y5qa5B

ASERT Threat Intelligence Report 2016-03: The Four-Element Sword Engagement
The body of the document is about aid for the Tibetan community. A portion is reproduced here:
Document metadata indicates that someone using the name “bull”
was the last person to modify and save the document. The last
modification date was December 31, 2015 – the same day the mail
was sent to targets.
Rendering the Tibetan themed RTF document with a vulnerable
instance of Office results in the injection of the Grabber (aka
EvilGrab) malware into the ctfmon.exe process. Grabber provides all
of the usual Remote Access Trojan (RAT) capabilities that any actor
would want, such as the capability to remotely control the target
system, list files, download and execute, spy on the user, download other code and execute commands to
perform lateral movement, exfiltrate data, etc. For those seeking more background, a helpful document to
understand the full capabilities of Grabber was written by Unit 42 in 2015 [13].
Inside the compromised machine, the Process Hacker tool allows us to easily observe the injected process
ctfmon.exe initiating an outbound connection to the C2 180.169.28[.]58 on TCP/8080.
We can observe the User-­‐Agent value hardcoded inside the Grabber binary (as discussed in the “Uncovering
the Seven Pointed Dagger” document from Arbor ASERT (http://www.arbornetworks.com/blog/asert/wp-­‐
6 Proprietary and Confidential Information of Arbor Networks, Inc.