Chinese APT41 Uses DodgeBox Loader to Deploy MoonWalk Backdoor via Google Drive

EXECUTIVE SUMMARY

Researchers have uncovered a previously unknown loader named DodgeBox, linked to the China-based advanced persistent threat (APT) actor APT41, also known as Earth Baku. DodgeBox loads a newly discovered backdoor called MoonWalk, which bears striking similarities to APT41's StealthVector tool. This loader incorporates advanced evasion techniques and utilizes Google Drive for command-and-control (C2) communication, marking a significant evolution in APT41's capabilities. MoonWalk enhances APT41's toolkit by leveraging Google Drive for C2 and exploiting Windows Fibers to bypass detection by anti-virus (AV) and Endpoint Detection and Response (EDR) solutions, underscoring an advancement in their approach to evading security measures and maintaining persistent access.[emaillocker id="1283"]

DodgeBox is a reflective DLL loader written in C, designed to be sideloaded by signed legitimate executables like taskhost.exe. It employs multiple evasion techniques such as call stack spoofing, DLL sideloading, DLL hollowing, and environmental guardrails. The loader decrypts its configuration using AES-CFB encryption and validates the integrity of the configuration with hard-coded MD5 hashes. DodgeBox performs environment checks, resolves API addresses using a salted FNV1a hash, unhooks DLLs, disables Control Flow Guard (CFG), and ensures it runs on the intended target machine by verifying MAC addresses, computer names, and user privileges. The loader decrypts and keys the MoonWalk payload, utilizing a unique machine-specific approach for added security, and ultimately loads the payload using DLL hollowing techniques.

The MoonWalk backdoor is a malware written in C, sharing significant code similarities with DodgeBox, suggesting a common development toolkit. It incorporates evasion techniques such as DLL hollowing, import resolution, DLL unhooking, and call stack spoofing. MoonWalk uses Google Drive for C2 communication to blend in with legitimate network traffic and employs Windows Fibers to evade AV/EDR solutions by breaking up the control flow. It decrypts and loads two embedded plugins: a C2 plugin that uses a custom encrypted protocol for communication with an attacker-controlled Google Drive account and a utility plugin for compression and public-key cryptography. MoonWalk also features a modular design, allowing for easy updates and customization for various scenarios.

In conclusion, the analysis of DodgeBox reveals strong similarities to the StealthVector loader associated with APT41, reinforcing a moderate confidence in its attribution to APT41 / Earth Baku. The loader's use of DLL sideloading and telemetry data collection from targeted regions underscores the nature of this threat. Similarly, MoonWalk's advanced evasion techniques and modular design, including its use of Google Drive for command and control and Windows Fibers for security evasion, highlight the evolving capabilities of APT41. Both malware samples demonstrate a high level of necessitating enhanced security measures and ongoing vigilance to effectively counter these advanced threats.

THREAT PROFILE:

REFERENCES:

The following reports contain further technical details:
https://thehackernews.com/2024/07/chinese-apt41-upgrades-malware-arsenal.html