fireeye-operation-saffron-rose

The “Stealer” Builder and ToolsDuring our research, we recovered two different tools used by the members of the Ajax Security Teamin conjunction with targeted intrusion activities. The first tool, labeled the ‘Stealer Builder’ was compiledon 2014-04-08. This compile date may indicate that the group is still active.Upon executing the ‘Stealer Builder’ the user is presented with an option to load the ‘Builder’ or to‘Decrypt’ logs generated from a victim and exfiltrated to a command-and-control (CnC) server underthe groups’ control.Figure 8: The Stealer ToolThe Builder option enables an attacker to configure a new Stealer backdoor. The user can configure thenew backdoor to connect to a specific CnC server with a personalized username and password. Theattacker can bind the backdoor to a legitimate application of his or her choosing, or they can cloak itwith an icon designed to make the backdoor appear as though it is a legitimate file. We also noted thatthe Builder did not allow the attacker to select a new passphrase or salt used to encrypt the stolen data.The passphrase ‘HavijeBaba’ and a salt of ‘salam!*%#’ are both hardcoded into the builder.Figure 9: The Stealer BuilderFireEye, Inc. Operation Saffron Rose 11