Malicious Office files dropping Kasidet and Dridex

Introduction 

We have covered Dridex Banking Trojan being delivered via various campaigns involving Office documents with malicious VBA macros in the past. However, over the past two weeks we are seeing these malicious VBA macros leveraged to drop Kasidet backdoor in addition to Dridex on the infected systems. These malicious Office documents are being spread as an attachment using spear phishing emails as described here. The malicious macro inside the Office document is obfuscated as shown in the code snapshot below -

Macro code

The macro downloads malware payload from the hardcoded URL. We have seen following URLs used in different document payloads that we captured for this campaign:

•       armandosofsalem[.]com/l9k7hg4/b4387kfd[.]exe
•       trinity.ad-ventures[.]es/l9k7hg4/b4387kfd[.]exe
•       188.226.152[.]172/l9k7hg4/b4387kfd[.]exe

In this blog, we will provide a detailed analysis for the Kasidet variant that we spotted in this campaign.

Kasidet Analysis

Installation: 
Kasidet installs itself into %APPDATA% folder. It creates a new folder there with the name "Y1FeZFVYXllb", this string is hardcoded in the malware. The same string is used as mutex name and in creating a Registry key for ensuring persistence upon system reboot.

AntiVM Check:
Kasidet tries to detect analysis systems during execution through following checks.
Checking Dubugger through "IsDebuggerPresent" and "CheckRemoteDebuggerPresent" Windows APIs. It also checks for the following popular sandbox related strings:

User Name: "MALTEST",  "TEQUILABOOMBOOM", "SANDBOX", "VIRUS", "MALWARE"

File Name: "SAMPLE", "VIRUS", "SANDBOX"

It tries to detect wine software by checking if kernel32.dll is exporting "wine_get_unix_file_name" function or not. It detects Vmware, VirtualBox, QEMU and Bochs by checking for following registry entries:

Vmware	"SOFTWARE\\VMware, Inc.\\VMware Tools"
	"HARDWARE\DEVICEMAP\Scsi\Scsi Port\Scsi Bus\Target Id\Logical Unit Id", "Identifier" , Vmware"
	"HARDWARE\DEVICEMAP\Scsi\Scsi Port\Scsi Bus\Target Id\Logical Unit Id", "Identifier" , "VBOX"
VirtualBox	"HARDWARE\\Description\\System", "SystemBiosVersion" , "VBOX" SOFTWARE\\Oracle\\VirtualBox Guest Additions" "HARDWARE\\Description\\System", "VideoBiosVersion" , "VIRTUALBOX"
QEMU	"HARDWARE\DEVICEMAP\Scsi\Scsi Port \Scsi Bus \Target Id \Logical Unit Id ", "Identifier" , "QEMU" "HARDWARE\\Description\\System" , "SystemBiosVersion" , "QEMU"
Bochs	"HARDWARE\\Description\\System" , "SystemBiosVersion" , "BOCHS”

Information Stealing capabilities:

Kasidet uses following two methods for stealing information from the victim's machine:

1. Memory Scraping – This allows Kasidet to steal credit card data from the memory of Point-Of-Sale (POS) systems. It scans the memory of all the running processes except the operating system processes listed below:
System
smss.exe
csrss.exe
winlogon.exe
lsass.exe
spoolsv.exe
devenv.exe

The stolen information is relayed back to the attacker using following URI format – 

d=1&id=<MachineID>&name=<SystemName>&type=<Track1 or Track2 data>&data=<stolen data>&p=< Process elevation status >

2. Browser Hooking –  This allows Kasidet to steal data from Web browsers. It can inject code into FireFox, Chrome, and Internet Explorer (IE). Browser names are not saved in plain text and instead this variant uses the same hash function as used by Carberp malware to encrypt the browser names. The following APIs are hooked in the web browser for stealing sensitive data: 

Browser	API
FireFox	PR_Write
Chrome	WSASend
IE	HttpSendRequestW , InternetWriteFile

The stolen information is relayed back to the attacker using following URI format – 

ff=1&id=<MachineID>&name=<SystemName>&host=<Base64 encoded host name>&form=< Base64 encoded HTTP header data>&browser=<Browser name>

The information stealing feature of this Kasidet variant were deactivated if the system locale or GeoUserID corresponds to Russia.

Network communication:

Kasidet contains a hardcoded list of Command & Control (C&C) server locations. It uses CryptStringToBinary API call to decrypt the embedded C&C URLs as seen below:

Kasidet C&C list

Upon successful infection, Kasidet sends a HTTP POST request with data “enter=1” (without quotes). All HTTP header fields (User-Agent, Content-type and Cookie) are hard coded in the payload itself.

Kasidet Hardcoded HTTP fields

C&C Server will not return required data if HTTP header fields are different.  The server sends a fake 404 response code and html data stating that page is not found but the C&C commands will be hidden in the response HTML comment tag as seen below:

Kasidet - First communication with C&C

Kasidet will request for additional commands from the C&C server with the following POST request:

Kasidet request for additional commands

Variable	Descriptions
cmd	Command. It is hardcoded in the malware payload as '1'.
id	MachineGuid value fetched  from Software\Microsoft\Cryptography registry key
name	System Name
os	Operating system version
p	Process elevation status
av	Antivirus installed on the infected system
v	Version of the bot. It is hardcoded in the malware. Current version that we analysed is 4.4
w	Flag that indicates whether the system locale and UserGeoID is Russia

Like browser names, all the command strings are also encrypted using a hash function. Below are some of the important commands:

Command Hash	Description
0x0E587A65 (rate <number>)	It is used in sleep function
0x89127D3	DDOS using HTTP protocol
0x0B37A84B6	Start keylogging and screen capture threads
0x89068E8h	Download and execute additional component. This file can be DLL, EXE or VBS.
0x4A9981B7	Search for given process name in current running processes in the system
0x8D26744	Find given file in system and upload to the server
0CAB1E64A	Drop setting.bin file,  change firewall settings to download and execute plugin component
0x10E6C4	Execute given command using windows cmd.exe

Conclusion 

Malicious Office document file is a popular vector for malware authors to deliver their payloads. Dridex authors have leveraged this technique for over a year and it was interesting to see the same campaign and URLs being leveraged to deliver Kasidet payloads. While this does not establish any links between the two malware family authors, it reaffirms the fact that a lot of the underlying infrastructure and delivery mechanisms are often shared by these cyber criminals.

ThreatLabZ is actively monitoring this threat and ensuring signature coverage for Zscaler customers.

Analysis by - Abhay Yadav, Avinash Kumar and Nirmal Singh

Dridex activity continues

Dridex, a banking malware which attempts to steal the victim's banking credentials and system information, continues to remain active in the wild after the recent takedown attempt. Dridex activity went down significantly in September after the takedown operation but we started seeing an uptick in the number of samples in our sandboxes starting early October 2015.

Dridex is distributed via e-mail with a Microsoft Office attachment that leads to the download and installation of the Dridex Trojan executable. The e-mail attachments in these campaigns varied from regular Microsoft Office document files to MHTML files as seen in Figure 1.

Figure 1: Malicious document sent in MHTML format

MHTML, also known as MIME HTML, is a web page archive format used to combine in a single document the HTML code and its companion resources that are otherwise represented by external links (such as images, Flash animations, Java applets, and audio files). The malware authors are known to send the documents containing malicious macro in MHTML format to evade antivirus detection.

The content of the embedded macro was both obfuscated and protected using a basic password that is intended to prevent modification of the macros.  We were able to bypass the password protection and extract the various document components by standard means.

Figure 2 shows an example embedded malicious macro that downloads the Dridex executable from a predetermined server:

Figure 2: Embedded malicious macro to download Dridex

The samples we are seeing in these new campaigns are a mix of unsigned as well as some digitally signed using valid certificates. The format of the URLs hosting the signed Dridex samples changed to 195.37.231[.]2:8080/uniq/load[.]php instead of previously seen URL format 94.250.252[.]13/bt/bt/stata[.]php

The Dridex executable downloaded by above macro (Figure 2) appears to be packaged using a custom packer. This instance of the Dridex Trojan is signed using a certificate with the common name of “Favorite-III” which appears specific to the Dridex malware and which is currently also present in Comodo’s Certificate Revocation List.

Figure 3: Dridex Certificate issued with CN Favorite-III

We also saw following additional certificates used to sign the newer Dridex executables:

• INTEX
• KASHTAN OOO
• Promtorg
• KONSALTING PLUS OOO
• Brand IT 
• AVTOZVIT Scientific Production Private Company
• Afet
• 3 AM CHP
• PJSC "BIZNES AVTOMATYKA"
• Favorite-III
• Private Person Parobii Yuri Romanovich
• SWIFT Weather
• PJSC "BIZNES AVTOMATYKA
• AVTOZVIT Scientific Production Private Company
• Private Person Parobii Yuri Romanovich
• Favorite-III [NEW - seen in October 2015]
• promtorg  [NEW - seen in October 2015]

The following are some recent URLs from which Dridex executables were downloaded:

• 93.170.104.168:443/uniq/load[.]php
• 178.62.7.183:443/uniq/load[.]php
• 195.37.231.2:443/uniq/load[.]php
• 5.2.199.30:8080/uniq/load[.]php
• 113.30.152.165:8080/uniq/load[.]php
• 168.243.33.195:8080/uniq/load[.]php
• 199.175.55.116:8080/uniq/load[.]php

The following are some MD5 sums of signed and unsigned Dridex executables that we have encountered in past month:

Signed

82BB00DCAC6411669CE6AE5A60CBB3B3
9D4225ECDCDA7FE9A5EAE48601919114
2485C741AF50DE986079B6AD9B6C948A
290CD720AECF28773960C8E41172513C
1C21AEB3DC0E30E05630A3F61AAE83F9
0DA24BD7B49A955D8E4624371CCB8E9F
AFADE4E50D147A1FE18ACA8942E3E679

Unsigned

1DE3889FDE95E695ADF6EADCB4829C6D
D7A31449E5F808FDBA0F6D3CF0D6E91C
7519F0D9D5C3B8D072FFCA7DDF213DDA
F2D6DEC39DAEF7ED90AAABB725590B02

Following are the statistics of Dridex executable downloads that we have seen in past six weeks:

Figure 4: Dridex executable downloads in past six weeks

Figure 5: Dridex executable hosting servers

Conclusion

Dridex infections went down considerably after the global takedown operation but we are starting to see a steady increase in the infections this month, which indicates the malware gang's attempt at resurrecting this highly lucrative Botnet. The authors continue to use the tactic of digitally signed malware executable to evade detection with legitimate certificates created specifically for this purpose.

Zscaler ThreatLabZ is actively monitoring this Botnet and ensuring that Zscaler customers are protected.

Research by Tarun Dewan and Nirmal Singh

Signed Dridex Campaign

Introduction

Malware authors use various means to make their malware look similar to legitimate software. One such approach involves signing a malware sample with a digital certificate. Recently we saw Dridex malware authors using this technique while reviewing the samples in our Cloud Sandbox. Dridex is a banking Trojan which typically arrives to a system via malicious spam email with a Microsoft Office file as an attachment. These files will have embedded macros that lead to the download and installation of the Dridex Trojan. Dridex then attempts to steal the victim's banking credentials and system information.

Signed Dridex campaign

Here we came across one malicious attachment with an encrypted macro that downloads signed Dridex samples from 81.17.28.101/bt/bt/sti[.]php. This Dridex sample is packed using a custom packer, which is is compiled with .NET. The current Dridex is signed with a certificate that is issued to Private Person Parobii Yuri Romanovich. This certificate as been specially created for spreading the Dridex malware.

Certificate

We also saw the following signer information in the certificates used for signing the Dridex executables:

• PJSC "BIZNES AVTOMATYKA
• AVTOZVIT Scientific Production Private Company
• Private Person Parobii Yuri Romanovich

The certificates were all issued by COMODO and we observed the following URLs serving the signed Dridex malware:

• 185.14.29.214/bt/bt/sdp [.] php
• 81.17.28.101/bt/bt/sti [.] php
• 5.196.241.204/bt/bt/ched [.] php
•  217.12.203.171/bt/bt/freda [.] php
• 94.250.252.13/bt/bt/stata [.] php
• 149.202.146.176/bt/bt/chdid [.] php
• 93.170.105.60/bt/bt/grtes [.] php

Below are the Dridex samples served from the aformentioned URLs. All tof he samples are packed with the same .NET packer mentioned above:

• 5CA1DBA1C72AC999E221DE98BBC584C4
• 9E73E0C4B92253C5F8B6648F29B28B5B
• CD243B30B9BBD682C082CFEFDBF79ACD
• E578618F2D38FC251D52D1366144404F
• 5F907702CE229937955B4DCE92EC4575
• DC443FBB5FB6125EBEEEBEC2E4BAA372
• 0BBC8CD08E9958ACDE0519A2B2840CD7
• 9D1D0632329F04D8B1EC21AFF4CE6493
• 32230D747829DCF77841F594AA54915A
• 8F1A9A9830FF02C5C2BA4C17DFE8B09D
• 00DCA835BB93708797A053A3B540DB16
• 393E2145F4C3E9B5697A2AAEB25AA8D3
• 1992170FDC642D4A99A7BC82BA82FA31
• 9261B8EAF1DA3D9CFF522875A7198667
• FB67C85F3F42D3E48B9E7B7637D30858
• E578618F2D38FC251D52D1366144404F

Dridex Packer:
The Dridex sample is embedded in the resource section of the packer. After unpacking, it drops a Borland Delphi executable file. The following is the snapshot of encrypted resource section:

Encrypted Resource Section

Dridex Activity:
The current Dridex sample tries to connect to different IPs included in the config file. The config file for the sample is embedded in the sample itself. In the config file we observed a botnet ID and list of  C&C servers. Below is a snapshot of config file:

Configuration file

Dridex collects and sends the following system information to one of the C&C mentioned in the config file:

• Computer Name
• User Name
• Windows Version
• Botnet ID

Information sent to the server

Below is the complete list of C&Cs it tries to connect.

• 80.247.233.18
• 91.121.82.113
• 69.164.213.85
• 79.143.191.147
• 199.241.30.233
• 162.243.12.14
• 188.93.73.90
•  195.154.184.240

Conclusion

The use of a legitimate certificate in signing malware executables to evade security detection is not new but is still very effective. The malware author aims to exploit the Code-Signing Certificate based whitelisting approach by signing their samples. Zscaler ThreatlabZ is actively monitoring these signed malware campaigns and ensuring coverage for our customers.

Analysis by Tarun Dewan and Nirmal Singh