Nytro Posted November 26, 2014 Report Posted November 26, 2014 THE REGIN PLATFORM NATION-STATE OWNAGE OF GSM NETWORKSKaspersky Lab ReportVersion 1.024 November 2014ContentsIntroduction, history...................................................................................................................................................... 3Initial compromise and lateral movement................................................................................................................... 3The Regin platform........................................................................................................................................................ 4Stage 1 – 32/64 bit................................................................................................................................................ 4Stage 2 – loader – 32-bit....................................................................................................................................... 7Stage 2 – loader – 64-bit....................................................................................................................................... 8Stage 3 – 32-bit – kernel mode manager “VMEM.sys”........................................................................................ 8Stage 3 – 64-bit....................................................................................................................................................... 9Stage 4 (32-bit) / 3 (64-bit) – dispatcher module, ‘disp.dll’................................................................................. 932-bit.................................................................................................................................................................. 964-bit.................................................................................................................................................................. 9Stage 4 – Virtual File Systems (32/64-bit)..........................................................................................................10Unusual modules and artifacts..................................................................................................................................16Artifacts..................................................................................................................................................................16GSM targeting........................................................................................................................................................18Communication and C&C...........................................................................................................................................20Victim statistics ..........................................................................................................................................................22Attribution....................................................................................................................................................................23Conclusions.................................................................................................................................................................23Technical appendix and indicators of compromise...................................................................................................24Yara rules................................................................................................................................................................24MD5s......................................................................................................................................................................25Registry branches used to store malware stages 2 and 3.............................................................................26C&C IPs...................................................................................................................................................................26VFS RC5 decryption algorithm..............................................................................................................................27Download: https://securelist.com/files/2014/11/Kaspersky_Lab_whitepaper_Regin_platform_eng.pdf Quote
