We decided to have an even closer look at Agent.BTZ and ComRAT and therefore analyzed the evolution of this RAT, covering seven years of development. Here is a table with the minimal information about 46 different samples:

Thanks to the versioning, we can deduce that the compilation dates we saw and currently see actually seem to be legit – except for the last known version, in which the author modified the compilation date in order to make the analysis more complex. We can see that this malware was really active in 2007 and 2008. New versions declined in frequency in 2009 and only one new sample was identified in 2010. We did not encounter any new sample from 2011, but the malware appeared back in 2012, with a new major version.

The RAT’s evolution described in ten steps

To describe the evolution of the development, we decided to compare ten major versions:

• Version Ch 1.0 (2007-06) to Ch 1.5 (2008-03)
• Version Ch 1.5 (2008-03) to Ch 2.03 (2008-05)
• Version Ch 2.03 (2008-05) to Ch 2.11 (2009-09)
• Version Ch 2.11 (2009-09) to Ch 2.14.1 (2010-02)
• Version Ch 2.14.1 (2010-02) to Ch 3.00 (2012-01)
• Version Ch 3.00 (2012-01) to Ch 3.10 (2012-12)
• Version Ch 3.10 (2012-12) to Ch 3.20 (2013-06)
• Version Ch 3.20 (2013-06) to Ch 3.25 (2014-02)
• Version Ch 3.25 (2014-02) to Ch 3.26 (2013-01; date has been modified)

The following chapter will present the main differences between the versions mentioned above. Here is the resemblance ratio for each version, comparing direct neighbor versions only, created using BinDiff:

The biggest code update has occurred between version 2.14.1 and version 3.00. The gap matches the absence of samples during two years and this fundamental modification is what we call the death of Agent.BTZ and the birth of ComRAT.

Differences between version Ch 1.0 (2007-06) to Ch 1.5 (2008-03)

The analyzed samples are:

• Ch 1.0: b41fbdd02e4d54b4bc28eda99a8c1502 
• Ch 1.5: bbf569176ec7ec611d8a000b50cdb754 
• Code similarity: 90%

We did not identify strong modification between the two samples. However, we can notice the following:

• The configuration file (XML) in version 1.5 is stored in Unicode and not in ASCII anymore;
• The two versions implement a mechanism to infect new media connected to the infected system. The implementation is not exactly the same nor is the log of media infection;
• Version 1.5 creates a new event: “wowmgr_is_load”. This event has then been used for years.

Differences between version Ch 1.5 (2008-03) and Ch 2.03 (2008-05)

The analyzed samples are:

• Ch 1.5: bbf569176ec7ec611d8a000b50cdb754 
• Ch 2.03: 78d3f074b70788897ae7e20e5137bf47 
• Code similarity: 83%

In version 2.03 of Agent.BTZ, the authors changed the following:

• They added obfuscation in order to hide sensitive strings;
• The communication protocol was modified in order to include the flag “<CHCMD>”
• we assume that “CH” has the same meaning than “Ch” before the version number and “CMD” is the abbreviation for command;
• From now on, the malware supports “runas” in order to execute commands as administrator. This command was implemented by Microsoft in Windows Vista in 2007. We assume that the author implemented this feature because several targets switched to this version of Windows in 2008.

According to an article, version 1.5 was used against the US Pentagon. We assume that the string obfuscation was performed in order to bypass security measures being capable of detecting an intrusion.

Differences between version Ch 2.03 (2008-05) and Ch 2.11 (2009-09)

The analyzed samples are:

• Ch 2.03: 78d3f074b70788897ae7e20e5137bf47 
• Ch 2.11: 162f415abad9708aa61db8e03bcf2f3c 
• Code similarity: 96%

The codes of these two versions are extremely similar to each other, we can only notice small changes:

• The author changed the name of several registry keys (probably to avoid detection by well-known IOC);
• The name of two exported functions were modified, too: InstallM() becomes AddAtomT() and InstallS() becomes AddAtomS(),probably for the same reason than above.

Differences between version Ch 2.11 (2009-09) and Ch 2.14.1 (2010-02)

The analyzed samples are:

• Ch 2.11: 162f415abad9708aa61db8e03bcf2f3c 
• Ch 2.14.1: 5121ce1f96d74076df1c39748e019f42 
• Code similarity: 98%

These codes are really similar to each other, too. We can notice only two changes:

• The author patched several bugs;
• Four new exports appear: DllCanUnLoadNow(), DllGetClassObject(), DllRegisterServer(), DllUnregisterServer().

The four exported libraries show that the malware has started to support the OLE Component Object Model (COM). This version is the first version able to be registered as a COM object. Three of the four functions are empty. The fourth one executes the malware.

Differences between version 2.14.1 (2010-02) and Ch 3.00 (2012-01)

The analyzed samples are:

• Ch 2.14.1: 5121ce1f96d74076df1c39748e019f42 
• Ch 3.00: 28dc1ca683d6a14d0d1794a68c477604 
• Code similarity: 60%

These codes really differ from each other, even if some parts of version 2.14.1 were retained. Moreover, the developers changed the compiler; they switched from Visual Studio 6.0 to Visual Studio 9.0/10.0 , which is a strong indicator for the huge differences.
Version 3.00 is what the G DATA SecurityLabs experts call ComRAT. We can say that version 2.14.1 is the last version of Agent.BTZ. Here are the main differences between Agent.BTZ and ComRAT:

• The new malware collects more information about the infected system (such as drive information, volume information…).
• The media stick infection mechanism has definitely been removed. We assume this happened due to the fact that Microsoft has disabled AutoRun for external media. For the attackers, this infection vector is not interesting anymore.
• The malware is injected into every process of the infected machine and the main payload is executed in “explorer.exe” as we explained in our article;
• The communication channel to the command and control is not the same anymore. In this new version, the malware uses POST requests with the following pattern:

   

• As the malware is injected into every process of the infected system, it creates named pipe in order to handle inter-processes communication.

On several 3.00 samples, the author forgot to remove the compilation path, here are some examples:

• c:\projects\ChinckSkx64\Debug\Chinch.pdb
• c:\projects\ChinckSkx64\Release\libadcodec.pdb
• C:\projects\ChinckSkx64\x64\Release\libadcodec.pdb
• E:\old_comp\_Chinch\Chinch\trunk\Debug\Chinch.pdb
• c:\projects\ChinchSk\Release\libadcodec.pdb

Thanks to these compilation paths, we assume that the original name of the RAT is “Chinch”, which leads us to the assumption that the “CH” characters in the version name and in the flag “<CHCMD>” stands for “Chinch”. In English, chinch is the word for a small North American bug, Blissus leucopterus. This word is derived from the Spanish word chinche, meaning pest.

Differences between version 3.00 (2012-01) and Ch 3.10 (2012-12)

The analyzed samples are:

• Ch 3.00: 28dc1ca683d6a14d0d1794a68c477604 
• Ch 3.10: b86137fa5a232c614ec5405be4d13b37 
• Code similarity: 90%

The codes are similar to each other, but the authors added several features:

• The malware generates more logs;
• The malware has a Mutex handle;
• The 3.10 version supports multiple command and control servers.

The last new feature is really interesting: if the compromised targets block a specific command and control server, the malware will continue to work, thanks to two alternative command and control servers.

Differences between version 3.10 (2012-12) and Ch 3.20 (2013-06)

The analyzed samples are:

• Ch 3.10: b86137fa5a232c614ec5405be4d13b37 
• Ch 3.20: 7872c1d88fe21d8a85f160a6666c76e8 
• Code similarity: 93%

The major new feature in the version is the new exports function called InstallW(). This exported function is used by the dropper to add persistence in the registry and to drop a second file (as explained in our previous article). Version 3.20 uses the following CLSID in order to hijack COM object: B196B286-BAB4-101A-B69C-00AA00341D07.
This object is the IConnectionPoint interface. The CLSID was only used in this version. We assume that the performed COM object hijacking generates some trouble on the infected system, that’s why the author changed related things in the next version. Furthermore, the CLSID was stored in plain text within the sample.

Differences between version Ch 3.20 (2013-06) and Ch 3.25 (2014-02)

The analyzed samples are:

• Ch 3.20: 7872c1d88fe21d8a85f160a6666c76e8 
• Ch 3.25: ec7e3cfaeaac0401316d66e964be684e 
• Code similarity: 91%

In the 3.25 version, the author switched to the CLSID: 42aedc87-2188-41fd-b9a3-0c966feabec1 as described in our article. Furthermore, the strings in the sample are obfuscated. The main new feature is the obfuscation – almost all strings are obfuscated and the XML pattern is not written in plain text anymore.

Differences between version Ch 3.25 (2014-02) and Ch 3.26 (2013-01; date has been modified)

The analyzed samples are:

• Ch 3.25: ec7e3cfaeaac0401316d66e964be684e 
• Ch 3.26: b407b6e5b4046da226d6e189a67f62ca 
• Code similarity: 95%

The version 3.26 is the latest known version. In this version:

• The authors removed the familiar XOR key used by Agent.BTZ and Uroburos. We assume that due to the G DATA publication in February 2014, the author decided to remove as many links as possible between Uroburos and Agent.BTZ/ComRAT/Chinch;
• The authors do not generate logs anymore;
• The compilation date has been modified, in order to make the analysis and timeline creation more complex.

Conclusion

This analysis shows us seven years of the evolution of a Remote Administration Tool, used by a group which targeted extremely sensitive entities, such as the US Pentagon  in 2008 or the Belgium Ministry of Foreign Affairs  in 2014 as well as the Finnish Ministry of Foreign Affairs.

Except for version 3.00, the modifications made are rather marginal. We can see that the authors adapted features to the Windows versions, patched bugs, added obfuscation etc… The biggest update was performed to version 3.00, after two years of silence. Visibly, this RAT was used alongside the Uroburos rootkit. Nevertheless, it is not entirely clear how and when the attackers choose to use the RAT or the rootkit or whether both are used in parallel.

Taking everything into consideration, G DATA SecurityLabs experts are sure that the group behind Uroburos/Agent.BTZ/ComRAT/Linux tool/… will remain an active player in the malware and APT field. The newest revelations made and connections drawn let us believe that there is even more to come.