MONSOON – ANALYSIS OF AN APT CAMPAIGN

Forcepoint Security Labs | Special Investigations
No further commands were receive any after this.
UNKNOWN LOGGER PUBLIC V 1.5
Unknown Logger is another
malware component used in
MONSOON. It is a publicly
released, free backdoor. It is
capable of credential theft from
browsers, keylogging, taking
screenshots, spreading itself
laterally, and downloading
second stage malware.
In 2012, a user named "The
Unknown" publicly released a
free version of a credential
stealing worm on
hackforums[.net] called
"Unknown Logger Public".
The actors have been using
version 1.5 of this malware in
some of their weaponised
documents. It is likely that they
simply downloaded and built
their own version from the
publicly available version 1.5
on Hackforums.
Figure 33 – Unknown Logger Server Configuration Panel
Unknown Logger is dropped by at least two 15 of the weaponised documents analysed. Both of these
documents exploit CVE-2014-6352.
15
SHA1: 824013c9d8b2aab1396c4a50579f8bd4bf80abdb
SHA1: e27d3cfc9141f618c5a8c075e7d18af11a012710
MONSOON – ANALYSIS OF AN APT CAMPAIGN Revision: 1.07 | TLP-WHITE | 37/57