A recent discovery by Unit 42, a threat research team at Palo Alto Networks, has shed light on a sophisticated malware sample that leverages C++/CLI to create a stealthy Internet Information Services (IIS) backdoor.
This malware is particularly noteworthy due to its use of a rarely employed programming language in the malware world, making it challenging to analyze and attribute.
Technical Analysis of the C++/CLI IIS Backdoor
The C++/CLI IIS backdoor is designed as a passive module that integrates with IIS servers.
It registers itself for RQ_SEND_RESPONSE event notifications, allowing it to intercept and process HTTP responses.
The malware uses custom HTTP request headers, such as X-ZA-Product and X-ZA-Platform, to receive encrypted commands from its command and control (C2) server.
These commands are encrypted using AES and then Base64-encoded, adding an extra layer of complexity to its communication protocol.
The backdoor supports a variety of commands, including file management, process execution, and system information retrieval.
Notably, it uses a cmd.exe wrapper application to execute commands, which is embedded within the malware itself.
This approach helps reduce the visibility of suspicious activity by avoiding direct invocation of cmd.exe from the IIS process.
The malware’s use of C++/CLI, a mixed-mode .NET language, complicates analysis due to the interplay between managed and unmanaged code.
This complexity, combined with the rarity of C++/CLI in malware development, suggests that the malware might have been used in targeted attacks.
Despite its sophisticated design, the malware contains debug strings in cleartext and uses hard-coded passwords, which could facilitate detection and analysis.
Detection and Protection
According tot the Report, Palo Alto Networks’ Advanced WildFire and Cortex XDR/XSIAM solutions are equipped to detect and prevent the execution of this malware.
Advanced WildFire utilizes memory analysis features to identify malicious behavior, while Cortex XDR and XSIAM employ behavioral threat protection and machine learning to block both known and unknown threats.
These tools are crucial for organizations seeking to protect themselves against such advanced and stealthy malware.
As threat actors continue to innovate and use less common programming languages, staying ahead with robust security measures is essential for maintaining network integrity.
