From 3dcf0ea70ceb388b3c82ea4fb533c759a11f0687 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Sat, 12 Sep 2026 10:51:44 +0000 Subject: [PATCH] Add content from: Toy Ghouls' New HiveMQ and Element Backdoors --- .../malware-analysis.md | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md index 392dffcdf57..f5dcf995d65 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md @@ -763,6 +763,38 @@ For DPAPI-specific post-exploitation workflows, see [DPAPI - Extracting Password When a transport module exposes generic verbs such as `get`, `send`, `upload`, `ws`, or `sendws`, check for a **small fixed XOR key** and text-safe wrappers such as **Base64** before assuming heavy crypto. Reused static headers, fixed URL paths, and custom tokens are often better detection pivots than domains alone. +## Machine-bound sealed configs and messaging-service C2 + +Some Windows implants accept a plaintext configuration only on first execution, encrypt its sensitive fields with **ChaCha20-Poly1305**, and derive key material from `HKLM\Software\Microsoft\Cryptography\MachineGuid`. The sealed blob therefore fails authentication after being copied to a host with a different machine identity. A sample may rewrite the original file in place or delete it after moving the blob into a custom `HKLM` value, so preserve the original registry hives and first-run filesystem timeline instead of analysing only the remaining executable.[[24]](#references) + +### Configuration-recovery workflow + +Treat the registry read, AEAD operation, and subsequent configuration parsing as a single data-flow problem.[[24]](#references) + +1. Search the launch directory and `%PROGRAMDATA%` for configuration files, including deleted copies, and inspect custom `HKLM\Software\` keys. +2. Trace access to `MachineGuid`, then break immediately after the ChaCha20-Poly1305 authentication/decryption routine; dump the plaintext before the parser copies or zeroes it. +3. Recover the nonce, authentication tag, serialized `blob` layout, and exact key-derivation steps from the sample. The `MachineGuid` value alone is not enough if the implant hashes or otherwise transforms it. +4. Expect credentials, private keys, broker channel identifiers, Matrix room IDs, and access tokens to exist briefly in process memory even when the on-disk configuration remains sealed. +5. If dynamic execution is necessary, use an isolated clone that preserves the investigated machine context; simply moving the blob to a generic sandbox can trigger the fatal decryption path and hide later behavior. + +Useful collection pivots for this pattern include:[[24]](#references) + +```powershell +reg query "HKLM\Software\Microsoft\Cryptography" /v MachineGuid +reg query "HKLM\Software\synapse\Config" /v SealedConfig +reg query "HKLM\Software\SynapseAgent" /v metrics_interval +Get-CimInstance Win32_Service | Select Name,DisplayName,PathName,StartName,State +Get-ChildItem $env:ProgramData -Filter config.toml -Recurse -Force -ErrorAction Ignore +``` + +### Correlating MQTT/Matrix C2 with host activity + +Legitimate messaging infrastructure can provide a complete bidirectional C2 without a dedicated-looking protocol: separate broker topics or Matrix event types carry status, periodic metrics, commands, configuration changes, and execution results. One observed design used MQTT routes ending in `/status`, `/metrics3`, `/cmd/req`, and `/cmd/res`; its command objects contained an ID, command string, and timeout, while results returned `stdout`, `stderr`, exit code, and execution duration. The Matrix variant used custom `m.bird.status`, `m.bird.metrics`, and `m.bird.cmd_response` events, with `cmd:` and `config:set_interval` message prefixes for tasking.[[24]](#references) + +Do not classify traffic only by the reputation of the broker, homeserver, or geolocation API. Attribute it to the originating process and correlate the connection with service creation, configuration-file activity, and child processes. Particularly strong chains are a WinRM session followed by an executable plus `config.toml`, registration of a misleadingly named service, a request to `http://ip-api.com/json`, and then TLS MQTT on `8883` or Matrix room traffic. A service spawning hidden `PowerShell.exe -NonInteractive -NoProfile -Command ` and immediately returning output over the same channel is a higher-confidence signal than any destination alone.[[24]](#references) + +For broker enumeration and MQTT topic testing, see [Pentesting MQTT](../../network-services-pentesting/1883-pentesting-mqtt-mosquitto.md). For the delivery-side artifacts and `wsmprovhost.exe` process context, see [WinRM lateral movement](../../windows-hardening/lateral-movement/winrm.md). + ## References @@ -790,4 +822,5 @@ When a transport module exposes generic verbs such as `get`, `send`, `upload`, ` - [21] [Recovering Metadata from .NET Native AOT Binaries](https://blog.washi.dev/posts/recovering-nativeaot-metadata/) - [22] [YARA-X CLI commands](https://virustotal.github.io/yara-x/docs/cli/commands/) - [23] [Dynamic capa: Exploring Executable Run-Time Behavior with the CAPE Sandbox](https://cloud.google.com/blog/topics/threat-intelligence/dynamic-capa-executable-behavior-cape-sandbox/) +- [24] [Angry Birds: Toy Ghouls’ new toys](https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/) {{#include ../../banners/hacktricks-training.md}}