QUIETCANARY

Quietcanary is a malicious software (malware) that has been exploited by threat groups such as Pensive Ursa and Tomiris. The malware, known for its backdoor capabilities, has been in use since at least 2019, with Pensive Ursa deploying it against targets in Ukraine in September 2022, often in conjunction with another malware called Kopiluwak. Quietcanary is proxy-aware and uses the System.Net.HttpWebRequest class to identify any default proxy specified on the victim's computer. All communications between Quietcanary and its command and control server (C2) are encrypted using RC4 and then encoded using Base-64. The malware operates by handling various command codes sent from the C2, which it separates into two categories: fast commands and long commands. Some of these commands include ClearCommand, KillCommand, ExeCommand, TimeoutCommand, UploadCommand, and DownloadCommand. Each command has a specific function, ranging from aborting current command execution and starting a new one, to executing a command with arguments or uploading a command to a given path. Quietcanary can parse multiple commands in a single response from the C2, demonstrating its sophisticated design and functionality. Despite its complex operations, there are some aspects of Quietcanary that remain unused or unclear. For example, an unused class named ServerInfoExtractor was found in the analyzed sample, suggesting potential additional functionalities that might not have been activated or used in this instance. Furthermore, certain configuration values within the malware are assumed to be set by methods outside the malware itself, as no code setting these values is present within the Quietcanary sample. This hints at the possibility of external tools or processes being used in conjunction with the malware during an attack.