Sidoh: WIZARD SPIDER’s Mysterious Exfiltration Tool

Table 1. Ryuk and Sidoh detected toolsets

The exact intent of Sidoh is only known by the threat actors that operated it, but the keywords used by WIZARD SPIDER open up speculation of its targeted audience and usage of the exfiltrated data.

Technical Analysis

 

 

The following technical analysis is based on the newest version of Sidoh. Differences between the two variants are noted throughout the text when applicable. Upon execution, Sidoh checks for the presence of a command line argument passed to it. If the argument is present, it is treated as a file path. Sidoh sleeps for 5,000 microseconds and then deletes the file if the argument is present. Sidoh lists all available drives on the host by calling GetLogicalDrives. For each available drive, it calls GetDriveTypeW to ensure the drive type is not DRIVE_CDROM. If the drive type is not a CD-ROM, the drive path’s contents are searched. After the drives have been searched, Sidoh attempts to search the contents of hosts that have IP addresses present within the compromised host’s ARP entries. The ARP entries are retrieved by calling GetIpNetTable. For each entry, Sidoh attempts to mount the IP address from within the entry as a network drive, using Server Message Block (SMB), and then proceeds to search the drive.

To enumerate files on disk, Sidoh calls FindFirstFileW and FindNextFileW. Sidoh contains a deny list targeting specific file types of folder names. Table 2 shows a block list of folders and file names whose contents are ignored by Sidoh.

Table 2. Sidoh folder name block list

Some of the names in Table 2 are not directories (e.g., .dll). The fields that end with ** are names that are artifacts from a Ryuk infection. For example, RyukReadMe.txt was the name for Ryuk ransom notes before WIZARD SPIDER switched the ransom note to HTML. Sidoh does not attempt to exfiltrate files over 50MB, and earlier variants would not exfiltrate files over 20MB. If a file is over 50MB, it is ignored. Along with folders names, Sidoh has an allow list of file extensions. Earlier variants contained the file extension .RYK, which is appended to files after being encrypted by Ryuk. The presence of the string related to Ryuk suggests that Sidoh was either derived from the Ryuk source code or designed to be compatible with systems that have been encrypted by Ryuk. Table 3 contains the block list of file extensions for variant 2. The newer list is more extensive, likely with an end goal of speeding up time spent scanning the host for files.

Table 3. Sidoh file extension name block list

If the filename contains an extension of .cpp, .h .xls, .xlsx, .doc, .docx, .docb, .pdf or

wallet.dat, an attempt to automatically exfiltrate the file is made. Early variants also included .txt and .gov file extension but were removed. Further details about the attempt are described in the next section, Exfiltration and Infrastructure. If the filename does not contain one of the previously mentioned file extensions, the filename is then checked against the keyword list in Table 4. If the filename contains one of the keywords in the following table, the file is exfiltrated.

Table 4. Sidoh file name exfiltration keyword list

Early variants of Sidoh contained functionality to search the contents of .docx or .xlsx files. To search the contents of .docx or .xlsx files, Sidoh must first parse the file type. Modern Microsoft Office documents are stored in the Microsoft Open XML (MOX) format. This format primarily consists of a ZIP file with XML data. Before decompressing the ZIP file, Sidoh would import a Dynamic Link Library (DLL) named libzip.dll. It is derived from the open-source C library, libzip, which can be used for reading, writing and modifying ZIP files. This library is not installed on Windows by default. In order to execute properly, these early variants of Sidoh would need libzip.dll to be present within the working directory or within the standard DLL search order. The Sidoh executable and libzip.dll are likely written to disk by a dropper. Once the libzip has been imported, it is used to decompress the document. Once decompressed, Sidoh reads the path word/document.xml for .docx files and xl/worksheets/sheet*.xml for .xlsx. The contents are read into a buffer and then searched for the keywords in Table 5. The bug existed in how Sidoh searched .xlsx for keywords. Data from rows and columns in Excel spreadsheets are not stored in xl/worksheets/sheet*.xml but are stored at the path xl/SharedStrings.xml. Therefore, the .xlsx file data that Sidoh reads and searches only contains the mapping of the rows and columns to fields in SharedStrings.xml but none of the text that would contain the keywords being searched for. The reading and searching of

.docx or .xlsx was removed in the newest variant, likely because of the described error. Newer variants simply read the contents of the file and search for one of the keywords in Table 5.

Table 5. Sidoh file name exfiltration keyword list

The lists in Table 4 and Table 5 contain many words that are misspelled (e.g., Engeneering) or two words concatenated (e.g., treasonrestricted). These errors hint that this list was hastily imputed or never reviewed. Further details about the attempts to upload the files are described next.

Exfiltration and Infrastructure

Sidoh uploads documents that match the search criteria to a command-and-control (C2) IP address via FTP with a hard-coded username and password of anonymous. If the FTP server is not available, Sidoh typically contains a backup IP address that it can use. One variant of Sidoh did not contain a backup IP address. Once connected, the files are uploaded to a hard-coded directory with four random digits prefixing the original filename. If the connections fail, Sidoh sleeps for a random amount of time (between 0 and 125 seconds) and then tries to connect again. Sidoh does not keep an active connection to the FTP server but continuously logs into the FTP server.

If during the exfiltration process Sidoh fails to connect to the C2 after three attempts, it scans the filename or contents of files with an extension of .cpp, .xls, .xlsx, .doc, .docx, .docb or .pdf for the targeted keywords to determine if additional effort should be made to exfiltrate those files. If there is a match, Sidoh makes another three connection attempts. After each failed connection, Sidoh will sleep for a random amount of time (between 0 and 125 seconds) between each attempt. If all attempts to connect to the C2 fail, Sidoh discards the current file being uploaded and continues to search for more files to exfiltrate. Table 6 contains all known Sidoh IP addresses and observed folder paths for uploading exfiltrated files.

Table 6. Sidoh IP addresses, upload paths and build times

Due to reallocation, the IP addresses in Table 6 should not be used for blocking.

Table 7. Sidoh SHA256 Hashes and Build Time

Conclusion

 

WIZARD SPIDER is one of the most sophisticated groups tracked by CrowdStrike. Their threat arsenal ranges from banking trojans to spam bots to ransomware — with all of these tools designed with an end result of getting money from their victims. Some of these tools have been short-lived, but the diversity in tooling used by WIZARD SPIDER demonstrates their desire to use new strategies to monetize their attacks. It is unknown if Sidoh is one such strategy that experimented with monetizing victims by stealing potentially sensitive or proprietary data, or if Sidoh was used by WIZARD SPIDER to steal data from specific victims at the request of a third party. There is even the possibility that the original Hermes source code (which Ryuk was derived from) was modified to be Sidoh, and the threat actors added the Ryuk file artifact references as a false flag. But the likely and simplest solution is Sidoh was used in rare instances to automatically steal data from compromised hosts by WIZARD SPIDER.

As of this publication date, CrowdStrike has not observed Sidoh within the telemetry of our customers. If your company was a victim of Sidoh and you have further details you’d be willing to share, please reach out to CrowdStrike Intelligence.

Additional Resources

• For more intel about WIZARD SPIDER, visit the CrowdStrike Adversary Universe.
• To find out how to incorporate intelligence on threat actors into your security strategy, visit the CROWDSTRIKE FALCON® INTELLIGENCE™ Threat Intelligence page.
• Learn about the powerful, cloud-native CrowdStrike Falcon® platform by visiting the product webpage.

   

• Get a full-featured free trial of CrowdStrike Falcon® Prevent™ to see for yourself how true next-gen AV performs against today’s most sophisticated threats.