Chinese Backdoor Zegost delivered via Hacking Team exploit

Introduction

Zscaler ThreatLabZ has been closely monitoring the usage of Hacking Team's leaked exploits in the wild since July, 2015 and recently uncovered the Emissary Panda APT attack leveraging these exploits. In past two months, we've spotted multiple instances of Zegost Backdoor Trojan installation attempts leveraging Hacking Team's Adobe Flash exploit (CVE-2015-5119) payload. These attacks do not appear to be targeted, but the payload involved in the infection cycle has some resemblance to recent APT payloads from HttpBrowser & the PlugX RAT family.

Attack Chain

The infection cycle starts with a legitimate Chinese real estate and shopping site www[.]kongquechang[.]com, which appears to have been compromised by the attackers and contains an injected script. The injected script will cause a series of redirects leading to Hacking Team's exploit payload as seen in Figure 1. The majority of users were led to the original compromised site following a Baidu search.

Figure 1: Compromised Chinese real estate & shopping site

The site www[.]kongquecheng[.]com is still infected but the exploit server appears to be down at the time of writing this blog. Attackers are abusing the Chinese URL shortening service t.cn to redirect victims to the attack server and also Baidu's URL shortening service dwz.cn to deliver the Adobe Flash exploit payload as seen below:

Figure 2: Zegost Backdoor Attack Chain

The Flash exploit payload (CVE-2015-5119) involved here is from the Hacking Team's leaked archive with updated shellcode. Upon successful exploitation, the embedded shellcode will trigger the download and execution of the Zegost executable from a predetermined location.

Figure 3: Hacking Team's Adobe Flash Exploit

Figure 4: Embedded shellcode to download & install Zegost

Zegost Payload Iterations

During the course of our monitoring we observed the attackers switch the malware payload multiple times.

Payload Type #1 - APT RAT like Zegost Installer

Filename:
svhost.exe

MD5:
E04F3C9C2F7BE694628AECCD23E8839D

The Zegost payload was being delivered as part of an installer archive, which is similar in structure to the APT RAT PlugX and HttpBrowser as detailed here. The downloaded installer was svhost.exe, which has following file structure:

Figure 5: APT RAT like Zegost installer archive

The Zegost installer is responsible for dropping the above three files and running the legitimate Ping_Master_Pro utility DATA.exe. The legitimate binary contains the data.dll in the import table, ensuring that the DLL will be loaded before it runs. The data.dll that gets loaded in this case, will be a fake VirtualBox display driver DLL file present in the same directory and it will patch the entry point of the main executable (DATA.exe) file with a jump instruction to run the DLL’s code instead. This technique is also known as DLL Hijacking which ensures that the fake display driver DLL gets loaded by abusing the Windows DLL load order. The DLL’s code is responsible for decrypting and running the Zegost Backdoor payload from the fafentuqiang.png file in the same memory space of the benign executable.

We observed a bug in the persistence module for this payload, which resulted in an incorrect path getting added to the registry entry created by the malware. The result was that upon system reboot the user's machine will no longer be infected with the Backdoor Trojan.

Payload Type #2 - Vanilla Zegost

Filename:
svhost.exe

MD5:
8F3B2C449793BC1538328CCC9BDC9CCD
62C705A0232EA6D4E3E3CE93F7506ACC

A modified Zegost payload was being delivered in decrypted form abandoning the installer archive structure. This payload was recently compiled and purports to be a XLLuaRuntime Dynamic Link Library file as seen below:

Figure 6: Recently compiled Zegost payload

Figure 7: Zegost payload file meta data

During our analysis we noticed that the persistence issue that existed in the previous iteration was resolved in this payload and the malware successfully remained active upon system reboot.

Zegost Infection Cycle

• Zegost Trojan drops a copy of itself in the Windows system directory as %SYSTEMDIR%\Autoexec.exe

• It creates the following registry key to ensure persistence upon system reboot:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Nobug = %SYSTEMDIR%\Autoexec.exe

• We also saw an alternate code for achieving persistence by registering a new Windows Service:

HKLM\SYSTEM\CurrentControlSet\Services\

ServiceName - DirectX dwx

DisplayName - DirectX Remover auy for Windows(R).

ImagePath - %SYSTEMDIR%\Autoexec.exe

• The Trojan reports the infected system information to a predetermined remote server at the following location:

Domain - www[.]svshot[.]com

Server IP - 123.57.54[.]57

Server Port - 8999

• The Command & Control server domain used in this attack was recently registered and points to a dedicated server hosted on the shady Chinese autonomous system - AS37963 (CNNIC-ALIBABA-CN-NET-AP) as seen below:

Figure 8: Command & Control server hosted in China

The same server is also used for the initial Adobe Flash exploitation attempt.

Conclusion

Hacking Team's exploit payloads remain a popular choice among cyber criminals for weaponizing their payloads. This is the first instance of the Zegost Backdoor Trojan being delivered using Hacking Team's exploit. The Zegost Backdoor payload iterations we observed in this attack chain indicates that the author is testing out new payloads.

Zscaler’s ThreatLabZ has confirmed coverage for these exploits and for the Zegost variants, ensuring protection for organizations using Zscaler’s Internet security platform.

Research by: Deepen Desai, Amandeep Kumar

Adobe Flash Vulnerability CVE-2015-5119 analysis

With the leak of Hacking Team's data, the security industry came to learn about multiple new 0day vulnerabilities targeting Flash, Internet Explorer, Android, etc. As always, exploit kit authors were quick to incorporate these 0day exploits into their arsenal.

In this blog, we will be looking at the CVE-2015-5119 exploit payload that we have now seen in the wild. The sample has multiple layers of obfuscation and packer routines. The malicious Flash payload is packed, XOR'ed and stored as a binary data inside a parent Flash file that dynamically unpacks a malicious Flash file and writes it to memory at run time.

Here is the structure of the CVE-2015-5119 exploit payload:

Packages, properties and method names are stored in variables for obfuscation:

Here we observe the calling of the unpack routine to decrypt the embedded SWF exploit payload:

An XOR key is used for unpacking and is hardcoded and assigned to the variable vari_10. This is what the unpacked content looks like:

Upon decompilation, it is apparent that majority of the codebase, including variable names and function names are the same as what we saw in the leaked source by the Hacking Team. The public exploit also has checks for:

• Presence of a debugger
• Operating System bitness (32-bit or 64-bit)

When the program execution starts, the ActionScript looks for the input parameters and based on it, sets a variable which is then sent to the main exploitation routine as seen below:

The TryExpl() routine allocates sequential pages of memory and begins the exploit cycle:

The vulnerability lies in making use of the valueOf property and corrupting the vector space so that the valueOf  property will overwrite the length field of the vector object, which will be further used to get access to vtables.

Here is explicit definition of valueOf function

prototype.valueOf() is setting up the length of the ByteArray to 4352

Once the memory allocation is done, a MyClass object is created and assigned to _ba[3]. The

valueOf()  function defines the length of ByteArray to 4352, which is greater than the length of the object created, causing reallocation of bytes inside the memory.

If the value of _ba[3] is set to zero after the assignment then it was successful in triggering a Use After Free vulnerability. The exploit code looks for the kernel32.VirtualProtect() (VP) function in the corrupted vector space as seen below:

A call to the VP function is made, which replaces the vtable pointer and sets the PAGE_EXECUTE_READWRITE permission before executing the final payload.

Hashes of  CVE-2015-5119 exploit payloads seen in the wild:

061c086a4da72ecaf5475c862f178f9d

079a440bee0f86d8a59ebc5c4b523a07

16ac6fc55ab027f64d50da928fea49ec

313cf1faaded7bbb406ea732c34217f4

6d14ba5c9719624825fd34fe5c7b4297

Conclusion

It will be a challenge for security vendors to get container file detection in place as majority of the time, the embedded content is highly obfuscated with multiple levels of packing. Adobe has already released a patch to fix this issue. We highly recommend enabling the Adobe's auto update feature to keep the relevant plugins updated.

References:

• http://malware.dontneedcoffee.com/2015/07/hackingteam-flash-0d-cve-2015-xxxx-and.html

Hacking Team leak, Flash 0day, exploit payloads and more

[Update - July 13, 2015]

In addition to the Flash 0day exploit that we reported earlier [CVE-2015-5119], two new Flash 0day exploits were found in the Hacking Team's leaked data and these flaws are not yet patched:

• CVE-2015-5122: valueOf use after free vulnerability during the assignment to freed TextBox

Two in-the-wild samples reported here

• 31d03169b9742a0ff04e3d24bb448bbf
• fcecd6b624bb50301a17d5aa423e135d

• CVE-2015-5123: valueOf use after free vulnerability during the assignment to freed Bitmap

Adobe acknowledged these issues over the weekend and is working on a patch. Meanwhile, ThreatLabZ has deployed additional coverage for these new exploits to protect Zscaler customers. We are continuously monitoring for new in-the-wild exploit payloads for these flaws.

Introduction

Data breaches have become a common and painful reality. Major enterprises, including retailers and financial institutions have been affected in the past few years. Even cyber criminals are not spared from breaches, with various malware code leaks, the most recent being that of the KINS 2.0 Banking Trojan family.

Earlier this week, we saw a large stolen information archive (400 GB) being published that belonged to the notorious Italian hackers-for-hire firm - Hacking Team. Hacking Team has been known to sell offensive surveillance technology to government agencies worldwide. The archive contains e-mails, invoices, and more importantly exploits & malware source codes. An individual that goes by the handle PhineasFisher has taken credit for the attack and if that name sounds familiar it's because he's done similar work before, having hacked and leaked data from Gamma International last year. His motivation for that breach was apparently similar as he accused the firm of selling surveillance tools to repressive regimes. While our assessment is far from over, in this blog, we will provide a quick run down of what we have seen in the archive related to exploits & malware thus far and we will continue to update as we discover more details.

Exploits, Remote Control System, and more

• Flash 0-day exploit with Proof-Of-Concept (POC) [CVE-2015-5119] - Confirmed 0day for the latest version of Adobe Flash Player, running on Windows XP and Windows 7. The exploit did not succeed on Windows 8.1. We also saw support for targeting OS X. This is a Use-After-free vulnerability in Adobe Flash player's built-in ByteArray class that can lead to crash or remote code execution by the attacker.

 Affected applications:

1. The majority of the popular browsers including Chrome, FireFox, Internet Explorer and Safari with Flash Player installed are vulnerable to this issue.
2. Microsoft Office 2007/2010/2013 - where the attack scenario will involve an office document with the malicious SWF file embedded in it. The document may arrive via an e-mail or as a drive-by download on the target system.

Adobe released a patch today to address this vulnerability.

• Microsoft Windows Kernel code injection vulnerability exploit that can be leveraged to perform privilege escalation on the target system to bypass various security mechanisms

• Support for iOS devices - They are leveraging the popular iOS Jailbreak application Cydia for iOS devices to further install malicious payloads on the target device.

• Support for Android Devices - There is a separate module for Android OS (Android Webkit) that is leveraging a probable 0day exploit [we are still working on confirming this] in the Android browser and running various known root-access exploits like exynos, gingerbreak, levitator, etc. to root the target devices and further install malicious payloads. 

• Support for Windows & Blackberry devices - We also saw source code for supposed exploits that will target Windows Phone 8 as well as Blackberry devices. 

• MacOS Rooting exploit to enable online and offline installation of untrusted applications.

• A Remote Control System (RCS) Dropper module that is capable of creating both mobile and computer system payloads for Windows and Macintosh. 

• A multi-stage JAVA exploit module that contains a weaponized version as well as a two stage version with features to by pass Microsoft Security Essentials and an example Trojanized Putty.exe payload.

• Multiple driver files that may contain Rootkit functionality to hide the malicious process and evade detection.

• Source code of the core Remote Control System module where we can see the in-depth list of features supported by it.

core-win32:

1.) Monitoring modules for Instant messengers, Web Browsers, PC cameras & microphones, etc.
2.) Monitoring social media activities over Yahoo, Gmail, Twitter, and Facebook
3.) Hooking Outlook and getting email and contact details.
4.) Relaying infected system information including time, battery status, processor, memory, OS, user etc..
5.) Advanced keylogging capabilities

 We also observed support for 64-bit operating system target.

• There are also multiple anti-VM, anti-Sandbox, and anti-AV evasion modules present in the source code archive.

We are still combing through the archive evaluating more exploits and we will continue to publish our findings as they emerge.

Loader configuration server

We saw a hardcoded IP address in the first stage shellcode payload that is supposedly hosting the configuration file as seen below

Hardcoded configuration file location

The shellcode payload is presumably used by the loader for downloading and installing the main RCS component following a successful exploitation attempt. A quick VirusTotal lookup for the IP address reveals lot of interesting activity in the past two months only:

VirusTotal report for the Configuration Server

Enterprises would be advised to block the aforementioned IP address if they are concerned that they may have been targeted by any of the Hacking Tools applications.

Conclusion

As has been the case in the past after any such leak, we will start seeing the leaked code being incorporated into many future spin offs as well as existing malware families as feature upgrades. Exploit Kit authors have already incorporated the Flash 0day payload in their exploit arsenal as noted here.

ThreatLabZ has ensured coverage for the Flash 0day (CVE-2015-5119) and other exploit payloads ensuring protection for the Zscaler customers. We will continue to monitor further developments surrounding this leak.

Research by: Abhay Yadav, Nirmal Singh, Deepen Desai