysis” or “C:\sandbox”, and blacklisted usernames like “admin”, “sandbox”, or “malware”.
   • Traffic Obfuscation: Loops requests to benign sites including “google.com”, “microsoft.com”, “cloudflare.com”, “amazon.com”, “facebook.com”, and “httpbin.org”.
   • Hidden Execution: Spawns a concealed PowerShell window via cmd /C powershell -WindowStyle Hidden -Command exit.
   • Mutex Check: Computes SHA256 of “nodejs_instance_mutex”, formats as “Global%x”, and uses PowerShell to verify if an instance is running: powershell -Command “$mutex = New-Object System.Threading.Mutex($false, ‘%s’); if($mutex.WaitOne(0)) { exit 0 } else { exit 1 }.

2. Persistence Strategies:

1. • File Hiding: Copies itself to %APPDATA%\nodejs.exe and applies attrib +h +s for hidden/system attributes.
   • Registry Autostart: Adds key via reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v nodejs /t REG_SZ /d “%s” /f.
   • Startup Shortcut: Creates a PowerShell script “create_shortcut.ps1” to generate “System Update.lnk” in the Startup folder, pointing to nodejs.exe.
   • Scheduled Service: Uses sc create “NodeJSUpdater” binPath= “%s” start= auto DisplayName= “Node.js Background Updater” type= own and sc start “NodeJSUpdater”.

3. C2 Communication:

C2 at “modindia.serveminecraft[.]net:8080” using TCP with JSON data. Beacon includes hardcoded ID, location (“windows – [hostname]”), and AV name. Supports commands: LIST (file enumeration), UPLOAD (file exfil), DOWNLOAD (file retrieval). Junk code is woven into the comms logic for added obfuscation.

Discovered in late August, this variant (“proxifiersetup.exe”) features obfuscated function names and a dev path “D:/bossmaya/newblkul/client/client_obfuscated.go”. It includes “ULTRA-CLIENT” strings and adds anti-debug checks for tools like OllyDbg, x64dbg, and IDA. Core functions remain similar, with minor tweaks.

C2 uses XOR-encrypted domains but falls back to IPs “45.155.54[.]122” and “45.155.54[.]62” on port 8080. Beacon adds “os” field; ID is random 8-byte hex. Commands unchanged: LIST, UPLOAD, DOWNLOAD.