THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

NOV 2014: SONY ATTACK DESTOVER BACKDOOR SAMPLES ARE BASED ON KORDLLBOT
The Destover “lightweight backdoor” (sha256
4c2efe2f1253b94f16a1cab032f36c7883e4f6c8d9fc17d0ee553b5afb16330c) mentioned in official statements
related to the Sony intrusion is a digitally signed file. There is also an almost identical unsigned file in existence with
the sha256 eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55. This unsigned file is the
original. It was established that the signed file was created as a “joke” by a researcher (4).
We were able to locate more malware samples similar to this backdoor. Many of these were created in a
timeframe well before the Sony intrusion came to light. Some also match the import hash indicators mentioned in
the US-CERT advisory, though import hashes are non-unique indicators and cannot always be relied upon.
Closer investigation reveals that this Destover sample is indeed derived from the same source base as KorDllbot.
This is based on the following indicators:
• The Chopstring API string obfuscation
• The CMXE command line construction
• Same way of declaring API’s
• Similarities with later samples, such as:
o A printf “MessageThread” statement in the beginning of the command handling function (similar
to Destover “MessageThread” samples)
o Use of the XOR-A7 encoding to decode strings (similar to Destover “b076e058” samples)
Throughout 2014 and 2015 and still ongoing in 2016, Destover-related backdoors have continued to be used in
various campaigns. They share many common traits, but there are also clear differences in functionality, hinting at
a common source repository but where customization is added as needed. Some subfamilies have received their
own variant names – i.e. Volgmer and Duuzer – while others have no separate moniker. See appendix for detailed
descriptions of variants.