Spearphishing Connects PCs to Russian Botnet

The talent over at MalwareBytes wrote this week about a Zbot dropper which comes from a PDF exploit through a spear-phishing e-mail.  In their blog, they discuss how a spear-phishing attempts to exploit either CVE-2013-0640 or CVE-2013-2729. User's must be extra cautious dealing with any attachment in an e-mail, but this threat merits extreme concern.  It installs a very persistent rootkit and logs the victim into a botnet which receives new commands/tasks every 10 minutes.  Removal is near impossible and also will use your Windows Mail to spear-phish your contact list.

As noted by MalwareBytes, attackers often use false extensions in order to infect victims (such as totally_legit.doc.exe). In the case of this attack, victim's download and click a malicious PDF.  This PDF, as Malwarebytes mentions, exploits Adobe Reader 11 and downloads an executable file.  At the time of research, 18/51 AV companies saw through this ruse and blocked the content before it had a chance to further exploit the victim.

We obtained a copy of the same malware in the Zscaler cloud and noted the following observations. A dropped file immediately connects to a Russian IP address to set up its beaconing activity as well as download more malicious PE files to the victim's machine.

axisbuild[.]com is showing some suspicious activity besides beaconing.

The translation of the C&C configuration file seen above in English is:

Интервал обращения к серверу в минутах

('Interval back to the server in minutes')

Таймаут цикличного обращения по ссылкам в минутах

('Timeout cyclical treatment referred to in minutes')

Список ссылок c&c

('The list of references c & c')

Страна бота

('Country bot')

Список задач

('task List')

In addition to awaiting for further commands from a remote server, the threat will also make many edits to the vicitm's system in order to remain despite removal processes.

There are several locations where this threat might download additional malicious PE files.  I've added a brief list below to illustrate.  I will provide more upon request to interested security professionals.

There are other locations used to download malicious files.

We took all different versions of these files and combined the phone home traffic to give a full list of IPs contacted.  The dropped files immediately begin to contact various IP addresses using nonstandard ports.  The following is a list of IPs and their hosted country.  

List of nonstandard ports used by all variants.

List of IP addresses which were contacted across all variants.

Administrators should monitor their networks for any activity which might match the outgoing transactions above.  Administrators will have a really tough time removing the threat due to the creation of a rootkit and altering the system's boot sequence.  The Zbot variant maintains a high level of persistence by doing the following:

This allows for untested drivers to be executed as part of the boot process

• Uses bcdedit to modify the Windows boot settings.

Dropped files create a system driver which executes during boot sequence.

• Spawns drivers in the Windows Directory

The Autostarter value is randomly generated

• Creates an autostart registry key

Used to inject malicious process into kernel.

• Registers kernel notifiers (kernel callbacks)

The victim is used as a node in further spear-phishing campaigns.

• Manipulates Windows Mail files

Users and Administrators must take extra caution against suspicious attachments.  Common methods for APT infection include tricking users to go to a compromised website or downloading something malicious through an attachment.  The fact that this threat compromises Windows Mail files means that the victim can be used to attack your contact list.  This allows for the attack to circumvent spam lists and base protections employed by regular users.  The best solution is to employ a sandboxing solution against all files which come through e-mail.

Bitcoin Miner Utilizing IRC Worm

Bitcoin miners have given a new reason for attackers to communicate en mass with infected users.  IRC worms are not exactly the most hip way to communicate, but they remain effective at sending and receiving commands.  I recently came across several samples which bit coin mining examples leveraging IRC.  The malicious binary, once installed, queries for the network shares connected to the victim's PC, drops a file, and creates an autorun.inf file to infect anyone unfortunate enough to use that same network share.

First, we see that the threat has many different variants at a single location

A portion of the malicious content on this IP.

This IP's urlquery report is also picking up some shady content on this IP.  Unfortunately, the Virustotal score at the time of analysis was 1/52.

The first thing the threat does is install itself to any network shares on the victim's system.

The file 'snkb0pt.exe' is installed in 'netshare:/snkb0pt/'

It also installs an autorun.inf file among files used to store content retrieved from victims.

Next, it installs itself as a service on the victim's PC to ensure that it can't easily be removed. Image File Execution Options are also created.  This will ensure that the malware can install as the "debugger" for a frequently-run program (such as Explorer) and thereby inject itself into the execution sequence.  Further explanation about this methodology seen here.

A service is created along with edits to Image File Execution Options.

Autorun additions are also created to establish itself at boot.

The malicious network share file is clearly calling shell32.dll in order to exploit other systems connected to this network share through a created autorun.inf file. 

That clsid is allows the executable to launch differently than in Explorer.

The export file stored in the network share stores information about what systems are infected.

There was not much IRC activity, but the framework exists to login to the attackers channel and receive commands for further action.

Connection is established

First attempt

A connection remains open, beaconing for further contact.

I analyzed all available samples and compiled a list of phone home DNS requests made by all the variants.

Of all samples collected, these dns requests were made.

Due to the high volume of variation in the samples, standard AV solutions only catch certain instances of the threat.

Sample 1

Sample 2

In the second instance, we see that some vendors have flagged the malware as a bitcoin miner.  A sandbox analysis of the second sample has strings related to a Bitcoin Mining application known as xptminer. 

The implications are that this threat infects one user and anyone connecting to a malicious network share. Infected machines then begin communicating to a server which manages bitcoin mining operations.

Probing into the Flash Zero Day Exploit (CVE-2014-0502)

Yesterday, a targeted campaign leveraging a Flash zero day exploit hit the news. Adobe has now released a security bulletin regarding this vulnerability. Based on the attack vector mentioned in prior research, we have concluded that recently observed .SWF exploitation is related to the recent zero-day threat flagged as CVE-2014-0502. Upon successful infection, the exploited victim is served a RAT (Remote Access Trojan). 

While we were doing our daily review of logs, we found a significant number of transactions related to this campaign. We specifically started looking for those compromised servers which have been mentioned in prior research.  We began investigating all suspicious transactions which used a known compromised site as a referral location. 

After some brief inspection of this location, we found not only the malicious .SWF, but also all other connected malicious files detailed in the analysis below. We will cover the dropped Flash file that exploits the vulnerability using an image that contained embedded shell code. This shellcode is then used to download the malware.

The Flash file was found to be encrypted using the DoSWF flash encryptor.

Upon throwing the Flash file into an ActionScript viewer, we immediately see the script shown below. The script tries to make a URL Request to a GIF Image file, which contains the embedded shellcode for an ROP exploit.

The script checks for the presence of a cookie labeled 'XPT2013111'. If this cookie is not already present, it sets the same.

The script then checks the operating system version and in the case of Windows XP, further checks the OS language. Details of the OS language and version are then used to determine the base address for the exploit. In case of Windows 7, the script further probes for unpatched and outdated versions of Java (Web Start 1.6 and 1.7) or Microsoft Office (Sharepoint OpenDocuments 3 or 4).




Here we can see on XP, based on the version and language, the base address for the exploit is determined by the script. Then the ROP sled is built to carry out the exploit.

The GIF image used for embedding the shellcode is shown below, which of course seems innocuous to the victim.

 

When opened in a hex editor, the magic bytes for a GIF image file can be seen.

However, upon careful examination, we further see extra bytes appearing toward the end of the image as shown below.

Using a shellcode emulator like libemu, we can see that this extra data represents the shellcode to be executed.

Here we see that the shellcode makes a call to the LoadLibraryA function and then to VirtualProtect to allocate memory in which to place the shellcode. It then checks for the /temp folder path and makes calls to InternetOpenUrlA to download the malware from a remote location http://[x.x.x.x]/common/update.exe and drops it into the /temp folder.

A sandbox analysis of the final dropped file can be seen here.

Browser plugins continue to be the Achilles heel of enterprise security. While enterprises struggle to ensure that browser plugins are up to date on all end user systems to prevent browser exploit kits from targeting known vulnerabilities, here we see yet another demonstration where even that is not enough. Attackers continue to identify and exploit 0day vulnerabilities in popular web browser plugins such as Adobe Flash, which unfortunately has a long history of dealing with such threats.

Aurora exploit still floating ...

It's been around two years since Microsoft released a patch for the IE 0day famously known as the Aurora exploit (CVE-2010-0249). We had blogged about this in the past when it was first seen in the wild on the 'GOV.CN' domain. This vulnerability targets IE version 6. Despite the passage of time, we continue to find live exploits for this vulnerability. Recently, we found a new URL which is serving the Aurora exploit code.

Exploit URL: hxxp://www.artbridal.com/bizcodi/gm/news.html

Let's take a look at the exploit code being delivered.

 

The exploit is delivered via obfuscated JavaScript code, although the level of obfuscation is not very high. Some of the strings and JavaScript function names are been obfuscated. The following is a snapshot of the de-obfuscated code.

If you observe the first image, the SPAN tag holds an IMG tag on which the 'onload' event calls an event handler  function 'eve'. This in turn creates an event object called 'e1', using the 'document.createEventObject' method. Then, by using an '.innerHTML' property, it assigns a null string to SPAN object 'sp1', but instead, the 'sp1' object is removed. In the function 'eve', the freed object is referenced, causing memory corruption in the form of an access violation in IE. To exploit this condition, the exploit code uses a typical heap spray technique to load the shellcode into memory for the execution. When the shellcode is executed, it tries to download a malicious file from the URL 'hxxp://fly-tld.ru/w.php?f=47&e=3'.  For a more detailed analysis, you can refer to this blog.

To obtain the aforementioned URL, the PE executable file was formed and extracted from the shell code in the exploit. The EXE was then examined using a debugger to extract the URL as can be seen below.

This URL is down at the moment, so further post exploitation analysis was not possible.

Reports:

VT URL Scan on found URL : 4/51 detections.

VT File Scan on EXE formed from Shellcode: 27/41 detections.

Various other URLs that have been seen in the past with similar patterns - '/w.php?f=(\d){2}&e=(\d){1,2}' include:

hxxp://synergyledlighting.net/w.php?f=56&e=4
hxxp://nicesextubes.co/w.php?f=18&e=6 
hxxp://iplaecrcocee.com/w.php?f=26&e=2
hxxp://iplaecrcocee.com/w.php?f=26&e=2
hxxp://examine.arsb.co.uk/w.php?f=20&e=2
hxxp://exciting.simssocialcheat.com/w.php?f=22&e=2
hxxp://oyacromifh.com/w.php?f=26&e=2
hxxp://eteaescopr.com/w.php?f=26&e=2

The obvious reason behind attacking old CVE's is the belief of attackers, that there are still un-patched and outdated browser's out there on end user machines. Sadly, they're correct. To avoid such attacks we suggest updating browsers with latest patches and migrating to the most recent version of the browser. 

Stay updated, Stay Safe!

Pradeep

Expack continues exploiting Java vulnerability

Exploit kits available in the wild tend to follow a trend by exploiting vulnerabilities reported in various browser components which are commonly deployed. Recently, we have seen an increase in exploitation of a year old vulnerability reported in the JRE component of JAVA (CVE-2012-1723). Exploitation of this vulnerability in JRE allows a attacker to download malware onto a victim's machine and execute it. Let's looks at an analysis of such an exploit kit recently found in the wild.

Exploit Kit URL:

hxxp://174.142.240.91/577ac477f62d4873cf41dc834d107b7c/influences-portal.php

When accessed, the above exploit URL executes obfuscated JavaScript and loads an applet into the browser as shown below:

Obfuscated source code:

Let's analyze the above obfuscated JavaScript code by de-obfuscating it. While de-obfuscating the JavaScript code, we noticed that the code has multiple layers of obfuscation. For the scope of this article, lets skip ahead to the end of the de-obfuscation process. 

As usual, the exploit kit request loads content based on the version of the browser and versions of different plugins installed in a browser by running browser/plugin detection logic embedded in obfuscated JavaScript. The exploit kit targets vulnerabilities in JRE (Java) and Adobe components of the browsers.

Let's take a look at following de-obfuscated code which loads malicious applet into browser:

The following code calls the relevant functions above, depending upon the JRE version found on the victim's machine:

The applet is executed by the browser, which then downloads a malicious .jar file from following URL,

hxxp://174.142.240.91/577ac477f62d4873cf41dc834d107b7c/influences-portal.php?gKoRO=UfhqAFb&gCTEVgSTdQbZjI=wUkSXV 

The de-complied code of the downloaded .jar file is also heavily obfuscated. 

VT Result: 13 / 45

MD5:  361b0e1eab5e647315e6873ea16ca720

This .jar files exploits the vulnerability in the JRE, which allows the attacker to download additional malware and execute it the browser context.

 

 VT Result: 13 / 46 

MD5: a151fdce265ba4fcab1b36bd624d330f

A Trojan then connects to the CnC server by sending POST data and in response, the CnC server replies with 'STATUS-IMPORT-OK'.

After receiving command 'STATUS-IMPORT-OK' from the CnC server, The Trojan then downloads another malware file (6.exe) from the same domain which looks to be a variant of ZerooAccess rootkit. The detection rate for the '6.exe' is also fairly low on VT.

VT-Result: 6 / 46  

MD5: b152b3d170dc089b057fbbe3d6393764

Exploitation of browser components such as Java and Adobe plugins by exploit kits are now a very common reason for enterprise PCs to become compromised. My colleague Krishanan Subramanian recently blogged about a rise in Red Kit Exploit Kit Activity, which also addressed the same vulnerability in Java. It is vital that enterprises ensure that browser plugins are always patched and up to date, something enterprises regularly fail to do. In the case Java, given the now regular stream of 0days that it has inspired, you may want to seriously consider disabling Java altogether, at least at the browser level, something that you can read about in a previous blog post entitled: Are you vulnerable to yet another Java 0Day exploit?

Pradeep

PDF exploits targeted through Blackhole exploit kits.

PDF exploits have been targeted by Blackhole exploit kits for some time now. The Blackhole exploit kit will deliver various malicious PDF files to a user if the victim is running a potentially vulnerable version of Adobe Reader. When these PDFs are opened through Adobe Reader, a known vulnerability is exploited which will then compromise the user’s machine.

Let’s look at the de-obfuscated portion of the Blackhole exploit kit. The exploit kit for this sample was delivered from “flightpub.net/l/src.php?case=46677c190b37f2d6”.

The de-obfuscated code above shows how an iFrame of 1x1 pixels is created to load a malicious PDF file residing at “./content/ap1.php?f=97d19::182b5” or “./content/ap1.php?f=97d19::182b5”, depending upon the version of Adobe reader installed. These two files are hosted on same the domain - “flightpub.net”.

The absolute paths of the malicious files are,

hxxp://flightpub.net/l/content/ap1.php?f=97d19::182b5 and
hxxp://flightpub.net/l/content/ap2.php?f=97d19::182b5

For analysis purposes, we can manually downloaded the aforementioned PDF files. The PDF files contain a JavaScript object, which contains obfuscated JavaScript, as shown below:

The JavaScript code loops through array ‘ar’ and converts each element of the array with logic included in function ‘test2()’. The de-obfuscated code targets a three year old vulnerability in Adobe Acrobat reader.

Let’s take a look at the some of the de-obfuscated code,

A stack based buffer overflow vulnerability exists in the ‘getIcon()’ method, which is detailed in CVE-2009-0927.

This vulnerability is widely targeted by various versions of the Blackhole exploit kit. I have seen different variants of the payload URL used to host these PDF exploits. The URL pattern changes with different variants of the exploit kit. The different URL path patterns seen so far are:

/content/ap1.php?f=97d19::182b5
/content/ap2.php?f=97d19::182b5
/content/fdp1.php?f=63
/content/fdp2.php?f=63
/content/adfp2.php?f=193
/content/adfp1.php?f=193

The common pattern in the above URL paths are ‘/content/’ and ‘.php?f=’. By identifying these common patterns one can write a network signature on URL strings to catch these malicious URLs.

Let’s take a look at couple of snort signatures for detecting these malicious URL’s.

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Blackhole Acrobat 1-7 PDF exploit download request 3"; flow:established,to_server; content:"/fdp1.php?f="; http_uri; reference:md5,8a33d1d36d097ca13136832aa10ae5ca; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014052; rev:2;)

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS DRIVEBY Blackhole PDF Exploit Request /fdp2.php"; flow:established,to_server; content:"/fdp2.php?f="; http_uri; reference:md5,8a33d1d36d097ca13136832aa10ae5ca; reference:cve,CVE-2011-0611; classtype:trojan-activity; sid:2014035; rev:2;)

Most of the vulnerabilities targeted by various exploit kits are public. Making sure all of your applications are updated regularly with the latest security updates will go a long way in helping to keep your computer secure.

Pradeep

Adobe Flash “SWF” Exploit still in the Wild.

A vulnerability reported in Adobe Flash in April 2011 (CVE-2011-0611) continues to be targeted. When first reported, the vulnerability was widely exploited by embedding a “.swf” file into Microsoft Office documents/html pages. Adobe issued patch for this vulnerability soon after it was reported, but the vulnerability remains a popular target.

Source of hxxp://220.181.23.217/baike/mhxy.html :

This exploit code embeds a “nb.swf” flash file into a webpage, which is then executed by the Adobe Flash player object initialized using classid “d27cdb6e-ae6d-11cf-96b8-444553540000”. When the page is being loaded, the malicious “nb.swf” file is downloaded from the URL “http://220.181.23.217/baike/nb.swf”.

Execution of “nb.swf” leads to memory corruption in Flash Player, which allows execution of arbitrary shellcode, which is passed as an input parameter.

Shellcode:

The Virustotal report for “nb.swf” shows it is a Trojan Downloader, used to deliver additional malware to the infected machine.

Flash and other browser plugins remain a popular target for attackers, even for known vulnerabilities that have been patched for some time. This is because attackers know that plugins regularly remain unpatched for some time. The chart below details the most outdated browser plugins seen by Zscaler during Q3 2011. As can be seen, about 7% of all browsers that we see with Flash Player installed, are running an outdated and potentially vulnerable version of the software. Other plugins present are even more frightening targets.

Be sure you update your plugins regularly!

Pradeep