Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
<strong>DESTOVER</strong> “BASICHWP” BACKDOOR, SEP 2015<br />
This generation of backdoors is similar to the previous ones in that they use a custom SSL-like protocol for C&C<br />
communication. They have been further simplified, but use more C++ classes, and the 256-bit stream cipher<br />
Caracachs (hardcoded password “abcdefghijklmnopqrstuvwxyz012345”) is used for both network traffic and API<br />
obfuscation. The same password is used in the example code for Caracachs found online (8), so no great effort has<br />
been taken to protect the encryption.<br />
This variety of Destover is the third we have seen installed by documents exploiting the CVE-2015-6585 HWP<br />
vulnerability.<br />
Command word set for this generation of backdoors is 0x8378-0x8390.<br />
Decoy document content include a CV from an apparently South Korean individual, and a document apparently<br />
from the South Korean Foreign Affairs and Unification Committee, as seen below.<br />
Decoy: State information systems audit planning document, Aug 2015
Change language