Experts Detail Logging Tool of DanderSpritz Framework Used by Equation Group Hackers

Cybersecurity researchers have offered a detailed glimpse into a
system called DoubleFeature that’s dedicated to logging the
different stages of post-exploitation stemming from the deployment
of DanderSpritz, a full-featured malware framework used by the
Equation Group^[1].

DanderSpritz came to light on April 14, 2017, when a hacking
group known as the Shadow Brokers leaked the exploit tool, among
others, under a dispatch titled “Lost in Translation^[2].” Also included in the
leaks was EternalBlue^[3], a cyberattack exploit
developed by the U.S. National Security Agency (NSA) that enabled
threat actors to carry out the NotPetya ransomware attack^[4] on unpatched Windows
computers.

The tool is a modular, stealthy, and fully functional framework
that relies on dozens of plugins for post-exploitation activities
on Windows and Linux hosts. DoubleFeature is one among them, which
functions as a “diagnostic tool for victim machines carrying
DanderSpritz,” researchers from Check Point said^[5]
in a new report published Monday.

“DoubleFeature could be used as a sort of Rosetta Stone for
better understanding DanderSpritz modules, and systems compromised
by them,” the Israeli cybersecurity firm added. “It’s an incident
response team’s pipe dream.”

Designed to maintain a log of the types of tools that could be
deployed on a target machine, DoubleFeature is a Python-based
dashboard that also doubles up as a reporting utility to exfiltrate
the logging information from the infected machine to an
attacker-controlled server. The output is interpreted using a
specialized executable named “DoubleFeatureReader.exe.”

Some of the plugins monitored by DoubleFeature include remote
access tools called UnitedRake (aka EquationDrug^[6]) and PeddleCheap, a
stealthy data exfiltration backdoor dubbed StraitBizarre, an
espionage platform called KillSuit (aka GrayFish), a persistence
toolset named DiveBar, a covert network access driver called
FlewAvenue, and a validator implant named MistyVeal that verifies
if the compromised system is indeed an authentic victim machine and
not a research environment.

“Sometimes, the world of high-tier APT tools and the world of
ordinary malware can seem like two parallel universes,” the
researchers said. “Nation-state actors tend to [maintain] clandestine, gigantic codebases, sporting a huge gamut of features
that have been cultivated over decades due to practical need. It
turns out we too are still slowly chewing on the 4-year-old leak
that revealed DanderSpritz to us, and gaining new insights.”