A Hunting Story

The Recorded Future tableview facilitates quick deconstruction of aggregated references, specifically in paste sites
over the past year, to isolate relevant and evolving adversary techniques.
Recorded Future’s table view categorizing base64 encoding references by filename extension and hash.
Let’s explore five events recently discovered in Recorded Future (and Recorded Future partners) that contain
similarities to the nation-state attack:
1. Base64 encoded PE file (first-stage implant) located on Pastebin that connects to a raw Pastebin page to download njRAT (secondstage
implant).
2. Additional base64 encoded njRAT sample located on Pastebin.
3. Third base64 encoded njRAT sample on Pastebin.
4. Examples of base64 encoded strings in web favicons.
5. Examples of base64 encoded strings in DNS TXT records.
1. Pastebin first-stage implant leads to Pastebin second-stage implant.
Our first example originates from hxxp://pastebin.com/MwRqGr2v (also cached in Recorded Future), which is a Visual
Basic program that contains a function that converts the obfuscated text on line two into binary data (a portable
executable file). Decoding the string creates a file with the following properties:
MD5: 938ea0d64bd83bd4e70a1eaa32620846
SHA1: 5c0cd0be6e32bf38136d48478fcdb99c4eed2a35
SHA256: 03a3ea9a13078f83fa080e0cd67ff5d7dd2b0d4333ddc67f9a51e0cba7242014
IMPHASH: f34d5f2d4577ed6d9ceec516c1f5a744
Size: 4.5 KB
Recorded Future Threat Intelligence Report
10