China-Based Tropic Trooper Adopts New Malware Variants and Custom Encryption to Target Victims

Tropic Trooper

• The attackers extended the AES specification in a custom implementation by performing the inverted sequence of round operations twice.
• The trojan is bundled in a greyware tool named SMS Bomber, which is used for DoS attacks against phones. Such types of tools are generally used by beginner threat actors who want to carry out attacks against sites.

How does the infection work?

• The infection starts with downloading a malicious version of SMS Bomber, which contains the tool's binary and standard functionality. 
• The download has been modified to add additional code that injects into a notepad[.]exe process.
• The downloaded .exe file is the Nimbda loader that has SMS Bomber as an embedded executable.

The Yahoyah variant 

• This payload is a new variant of Yahoyah, which collects data about the host and then sends it to the C2 server. The collected information includes MAC address, computer name, and OS version, among others.
• The final payload, dropped by the Yahoyah executable, is inserted in a JPG image using steganography. The .exe is spotted as a TClient backdoor, used by Tropic Trooper in several past campaigns.

Conclusion