Pingback Backdoor

Pingback is a recently identified backdoor which affects 64-bit Windows systems. It is delivered as a 64-bit Dynamic Link Library (DLL) and achieves persistence on a host through the technique of DLL hijacking (T1574.001). Pingback carries out C2 operations via Internet Control Message Protocol (ICMP).

A malicious DLL, oci.dll, is loaded using DLL hijacking, a technique which allows attackers to exploit trusted Windows processes to run arbitrary malicious code. This is achieved by placing a malicious DLL file in a folder trusted by the Windows operating system, resulting in a legitimate system application running the malicious DLL file.

Pingback uses this technique to load the malicious oci.dll via the Microsoft Distributed Transaction Control (msdtc) service. The msdtc service will search for 3 DLLs, which by default do not exist on the Windows System directory, one of which is an Oracle library called oci.dll. The malicious DLL is dropped into the Windows System directory and renamed as oci.dll, which results in it being loaded by the msdtc service.

The method used to drop the malicious DLL into the Windows System directory is not fully known, but there are indications that other unidentified malware is used to drop the malicious oci.dll and to configure msdtc to run on start-up.

Pingback communicates with a C2 server, using ICMP to evade diagnostic tools which rely on port detection. ICMP is normally used for network pings and does not communicate using network ports. The ICMP packet’s data field is used to transfer arbitrary data, enabling the C2 server to send commands to exploited hosts, which use the same method to respond. To achieve this, Pingback listens for inbound ICMP packets and selectively parses packets with sequence numbers: 1234, 1235 and 1236. Packets with the sequence number 1234 contain payloads or commands, enabling the C2 server to download and upload of files, and execute other arbitrary commands on the remote host. Packets 1235 and 1236 are used only for ICMP communication, to acknowledge that requests have been received.