0 Results Found
            Back To Results
              Threat Analysis

              HTran and the Advanced Persistent Threat

              • Author: Joe Stewart, Director of Malware Research, Dell SecureWorks Counter Threat Unit Research Team
              • Date: August 3, 2011

              While researching one of the malware families involved in the RSA breach disclosed in March 2011, Dell SecureWorks CTU observed an interesting pattern in the network traffic of a related sample (MD5:53ba6845f57f8e9ef600ef166be3be14). When the sample under analysis attempted to connect to the C2 server at my.amazingrm.com (203.92.45.2), the server returned a succinct plain-text error message instead of the expected HTTP-formatted response:

              [SERVER]connection to funn 
              
              

              Although the message was seemingly truncated, this pattern was enough to correlate the error string to a known (and fairly old) program called "HUC Packet Transmit Tool", or "HTran", for which source code can be readily found on the Internet:
              http://read.pudn.com/downloads199/sourcecode/windows/935255/htran.cpp__.htm

              HTran is a rudimentary connection bouncer, designed to redirect TCP traffic destined for one host to an alternate host. The source code copyright notice indicates that HTran was authored by "lion", a well-known Chinese hacker and member of "HUC", the Honker Union of China. The purpose of this type of tool is to disguise either the true source or destination of Internet traffic in the course of hacking activity.

              HTran contains several debugging messages throughout the source code that are sent to the console or to the connecting client in order to diagnose connection issues. The part of the HTran source code that generated the error message seen in the trojan C2 response is shown below:

              if(client_connect(sockfd2,host,port2)==0)
              {
              closesocket(sockfd2);
              sprintf(buffer,"[SERVER]connection to %s:%d error\r\n", host, port2);
              send(sockfd1,buffer,strlen(buffer),0);

              The code is written so that if the connection bouncer is unable to connect to the hidden destination in order to relay the incoming traffic, the formatted error message containing the target host and port parameters will be sent to the connecting client. As long as there are no connection issues, HTran might be a useful tool to hide a trojan C2's true location - but, in the case of any connection downtime between the HTran host and the hidden C2, HTran will betray the location of the hidden C2 host.

              Instances of HTran on multiple hosts could theoretically be chained together in order to add extra layers of obfuscation. However, in case of the final endpoint C2 being unavailable for any reason, the last link in the HTran chain will still pass its connection failure message up the chain, rendering all of the other layers of obfuscation useless. This tiny bit of error debugging code left in by the author can be quite useful if one wants to track HTran-bounced hacking activity to its source.

              HTran Survey

              Armed with the knowledge of HTran's transient error message formatting, Dell SecureWorks CTU was able to locate TCP packet captures containing HTran connection errors in response to traffic from other APT-related malware that had been previously executed in our sandnet. The following Snort signatures can be used by other organizations to search for HTran connection error messages in transit on their networks:

              alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"HTran Connection Redirect Failure Message"; 
              flow:established,from_server; dsize:<80; content:"|5b|SERVER|5d|connection|20|to|20|"; depth:22; 
              reference:url,www.secureworks.com/research/threats/htran/; sid:1111111111;) 
              alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"HTran Connection Redirect Failure Message 
              (Unicode)"; flow:established,from_server; dsize:<160; content:"|5b00|S|00|E|00|R|00|V|00|E|00|R|
              005d00|c|00|o|00|n|00|n|00|e|00|c|00|t|00|i|00|o|00|n|002000|t|00|o|002000|"; depth:44; 
              reference:url,www.secureworks.com/research/threats/htran/; sid:1111111112;) 
              
              

              In addition to locating historical packet captures containing evidence of HTran connection failures, Dell SecureWorks CTU implemented a scanning system which checks for the HTran error message in responses from active probing of more than a thousand IP addresses known to be associated with APT trojan activity currently or in the past. The results of this survey can be seen in the following table:


              Malware C2 IP/Port

              Associated Hostnames

              Host-Related Malware Hashes

              Hidden Destination IP/Port

              12.38.236.41:443

              epod.businessconsults.net
              hapyy2010.lflinkup.net
              info.businessconsults.net
              pop.businessconsults.net
              ssa.businessconsults.net
              sys.businessconsults.net

              3493fc0e4a76b9d12b68afc46cab7f34
              fd4a4ac08f5a7271fbd9b8157d30244e
              51744d77fc8f874934d2715656e1a2df

              112.65.87.58:443
              58.247.25.108:443

              173.244.209.196:443

              bbs.india-videoer.com
              itiupdated.dyndns.info
              news.india-videoer.com
              www.india-videoer.com

              1daa3e392d1fea79badfbcd86d765d32
              855cea7939936e86016a0aedee1d2c24

              123.120.102.251:443

              204.45.228.140:80
              204.45.228.140:443

              create301.dyndns.info

              00b9619613bc82f5fe117c2ca394a328

              123.120.106.136:8080
              123.120.117.98:9000
              123.120.126.73:8080
              123.120.127.146:9000

              207.225.36.69:443

              leets.hugesoft.org
              rouji.freespirit.acmetoy.com
              slnoa.newsonet.net
              sos.businessconsults.net
              trb.arrowservice.net
              ug-aa.hugesoft.org
              www.optimizon.com

              cca75af9786d7364866f40b80dddcc5c

              58.247.240.91:80

              212.125.200.197:443

              inter.earthsolution.org
              quick.earthsolution.org

              3a3bf6cab9702d0835e8425f4e9d7a9c

              223.167.5.10:8000
              223.167.5.250:8000
              223.167.5.254:8000

              212.125.200.204:443

              bah001.blackcake.net
              caci2.infosupports.com
              doa.bigdepression.net
              lucy2.businessconsults.net
              lucy2.infosupports.com
              lucy.blackcake.net
              lucy.businessconsults.net
              mantech.blackcake.net
              news.businessconsults.net
              qiao1.bigdepression.net
              qiao2.bigdepression.net
              qiao3.bigdepression.net
              qiao4.bigdepression.net
              qiao5.bigdepression.net
              qiao6.bigdepression.net
              sports.businessconsults.net
              srs.infosupports.com

              03557c3e5c87e6a121c58f664b0ebf18
              8a873136b6e4dd70ff9470288ff99d93
              bbf4212f979c32eb6bc43bd8ba5996f9

              112.64.214.174:443

              220.110.70.51:443

              nsweb.hostent.org

              c9067c06bb9e8a5304b93687c59e4e15

              125.215.189.114:40781

              60.249.150.162:443

              argentinia.faqserv.com
              epaserver.toythieves.com
              mailserver.instanthq.com
              mailserver.sendsmtp.com
              moiserver.myftp.info
              mosfdns.ddns.ms
              office.lflink.com
              san.www1.biz
              seoulsummit.ddns.ms
              songs.longmusic.com
              sysinfo.mynumber.org
              timeforbeat.ns01.us
              www.cpear.ddns.us
              yahoo2.epac.to

               

              121.229.201.158:10009
              121.229.201.238:10009

              64.255.101.100

              aar.bigdepression.net
              conn.gxdet.com
              db.billten.net
              ddbb.gxdet.com
              info.billten.net
              info.dcfrr.com
              info.helpngr.net
              info.new-soho.com
              info.scitence.net
              mail.new-soho.com
              mailsrv.scitence.net
              news.billten.net
              news.scitence.net
              pop.dnsweb.org
              techniq.whandjg.net
              webmail.dcfrr.com
              webmail.whandjg.net

              056310138cb5ed295f0df17ac591173d
              45a66ae3537488f7d63622ded64461e0
              92e28cec1c82f5d82cbd80c64050c5ca
              ec4d34c742d2d5714c600517f05c2253

              112.64.213.249:443

              68.96.31.136

              gee.safalife.com
              ghma.earthsolution.org
              hav.earthsolution.org
              java.earthsolution.org
              quiet.earthsolution.org
              special.earthsolution.org
              visual.earthsolution.org
              vop.earthsolution.org
              vope.purpledaily.com

              3a3bf6cab9702d0835e8425f4e9d7a9c
              7cb055ac3acbf53e07e20b65ec9126a1

              223.167.5.10:8000

              72.167.34.54:443

              catalog.earthsolution.org
              ou2.infosupports.com
              ou3.infosupports.com
              ou7.infosupports.com
              www2.wikaba.com
              yang1.infosupports.com
              yang2.infosupports.com

              47a76cf2e60960405a492bc7f41b0483

              58.247.27.232:443


              HTran Survey Results

              The hostnames in the table were gathered using passive DNS records showing that at one point in time they pointed to the IP address in question. The hostnames may currently be pointed at different IP addresses than shown, as they are rotated frequently. The domains involved are all known to be connected to a variety of different Advanced Persistent Threat (APT) trojans. In cases where a related sample has been analyzed by Dell SecureWorks CTU, the MD5 hash of the sample is provided.

              The survey of HTran traffic shows a clear pattern that can be seen by analyzing the Autonomous System Number (ASN) owner of each hidden IP address:

              17621  |  112.64.213.249  |  CNCGROUP-SH China Unicom Shanghai network
              17621  |  112.64.214.174  |  CNCGROUP-SH China Unicom Shanghai network
              17621  |  112.65.87.58    |  CNCGROUP-SH China Unicom Shanghai network
              4134   |  121.229.201.158 |  CHINANET-BACKBONE No.31,Jin-rong Street
              4134   |  121.229.201.238 |  CHINANET-BACKBONE No.31,Jin-rong Street
              4808   |  123.120.106.136 |  CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
              4808   |  123.120.117.98  |  CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
              4808   |  123.120.126.73  |  CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
              4808   |  123.120.127.146 |  CHINA169-BJ CNCGROUP IP network China169 Beijing Province Network
              4515   |  125.215.189.114 |  ERX-STAR PCCW IMSBiz
              60055  |  223.167.5.10    |  CNCGROUP-SH China Unicom Shanghai network
              60055  |  223.167.5.250   |  CNCGROUP-SH China Unicom Shanghai network
              60055  |  223.167.5.254   |  CNCGROUP-SH China Unicom Shanghai network
              17621  |  58.247.240.91   |  CNCGROUP-SH China Unicom Shanghai network
              17621  |  58.247.25.108   |  CNCGROUP-SH China Unicom Shanghai network
              17621  |  58.247.27.232   |  CNCGROUP-SH China Unicom Shanghai network
              

              Every hidden IP address observed in the HTran error messages captured during our survey is located on just a few different networks in the People's Republic of China (PRC). In almost every case, the observable C2 is in a different country, most likely the same country in which the victim institution is located.

              It's not surprising that hackers using a Chinese hacking tool might be operating from IP addresses in the PRC. Most of the Chinese destination IPs belong to large ISPs, making further attribution of the hacking activity difficult or impossible without the cooperation of the PRC government.

              Conclusion

              Over the past ten years, we have seen dozens of families of trojans that have been implicated in the theft of documents, email and computer source code from governments, industry and activists. Typically when hacking or malware traffic is reported on the Internet, the location of the source IP is not a reliable indicator of the true origin of the activity, due to the wide variety of programs designed to tunnel IP traffic through other computers. However, occasionally we get a chance to peek behind the curtain, either by advanced analysis of the traffic and/or its contents, or due to simple programmer/user error. This is one of those cases where we were lucky enough to observe a transient event that showed a deliberate attempt to hide the true origin of an APT. This particular hole in the operational security of a certain group of APT actors may soon be closed, however it is impossible for them to erase the evidence gathered before that time. It is our hope that every institution potentially impacted by APT activity will make haste to search out signs of this activity for themselves before the window of opportunity closes.


              Related Content