CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. It is tracked separately from the X-Agent for Android.
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
| IP:Port | Timestamp |
|---|
| Domain | Timestamp |
|---|
| URL | Timestamp |
|---|
2020-09-10 by GReAT from Kaspersky Labs
2020-07-29 by GReAT from Kaspersky Labs
2020-02-13 by Qi Anxin Threat Intelligence Center from Qianxin
2020 by SecureWorks from Secureworks
2018-10-04 by Critical Attack Discovery and Intelligence Team from Symantec
2018-10-04 by NCSC UK from NCSC UK
2017-12-21 by ESET Research from ESET Research
2017-03-23 by PhysicalDrive0 from Twitter (PhysicalDrive0)
2017-03-02 by Boldizsar Bencsath from Laboratory of Cryptography and System Security
2017-02-21 by Bitdefender from Bitdefender
2017-02-20 by Mila Parkour from Contagio Dump
2017-02-14 by Robert Falcone from Palo Alto Networks Unit 42
2017-01-10 by FireEye iSIGHT Intelligence from FireEye
2017-01-03 by Boldizsar Bencsath from CrySyS Lab
2016-10-20 by ESET Research from ESET Research
2016-06-15 by Dmitri Alperovitch from CrowdStrike
2016-02-12 by Bryan Lee from Palo Alto Networks Unit 42
2016-02-12 by Bryan Lee from Palo Alto Networks Unit 42
2015-12-17 by Bitdefender from Bitdefender
2015-12-04 by GReAT from Kaspersky Labs
2015-02-04 by Lambert Sun from Trend Micro
2014-09-05 by Neel Mehta from Google
2014 by FireEye from FireEye
Tool: X-Agent
Names: X-Agent, Xagent, Popr-d30, SPLM, CHOPSTICK, fysbis, Backdoor.SofacyX, webhp
Description: CHOPSTICK is a malware family of modular backdoors used by APT28. It has been used since at least 2012 and is usually dropped on victims as second-stage malware, though it has been used as first-stage malware in several cases. It has both Windows and Linux variants. It is tracked separately from the X-Agent for Android.
Category: Malware
Type: Backdoor, Keylogger, Info stealer, Tunneling
Information: https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf
Information: http://blog.crysys.hu/2017/01/technical-details-on-the-fancy-bear-android-malware-poprd30-apk/
Information: http://blog.crysys.hu/2017/03/update-on-the-fancy-bear-android-malware-poprd30-apk/
Information: https://contagiodump.blogspot.de/2017/02/russian-apt-apt28-collection-of-samples.html
Information: http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf
Information: https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/
Information: https://www.thecssc.com/wp-content/uploads/2018/10/4OctoberIOC-APT28-malware-advisory.pdf
Information: http://www2.fireeye.com/rs/fireye/images/rpt-apt28.pdf
Information: https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/
Information: http://csecybsec.com/download/zlab/20180713_CSE_APT28_X-Agent_Op-Roman%20Holiday-Report_v6_1.pdf
Mitre-attack: https://attack.mitre.org/software/S0023/
Mitre-attack: https://attack.mitre.org/software/S0410/
Mitre-attack: https://attack.mitre.org/software/S0161/
Mitre-attack: https://attack.mitre.org/software/S0314/
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/apk.popr-d30
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/elf.xagent
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/osx.xagent
Malpedia: https://malpedia.caad.fkie.fraunhofer.de/details/win.xagent
Alienvault-otx: https://otx.alienvault.com/browse/pulses?q=tag:X-Agent
Last-card-change: 2022-12-30
Source: https://apt.etda.or.th/cgi-bin/listtools.cgi
| TA0043 | TA0042 | TA0001 | TA0002 | TA0003 | TA0004 | TA0005 | TA0006 | TA0007 | TA0008 | TA0009 | TA0011 | TA0010 | TA0040 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
T1091 REPLICATION THROUGH REMOVABLE MEDIA part of apt28's operation involved using chopstick modules to copy itself to air-gapped machines and using files written to usb sticks to transfer data and command traffic. | T1112 MODIFY REGISTRY chopstick may modify registry keys to store rc4 encrypted configuration information. T1027.011 OBFUSCATED FILES OR INFORMATION : FILELESS STORAGE chopstick may store rc4 encrypted configuration information in the windows registry. T1497 VIRTUALIZATION/SANDBOX EVASION chopstick includes runtime checks to identify an analysis environment and prevent execution on it. | T1083 FILE AND DIRECTORY DISCOVERY an older version of chopstick has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o. T1012 QUERY REGISTRY chopstick provides access to the windows registry, which can be used to gather information. T1518.001 SOFTWARE DISCOVERY : SECURITY SOFTWARE DISCOVERY chopstick checks for antivirus and forensics software. T1497 VIRTUALIZATION/SANDBOX EVASION chopstick includes runtime checks to identify an analysis environment and prevent execution on it. | T1091 REPLICATION THROUGH REMOVABLE MEDIA part of apt28's operation involved using chopstick modules to copy itself to air-gapped machines and using files written to usb sticks to transfer data and command traffic. | T1071.001 APPLICATION LAYER PROTOCOL : WEB PROTOCOLS various implementations of chopstick communicate with c2 over http. T1071.003 APPLICATION LAYER PROTOCOL : MAIL PROTOCOLS various implementations of chopstick communicate with c2 over smtp and pop3. T1092 COMMUNICATION THROUGH REMOVABLE MEDIA part of apt28's operation involved using chopstick modules to copy itself to air-gapped machines, using files written to usb sticks to transfer data and command traffic. T1568.002 DYNAMIC RESOLUTION : DOMAIN GENERATION ALGORITHMS chopstick can use a dga for fallback channels, domains are generated by concatenating words from lists. |