Introduction

In the first quarter of 2024, specialists from Positive Technologies Expert Security Center (PT ESC) detected a series of attacks targeting government organizations in Russia, Belarus, Kazakhstan, Uzbekistan, Kyrgyzstan, Tajikistan, and Armenia. We could not find any links to known groups that used the same techniques. The main goal of the attack was stealing credentials for various services from computers used by public servants. We dubbed the group "Lazy Koala"—for the unsophisticated techniques they used and after the name of the user who controlled the Telegram bots that received the stolen data. The malware that powered the attacks, which we named "LazyStealer", proved productive despite a simple implementation. We could not ascertain the infection vector, but all signs pointed to phishing. All the victims were notified directly about the compromise.

LazyStealer analysis

All the samples we came across used PyInstaller as the packer. Underneath that, all of the code was covered with Pyarmor.

Stripping the protection requires the bypass.py script, an installed Pyarmor module, and the pytransform.py file from that module. The file needs to be copied to the same folder as the target .py file. After removing the protection from one of the samples, we came across a script whose sole function was to connect Python modules.

The modules framed in the image above, named hello.cp39-win_amd64.pyd and pdfbyte.cp39-win_amd64.pyd in the file system, are DLLs compiled with Cython. These run at import. When compiling with Cython, only string and numeric constants remain from the original script, with all the logic, such as cycles, set operations, and passing arguments, implemented natively. Therefore, it does not appear possible to obtain the original script, as with PyInstaller or Pyarmor, but a reasonably faithful reconstruction can be made.

Let us start with pdfbyte.cp39-win_amd64.pyd. All the logic will run in the sole exportable function, PyInit_pdfbyte. The postfix pdfbyte stands for the name of the module compiled from pdfbyte.pyx. The postfix in the name of the exportable function changes with the module.

PyInit_pdfbyte invokes the function PyModuleDef_Init with the argument pyx_moduledef, which defines a module that contains all information required for creating a module object. There is typically only one statically initialized variable of this type per module.

The argument pyx_moduledef has the structure shown below. We are interested in the module - m_slots. To find the function that initializes and executes the script, we need to go to the address of that field.

struct PyModuleDef {
    PyModuleDef_Base m_base;
    const char* m_name;
    const char* m_doc;
    __int64 m_size;
    PyMethodDef* m_methods;
    PyModuleDef_Slot* m_slots;
    int(__cdecl* m_traverse)(_object*, int(__cdecl*)(_object*, void*), void*);
    int(__cdecl* m_clear)(_object*);
    void(__cdecl* m_free)(void*);
};

Once there, we discover a PyModuleDef_Slot structure array with two functions.

The PyModuleDef_Slot structure is provided below; we are interested in the value field.

struct PyModuleDef_Slot {
    __int64 slot;
    void* value;
};

Below the __pyx_moduledef_slots array zero index is the value field: the function _pyx_py_mode_create, which is the module constructor. Right below the first index is _pyx_pymod_exec_pdf, which is the function we are looking for. It initializes the _pyx_mstate_global service fields at the very beginning.

The global variable _pyx_mstate_global manages all the objects. It has the structure presented below, where the fields we are interested in begin with the index 6, marked as the array n of _pyx_object fields.

struct __pyx_mstate
{
    _object* __pyx_d;
    _object* __pyx_b;
    _object* __pyx_cython_runtime;
    _object* __pyx_empty_tuple;
    _object* __pyx_empty_bytes;
    _object* __pyx_empty_unicode;
    _object* __pyx_object[n];
};

This is because only the first six objects are constant, as they carry service information for the entire module, and starting with field seven, they vary in number. For example, the number of these objects depends on the number of strings, values, and the presence of callable functions.

An example of initializing string constants in the function Pyx_CreateStringTabAndInitStrings is presented below.

In the Pyx_CreateStringTabAndInitStrings structure presented below, we are interested in the s field, the name of the string constant that may be the name of a variable, module, method in a module, or string value.

struct __Pyx_StringTabEntry
{
    _object** p;
    const char* s;
    const __int64 n;
    const char* encoding;
    const char is_unicode;
    const char is_str;
    const char intern;
};

An example of connecting modules.

An example of assigning a variable name.

An example of invoking a method from a connected module with an argument.

Once we know all of these, we can reconstruct the script.

Executing this code opens a document in the browser. A set of four different documents is presented below.

Next, we look at the native structures in hello.cp39-win_amd64.pyd, which were absent from pdfbyte.cp39-win_amd64.pyd due to the simplicity and brevity of the original script.

If the original script contained functions, constants for these would be initialized in _Pyx_InitCachedConstants, a part of which is presented below.

The other part of the information about the functions is located sequentially in the data section.

The function structure is provided below; we are interested in the following fields:

• ml_name: function name
• ml_meth: native function implementation

struct PyMethodDef {
    const char* ml_name;
    _object* (__cdecl* ml_meth)(_object*, _object*);
    int ml_flags;
    const char* ml_doc;
};

Before invoking any function, it needs to be initialized with the help of the information described above.

Once we have all of these, we can reconstruct the script.

This script steals Google Chrome logins and passwords and forwards these to a Telegram bot.

In addition to this, we found a sample in which the document display logic was written in Cython and the password stealing logic, in pure Python. The two differ in the names of variables and functions, and slightly, in program structure.

We could not find the persistence mechanism used by the stealer. This could be because it was part of an attack chain or because it was designed not to leave any traces, which, however, would make this a one-off attack.

Attribution

All the bots we found were linked to one user, who controlled the bots and who was their likely creator. See below for a graph that connects the user to the bots.

The victim geography and the arsenal used by Lazy Koala suggest that it is linked to the YoroTrooper group, which is known to have used similar techniques and tools. However, we could not find any direct connections.

Victims

Lazy Koala hit governmental, financial, medical, and educational institutions in Russia, Belarus, Kazakhstan, Tajikistan, Kyrgyzstan, Armenia, and Uzbekistan. Compromised accounts at the time of discovery totaled 867, 321 of these unique. All the victims were notified directly about the compromise.

Takeaways

The Lazy Koala case shows that successful attacks do not necessarily have to rely on sophisticated tools, tactics, or techniques. Sophisticated does not mean better. Convincing the victim to open a file is enough. The group's main tool is a primitive stealer, whose protection helps to evade detection, slow down analysis, grab all the stolen data, and send it to Telegram, which has been gaining popularity with malicious actors by the year. The stolen data ends up sold or reused for further attacks, this time against the companies' internal structures.

Author: Vladislav Lunin

Indicators of compromise

MITRE ATT&CK tactics and techniques

Verdicts by Positive Technologies products

PT Sandbox

Suspicious:

• Read.Window.Handle.Enumeration
• Create.Process.Taskkill.TerminateProcess
• Read.Thread.Info.AntiDebug, Write.Thread.Info.AntiDebug
• Read.File.Browser.Credentials

Malware:

• Trojan-Spy.Win32.LazyStealer.a
• Trojan_PSW.Win32.Generic.a
• Trojan.Win32.Generic.a

MaxPatrol SIEM

Run_Masquerading_Executable_File

Suspicious_Connection

Credential_Access_to_Passwords_Storage

PT NAD

tls.server_name == "api.telegram.org"