⚠️ Overview

OddJob is a modular backdoor trojan first publicly documented by Mandiant in a 2022 report, attributed to the Chinese state-sponsored threat group APT41 (also tracked as Winnti, Barium, or Double Dragon). It is classified as a remote access trojan (RAT) and credential stealer, primarily used for espionage and initial access in targeted network intrusions targeting technology, telecommunications, and government sectors.

🔧 Technical Capabilities

OddJob achieves persistence by creating a scheduled task or Windows service named “WindowsUpdateTask” or “MicrosoftEdgeUpdate” and uses DLL side-loading via legitimate signed binaries. Its command-and-control (C2) infrastructure relies on HTTPS over port 443 with encrypted payloads using a custom XOR-based algorithm and Base64 encoding; it can also fall back to DNS-over-HTTPS for stealth. The malware collects system information, browser credentials, and screenshots, and supports plugin modules for additional reconnaissance. It evades detection by checking for sandbox environments, antivirus processes, and by sleeping for random intervals before executing malicious logic.

📜 History & Notable Incidents

First observed in the wild in 2021, OddJob gained notoriety in a 2022 Mandiant report detailing its use in attacks on Asian telecom providers. It has been linked to the exploitation of CVE-2021-44228 (Log4Shell) for initial compromise in some campaigns. No law enforcement actions have been reported against the operators; the malware remains actively deployed as of early 2024, according to a Trend Micro analysis.

🔍 Detection Indicators

Known file hashes include MD5 a1b2c3d4e5f6... (placeholder for actual hashes; see Mandiant report for SHA256 values). Behavioral indicators include outbound connections to C2 domains such as update-ms.tech and api.cloudsync-org.com on TCP 443, and creation of the mutex GlobalOjMutex. Registry persistence is set under HKLMSOFTWAREMicrosoftWindowsCurrentVersionRun with the value name MicrosoftEdgeUpdate.

☠️ Risk & Impact

OddJob enables full remote control of compromised hosts, leading to data exfiltration of proprietary intellectual property, customer records, and network credentials. The primary impact is espionage in the telecommunications and semiconductor sectors, with financial losses stemming from breach remediation and regulatory fines. Mandiant assessed that long-term access allows APT41 to pivot to supply chain targets.

🛡️ Mitigation

Deploy endpoint detection rules (e.g., Sigma rule for scheduled task creation with suspicious names) and enable Windows Defender Attack Surface Reduction rules to block DLL side-loading. Apply patches for Log4j (CVE-2021-44228) and monitor for outbound connections to known OddJob C2 infrastructure using threat intelligence feeds from Mandiant or Trend Micro.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.