Kaspersky ToddyCat June 2022

Ninja has the ability to modify headers and URL paths to hide malicious traffic in HTTP requests.

Ninja has the ability to mimic legitimate services with customized HTTP URL paths and headers to hide malicious traffic.

Samurai can leverage an exfiltration module to download arbitrary files from compromised machines.

Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.

Ninja can enumerate the IP address on compromised systems.

Samurai can encrypt the names of requested APIs.

Samurai can compile and execute downloaded modules at runtime.

Samurai can encrypt API name strings with an XOR-based algorithm.

The Ninja payload is XOR encrypted and compressed. Ninja has also XORed its configuration data with a constant value of `0xAA`.

Ninja has compressed its data with the LZSS algorithm.

Samurai can deliver its final payload as a compressed, encrypted and base64-encoded blob.

Ninja can configure its agent to work only in specific time frames.

ToddyCat has used the name `debug.exe` for malware components.

Samurai has created the directory `%COMMONPROGRAMFILES%\Microsoft Shared\wmi\` to contain DLLs for loading successive stages.

Ninja has the ability to inject an agent module into a new process and arbitrary shellcode into running processes.

Ninja can enumerate processes on a targeted host.

Samurai can use a remote command module for execution via the Windows command line.

Ninja can change or create the last access or write times.

Ninja can use HTTP for C2 communications.

Samurai can use a .NET HTTPListener class to receive and handle HTTP POST requests.

Ninja can obtain the computer name and information on the OS from targeted hosts.

Samurai can use a specific module for file enumeration.

Ninja has the ability to enumerate directory content.

Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.

Ninja can proxy C2 communications including to and from internal agents without internet connectivity.

Ninja has the ability to use a proxy chain with up to 255 hops when using TCP.

Ninja can forward TCP packets between the C2 and a remote host.

Samurai can use a proxy module to forward TCP packets to external hosts.

China Chopper's server component can download remote files.

Samurai has been used to deploy other malware including Ninja.

The Ninja loader can call Windows APIs for discovery, process injection, and payload decryption.

Samurai has the ability to call Windows APIs.

The Samurai loader component can create multiple Registry keys to force the svchost.exe process to load the final backdoor.

Samurai can base64 encode data sent in C2 communications prior to its encryption.

Ninja can encode C2 communications with a base64 algorithm using a custom alphabet.

The Ninja loader component can decrypt and decompress the payload.

ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.

Ninja has gained execution through victims opening malicious executable files embedded in zip archives.

Ninja can store its final payload in the Registry under `$HKLM\SOFTWARE\Classes\Interface\` encrypted with a dynamically generated key based on the drive’s serial number.

Samurai can check for the presence and version of the .NET framework.

Samurai can create a service at `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost` to trigger execution and maintain persistence.

Ninja can create the services `httpsvc` and `w3esvc` for persistence .

Ninja can use pipes to redirect the standard input and the standard output.

ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.

Ninja has been distributed to victims via the messaging app Telegram.

Samurai can encrypt C2 communications with AES.

Ninja can XOR and AES encrypt C2 messages.

Ninja can obtain information on physical drives from targeted hosts.