Reaver

Reaver is a type of malware discovered by researchers at Palo Alto Networks in November 2017, but its activity dates back to at least late 2016. Researchers identified only ten unique samples of the malware, indicating limited use, and three different variants, noted as versions 1, 2, and 3. The malware is unique as its final payload masquerades as a control panel link (CPL) file. The intended targets of this activity are unknown as of this writing; however, it was used concurrently with the SunOrcal malware and the same C2 infrastructure used by threat actors who primarily target based on the "Five Poisons" - five perceived threats deemed dangerous to, and working against the interests of, the Chinese government.

Version 1 of the Reaver malware payload communicates with its remote server via HTTP GET and POST requests. It collects the following information from the victim's machine:

  • CPU speed
  • Computer name
  • Username
  • IP address
  • Microsoft Windows version
  • Physical and virtual memory information

Reaver version 1 has the following capabilities:

  • Get drive information
  • Read files
  • Write files
  • Delete files
  • Move files
  • Spawn processes
  • Create directories

Versions 2 and 3 of the Reaver malware payloads communicate using raw TCP connections. It collects the following information from the victim's machine:

  • Computer name
  • Volume serial number
  • Microsoft Windows version
  • CPU speed
  • ANSI code page
  • OEM code page identifier for the operating system
  • Physical and virtual memory information

Reaver versions 2 and 3 have the following capabilities:

  • Get drive information
  • Modify files
  • Modify directories
  • Modify registry
  • Spawn processes
  • Terminate processes
  • Modify services
  • Kill self

Technical Details

  • Palo Alto Networks provides technical details of the Reaver malware here.