Chinese cyber espionage APT group leveraging recently leaked Hacking Team exploits to target a Financial Services Firm

Introduction

As predicted following the leak of Hacking Team exploit codes covered here, the Zscaler security research team has recently started seeing a Chinese cyber espionage group weaponizing malware payloads using the 0-day exploits found in the leaked Hacking Team archives. As such, this new attack represents a dangerous new hybrid combining the work of a notorious cyber criminal gang with Chinese cyber espionage group to attack a financial services firm. 

Zscaler's cloud sandboxes recently detected a Remote Access Trojan (RAT) being delivered by a well-known Chinese cyber espionage group using the Hacking Team’s 0-day exploits. This attack was specifically targeting a well-known financial services firm. The exploit files involved were identical to the Hacking Team's leaked exploit HTML, JavaScript, and ShockWave Flash 0-day files. The end payload that was installed is the HttpBrowser RAT, known to be used by the Chinese group in previous targeted attacks against governments.

Figure 1: Chinese APT attack cycle to plant HttpBrowser RAT

Hacking Team Exploits

The attack involved targeted users visiting a malicious URL delivered via a spear phishing attack. The malicious URL points to a remote server located in Hong Kong (IP Address - 210.209.89.162) that downloads and executes a malicious ShockWave Flash payload through a specially crafted HTML & JavaScript. The exploit files involved are identical to the ones that we found during our analysis of the Hacking Team leaked code as seen below:

Figure 2: Resemblance with Hacking Team's exploit HTML

Figure 3: Resemblance with Hacking Team's SWF exploit

The Adobe ShockWave exploit (CVE-2015-5119) if successful will download and install a variant of the HttpBrowser RAT from the same Hong Kong based server which eventually also serves as the Command & Control (C&C) server.

Figure 4: Hong Kong based server used in the attack [credit: domaintools.com]

Malware Payload - HttpBrowser RAT

HttpBrowser is a RAT that has become extremely popular in past two years among the APT adversaries, leveraged in various targeted attacks. The RAT has been leveraged as the primary payload by the APT group that is also known to install the nasty Backdoor PlugX RAT during lateral movement in the victim environment after compromise.

The HttpBrowser payload used for the attack was compiled just few days before the attack as seen below:

Figure 5: HttpBrowser payload compilation time

The HttpBrowser installer archive structure is very similar to that observed in previous PlugX attacks. The installer archive in our case was svchost.exe (saved as xox.exe) that consisted of the following three files:

• VPDN_LU.exe - A legitimate digitally signed Symantec Antivirus executable to evade detection

Figure 6: Legitimate Symantec Antivirus executable used in the attack 

• navlu.dll - A fake Symantec DLL to decrypt and run the HttpBrowser RAT
• navlu.dll.url - Encrypted HttpBrowser RAT payload

The HttpBrowser RAT installer is responsible for dropping the above three files and running the legitimate Symantec Antivirus binary VPDN_LU.exe. The legitimate binary contains the navlu.dll in the import table ensuring that the DLL will be loaded before it runs. The navlu.dll that gets loaded in this case will be the fake Symantec DLL file present in the same directory and it will patch the entry point of the main executable file with a jump instruction to run the DLL’s code instead. 

Figure 7: Legitimate executable entry point patched

This technique is also known as DLL Hijacking which ensures that the fake Symantec DLL gets loaded by abusing the Windows DLL load order. The DLL’s code is responsible for decrypting and running the HttpBrowser RAT payload from the navlu.dll.url file in the same memory space of the benign executable. The decryption routine consist of an incremental XOR as seen below:

Figure 8: Incremental XOR routine to decrypt RAT payload

The HttpBrowser installer structure ensures that the malware evades detection by running in the context of the legitimate signed binary. This also ensures that the malicious DLL will not run by itself in automated analysis environments.

The malware then deletes the original installer file and moves the dropped files to the following location:

• %ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe
• %ALLUSERPROFILE%\%APPDATA%\vpdn\navlu.dll
• %ALLUSERPROFILE%\%APPDATA%\vpdn\navlu.dll.dll

The malware also creates the following registry entry to ensure persistence:

• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe”

Command & Control communication

The HttpBrowser RAT variant was configured to connect to the following Command & Control server upon successful infection:

• update.hancominc[.]com:8080

It relays the following information of the victim machine in an encrypted format over SSL:

/loop?c=<computerName & userName>&l=<IP Address>&o=<Operating System details>&u=<GUID>&r=<Injection Status (Boolean)>&t=<Running Time>

The commands supported by this RAT variant are:

Command	Description
init	start reverse shell and send list of drives on infected system.
setcmd	change the default (cmd.exe) shell
settime	Set sleep time
uninstall	uninstall itself
write	write command to shell
list	Send list of files and folders to C&C
upload	Download file from C&C
down	Upload file to C&C

Here are some sample decrypted C&C transactions from the HttpBrowser RAT:

Figure 9: List of drives sent as part of the init command

Figure 10: List of files sent as part of the list command

Conclusion

HttpBrowser RAT, due to the range of features including SSL based C&C channel, anti-detection & anti-analysis techniques, remains the popular malware of choice for APT attacks. There have been multiple instances where this RAT co-existed with PlugX RAT on the compromised network indicating an APT adversary group with a set attack tool arsenal. The network infrastructure leveraged in this attack against the financial services firm shows involvement of a previously known Cyber espionage APT group of Chinese origin. The main motive of this group is to monitor and exfiltrate intellectual property data from the target organization.

Zscaler’s ThreatLabZ has confirmed coverage for these exploits and for the HttpBrowser variant, ensuring protection for organizations using Zscaler’s Internet security platform.

Research by: Abhay Yadav, Avinash Kumar, Nirmal Singh, Deepen Desai

Adobe Flash Vulnerability CVE-2015-5119 analysis

With the leak of Hacking Team's data, the security industry came to learn about multiple new 0day vulnerabilities targeting Flash, Internet Explorer, Android, etc. As always, exploit kit authors were quick to incorporate these 0day exploits into their arsenal.

In this blog, we will be looking at the CVE-2015-5119 exploit payload that we have now seen in the wild. The sample has multiple layers of obfuscation and packer routines. The malicious Flash payload is packed, XOR'ed and stored as a binary data inside a parent Flash file that dynamically unpacks a malicious Flash file and writes it to memory at run time.

Here is the structure of the CVE-2015-5119 exploit payload:

Packages, properties and method names are stored in variables for obfuscation:

Here we observe the calling of the unpack routine to decrypt the embedded SWF exploit payload:

An XOR key is used for unpacking and is hardcoded and assigned to the variable vari_10. This is what the unpacked content looks like:

Upon decompilation, it is apparent that majority of the codebase, including variable names and function names are the same as what we saw in the leaked source by the Hacking Team. The public exploit also has checks for:

• Presence of a debugger
• Operating System bitness (32-bit or 64-bit)

When the program execution starts, the ActionScript looks for the input parameters and based on it, sets a variable which is then sent to the main exploitation routine as seen below:

The TryExpl() routine allocates sequential pages of memory and begins the exploit cycle:

The vulnerability lies in making use of the valueOf property and corrupting the vector space so that the valueOf  property will overwrite the length field of the vector object, which will be further used to get access to vtables.

Here is explicit definition of valueOf function

prototype.valueOf() is setting up the length of the ByteArray to 4352

Once the memory allocation is done, a MyClass object is created and assigned to _ba[3]. The

valueOf()  function defines the length of ByteArray to 4352, which is greater than the length of the object created, causing reallocation of bytes inside the memory.

If the value of _ba[3] is set to zero after the assignment then it was successful in triggering a Use After Free vulnerability. The exploit code looks for the kernel32.VirtualProtect() (VP) function in the corrupted vector space as seen below:

A call to the VP function is made, which replaces the vtable pointer and sets the PAGE_EXECUTE_READWRITE permission before executing the final payload.

Hashes of  CVE-2015-5119 exploit payloads seen in the wild:

061c086a4da72ecaf5475c862f178f9d

079a440bee0f86d8a59ebc5c4b523a07

16ac6fc55ab027f64d50da928fea49ec

313cf1faaded7bbb406ea732c34217f4

6d14ba5c9719624825fd34fe5c7b4297

Conclusion

It will be a challenge for security vendors to get container file detection in place as majority of the time, the embedded content is highly obfuscated with multiple levels of packing. Adobe has already released a patch to fix this issue. We highly recommend enabling the Adobe's auto update feature to keep the relevant plugins updated.

References:

• http://malware.dontneedcoffee.com/2015/07/hackingteam-flash-0d-cve-2015-xxxx-and.html

Hacking Team leak, Flash 0day, exploit payloads and more

[Update - July 13, 2015]

In addition to the Flash 0day exploit that we reported earlier [CVE-2015-5119], two new Flash 0day exploits were found in the Hacking Team's leaked data and these flaws are not yet patched:

• CVE-2015-5122: valueOf use after free vulnerability during the assignment to freed TextBox

Two in-the-wild samples reported here

• 31d03169b9742a0ff04e3d24bb448bbf
• fcecd6b624bb50301a17d5aa423e135d

• CVE-2015-5123: valueOf use after free vulnerability during the assignment to freed Bitmap

Adobe acknowledged these issues over the weekend and is working on a patch. Meanwhile, ThreatLabZ has deployed additional coverage for these new exploits to protect Zscaler customers. We are continuously monitoring for new in-the-wild exploit payloads for these flaws.

Introduction

Data breaches have become a common and painful reality. Major enterprises, including retailers and financial institutions have been affected in the past few years. Even cyber criminals are not spared from breaches, with various malware code leaks, the most recent being that of the KINS 2.0 Banking Trojan family.

Earlier this week, we saw a large stolen information archive (400 GB) being published that belonged to the notorious Italian hackers-for-hire firm - Hacking Team. Hacking Team has been known to sell offensive surveillance technology to government agencies worldwide. The archive contains e-mails, invoices, and more importantly exploits & malware source codes. An individual that goes by the handle PhineasFisher has taken credit for the attack and if that name sounds familiar it's because he's done similar work before, having hacked and leaked data from Gamma International last year. His motivation for that breach was apparently similar as he accused the firm of selling surveillance tools to repressive regimes. While our assessment is far from over, in this blog, we will provide a quick run down of what we have seen in the archive related to exploits & malware thus far and we will continue to update as we discover more details.

Exploits, Remote Control System, and more

• Flash 0-day exploit with Proof-Of-Concept (POC) [CVE-2015-5119] - Confirmed 0day for the latest version of Adobe Flash Player, running on Windows XP and Windows 7. The exploit did not succeed on Windows 8.1. We also saw support for targeting OS X. This is a Use-After-free vulnerability in Adobe Flash player's built-in ByteArray class that can lead to crash or remote code execution by the attacker.

 Affected applications:

1. The majority of the popular browsers including Chrome, FireFox, Internet Explorer and Safari with Flash Player installed are vulnerable to this issue.
2. Microsoft Office 2007/2010/2013 - where the attack scenario will involve an office document with the malicious SWF file embedded in it. The document may arrive via an e-mail or as a drive-by download on the target system.

Adobe released a patch today to address this vulnerability.

• Microsoft Windows Kernel code injection vulnerability exploit that can be leveraged to perform privilege escalation on the target system to bypass various security mechanisms

• Support for iOS devices - They are leveraging the popular iOS Jailbreak application Cydia for iOS devices to further install malicious payloads on the target device.

• Support for Android Devices - There is a separate module for Android OS (Android Webkit) that is leveraging a probable 0day exploit [we are still working on confirming this] in the Android browser and running various known root-access exploits like exynos, gingerbreak, levitator, etc. to root the target devices and further install malicious payloads. 

• Support for Windows & Blackberry devices - We also saw source code for supposed exploits that will target Windows Phone 8 as well as Blackberry devices. 

• MacOS Rooting exploit to enable online and offline installation of untrusted applications.

• A Remote Control System (RCS) Dropper module that is capable of creating both mobile and computer system payloads for Windows and Macintosh. 

• A multi-stage JAVA exploit module that contains a weaponized version as well as a two stage version with features to by pass Microsoft Security Essentials and an example Trojanized Putty.exe payload.

• Multiple driver files that may contain Rootkit functionality to hide the malicious process and evade detection.

• Source code of the core Remote Control System module where we can see the in-depth list of features supported by it.

core-win32:

1.) Monitoring modules for Instant messengers, Web Browsers, PC cameras & microphones, etc.
2.) Monitoring social media activities over Yahoo, Gmail, Twitter, and Facebook
3.) Hooking Outlook and getting email and contact details.
4.) Relaying infected system information including time, battery status, processor, memory, OS, user etc..
5.) Advanced keylogging capabilities

 We also observed support for 64-bit operating system target.

• There are also multiple anti-VM, anti-Sandbox, and anti-AV evasion modules present in the source code archive.

We are still combing through the archive evaluating more exploits and we will continue to publish our findings as they emerge.

Loader configuration server

We saw a hardcoded IP address in the first stage shellcode payload that is supposedly hosting the configuration file as seen below

Hardcoded configuration file location

The shellcode payload is presumably used by the loader for downloading and installing the main RCS component following a successful exploitation attempt. A quick VirusTotal lookup for the IP address reveals lot of interesting activity in the past two months only:

VirusTotal report for the Configuration Server

Enterprises would be advised to block the aforementioned IP address if they are concerned that they may have been targeted by any of the Hacking Tools applications.

Conclusion

As has been the case in the past after any such leak, we will start seeing the leaked code being incorporated into many future spin offs as well as existing malware families as feature upgrades. Exploit Kit authors have already incorporated the Flash 0day payload in their exploit arsenal as noted here.

ThreatLabZ has ensured coverage for the Flash 0day (CVE-2015-5119) and other exploit payloads ensuring protection for the Zscaler customers. We will continue to monitor further developments surrounding this leak.

Research by: Abhay Yadav, Nirmal Singh, Deepen Desai