{"id":5617,"date":"2018-12-02T01:41:14","date_gmt":"2018-12-02T01:41:14","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=5617"},"modified":"2018-12-02T01:41:14","modified_gmt":"2018-12-02T01:41:14","slug":"beyond-good-ol-run-key-part-95","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2018\/12\/02\/beyond-good-ol-run-key-part-95\/","title":{"rendered":"Beyond good ol\u2019 Run key, Part 95"},"content":{"rendered":"

I recently read ESET research paper on Turla<\/a> [PDF warning].<\/p>\n

While reading it, I came across a description of Turla’s legacy persistence mechanism that requires a presence of The Bat! program on the infected system. While Eset’s paper claims Turla no longer uses this trick, I thought it would be a good idea to include the description of it in this series. Plus I added one more trick as a bonus.<\/p>\n

For these who don’t know, The Bat! is a very popular email client. It is actively developed and there are still many users that could be targeted by malware abusing this program’s plug-in framework.<\/p>\n

As per the ESET document:<\/p>\n

To register as a plugin for The Bat!, the malware was modifying the file %appdata%\\The Bat!\\Mail\\
\nTBPlugin.INI. This is the legitimate method to register a plugin for The Bat! and some plugins such
\nas anti-spam plugins also rely on it.<\/p>\n

The structure of the TBPlugin.INI is pretty straightforward – it’s a standard Windows .ini file:<\/p>\n

...\r\n[Plugins]\r\nCount=<number>\r\nPlugin #1=<file name>\r\nPlugin #2=<file name>\r\n...<\/pre>\n
The .ini file may include other sections e.g.\u00a0[Plugin Data], and [AntiSpam].<\/p>\n
The default file extension for plugins is .tbp.<\/p>\n
The Plug-in is a standard DLL module; to work properly, it needs to export some, or all the APIs listed below:<\/p>\n