Toy Ghouls' New HiveMQ and Element Backdoors

src/generic-methodologies-and-resources/basic-forensic-methodology/malware-analysis.md

@@ -763,6 +763,38 @@ For DPAPI-specific post-exploitation workflows, see [DPAPI - Extracting Password
 
 When a transport module exposes generic verbs such as `get`, `send`, `upload`, `ws`, or `sendws`, check for a **small fixed XOR key** and text-safe wrappers such as **Base64** before assuming heavy crypto. Reused static headers, fixed URL paths, and custom tokens are often better detection pivots than domains alone.
 
+## Machine-bound sealed configs and messaging-service C2
+
+Some Windows implants accept a plaintext configuration only on first execution, encrypt its sensitive fields with **ChaCha20-Poly1305**, and derive key material from `HKLM\Software\Microsoft\Cryptography\MachineGuid`. The sealed blob therefore fails authentication after being copied to a host with a different machine identity. A sample may rewrite the original file in place or delete it after moving the blob into a custom `HKLM` value, so preserve the original registry hives and first-run filesystem timeline instead of analysing only the remaining executable.<sup>[[24]](#references)</sup>
+
+### Configuration-recovery workflow
+
+Treat the registry read, AEAD operation, and subsequent configuration parsing as a single data-flow problem.<sup>[[24]](#references)</sup>
+
+1. Search the launch directory and `%PROGRAMDATA%` for configuration files, including deleted copies, and inspect custom `HKLM\Software\<vendor>` keys.
+2. Trace access to `MachineGuid`, then break immediately after the ChaCha20-Poly1305 authentication/decryption routine; dump the plaintext before the parser copies or zeroes it.
+3. Recover the nonce, authentication tag, serialized `blob` layout, and exact key-derivation steps from the sample. The `MachineGuid` value alone is not enough if the implant hashes or otherwise transforms it.
+4. Expect credentials, private keys, broker channel identifiers, Matrix room IDs, and access tokens to exist briefly in process memory even when the on-disk configuration remains sealed.
+5. If dynamic execution is necessary, use an isolated clone that preserves the investigated machine context; simply moving the blob to a generic sandbox can trigger the fatal decryption path and hide later behavior.
+
+Useful collection pivots for this pattern include:<sup>[[24]](#references)</sup>
+
+```powershell
+reg query "HKLM\Software\Microsoft\Cryptography" /v MachineGuid
+reg query "HKLM\Software\synapse\Config" /v SealedConfig
+reg query "HKLM\Software\SynapseAgent" /v metrics_interval
+Get-CimInstance Win32_Service | Select Name,DisplayName,PathName,StartName,State
+Get-ChildItem $env:ProgramData -Filter config.toml -Recurse -Force -ErrorAction Ignore
+```
+
+### Correlating MQTT/Matrix C2 with host activity
+
+Legitimate messaging infrastructure can provide a complete bidirectional C2 without a dedicated-looking protocol: separate broker topics or Matrix event types carry status, periodic metrics, commands, configuration changes, and execution results. One observed design used MQTT routes ending in `/status`, `/metrics3`, `/cmd/req`, and `/cmd/res`; its command objects contained an ID, command string, and timeout, while results returned `stdout`, `stderr`, exit code, and execution duration. The Matrix variant used custom `m.bird.status`, `m.bird.metrics`, and `m.bird.cmd_response` events, with `cmd:` and `config:set_interval` message prefixes for tasking.<sup>[[24]](#references)</sup>
+
+Do not classify traffic only by the reputation of the broker, homeserver, or geolocation API. Attribute it to the originating process and correlate the connection with service creation, configuration-file activity, and child processes. Particularly strong chains are a WinRM session followed by an executable plus `config.toml`, registration of a misleadingly named service, a request to `http://ip-api.com/json`, and then TLS MQTT on `8883` or Matrix room traffic. A service spawning hidden `PowerShell.exe -NonInteractive -NoProfile -Command <command>` and immediately returning output over the same channel is a higher-confidence signal than any destination alone.<sup>[[24]](#references)</sup>
+
+For broker enumeration and MQTT topic testing, see [Pentesting MQTT](../../network-services-pentesting/1883-pentesting-mqtt-mosquitto.md). For the delivery-side artifacts and `wsmprovhost.exe` process context, see [WinRM lateral movement](../../windows-hardening/lateral-movement/winrm.md).
+
 
 
 ## References
@@ -790,4 +822,5 @@ When a transport module exposes generic verbs such as `get`, `send`, `upload`, `
 - [21] [Recovering Metadata from .NET Native AOT Binaries](https://blog.washi.dev/posts/recovering-nativeaot-metadata/)
 - [22] [YARA-X CLI commands](https://virustotal.github.io/yara-x/docs/cli/commands/)
 - [23] [Dynamic capa: Exploring Executable Run-Time Behavior with the CAPE Sandbox](https://cloud.google.com/blog/topics/threat-intelligence/dynamic-capa-executable-behavior-cape-sandbox/)
+- [24] [Angry Birds: Toy Ghouls’ new toys](https://securelist.com/toy-ghouls-new-hivemq-and-element-backdoors/121270/)
 {{#include ../../banners/hacktricks-training.md}}