{
  "name": "Earth Lusca Uses KTLVdoor Backdoor for Multiplatform Intrusion",
  "slug": "earth-lusca-uses-ktlvdoor-backdoor-for-multiplatform-intrusion",
  "description": "A new multiplatform backdoor named KTLVdoor, written in Golang with versions for Windows and Linux, has been discovered during monitoring of the Chinese-speaking threat actor Earth Lusca. This highly obfuscated malware impersonates system utilities and allows attackers to control infected systems, manipulate files, and gather information. The campaign involves over 50 C&C servers hosted in China, potentially shared with other threat actors. KTLVdoor uses sophisticated encryption and obfuscation techniques, including a custom TLV-like configuration format and AES-GCM encryption for C&C communication. The malware's capabilities include file operations, command execution, port scanning, and proxy functionality.",
  "published": "2024-09-04T07:22:57+00:00",
  "created_at": "2024-09-04T07:22:57+00:00",
  "modified_at": "2024-09-04T07:55:54+00:00",
  "created_at_opencti": "2024-09-04T07:22:57+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-09-04",
    "golang",
    "ktlvdoor"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "59.110.226.246"
      },
      {
        "id": "",
        "name": "59.110.136.109"
      },
      {
        "id": "",
        "name": "47.99.78.41"
      },
      {
        "id": "",
        "name": "47.98.50.198"
      },
      {
        "id": "",
        "name": "47.98.173.175"
      },
      {
        "id": "",
        "name": "47.97.109.62"
      },
      {
        "id": "",
        "name": "47.96.97.77"
      },
      {
        "id": "",
        "name": "47.96.5.136"
      },
      {
        "id": "",
        "name": "47.96.160.242"
      },
      {
        "id": "",
        "name": "47.96.135.49"
      },
      {
        "id": "",
        "name": "47.96.13.99"
      },
      {
        "id": "",
        "name": "47.96.106.167"
      },
      {
        "id": "",
        "name": "47.95.198.228"
      },
      {
        "id": "",
        "name": "47.95.12.152"
      },
      {
        "id": "",
        "name": "47.95.168.191"
      },
      {
        "id": "",
        "name": "47.94.229.250"
      },
      {
        "id": "",
        "name": "47.94.223.124"
      },
      {
        "id": "",
        "name": "47.94.227.15"
      },
      {
        "id": "",
        "name": "47.94.202.137"
      },
      {
        "id": "",
        "name": "47.94.200.23"
      },
      {
        "id": "",
        "name": "47.94.20.102"
      },
      {
        "id": "",
        "name": "47.94.194.248"
      },
      {
        "id": "",
        "name": "47.94.166.190"
      },
      {
        "id": "",
        "name": "47.94.143.163"
      },
      {
        "id": "",
        "name": "47.94.193.44"
      },
      {
        "id": "",
        "name": "47.93.47.186"
      },
      {
        "id": "",
        "name": "47.93.38.26"
      },
      {
        "id": "",
        "name": "47.102.36.88"
      },
      {
        "id": "",
        "name": "47.101.48.168"
      },
      {
        "id": "",
        "name": "47.101.43.111"
      },
      {
        "id": "",
        "name": "47.100.98.234"
      },
      {
        "id": "",
        "name": "47.100.59.42"
      },
      {
        "id": "",
        "name": "47.100.160.164"
      },
      {
        "id": "",
        "name": "47.100.121.195"
      },
      {
        "id": "",
        "name": "39.107.75.91"
      },
      {
        "id": "",
        "name": "39.107.67.131"
      },
      {
        "id": "",
        "name": "39.107.231.100"
      },
      {
        "id": "",
        "name": "39.107.101.26"
      },
      {
        "id": "",
        "name": "39.106.40.121"
      },
      {
        "id": "",
        "name": "39.106.13.202"
      },
      {
        "id": "",
        "name": "39.106.135.228"
      },
      {
        "id": "",
        "name": "39.105.121.123"
      },
      {
        "id": "",
        "name": "39.105.107.130"
      },
      {
        "id": "",
        "name": "182.92.243.166"
      },
      {
        "id": "",
        "name": "182.92.169.60"
      },
      {
        "id": "",
        "name": "182.92.155.149"
      },
      {
        "id": "",
        "name": "139.224.45.232"
      },
      {
        "id": "",
        "name": "182.92.101.4"
      },
      {
        "id": "",
        "name": "139.224.254.181"
      },
      {
        "id": "",
        "name": "139.196.89.210"
      },
      {
        "id": "",
        "name": "139.196.196.178"
      },
      {
        "id": "",
        "name": "123.57.6.3"
      },
      {
        "id": "",
        "name": "123.57.60.94"
      },
      {
        "id": "",
        "name": "123.57.223.22"
      },
      {
        "id": "",
        "name": "123.57.218.176"
      },
      {
        "id": "",
        "name": "121.40.70.23"
      },
      {
        "id": "",
        "name": "123.56.45.175"
      },
      {
        "id": "",
        "name": "118.31.53.137"
      },
      {
        "id": "",
        "name": "116.62.231.152"
      },
      {
        "id": "",
        "name": "116.62.142.53"
      },
      {
        "id": "",
        "name": "106.15.90.75"
      },
      {
        "id": "",
        "name": "106.15.193.24"
      },
      {
        "id": "",
        "name": "106.14.175.235"
      },
      {
        "id": "",
        "name": "101.201.69.42"
      },
      {
        "id": "",
        "name": "101.201.68.58"
      },
      {
        "id": "",
        "name": "101.201.35.96"
      },
      {
        "id": "",
        "name": "101.200.63.187"
      },
      {
        "id": "",
        "name": "47.98.121.179"
      },
      {
        "id": "",
        "name": "47.101.137.187"
      },
      {
        "id": "",
        "name": "101.200.156.217"
      },
      {
        "id": "",
        "name": "116.62.120.97"
      },
      {
        "id": "",
        "name": "182.92.233.242"
      },
      {
        "id": "",
        "name": "http://59.110.226.246:443"
      },
      {
        "id": "",
        "name": "http://59.110.136.109:9999"
      },
      {
        "id": "",
        "name": "http://47.99.78.41:443"
      },
      {
        "id": "",
        "name": "http://47.98.50.198:80"
      },
      {
        "id": "",
        "name": "http://47.98.173.175:443"
      },
      {
        "id": "",
        "name": "http://47.98.121.179:443"
      },
      {
        "id": "",
        "name": "http://47.97.109.62:443"
      },
      {
        "id": "",
        "name": "http://47.96.97.77:443"
      },
      {
        "id": "",
        "name": "http://47.96.5.136:443"
      },
      {
        "id": "",
        "name": "http://47.96.160.242:443"
      },
      {
        "id": "",
        "name": "http://47.96.135.49:443"
      },
      {
        "id": "",
        "name": "http://47.96.13.99:443"
      },
      {
        "id": "",
        "name": "http://47.96.106.167:443"
      },
      {
        "id": "",
        "name": "http://47.95.198.228:53"
      },
      {
        "id": "",
        "name": "http://47.95.168.191:80"
      },
      {
        "id": "",
        "name": "http://47.95.12.152:53"
      },
      {
        "id": "",
        "name": "http://47.94.229.250:8081"
      },
      {
        "id": "",
        "name": "http://47.94.229.250:443"
      },
      {
        "id": "",
        "name": "http://47.94.227.15:443"
      },
      {
        "id": "",
        "name": "http://47.94.223.124:9999"
      },
      {
        "id": "",
        "name": "http://47.94.202.137:443"
      },
      {
        "id": "",
        "name": "http://47.94.200.23:443"
      },
      {
        "id": "",
        "name": "http://47.94.20.102:443"
      },
      {
        "id": "",
        "name": "http://47.94.194.248:53"
      },
      {
        "id": "",
        "name": "http://47.94.193.44:443"
      },
      {
        "id": "",
        "name": "http://47.94.166.190:9999"
      },
      {
        "id": "",
        "name": "http://47.94.143.163:443"
      },
      {
        "id": "",
        "name": "http://47.93.47.186:443"
      },
      {
        "id": "",
        "name": "http://47.93.38.26:53"
      },
      {
        "id": "",
        "name": "http://47.102.36.88:53"
      },
      {
        "id": "",
        "name": "http://47.101.48.168:80"
      },
      {
        "id": "",
        "name": "http://47.101.43.111:53"
      },
      {
        "id": "",
        "name": "http://47.101.137.187:8032"
      },
      {
        "id": "",
        "name": "http://47.100.98.234:443"
      },
      {
        "id": "",
        "name": "http://47.100.59.42:443"
      },
      {
        "id": "",
        "name": "http://47.100.121.195:443"
      },
      {
        "id": "",
        "name": "http://47.100.160.164:80"
      },
      {
        "id": "",
        "name": "http://39.107.75.91:81"
      },
      {
        "id": "",
        "name": "http://39.107.75.91:443"
      },
      {
        "id": "",
        "name": "http://39.107.67.131:81"
      },
      {
        "id": "",
        "name": "http://39.107.231.100:53"
      },
      {
        "id": "",
        "name": "http://39.107.101.26:9999"
      },
      {
        "id": "",
        "name": "http://39.106.40.121:53"
      },
      {
        "id": "",
        "name": "http://39.106.135.228:53"
      },
      {
        "id": "",
        "name": "http://39.106.13.202:443"
      },
      {
        "id": "",
        "name": "http://39.105.121.123:9999"
      },
      {
        "id": "",
        "name": "http://39.105.107.130:8081"
      },
      {
        "id": "",
        "name": "http://39.105.107.130:443"
      },
      {
        "id": "",
        "name": "http://182.92.243.166:1433"
      },
      {
        "id": "",
        "name": "http://182.92.233.242:8081"
      },
      {
        "id": "",
        "name": "http://182.92.233.242:443"
      },
      {
        "id": "",
        "name": "http://182.92.169.60:8081"
      },
      {
        "id": "",
        "name": "http://182.92.169.60:443"
      },
      {
        "id": "",
        "name": "http://182.92.155.149:81"
      },
      {
        "id": "",
        "name": "http://182.92.101.4:81"
      },
      {
        "id": "",
        "name": "http://182.92.101.4:443"
      },
      {
        "id": "",
        "name": "http://139.224.45.232:53"
      },
      {
        "id": "",
        "name": "http://139.224.254.181:53"
      },
      {
        "id": "",
        "name": "http://139.196.89.210:80"
      },
      {
        "id": "",
        "name": "http://139.196.196.178:53"
      },
      {
        "id": "",
        "name": "http://123.57.60.94:8081"
      },
      {
        "id": "",
        "name": "http://123.57.60.94:443"
      },
      {
        "id": "",
        "name": "http://123.57.6.3:81"
      },
      {
        "id": "",
        "name": "http://123.57.223.22:81"
      },
      {
        "id": "",
        "name": "http://123.57.223.22:443"
      },
      {
        "id": "",
        "name": "http://123.57.218.176:81"
      },
      {
        "id": "",
        "name": "http://123.56.45.175:81"
      },
      {
        "id": "",
        "name": "http://123.56.45.175:443"
      },
      {
        "id": "",
        "name": "http://121.40.70.23:443"
      },
      {
        "id": "",
        "name": "http://118.31.53.137:443"
      },
      {
        "id": "",
        "name": "http://116.62.231.152:443"
      },
      {
        "id": "",
        "name": "http://116.62.142.53:443"
      },
      {
        "id": "",
        "name": "http://116.62.120.97:443"
      },
      {
        "id": "",
        "name": "http://106.15.90.75:80"
      },
      {
        "id": "",
        "name": "http://106.15.193.24:443"
      },
      {
        "id": "",
        "name": "http://106.14.175.235:443"
      },
      {
        "id": "",
        "name": "http://101.201.69.42:443"
      },
      {
        "id": "",
        "name": "http://101.201.68.58:53"
      },
      {
        "id": "",
        "name": "http://101.201.35.96:53"
      },
      {
        "id": "",
        "name": "http://101.200.63.187:53"
      },
      {
        "id": "",
        "name": "http://101.200.156.217:81"
      },
      {
        "id": "",
        "name": "fd3205edef38248c059898274f5818abbcb757adb707ca47580d4b16772a38d1"
      },
      {
        "id": "",
        "name": "fcf0cf8a19fa16792771310462d36f3c059ed7d36ef90899316313f4626d24d7"
      },
      {
        "id": "",
        "name": "dc4277e5f6e76ef3f5c0da8a6703acd69a017747aac0413f7248911e51214641"
      },
      {
        "id": "",
        "name": "d72ea22e6f35e848a2e5870863e410f0434013ad43c3f5b6935168fc07c7d7b0"
      },
      {
        "id": "",
        "name": "d18019064e5903dcf7c29921c10a7a90176cccd55d9cf3ba1e3e9805c1364df1"
      },
      {
        "id": "",
        "name": "d095e636400ee633ae22488bba77d53f584f1ff279fd604bb6e60c0211d1957e"
      },
      {
        "id": "",
        "name": "c75c5d7b4bdedcf5c6e78305d62f6830f4766c4517cf650a36493e19574c507d"
      },
      {
        "id": "",
        "name": "c0b1deaa2598936c284684b50a652f98771a129e882f382ac011d5ab984fd132"
      },
      {
        "id": "",
        "name": "b66dab4fbdae54eea59313fd218abc96a54c0bbf0ab774dbe8776de9322510b2"
      },
      {
        "id": "",
        "name": "aa7bc130c5340364f61074f7c98651e80db3b08396a4fb449f614e0889acfdd3"
      },
      {
        "id": "",
        "name": "aa5ff64cadabd2d8aba7963c2372270bbfdafa155f85a9a9ec2b57674cf8173e"
      },
      {
        "id": "",
        "name": "a133b1839bad5616b51915f2dfe420be36e05ee5c5f1c8e81220177b14c12848"
      },
      {
        "id": "",
        "name": "9ceb37c55a1e55afe50e2b892d3756e5c89ee71131245f5da72c1b8dd0005b99"
      },
      {
        "id": "",
        "name": "99027cf9f6fcce91d1d08a8cc15043912e51aff82804d4678c7b453e55899404"
      },
      {
        "id": "",
        "name": "7ff329e0a20a96dd4d0e8b42a216ade348161566250b7e39e166031c881f34d0"
      },
      {
        "id": "",
        "name": "6eec892054e6cb1addbde2fa92d3ccb5d56d37aa992f81f9106aaf124b9d3525"
      },
      {
        "id": "",
        "name": "644b88ce37d8ccb9258df6fcd74c6b485323dcfd9feb0f961252e6c311241703"
      },
      {
        "id": "",
        "name": "3dcad2fdebd68390ea4a80398593cfc3360ef51291b853cb3e9a607915ec74cb"
      },
      {
        "id": "",
        "name": "3d753a9e8e6ab22a498f7c6702910ea3e77ca8ef524f8435ac4614a9d4cbf345"
      },
      {
        "id": "",
        "name": "20f09959706797b81b2a4de627c01d0c0d890d142954d455a0e50f7811bdc951"
      },
      {
        "id": "",
        "name": "19f94c523d4488a50584dd3d96500820e4f479cadcef4d14a1dd7cf939cd3154"
      },
      {
        "id": "",
        "name": "18e2b7df374a838a57ebf3186b13a26e523cf964afde50b7ba765ed4d5509670"
      },
      {
        "id": "",
        "name": "1887185af63849aea9cdd7855b638110447842f178fca9cd81b76c72acd16e68"
      },
      {
        "id": "",
        "name": "12435ae8d190c4a0cae64009416f17195dbb7f7ca732b69e6178e9dd4c66fcb2"
      },
      {
        "id": "",
        "name": "1185fa967aa989d5e072577e493d2b307c48181480129d4c45337da64d5bfd25"
      },
      {
        "id": "",
        "name": "0b2e9328d82a045ce00f6b1b449ae32d8997f631f691350ea39d85c78eb66216"
      },
      {
        "id": "",
        "name": "01ef286f55d1a15f308f2bed102bec0916d799d8e883a48117cecfe713a74267"
      }
    ],
    "malware": [
      {
        "id": "8ae2f580-0941-45a4-b9da-fe3b4d9c0eac",
        "name": "KTLVdoor",
        "slug": "ktlvdoor"
      }
    ],
    "intrusion_sets": [
      {
        "id": "d6aaeb2d-4a61-488f-9b96-cc795c700cd0",
        "name": "Earth Lusca",
        "slug": "earth-lusca"
      }
    ],
    "attack_patterns": [
      {
        "id": "5d2af906-6187-4702-ab9f-590fbe5b1ca3",
        "name": "T1021.002"
      },
      {
        "id": "beaa4978-0309-438b-a45e-ec566b643811",
        "name": "T1505.003"
      },
      {
        "id": "195d9773-4de3-4f61-b94d-a2b53cb65608",
        "name": "T1021.001"
      },
      {
        "id": "a58c2bff-7d90-4816-93fd-aa0b6beca12e",
        "name": "T1124"
      },
      {
        "id": "e1b18ecf-d74e-4fe6-9bd4-ca6a62e7d818",
        "name": "T1027.002"
      },
      {
        "id": "16e26db7-7376-40c1-b8a9-23d56c44f7ee",
        "name": "T1571"
      },
      {
        "id": "3ccbe4bd-0466-4cbc-9645-5082016edc19",
        "name": "T1070.006"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "c3af9fd7-d307-4df4-9220-cc627938fb85",
        "name": "T1055"
      },
      {
        "id": "53c193a7-f726-4bd2-ae88-4019e2604adf",
        "name": "T1046"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "China"
      },
      {
        "id": "",
        "name": "Finance"
      }
    ]
  },
  "external_refs": [
    "https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/i/earth-lusca-uses-ktlvdoor-backdoor-for-multiplatform-intrusion--/Indicators%20of%20Compromise%20-%20Earth%20Lusca%20Uses%20KTLVdoor%20Backdoor%20for%20Multiplatform%20Intrusion.txt",
    "https://otx.alienvault.com/pulse/66d826f2f61254f51a48bbe7"
  ]
}