Compromised Wordpress sites serving multiple malware payloads

During our daily log monitoring process, we observe many interesting threat events. One such event led to a compromised WordPress site campaign, which was found to serve multiple malware families including Upatre/Hencitor/Extrat Xtreme RAT/Vawtrak. The URLs which were serving malware were found to adhere to a particular pattern. Infected WordPress sites observed, included URLs with "/1.php?r”. Emerging Threats (ET) had previously released a Snort signature for this campaign on 12/08/2014. Since then, we have been continuously monitoring the activities related to it. The following is the snort signature released by ET.
 

Snort Signature

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"ET CURRENT_EVENTS Probable malicious download from e-mail link /1.php"; flow:established,to_server; urilen:8; content:"/1.php?r"; http_uri; content:!"Referer|3a 20|"; http_header; flowbits:set,et.exploitkitlanding; classtype:bad-unknown; sid:2019894; rev:1;)

Below are the compromised websites observed, which have been found to be serving multiple malware families.

Compromised wordpress websites

airlessspraysupplies[.]com/wp-includes/1[.]php?r

altero[.]be/1[.]php?r

alzina[.]cat/1[.]php?r

angeladoesfood[.]com/wp-admin/1[.]php?r

apsmiles[.]com/wp-content/themes/rfx/1[.]php?r

architecture[.]web[.]auth[.]gr/1[.]php?r

augustgifford[.]com/wp-admin/1[.]php?r

bankruptcy-software[.]com/wp-content/themes/classic/1[.]php?r

bernie[.]jshall[.]net/wp-content/themes/twentytwelve/1[.]php?r

beta[.]pescariusports[.]ro/images/1[.]php?r

blackwellanddenton[.]com/components/com_contact/1[.]php?r

blog[,]longboardsicecream[.]com/wp-content/plugins/1[.]php?r

blog[.]ridici-jednotky[.]cz/wp-content/plugins/simple4us/1[.]php?r

blog[.]topdealslondon[.]com/wp-content/uploads/1[.]php?r

cartorioalbuquerque[.]com[.]br/images/1[.]php?r

climatechange[.]mobi/images/1[.]php?r

core[.]is/1[.]php?r

couponshare[.]me/1[.]php?r

dannygill[.]co[.]uk/wp-content/plugins/simple4us/1[.]php?r

dlaciebie[.]org/wp-admin/1[.]php?r

geototal[.]az/en/ru/engine/editor/scripts/common/codemirror/mode/xml/1[.]php?r

kba1f9684c70[.]nazwa[.]pl/images/1[.]php?r

linkleads[.]vn/1[.]php?r

lionel[.]my/wp-content/plugins/akismet/1[.]php?r

livedoor[.]eu/1[.]php?r

ludovicharollais[.]org/wp-admin/1[.]php?r

m11[.]mobi/images/1[.]php?r

matthewkarant[.]com/wp-content/themes/twentynine/1[.]php?r

mcymbethel[.]com[.]ar/modules/mod_ariimageslider/1[.]php?r

merklab[.]eu/1[.]php?r

mitoyotaseagarrota[.]com/components/com_banners/1[.]php?r

mlmassagetherapy[.]com[.]au/wp-content/uploads/1[.]php?r

monitoring[.]sensomedia[.]hu/1[.]php?r

newwww[.]r11mis[.]be/images/1[.]php?r

odelia-coaching[.]co[.]il/wp-content/plugins/google-sitemap-generator/1[.]php?r

odelia-coaching[.]co[.]il/wp-content/plugins/google-sitemap-generator/1[.]php?r

osp[.]ruszow[.]liu[.]pl/images/1[.]php?r

pms[.]isovn[.]net/images/1[.]php?r

prodvizhenie-sajta[.]com/images/1[.]php?r

redmine[.]sensomedia[.]hu/1[.]php?r

salihajszalon[.]hu/1[.]php?r

sonicboommusic[.]com[.]au/components/com_banners/1[.]php?r

sparkledesign[.]ro/1[.]php?r

thebestcookbooks[.]co[.]uk/wp-content/plugins/1[.]php?r

thefoodstudio[.]co[.]nz/wp-content/themes/food-cook/1[.]php?r

thietkekientruca4[.]vn/1[.]php?r

treasurething[.]com/wp-includes/pomo/1[.]php?r

tsv-penzberg[.]de/wp-admin/1[.]php?r

turbomarketingteam[.]com/1[.]php?r

tusengangerstarkare[.]ingelaclarin[.]se/wp-admin/1[.]php?r

twobyones[.]com/1[.]php?r

xhmeiastokyma[.]gr/1[.]php?r

youreverlastingmemories[.]co[.]uk/1[.]php?r

These compromised WordPress sites may have been used by Exploit Kit (EK) authors as drop sites for serving malware. Another potential attack vector could involve email spam.

The following table shows different types of malware we have seen dropped from the aforementioned compromised sites. All malware was found to be zipped.
 

ZIP MD5	ZIPFILE NAME
2f225283c66032c9f7dcb44f42697246	fax_20141204_385.pdf.zip
6696527bfda97b1473d1047117ded8d6	invoice.pdf.zip
93babef06bfd93bcbb5065c445fb57d4	label_08122014_23.pdf.zip
bea9be813bb7df579d5be3e4543dc6a4	payment_details9427923.pdf.zip
1159fe7ec4d0b2cfde57dfb28b98f0c9	ePackage_12092014_42.pdf.zip
038710b2029046c39ca4082e2c34f9b3	wav_voice20141208.zip
ec35acdbe331c73e5e6883ebc08f896d	payment_invoice_182734.pdf.zip
8f00cfdf067b01462670212ba5874cdb	pdf_efax_9823612397.zip

Lets take a look at the files after unzipping them. All of the files are Windows screen savers and include fake icons of legitimate software packages, to persuade the victims to click on them.

Downloaded files:

For this post we've chosen to focus on the Hencitor malware. Hencitor’s typical behavior is to download additional malware onto the victim’s machine and execute it. 

MD5: 6bb3b23ff3e736d499775120aa8d6ae2
VT Score: 9/56 (At the time of analysis)

Lets take a look at some important things noted while conducting dynamic analysis of this malware.

• Copies itself to 
• "C:\Users\Win7 64Bit\AppData\Roaming\Windows\winlogin.exe”
• Creates autostart registry key entry
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run
• "winlogin” = "C:\Users\Win7 64Bit\AppData\Roaming\Windows\winlogin.exe”
• Uses ping.exe to check the status of other devices and networks.
• cmd /D /R ping -n 10 localhost && del C:\payment_invoice_182734.pdf.scr.exe && start /B C:\Users\Win7 64Bit\AppData\Roaming\Windows\winlogin.exe && exit
• Creates a thread in following existing process on the system.
• C:\Windows\explorer.exe
• C:\Windows\System32\sppsvc.exe
• C:\Windows\System32\wbem\WmiPrvSE.exe
• C:\Windows\System32\conhost.exe
• Deletes itself after installation 
• c:\payment_invoice_182734.pdf.scr.exe
• Malware seen to resolve couple of suspicious tor sites. 
• o3qz25zwu4or5mak.tor2web[.]org 
• o3qz25zwu4or5mak.tor2web[.]ru 

Conclusion:

Compromising vulnerable WordPress sites to spread malware has become one of the more widely used attack vectors by EK’s and email spam campaigns. Such campaigns generally drop variants of well known malware families,  which are undetected by the AV vendors. By the time of analysis we observed poor detection rates for the malware samples involved in this campaign.

-Stay Safe

Evolution of Upatre Trojan Downloader

Background

Upatre is a Trojan Downloader family that once installed, is responsible for stealing information and downloading additional malware onto the victim machine. It typically arrives via spammed e-mail messages from the Cutwail Botnet, either as an attachment or via a URL pointing to a remote hosting site. We are also seeing Exploit Kits being used as a vector for Upatre infections in the wild.

Upatre Downloader cybercrime network

Upon successful infection, Upatre has been responsible for downloading malicious payloads from known malware families such as:

• Zeus (Zbot) banking Trojan
• Rovnix Volume Boot Record (VBR) bootkit
• Dyreza (DYRE) banking Trojan

The Upatre malware family was first discovered in August 2013 and exponentially increased its infection rates by October, 2013. With the demise of the popular Blackhole Exploit Kit in October 2013, many malware authors resorted to traditional spam with the Upatre Trojan downloader as a medium for delivery of the ultimate payload, which also contributed to the increase in infections.

The Upatre malware authors have deployed multiple new techniques over the past year, which is the reason why it is one of the most prevalent malware families today. Some of the features that we have tracked include:

• Password protected attachments - This makes the e-mail look more legitimate and confidential
• Spammed as an attachment inside an attachment - The spammed e-mail messages contained another e-mail message (*.msg, *.eml) as an attachment which contains the actual Upatre archive attachment
• Email messages containing a URL pointing to the actual payload
• Randomized header bytes and encrypted malware downloads to evade detection
• Usage of SSL encryption for Command & Control (C2) communication and subsequent malware downloads

Recent Attacks

We have seen an increase in the number of Upatre Downloader infections occurring through spammed messages containing fake invoices or voice-mail messages in the past month. The final payload being downloaded from these recent Upatre infections tends to be the Dyreza Banking Trojan. Below is a sample e-mail message from this campaign:

Cutwail spam e-mail leading to Upatre

If the user clicks on the link in the e-mail, they will be redirected to the same site with additional information identifying the operating system in the URI before serving the payload as seen here:

GET /documents/invoice_101114_pdf.php?h=[3 digit integer]&w=[4 digit integer]&ua=[User-Agent String]&e=1 HTTP/1.1

The user will then be prompted to download a zipped archive file, which contains a new variant of the Upatre Trojan downloader as seen below:

Upatre download in an archive

The user is redirected to a legitimate site (i.e "www.hsbc.com"), if the operating system is not supported or is redirected at the end of the download cycle.

The Upatre executable masquerades as a PDF document as seen here:

Upatre executable with PDF icon

The infection cycle begins once the user opens the enclosed executable file. It makes a copy of itself as "%Temp%\pvavq.exe" and runs it. The newly launched process "pvavq.exe", will then delete the original executable "invoice10-11-14_pdf.exe". It connects to a remote C2 server over TCP port 40007 to report the infection and supply information about the Month and Year of spammed binary, victim computer name, operating system information, etc.

Upatre network communication

It further downloads the Dyreza banking Trojan in an encrypted form as "%Temp%\utt214.tmp" on the victim machine to evade network detection. It then decrypts the downloaded payload as "%Temp%\EXE1.exe" and executes it. This will initiate the Dyreza banking Trojan infection cycle.

Dyreza banking Trojan encrypted and decrypted payload

This variant uses an incremental 4-byte XOR key in the decryption routine as opposed to the hardcoded key we have seen before.

Part of Upatre decryption routine for downloaded payload

The following screenshot shows the custom User-Agent string and hard coded remote server locations we found during our Upatre binary analysis:

unpacked Upatre binary

Indicators of Compromise

Here is a sample list of HTTP requests that will provide a good indication of an Upatre and Dyreza compromise on your network:

Upatre indicators of compromise

Additionally, we have seen the following three hardcoded User-Agent strings being used for the HTTP requests in the Upatre variants that we have analyzed:

• ENUPDATE
• ONLYUPDATE
• UPDATE

Conclusion

The Upatre Trojan downloader family continues to evolve and is one of the most prevalent malware families at present. It continues to add new malware to its cyber crime pay-per-install nexus, serving as a vector for downloading and installing additional malware family payloads.

Zscaler ThreatLabZ is actively monitoring this threat and ensuring full security coverage for our customers.