HTran and the Advanced Persistent Threat | Dell SecureWorks

HTran and the Advanced Persistent Threat

While researching one of the malware families involved in the RSA breach disclosed in March 2011, Dell SecureWorks CTU observed an interesting pattern in the network traffic of a related sample (MD5:53ba6845f57f8e9ef600ef166be3be14). When the sample under analysis attempted to connect to the C2 server at my.amazingrm.com (203.92.45.2), the server returned a succinct plain-text error message instead of the expected HTTP-formatted response:

[SERVER]connection to funn

Although the message was seemingly truncated, this pattern was enough to correlate the error string to a known (and fairly old) program called "HUC Packet Transmit Tool", or "HTran", for which source code can be readily found on the Internet:
http://read.pudn.com/downloads199/sourcecode/windows/935255/htran.cpp__.htm

HTran is a rudimentary connection bouncer, designed to redirect TCP traffic destined for one host to an alternate host. The source code copyright notice indicates that HTran was authored by "lion", a well-known Chinese hacker and member of "HUC", the Honker Union of China. The purpose of this type of tool is to disguise either the true source or destination of Internet traffic in the course of hacking activity.

HTran contains several debugging messages throughout the source code that are sent to the console or to the connecting client in order to diagnose connection issues. The part of the HTran source code that generated the error message seen in the trojan C2 response is shown below:


if(client_connect(sockfd2,host,port2)==0)
{
closesocket(sockfd2);
sprintf(buffer,"[SERVER]connection to %s:%d error\r\n", host, port2);
send(sockfd1,buffer,strlen(buffer),0);

The code is written so that if the connection bouncer is unable to connect to the hidden destination in order to relay the incoming traffic, the formatted error message containing the target host and port parameters will be sent to the connecting client. As long as there are no connection issues, HTran might be a useful tool to hide a trojan C2's true location - but, in the case of any connection downtime between the HTran host and the hidden C2, HTran will betray the location of the hidden C2 host.

Instances of HTran on multiple hosts could theoretically be chained together in order to add extra layers of obfuscation. However, in case of the final endpoint C2 being unavailable for any reason, the last link in the HTran chain will still pass its connection failure message up the chain, rendering all of the other layers of obfuscation useless. This tiny bit of error debugging code left in by the author can be quite useful if one wants to track HTran-bounced hacking activity to its source.

HTran Survey

Armed with the knowledge of HTran's transient error message formatting, Dell SecureWorks CTU was able to locate TCP packet captures containing HTran connection errors in response to traffic from other APT-related malware that had been previously executed in our sandnet. The following Snort signatures can be used by other organizations to search for HTran connection error messages in transit on their networks:

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"HTran Connection Redirect Failure Message"; flow:established,from_server; dsize:<80; content:"|5b|SERVER|5d|connection|20|to|20|"; depth:22; reference:url,www.secureworks.com/research/threats/htran/; sid:1111111111;)
alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"HTran Connection Redirect Failure Message (Unicode)"; flow:established,from_server; dsize:<160; content:"|5b00|S|00|E|00|R|00|V|00|E|00|R|005d00|c|00|o|00|n|00|n|00|e|00|c|00|t|00|i|00|o|00|n|002000|t|00|o|002000|"; depth:44; reference:url,www.secureworks.com/research/threats/htran/; sid:1111111112;)

In addition to locating historical packet captures containing evidence of HTran connection failures, Dell SecureWorks CTU implemented a scanning system which checks for the HTran error message in responses from active probing of more than a thousand IP addresses known to be associated with APT trojan activity currently or in the past. The results of this survey can be seen in the following table:


Malware C2 IP/Port

Associated Hostnames

Host-Related Malware Hashes

Hidden Destination IP/Port

12.38.236.41:443

epod.businessconsults.net
hapyy2010.lflinkup.net
info.businessconsults.net
pop.businessconsults.net
ssa.businessconsults.net
sys.businessconsults.net

3493fc0e4a76b9d12b68afc46cab7f34
fd4a4ac08f5a7271fbd9b8157d30244e
51744d77fc8f874934d2715656e1a2df

112.65.87.58:443
58.247.25.108:443

173.244.209.196:443

bbs.india-videoer.com
itiupdated.dyndns.info
news.india-videoer.com
www.india-videoer.com

1daa3e392d1fea79badfbcd86d765d32
855cea7939936e86016a0aedee1d2c24

123.120.102.251:443

204.45.228.140:80
204.45.228.140:443

create301.dyndns.info

00b9619613bc82f5fe117c2ca394a328

123.120.106.136:8080
123.120.117.98:9000
123.120.126.73:8080
123.120.127.146:9000

207.225.36.69:443

leets.hugesoft.org
rouji.freespirit.acmetoy.com
slnoa.newsonet.net
sos.businessconsults.net
trb.arrowservice.net
ug-aa.hugesoft.org
www.optimizon.com

cca75af9786d7364866f40b80dddcc5c

58.247.240.91:80

212.125.200.197:443

inter.earthsolution.org
quick.earthsolution.org

3a3bf6cab9702d0835e8425f4e9d7a9c

223.167.5.10:8000
223.167.5.250:8000
223.167.5.254:8000

212.125.200.204:443

bah001.blackcake.net
caci2.infosupports.com
doa.bigdepression.net
lucy2.businessconsults.net
lucy2.infosupports.com
lucy.blackcake.net
lucy.businessconsults.net
mantech.blackcake.net
news.businessconsults.net
qiao1.bigdepression.net
qiao2.bigdepression.net
qiao3.bigdepression.net
qiao4.bigdepression.net
qiao5.bigdepression.net
qiao6.bigdepression.net
sports.businessconsults.net
srs.infosupports.com

03557c3e5c87e6a121c58f664b0ebf18
8a873136b6e4dd70ff9470288ff99d93
bbf4212f979c32eb6bc43bd8ba5996f9

112.64.214.174:443

220.110.70.51:443

nsweb.hostent.org

c9067c06bb9e8a5304b93687c59e4e15

125.215.189.114:40781

60.249.150.162:443

argentinia.faqserv.com
epaserver.toythieves.com
mailserver.instanthq.com
mailserver.sendsmtp.com
moiserver.myftp.info
mosfdns.ddns.ms
office.lflink.com
san.www1.biz
seoulsummit.ddns.ms
songs.longmusic.com
sysinfo.mynumber.org
timeforbeat.ns01.us
www.cpear.ddns.us
yahoo2.epac.to

 

121.229.201.158:10009
121.229.201.238:10009

64.255.101.100

aar.bigdepression.net
conn.gxdet.com
db.billten.net
ddbb.gxdet.com
info.billten.net
info.dcfrr.com
info.helpngr.net
info.new-soho.com
info.scitence.net
mail.new-soho.com
mailsrv.scitence.net
news.billten.net
news.scitence.net
pop.dnsweb.org
techniq.whandjg.net
webmail.dcfrr.com
webmail.whandjg.net

056310138cb5ed295f0df17ac591173d
45a66ae3537488f7d63622ded64461e0
92e28cec1c82f5d82cbd80c64050c5ca
ec4d34c742d2d5714c600517f05c2253

112.64.213.249:443

68.96.31.136

gee.safalife.com
ghma.earthsolution.org
hav.earthsolution.org
java.earthsolution.org
quiet.earthsolution.org
special.earthsolution.org
visual.earthsolution.org
vop.earthsolution.org
vope.purpledaily.com

3a3bf6cab9702d0835e8425f4e9d7a9c
7cb055ac3acbf53e07e20b65ec9126a1

223.167.5.10:8000

72.167.34.54:443

catalog.earthsolution.org
ou2.infosupports.com
ou3.infosupports.com
ou7.infosupports.com
www2.wikaba.com
yang1.infosupports.com
yang2.infosupports.com

47a76cf2e60960405a492bc7f41b0483

58.247.27.232:443

HTran Survey Results

The hostnames in the table were gathered using passive DNS records showing that at one point in time they pointed to the IP address in question. The hostnames may currently be pointed at different IP addresses than shown, as they are rotated frequently. The domains involved are all known to be connected to a variety of different Advanced Persistent Threat (APT) trojans. In cases where a related sample has been analyzed by Dell SecureWorks CTU, the MD5 hash of the sample is provided.

The survey of HTran traffic shows a clear pattern that can be seen by analyzing the Autonomous System Number (ASN) owner of each hidden IP address:

17621 |   112.64.213.249 |CNCGROUP-SH China Unicom Shanghai network
17621 |   112.64.214.174 |CNCGROUP-SH China Unicom Shanghai network
17621 |     112.65.87.58 |CNCGROUP-SH China Unicom Shanghai network
4134 |  121.229.201.158 |CHINANET-BACKBONE No.31,Jin-rong Street
4134 |  121.229.201.238 |CHINANET-BACKBONE No.31,Jin-rong Street
4808 |  123.120.106.136 |CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
4808 |   123.120.117.98 |CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
4808 |   123.120.126.73 |CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
4808 |  123.120.127.146 |CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
4515 |  125.215.189.114 |ERX-STAR PCCW IMSBiz
60055 |     223.167.5.10 |CNCGROUP-SH China Unicom Shanghai network
60055 |    223.167.5.250 |CNCGROUP-SH China Unicom Shanghai network
60055 |    223.167.5.254 |CNCGROUP-SH China Unicom Shanghai network
17621 |    58.247.240.91 |CNCGROUP-SH China Unicom Shanghai network
17621 |    58.247.25.108 |CNCGROUP-SH China Unicom Shanghai network
17621 |    58.247.27.232 |CNCGROUP-SH China Unicom Shanghai network

Autonomous System Owner By HTran IP Address

Every hidden IP address observed in the HTran error messages captured during our survey is located on just a few different networks in the People's Republic of China (PRC). In almost every case, the observable C2 is in a different country, most likely the same country in which the victim institution is located.

htran_bouncers


It's not surprising that hackers using a Chinese hacking tool might be operating from IP addresses in the PRC. Most of the Chinese destination IPs belong to large ISPs, making further attribution of the hacking activity difficult or impossible without the cooperation of the PRC government.

Conclusion

Over the past ten years, we have seen dozens of families of trojans that have been implicated in the theft of documents, email and computer source code from governments, industry and activists. Typically when hacking or malware traffic is reported on the Internet, the location of the source IP is not a reliable indicator of the true origin of the activity, due to the wide variety of programs designed to tunnel IP traffic through other computers. However, occasionally we get a chance to peek behind the curtain, either by advanced analysis of the traffic and/or its contents, or due to simple programmer/user error. This is one of those cases where we were lucky enough to observe a transient event that showed a deliberate attempt to hide the true origin of an APT. This particular hole in the operational security of a certain group of APT actors may soon be closed, however it is impossible for them to erase the evidence gathered before that time. It is our hope that every institution potentially impacted by APT activity will make haste to search out signs of this activity for themselves before the window of opportunity closes.

 

Next Steps

phonepicCall Us Today
(877) 838-7947
UK +44 131 260 3044

SMB SOLUTIONS

Online Tools

  • Print this Page
  • Share This Resource





By completing this form you'll be opting in to receiving future communications about products and services from Dell SecureWorks.