Everything You Need to Know About MATA Malicious Framework

The Windows version of MATA consists of several components. According to Cyber security courses online in telemetry, the actor loaded the encrypted Next stage payload using loader malware. I don't know if the loaded payload is Orchestrator malware, but almost all victims have loaders and orchestrators on the same machine.

Loader

This loader takes a hard-coded hexadecimal string, converts it to binary, and AES decrypts it to get the path to the user data file. Each loader has a hard-coded path to load the encrypted payload. The user data file is then decrypted and loaded with AES in the cyber security pg course.  The loader malware found in one of the compromised victims revealed that the parent process running the loader malware was the process "C: WindowsSystem32wbemWmiPrvSE.exe". The WmiPrvSE.exe process is a "WMI provider host process", which usually means that an actor ran this loader malware from a remote host and moved it sideways. Therefore, suppose an actor uses this loader to compromise an additional host on the same network.

Orchestrator and Plugin

An orchestrator malware was found in the lsass.exe process on the victim's computer. This orchestrator malware reads encrypted configuration data from a registry key and decrypts it using the AES algorithm. If there is no registry value, the malware uses hard-coded authentication information. Orchestrators can load 15 plug-ins at the same time. There are three ways to load it.

• Download the plug-in from the specified HTTP or HTTPS server
• Download the AES encryption plug-in file from the specified disk path
• Load the plug-in file from the current MataNet connection

 Malware author Calls the infrastructure MataNet in top cyber security courses online. For secret communication, use the TLS 1.2 connection using the open-source library "OpenSSL 1.1.0f" which is statically linked in this module. In addition, traffic between MataNet nodes is encrypted with a random RC4 session key. MataNet implements both client mode and server mode. In server mode, the certificate file "c_2910.cls" and the private key file "k_3872.cls" are loaded for TLS encryption. However, this mode is not used. The MataNet client establishes regular connections with  C2. Each message has a 12-byte header,  the first DWORD is the message ID and the rest is auxiliary data. The main function of the orchestrator is to load each plugin file and run it in memory. Each DLL file type plugin provides an interface to Orchestrator and provides a wide range of features that can be used to control an infected computer. The MATA_Plug_WebProxy plugin has an interesting string "Proxyagent: mattdotnet". This is a reference to Matt McKnight's open source project. However, there are some differences. Matt's projects are written in C # instead of C ++. For example, MATA proxies are significantly simpler because there is no cache or SSL support. The creator of MATA may have found and used the source code for an early version of Matt's proxy server. It seems that the malware author rewrote the code from C # to C ++, but its footprint hasn't changed.

Non-Windows versions of the MATA

MATA frameworks are intended for Linux and macOS systems as well as Windows systems.

Linux Version

During the investigation, we also found a package containing various MATA files and numerous cyber attack tools. In this case, the package was found on a legitimate distribution site. This may indicate that the malware was distributed this way. It included the Windows MATA Orchestrator, a Linux folder listing tool, a script for using the Atlassian Confluence Server (CVE20193396), a legitimate Socat tool, and a Linux version of  MATA Orchestrator bundled with numerous plugins. China-based security provider Netlab has also published a very detailed blog about malware. The module is designed to run as a daemon. At startup, the module reads the PID from "/var/run/init.pid" to see if it is already running and the contents of the  file "/ proc /% pid% / cmdline" are equal to "/ flash" Check if. / bin "is / installed". Note that / flash / bin / mountd is an unusual path for a standard Linux desktop or server installation. This path indicates that MATA's Linux target is a network device without a hard drive, such as a router, firewall, or x86_64-based IoT device. The module can be run on the "/ pro" switch to skip the "init.pid" check. AES-encrypted configurations are stored in the "$ HOME / .memcache" file. The behaviour of this module corresponds to the behaviour of the Windows MATA Orchestrator above. The Linux version of MATA has a log send plugin. This plugin has interesting new features, a "scan" command that attempts to establish a TCP connection on ports 8291 (used to manage MikroTik RouterOS devices) and 8292 ("Bloomberg Professional" software), and a random IP address that belongs to a private address. Implements a random establishment. network. All successful connections are logged and sent to  C2. These protocols could be used by an attacker to select a target.  macOS version  I found another MATA malware target for macOS that was uploaded to VirusTotal on April 8, 2020. The malicious Apple Disk Image file is a Trojanized macOS application based on an open-source two-factor authentication application called MinaOTP.