THE HISTORY OF THE DARKSEOUL GROUP AND THE SONY INTRUSION MALWARE DESTOVER

THE DESTOVER FAMILY
DESTOVER “B076E058” BACKDOORS, FEB-JUNE 2014.
This sub variant has been named “b076e058” based on the first portion of the RSA authentication key used for its
server handshake.
Most samples share the ChopString and XOR-A7 obfuscation functions with the Sony-associated malware
eff542ac8e37db48821cb4e5a7d95c044fff27557763de3a891b40ebeb52cc55. They also declare API calls in the
same way.
Samples of this variant were all compiled with the library name “Troy.dll” in the Export Table, similar to what
McAfee documented in their “Operation Troy” paper (5) on destructive attacks against South Korean targets.
Troy.dll visible in 10d3ab45077f01675a814b189d0ac8a157be5d9f1805caa2c707eecbb2cbf9ac
This variant is typically installed as service, with one export - “ServiceMain”. Its main purpose is to listen on a given
port and accept commands. The integer codes used for these commands are:
A variant: 0x54b7- 0x54cb, with the exception of 0x54be and 0x54ca.
B variant: 0x54b7- 0x54cb, with the exception of 0x54be and 0x54ca, and the addition of 0x54d0.
The installation is done by unobfuscated dropper executables, which install the service DLLs after performing some
systems checks.