team82_iocontrol.pdf

What is the IOCONTROL Malware? 4

IOCONTROL Deployment on ORPAK Systems 5

ORPAK Systems Devices 7

IOCONTROL Binary Analysis 8

Unpacking and Emulation of IOCONTROL 8

Decrypting the Configuration 11

Resolving IOCONTROL Command-and-Control via DOH 14

Persistence 15

Communication with C2 Via MQTT 16

MQTT Protocol 16

Supported Commands 18

IOCONTROL Flow: Simplified 19

IOCONTROL Infrastructure 20

Domain 20

Summary 21

IOCONTROL Indicators of Compromise (IoC) 22

Appendix #1 - Environment Variables (post processing) 23

Appendix #2 - Decrypted Config 23

Contents

3Inside a New Cyber Weapon: IOCONTROL ©Copyright Claroty…