read By Josh Grunzweig and Jen Miller-Osborn . November 10, 2017 at 1:00 PM . Category: Unit 42 . Tags: Reaver, SunOrcal . Summary Unit 42 has discovered a new malware family we’ve named “Reaver” with ties to attackers who use SunOrcal malware. Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file. While we don’t have information on the intended targets in this case, previous reports on this activity have identified targeting primarily among the “Five Poisons” which are movements the Chinese government perceives as dangerous. Reaver Malware Analysis To date, Palo Alto Networks Unit 42 has identified 10 unique samples and three distinct variants of a new malware family we have named “Reaver”. As such, we identify each variant as Reaver.v1, Reaver.v2, and Reaver.v3. The flow for Reaver is as shown: Figure 1 Reaver execution flow diagram . Reaver.v1 The earliest variant of Reaver begins by attempting to enable the SeDebugPrivilege privilege for the running process. A shortcut file is generated in the following path: - %TEMP%\~Update.lnk This ‘~Update.lnk’ file is then copied to a filename of ‘Windows help.lnk’, which is placed in the startup path previously identified. It will specifically load this CPL file via a call to the built-in Microsoft Windows ‘control.exe’ utility. Data that is sent is compressed and then base64-encoded before being included in the requests. The following example Python code shows how this encryption takes place: After this data is exfiltrated, the malware expects 8 bytes of data that contains two DWORDs. AutoFocus customers can monitor activity using this malware with the following tags: Reaver SunOrcal - Reaver - SunOrcal Get updates from Palo Alto Networks