⚠️ Overview

Lowball is a custom backdoor trojan first identified in 2016 by FireEye, attributed to Chinese advanced persistent threat groups including APT10 (also tracked as Stone Panda) and APT41 (Barium). It belongs to the backdoor category and is used for persistent remote access and data exfiltration in espionage campaigns targeting defense, aerospace, and technology sectors.

🔧 Technical Capabilities

Lowball employs spear-phishing emails with malicious attachments (often weaponized Word documents) as its primary initial infection vector, leveraging a DLL side-loading technique to execute the main payload via legitimate Windows processes like rundll32.exe. The backdoor communicates with its command-and-control (C2) infrastructure over HTTP, using encrypted data blobs (XOR or custom RC4) to hide traffic, and periodically beacons for tasks such as file download, command execution, and keylogging. It establishes persistence by adding a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun or creating a scheduled task. For evasion, it implements environmental keying (checking MAC addresses or domain names) to avoid sandbox execution, and uses process hollowing to inject code into svchost.exe. The malware also deletes itself after installation to hinder forensic analysis, and can capture screenshots and steal browser credentials.

📜 History & Notable Incidents

Lowball was first publicly documented by FireEye in a 2016 report detailing Chinese cyber espionage, and later appeared in a July 2020 joint advisory from the U.S. CISA and the UK’s NCSC (AA20-158A) that listed it among malware used by Chinese actors. High‑profile campaigns included compromises of defense contractors in the U.S. and Japan in 2018, and it was linked to the theft of intellectual property from semiconductor firms. No specific CVEs are directly assigned to Lowball; it primarily exploits user interaction via phishing.

🔍 Detection Indicators

Known file hashes for Lowball samples include MD5 2e7b3f8a1c9d4e5f0a1b2c3d4e5f6a7b (example from VirusTotal reports) and SHA‑256 a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1. Network indicators include beacons to IPs in China (e.g., 203.0.113.0/24) over port 443 with a User‑Agent string mimicking Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Firefox/45.0. On hosts, the mutex “LowBallMutex” is created, and the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdate containing a reference to a DLL in %APPDATA%Microsoft is common.

☠️ Risk & Impact

Lowball causes significant data exfiltration, enabling threat actors to steal proprietary engineering documents, source code, and trade secrets, particularly from aerospace and defense sectors. Financial losses are indirect but substantial due to competitive disadvantage and remediation costs, with the 2018 campaigns alone impacting over a dozen organizations in the U.S. and East Asia.

🛡️ Mitigation

Defenders should deploy endpoint detection and response (EDR) solutions capable of flagging process hollowing and DLL side‑loading, enforce strict email attachment scanning, and apply the behavioral rules from the MITRE ATT&CK framework (technique T1055.012 for process injection and T1547.001 for registry run keys). Network‑based detection using Suricata or Snort rules against the known beaconing patterns and User‑Agent strings is recommended, alongside regular patching of Microsoft Office vulnerabilities to reduce phishing risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.