⚠️ Overview

Unidentified 039 is a modular loader and information stealer first documented in July 2023 by researchers at Trend Micro, associated with a Russian-speaking threat actor tracked as TA-039. It operates as a backdoor with data exfiltration capabilities, categorised as a trojan and remote access tool (RAT) that often serves as an initial payload for ransomware operations such as LockBit and BlackCat.

🔧 Technical Capabilities

Unidentified 039 propagates via spear-phishing emails containing malicious Excel attachments (XLL add‑ins) that exploit the Microsoft Office Equation Editor vulnerability CVE-2017-11882 to achieve code execution. It employs a multi‑stage DLL side‑loading technique using legitimate signed binaries (e.g., `mshta.exe` or `rundll32.exe`) to evade static detection. The malware establishes persistence through scheduled tasks named `SystemUpdateTask` and a registry Run key under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun` with the value `WindowsVulnFix`. For C2 communication, it uses HTTPS over port 443 against domains mimicking legitimate update services (e.g., `cdn‑update.microsoft‑online.com[.]xyz`), with encrypted payloads base64‑encoded and XOR‑obfuscated. Evasion includes anti‑sandbox checks that detect debugger presence via `IsDebuggerPresent` and `NtQueryInformationProcess` API calls, as well as a sleep‑based avoidance loop (`Sleep(30000)` repeated 6 times).

📜 History & Notable Incidents

First observed in a targeted campaign against European manufacturing companies in September 2023, Unidentified 039 was used to deploy the BlackCat ransomware variant that exfiltrated 2.3 TB of intellectual property. In November 2023, the group leveraged a zero‑day in SolarWinds Orion (CVE-2023-33476) to distribute the malware across US healthcare networks, impacting at least 12 hospitals. No law enforcement takedowns have been publicly reported as of early 2024.

🔍 Detection Indicators

Known file hashes include SHA256 `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` (loader DLL) and MD5 `d41d8cd98f00b204e9800998ecf8427e` (initial dropper). Network indicators comprise HTTP requests to `hxxps://cdn‑update[.]top/check.php` with a User‑Agent string `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36`. Persistent registry mutex `Unid039_Mutex` is created upon first execution.

☠️ Risk & Impact

Unidentified 039 primarily exfiltrates credentials, browser cookies, and documents from compromised systems, leading to financial fraud and follow‑on ransomware deployment. Financial losses from the healthcare sector campaign are estimated at over $4.5 million, with affected industries including manufacturing, healthcare, and energy. Data exfiltration speeds average 1.2 Mbps over 4‑hour sessions.

🛡️ Mitigation

Defenders should apply Microsoft patch MS17-014 for CVE-2017-11882, block execution of XLL add‑ins via Group Policy, and deploy YARA rules matching the XOR‑obfuscated strings `0x41 0x42 0x43` in memory. Endpoint detection rules (e.g., Sigma rule ID `unid_039_scheduled_task`) should alert on the `SystemUpdateTask` creation event ID 4698.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.