8t_Dropper, RoyalRoad

SonicWall Capture Labs Threat Research Team recently found a new sample for 8t_Dropper aka RoyalRoad. Royal Road is a tool shared by many targeted attack groups believed to belong to China. The sample below locates and downloads passwords using SQL queries into your current browsers stored database. (Google Chrome, Firefox, Thunderbird)

Threat Actor(s) Involved: Hellsing, Ice Fog, Pirate Panda, RANCOR, TA428, Tick, Tonto Team, Karma Panda

ID: T1055
Sub-techniques: T1055.001, T1055.002, T1055.003, T1055.004, T1055.005, T1055.008, T1055.009, T1055.011, T1055.012, T1055.013, T1055.014
Tactics: Defense Evasion, Privilege Escalation
Platforms: Linux, Windows, macOS
Data Sources: API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Defense Bypassed: Anti-virus, Application control
CAPEC ID: CAPEC-640

Checking for a valid PE File, red highlights will form within each PE member, if invalid data is found within the PE File. This sample passes, this check.

Entropy of sample:

A List/Table of the shell coders function calls in IDA Pro, disassembled:

This trick is used a lot in malware, (Call+5), disassembled:

Shellcode Function Calls Disassembled in x32 Debug:

Encrypted Buffer:

Decrypted Buffer:

Encryption used in DLL:

NSS Info:

NSS Overview:

NSS Decompiled

SQL Functions Decompiled:

(SQL Query) - Thunderbird Password Captures:

(SQL Query) - Google Chrome Password Captures:

• Windows 10
• Windows 8.1
• Windows 8.0
• Windows 7
• Windows Vista

• GAV: 8t_Dropper.A (Trojan)

Sample SHA256 Hash: 859443a72a9a9f53e3810efbddc79c68a243fcba0c52957c0a37846384477133