Talos Bisonal Mar 2020

Bisonal has collected information from a compromised host.

Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.

Bisonal can execute ipconfig on the victim’s machine.

Bisonal has appended random binary data to the end of itself to generate a large binary.

Bisonal has used the MPRESS packer and similar tools for obfuscation.

Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.

Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.

Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.

Bisonal has added the exfiltrated data to the URL over the C2 channel.

Bisonal can obtain a list of running processes on the victim’s machine.

Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.

Bisonal's dropper creates VBS scripts on the victim’s machine.

Bisonal will delete its dropper and VBS scripts from the victim’s machine.

Bisonal has used commands and API calls to gather system information.

Bisonal can retrieve a file listing from the system.

Bisonal has supported use of a proxy server.

Bisonal has used raw sockets for network communication.

Bisonal has the capability to download files to execute on the victim’s machine.

Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.

Bisonal has deleted Registry keys to clean up its prior activity.

Bisonal has encoded binary data with Base64 and ASCII.

Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\microsoft\word\startup\` repository.

Bisonal has decoded strings in the malware using XOR and RC4.

Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.

Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.

Tonto Team has relied on user interaction to open their malicious RTF documents.

Bisonal can check to determine if the compromised system is running on VMware.

Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.

Bisonal has been modified to be used as a Windows service.

Bisonal has added itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.

Bisonal has been delivered as malicious email attachments.

Bisonal has used a dynamic DNS service for C2.

Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.