Chinese Backdoor Zegost delivered via Hacking Team exploit

Introduction

Zscaler ThreatLabZ has been closely monitoring the usage of Hacking Team's leaked exploits in the wild since July, 2015 and recently uncovered the Emissary Panda APT attack leveraging these exploits. In past two months, we've spotted multiple instances of Zegost Backdoor Trojan installation attempts leveraging Hacking Team's Adobe Flash exploit (CVE-2015-5119) payload. These attacks do not appear to be targeted, but the payload involved in the infection cycle has some resemblance to recent APT payloads from HttpBrowser & the PlugX RAT family.

Attack Chain

The infection cycle starts with a legitimate Chinese real estate and shopping site www[.]kongquechang[.]com, which appears to have been compromised by the attackers and contains an injected script. The injected script will cause a series of redirects leading to Hacking Team's exploit payload as seen in Figure 1. The majority of users were led to the original compromised site following a Baidu search.

Figure 1: Compromised Chinese real estate & shopping site

The site www[.]kongquecheng[.]com is still infected but the exploit server appears to be down at the time of writing this blog. Attackers are abusing the Chinese URL shortening service t.cn to redirect victims to the attack server and also Baidu's URL shortening service dwz.cn to deliver the Adobe Flash exploit payload as seen below:

Figure 2: Zegost Backdoor Attack Chain

The Flash exploit payload (CVE-2015-5119) involved here is from the Hacking Team's leaked archive with updated shellcode. Upon successful exploitation, the embedded shellcode will trigger the download and execution of the Zegost executable from a predetermined location.

Figure 3: Hacking Team's Adobe Flash Exploit

Figure 4: Embedded shellcode to download & install Zegost

Zegost Payload Iterations

During the course of our monitoring we observed the attackers switch the malware payload multiple times.

Payload Type #1 - APT RAT like Zegost Installer

Filename:
svhost.exe

MD5:
E04F3C9C2F7BE694628AECCD23E8839D

The Zegost payload was being delivered as part of an installer archive, which is similar in structure to the APT RAT PlugX and HttpBrowser as detailed here. The downloaded installer was svhost.exe, which has following file structure:

Figure 5: APT RAT like Zegost installer archive

The Zegost installer is responsible for dropping the above three files and running the legitimate Ping_Master_Pro utility DATA.exe. The legitimate binary contains the data.dll in the import table, ensuring that the DLL will be loaded before it runs. The data.dll that gets loaded in this case, will be a fake VirtualBox display driver DLL file present in the same directory and it will patch the entry point of the main executable (DATA.exe) file with a jump instruction to run the DLL’s code instead. This technique is also known as DLL Hijacking which ensures that the fake display driver DLL gets loaded by abusing the Windows DLL load order. The DLL’s code is responsible for decrypting and running the Zegost Backdoor payload from the fafentuqiang.png file in the same memory space of the benign executable.

We observed a bug in the persistence module for this payload, which resulted in an incorrect path getting added to the registry entry created by the malware. The result was that upon system reboot the user's machine will no longer be infected with the Backdoor Trojan.

Payload Type #2 - Vanilla Zegost

Filename:
svhost.exe

MD5:
8F3B2C449793BC1538328CCC9BDC9CCD
62C705A0232EA6D4E3E3CE93F7506ACC

A modified Zegost payload was being delivered in decrypted form abandoning the installer archive structure. This payload was recently compiled and purports to be a XLLuaRuntime Dynamic Link Library file as seen below:

Figure 6: Recently compiled Zegost payload

Figure 7: Zegost payload file meta data

During our analysis we noticed that the persistence issue that existed in the previous iteration was resolved in this payload and the malware successfully remained active upon system reboot.

Zegost Infection Cycle

• Zegost Trojan drops a copy of itself in the Windows system directory as %SYSTEMDIR%\Autoexec.exe

• It creates the following registry key to ensure persistence upon system reboot:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Nobug = %SYSTEMDIR%\Autoexec.exe

• We also saw an alternate code for achieving persistence by registering a new Windows Service:

HKLM\SYSTEM\CurrentControlSet\Services\

ServiceName - DirectX dwx

DisplayName - DirectX Remover auy for Windows(R).

ImagePath - %SYSTEMDIR%\Autoexec.exe

• The Trojan reports the infected system information to a predetermined remote server at the following location:

Domain - www[.]svshot[.]com

Server IP - 123.57.54[.]57

Server Port - 8999

• The Command & Control server domain used in this attack was recently registered and points to a dedicated server hosted on the shady Chinese autonomous system - AS37963 (CNNIC-ALIBABA-CN-NET-AP) as seen below:

Figure 8: Command & Control server hosted in China

The same server is also used for the initial Adobe Flash exploitation attempt.

Conclusion

Hacking Team's exploit payloads remain a popular choice among cyber criminals for weaponizing their payloads. This is the first instance of the Zegost Backdoor Trojan being delivered using Hacking Team's exploit. The Zegost Backdoor payload iterations we observed in this attack chain indicates that the author is testing out new payloads.

Zscaler’s ThreatLabZ has confirmed coverage for these exploits and for the Zegost variants, ensuring protection for organizations using Zscaler’s Internet security platform.

Research by: Deepen Desai, Amandeep Kumar

Fake BatteryBotPro ClickFraud, AdFraud, SMS & Downloader Trojan

[UPDATE #1 - July 8, 2015] We would like to clarify that at the time of our analysis, the app was not present on the Google Store. We found references to this fake app being hosted on the Google Play store during our research where it showed that the App has been removed from the Google Play store already as seen below:

Link to Google Play Store for the fake app

.....

[UPDATE #2 - July 9, 2015] Google Android security team confirmed that the fake application was uploaded to the Google Play Developer Console by the miscreants.

Google Play Developer Console enables developers to easily publish and distribute their applications directly to users of Android-compatible phones

However, as per Google's Android team the fake app did not make it to the official Google Play Store as Google's security system flagged the fake app during scanning.

.....

Malware authors tend to follow one of the following two methods for malware development:

1. Create a malware app from scratch.
2. Compromise a legit app by embedding malicious modules into it. 

With Android being open source and an Android app being easily reversible, most of the malware developers tend to stick with the second option.

Spoofed Functionality and Ads:

We came across a malicious app recently that followed this path. This time the spoofed app was a copy of a legit app named BatteryBot Pro. The spoofed app had the package name of 'com.polaris.BatteryIndicatorPro' and was removed from the Play Store as soon as Google became aware of it's malicious intent.

We also saw a spoofed version of BatteryBot Pro available for free during our research. The actual price of BatteryBotPro on official Play Store is Rs.179.99. The legit BatteryBotPro app demanded for minimal permissions as shown below:

Legit app permissions

In contrast, the fake app was requesting many more permissions, raising a red flag as can be seen in the screenshot below:

Permission requested by Malware

The screenshot below shows a comparison between the actual app and the fake app. The legit app functionality was modified and embedded at a different location within the fake app:

legit app vs fake app

Upon installation of the malicious app, it demanded administrative access, which clearly portrays the motive of malware developer to obtain full control access of the victim's device.

Request for Administrator access

Once the permission is granted, the fake app will provide the same functionality to the victim found in the original version of BatteryBot Pro but performs malicious activity in the background.

opening BatteryPro screen

ClickFraud and AdFraud activity

Though the app seems to be working normally, at the back-end it tried to load various ad libraries, ultimately delivering a click fraud campaign.

Requests sent in back-end

Some of these URLs were hard coded in the app and some were sent by the remote server.

Hard-coded URLs in database

The malware tries to collect the following information from the victim device:

-Memory available in device
-IMEI
-Phone Operator
-Location
-Langauge
-Phone Model
-Sim Card availability

The following screenshot shows the data being collected.

Parameters sent to server

Parameters sent to server

On the basis of various parameters and conditions in the server request, the malware starts receiving a list of ads to be displayed, along with the URLs from where to fetch the ad.s

Response from server containing ad URL

The malicious app then downloads and installs additional malicious APKs without the user's consent:

  

Downloaded Apps by malware

Apart from the implicit downloads, the malware also displays pop-up ads to the user:

Pop up Ads

This malware was not only built with the purpose of displaying ads, it was also designed with more evil intentions.

Sending SMS messages: 

The main Activity Screen is identical to original app but when the user clicks on "View Battery Use", the malware sends a few requests to its Command & Control server to retrieve short codes. These short codes were premium rate SMS numbers where a message was sent. This will result in financial loss to the affected user.

Requests sent to server can be seen below:

Device info sent in request

Though the content was encoded, we did not have to work hard to determine what was sent as the malware developer forgot to remove the logs. The server responds with short codes that are used for sending messages. The following screenshot shows a premium SMS response received from the server.

Logs showing server response

Uninstall FAILED: 

Apart from displaying ads and sending SMS message, the malware is also very persistent. Being run with administrator privileges, the user cannot delete the app after installation.

Uninstall not possible

"Persistence" Effect:
While  in some of the scenarios we were able to manually delete the app, the malware authors have taken care of ensure persistence. The malware silently installs an app with a package name of com.nb.superuser, which runs as a different thread and resides on the device even if the app is forcefully deleted.

This acts as a service and sends requests to hard-coded URLs found in the app.
The screenshot below shows the hard coded URLs.

Hard-coded URLs

The service started by this app continually sends requests to aforementioned URLs, some of which will deliver new APKs.

Conclusion: 

The Malware we saw in this blog was designed with multiple evil intentions including ClickFraud, AdFraud, Premium rate SMS fraud and the download & installation of additional malicious APKs.

A few traces of command execution were also seen in the app but were not fully implemented. Perhaps the developer is working on an upgraded version of the malware with proper "command-execution" functionality.

The ThreatLabZ team will continue monitoring new mobile malware threats and ensure protection for Zscaler customers.

Fake porn site serving Chinese SMS Trojan

The majority of Android malware continues to target Android devices that permit the installation of apps beyond the official Google Play store. Often, the malicious Android apps are delivered via third party app stores, but we do also see rogue apps delivered directly from malicious sites. Recently, we came across a fake porn site which is serving a Chinese SMS Trojan.

http://baidu-google{-}sogou-soso-360-qq.lrh6.com/cdn/index.html?l{}=banmeng&uid=3002&t=ar

Malware payload.

The above screenshot shows the malicious APK file being downloaded following user acceptance. When a user visits the page and attempts to view a video they will then be prompted to install an app. The user is social engineered into believing that installing the app is necessary to view the video, but in doing so, they are actually installing the malicious app that will carry out SMS fraud.

File Info:

Md5: 96caed56d6d735dd14a21a4d504e82c3.

Name: GA2161.apk

Size: 0.9 MB.

Package name: iickcf.ndakik.feockk.gcahbp.oefdnc.omeonn

Interestingly, the payload filename is dynamically generated and will change with each new download. This is likely an attempt to bypass basic blacklisting of a known malicious app name.

Changing APK names

Upon successful infection, the following icon is visible to the end user on their mobile phone:

Icon of installed malware

The malware then declares a Broadcast Receiver, which is registered to intercept all future SMS messages received by the user. The received message is analyzed by the malware to determine where it was received from. Once the sender's identity is confirmed, it parses the content of the received messages and matches it against certain hard coded message strings as seen below:

Receives SMS.

The following is the list of hard coded Chinese message strings and their English translations:

Hard coded message strings.

Translated Chinese message strings [Credit: Google]

The intention of the malware author is clear from these message strings. The app generates fraudulent transactions from an infected device by purchasing on-demand videos and premium SMS services controlled by the attacker. SMS messages are generated by the app to initiate a purchase. The app then monitors incoming SMS messages to identify the purchase validation message, which must be accurately responded to in order to complete the transaction. When the validation message has been intercepted, it is parsed and matched against the hardcoded strings in the image above, to determine and submit the appropriate response. Once this occurs, the transaction is complete and the victim will be charged by their mobile provider.

SMS Trojan Fraud cycle

SMS send function.

The malware also leverages the International Mobile Subscriber Identity (IMSI) property for determining the location of the device, as well as service provider information as seen below:

Checks for IMSI.

After a successful SMS send operation, the app submits a POST request to its Command & Control (C2) server 'msg-web.pw' on port 8456.

Post request.

The app sends the following information to the C2 server:

Post request capture.

We were able to observe portions of the C2 server panel used by the malware author due to a lack of authentication applied to specific web pages. The administration panel used to manage the Trojan can be seen in the screenshots below:

C&C Panel Login

C&C Panel Actions

It also sends the same information to IP Address 115.28.252.178, which appears to be an alternate C2 server for the same Trojan:

Portal 3

Post request.

The malicious app then sends a POST request checking for updates and in response, receives a URL pointing to a JAR file named "firstpay_v7.0.jar" as seen below:

Jar file location

This jar file consists of a Dex file which is capable of running on the infected mobile device as seen below:

Dex execution.

Below you can see the warning message dislayed by the phone when sending an SMS message which may incur additional charges.

Money warning

Conclusion

This malware is yet another addition to the Android SMS Trojan Family. It scams the user by purchasing subscriptions for porn services, on-demand videos and sending premium rate SMS messages. SMS fraud remains the most common form of monetization that we see with malicious mobile apps and it is almost exclusively a problem on the Android platform. One simple yet effective defense, involves restricting app installation to reputable App stores such as those operated by Google & Amazon.

Research & Analysis by Viral and Shivang.

Android Banking Trojan and SMS stealer floating in the wild

We recently came across an Android Banking Trojan with a very low antivirus detection rate that is targeting Chinese mobile users. This Android malware is capable of stealing banking information by intercepting SMS messages looking for certain keywords. It also steals all the contact information from the user's mobile device and relays it to a remote Command & Control (C2) server.

Malicious Android package details

• Name : 888.apk.
• MD5 :  ff081c1400a948f2bcc4952fed2c818b.
• VT : 7/56 (at the time of analysis)
• Source: http://wap{.}jhgxc{.}com/888.apk

Functionality

•  Intercept and capture all incoming and outgoing SMS messages
•  Intercept incoming calls and the ability to end calls
•  Receive C2 commands via SMS
•  Sends stolen data via SMS, e-mail, and possibly web requests to the C2 server

Let's take a look at some of the above mentioned malware features and how they have been implemented:

Email sent SMS

In the screenshot above, you can see that it is e-mailing the captured outbound SMS messages using a hardcoded 163.com email address. It e-mails the stolen data to itself with the subject "Send SMS".

Email and SMS all sniffed data

Here you can see that it is e-mailing the captured inbound SMS messages using the same parameters that it used for outbound SMS messages. Additionally, it is also relaying the same information via SMS to a hardcoded Chinese phone number "15996581524".

Intercepting call

The above screenshot shows the ability to intercept incoming calls and send the caller's number via e-mail with subject "Intercept incoming call once the call!". It also has the ability to end the call.

Receives SMS as commands.

It's also capable of receiving C2 commands via SMS from the malware author to act further.

Commands to act

As seen in the screenshot above, the attacker can start the data capturing activity by sending the SMS command "intercept#" and can also stop the capturing activity by sending SMS command "interceptstop#".

Banking strings

In the screenshot above, you can see that there are string checks in place which are related to online banking transactions. It checks for strings like "Pay","Check","Bank","Balance","Validation"  which clearly shows the intent of the malware author to sniff banking related information.

Setting high priorities

The malware sets the SMS receiver and outgoing call services to high priority. This will ensure that the malicious application will get a higher preference for these events compared to other applications.

Web request for sending stolen contacts

We also saw some code that can allow the malware to send stolen contact information & SMS data through web requests. However, it appears to be non-functional in this version and the malware author might still be testing out this feature, as seen by the usage of the private IP address:

 "http://192.168.1.102/input/input_data_get_contact.asp?user=XXX&pwd=XXXX&addr="

Web request for sending stolen SMS data

"http://192.168.1.102/input/input_data_get_sms.asp?user=XXX&pwd=XXX&addr=XXX&id=XXX"

The following are screenshots showing a sample of stolen information that the malware author has been able to capture through these malicious APK infections till now:

Sent email section

E-mailed stolen SMS message

Intercepted incoming call notification

SMS matching online banking strings

Stolen contact information

Infected mobile users.

Intercepted online banking SMS

Intercepted online banking SMS

Here you can see some serious financial information sniffed by this malware illustrating the impact of such banking sniffers.

-Viral.