Potentially Painful Programs Promising Pirated Products

A major source of PC compromise doesn't come from targeted APT campaigns or Exploit Kits, but user's clicking things that they simply shouldn't. A common practice for adware and spyware writers is hosting large numbers of seemingly legitimate files that users might trust from an unknown source. Users know trusted download locations for common packages like Flash Player or Skype, but when searching for pirated software or media, any link that promises results becomes a trusted source. ThreatLabZ has been monitoring a large campaign of two well known adware/spyware packages, namely OutBrowse and MultiPlug.

ThreatLabZ has observed filenames purporting to be popular software applications, PC games, movies, TV series, car repair guides, etc. being used to trick users into downloading and running spyware packages. Below is a sample list of filenames from this month:

• Colin McRae Rally 2.0 Full Version - FullRip   Download Low Spec PC Games   RataMap   Download Low End PC Games.exe
• adobe acrobat 8 standard serial number generator.exe
• dell bluetooth headset bh200 driver.exe
• Wii dance revolution.exe
• Besiege Free Download Game.exe
• Tropico Reloaded   Free Download PC Game Full Version.exe
• Minecraft 1.8 Crack Full Free Download.exe
• Dragon Ball Complete Series Episode1.exe
• Home.2015.720p._-DL.MaZiKa2daY.CoM.mkv.exe
• visual studio 2012 crack torrent.exe
• LEXUS LS 460 user guide provided through pdfretriever.com.exe

Once installed, the user is shown unsolicited advertisements and experiences a substantial increase in browser tracking activity. We noticed the cyber-criminals involved in these campaigns heavily leverage .info TLD domains as seen in the table below:

Domain	Adware Family
a.webboxwebs[.]info	MultiPlug Adware
get1.0111design[.]info	Outbrowse Adware
a.positionpublic[.]info	MultiPlug Adware
a.parser-case-croc[.]info	MultiPlug Adware
get.0136g[.]info	Outbrowse Adware
a.linuxcallring-north[.]info	MultiPlug Adware
a.northsinglemultiple[.]info	MultiPlug Adware
get.0136h[.]info	Outbrowse Adware
a.valuevilleville[.]info	MultiPlug Adware
a.cooledon[.]info	MultiPlug Adware
a.beeforcelevel[.]info	MultiPlug Adware
a.stickercenter[.]info	MultiPlug Adware
get.0136i[.]info	Outbrowse Adware

OutBrowse

The OutBrowse family authors leverage popular TV shows, software applications and trending news to deliver custom payloads that monitor the user's browsing activity. Their business model is to direct users to a pay site that provide various services.

Didn't I just download Tony Hawk Pro Skater2.Crack.CDKEY.exe?

The phone home communication for OutBrowse also provides excessive information to the advertisers. This data often includes the system's MAC address, IP address, different browser versions installed, and the machine GUID.

Data Collection from the victim's system.

OutBrowse beacons to several domains to share machine details and send aggressive advertisements. We have been monitoring this activity to the following domains for several months:

• srv.dmdataserver[.]com
• static.revenyou[.]com
• srv.desk-top-app[.]info

Consistent traffic to known Outbrowse beacons

OutBrowse is normally found on the victim's machine by inspecting the user's C:\Documents And Settings\user\Local Settings\Temp\ directory for any suspicious files. It's common for OutBrowse to also install other bundled software packages as well. Users should check their autostart programs and Browser Helper Object (BHO) entries for software that is suspicious.

OutBrowse installed MiniGet as a BHO and Content Menu in Internet Explorer

MultiPlug

MutliPlug is another adware package that is installed as part of this campaign. The purpose of this package is to provide a custom executable to the victim that leads to additional bundleware. After a successful MultiPlug infection, we noticed applications like LightningDownloader, SeekerFoobar, WeatherBug, and EasyAutoRefresh getting dropped on the victim machine.

Silent Installers seen to download additional adware packages.

Once MultiPlug is installed, it starts downloading and installing additional packages in the background while displaying unsolicited advertisements.

A common location-targeted advertisement seen from a package installed by MultiPlug

Highly aggressive advertisements attempting to lead the victim to buying software.

The best way to remediate this attack is to review all installed programs through Windows Control Panel and odds are good that MultiPlug installed at least multiple unwanted software packages. Once this is done, users should review their autostart job files in the C:\WINDOWS\Tasks\ directory for anomalous entries. Installed Browser Helper Objects should also be checked using applications like HiJackThis or X-rayPC.

ThreatLabZ has been closely monitoring these campaigns for the past few months and the trend shows no sign of slowing down as seen in the time chart below:

Several sites are phishing users with the promise of illegally obtained content

The bulk of these attacks are hosted in the United States.

Conclusion

The moral of this story is to not trust seemingly legitimate content if you are attempting to obtain it illegally. Users show a distinct lapse in judgment when they believe the desired content is available for free. We recommend not attempting to pirate content and simply paying for the media desired.

Walkthrough of a Recent Zbot Infection and associated CnC Server

During routine ThreatLabZ log analysis, we encountered the following malicious Zbot executable connecting back to it's CnC and exfiltrating data via POST requests.

• MD5: 0b43d6a65f67ef48f4da3a1cc09335a1
• Size: 442368 bytes
• Detected as PWS:Win32/Zbot by Microsoft (VT 43/49)

[POST DATA]

iTpRAQWetIVVzRx502Gqds3DKmG80ru/P1ggedWTJAgrue/EVaoL95bMH6K0It8I9/wGHEIKbkXhcoxGOKgJOxGFYkvfoWsUM/NWAUQ+wdjlZOpD0Ke77Sob6rQT0WToRF9lWkhx514Es9wGHNKTn5xrTY7pJeqxGiTNMsB3fsCFfjZZKabmhwDzKTP/0W6FFEJb

What separated this discovery from your average CnC server? The attackers were kind enough to leave the CnC server largely exposed (directory browsing enabled, many files not password protected) to provide a rare behind the scenes look at a live botnet operation. Let's walk through what we observed.  

The above mentioned Zbot variant was responsible for dropping the following malicious files:

• 6ca1690720b3726bc76ef0e7310c9ee7 - Win32/Stoberox.B (VT 26 / 50)
• d2c6a0e888d66882d7dc29667c4c9ec0 - TrojanDownloader:Win32/Cutwail (VT 38/50)

We also noted that it started a server listening on ports 1548 and 3492 and sends some data via POST requests to hxxp://vodrasit.su/admin/gate.php
(see malwr sandbox report).

Domains contacted:

• shivammehta.com [ IP: 181.224.129.14]
• merdekapalace.com [IP: 202.71.103.21]
• vodrasit.su [IP: 37.115.13.224]

IPs contacted:

Malicious IP	Virus total links
99.42.33.76	https://www.virustotal.com/en/ip-address/99.42.33.76/information/
115.126.143.176	https://www.virustotal.com/en/ip-address/115.126.143.176/information/
50.179.168.36	https://www.virustotal.com/en/ip-address/50.179.168.36/information/
158.58.230.200	https://www.virustotal.com/en/ip-address/158.58.230.200/information/
212.186.32.8	https://www.virustotal.com/en/ip-address/212.186.32.8/information/
61.27.49.175	https://www.virustotal.com/en/ip-address/61.27.49.175/information/
86.133.91.153	https://www.virustotal.com/en/ip-address/86.133.91.153/information/
206.205.226.130	https://www.virustotal.com/en/ip-address/206.205.226.130/information/
172.245.217.122	https://www.virustotal.com/en/ip-address/172.245.217.122/information/
80.213.146.163	https://www.virustotal.com/en/ip-address/80.213.146.163/information/
81.206.227.11	https://www.virustotal.com/en/ip-address/81.206.227.11/information/
91.21.200.217	https://www.virustotal.com/en/ip-address/91.21.200.217/information/
1.240.64.211	https://www.virustotal.com/en/ip-address/1.240.64.211/information/
24.184.76.143	https://www.virustotal.com/en/ip-address/24.184.76.143/information/
97.104.63.159	https://www.virustotal.com/en/ip-address/97.104.63.159/information/
172.11.217.35	https://www.virustotal.com/en/ip-address/172.11.217.35/information/
87.1.90.206	https://www.virustotal.com/en/ip-address/87.1.90.206/information/
81.149.88.233	https://www.virustotal.com/en/ip-address/81.149.88.233/information/
203.110.94.69	https://www.virustotal.com/en/ip-address/203.110.94.69/information/
50.11.239.126	https://www.virustotal.com/en/ip-address/50.11.239.126/information/
181.224.129.14	https://www.virustotal.com/en/ip-address/181.224.129.14/information/
108.162.199.119	https://www.virustotal.com/en/ip-address/108.162.199.119/information/
202.71.103.21	https://www.virustotal.com/en/ip-address/202.71.103.21/information/
65.55.172.254	https://www.virustotal.com/en/ip-address/65.55.172.254/information/
120.150.210.249	https://www.virustotal.com/en/ip-address/120.150.210.249/information/

While looking at the POST data submitted to hxxp://vodrasit.su/admin/gate.php, we explored this site and found that it is currently hosting two malicious files and a password protected admin console.

Below are the files which are hosted on hxxp://vodrasit.su/, which can be observed thanks to the fact that the attackers left directory browsing enabled:

[   ]  admin.zip 03-Mar-2014 09:49 12M  
[DIR] admin/ 21-Aug-2013 23:44  
[   ]  all.exe 21-Mar-2014 17:36 457K
[   ]  rok.exe 21-Mar-2014 06:23 75K

 

• a68b10d96eb89af7388d4daa64071ad1 | rok.exe | VT: 3/50 | VT_Link | Malwr_Sandbox_Link 
• 76fe3432c75ee724a8f20ea97696bd17 2/50 | all.exe | VT: 2/50 | VT_Link | Malwr_Sandbox_Link

all.exe attempted to communicate to the followings DGA generated Domains:

• aulbbiwslxpvvphxnjij.biz
• kvdmkndexomrceqydtgepr.net
• gadmxsmfeqrscmfytvksirnyxm.com
• xgkzhahdqsxgusireqxdqkzsk.ru
• aemfyldumrlithbaayzhib.com
• jbqswspnseqsqwmrnzxodivuciv.net
• ijfifyhydeydxwdnrkuwsovofm.org
• lrtofahqzlvrsxsscdaykzuqs.info
• dgmeulrobvsfaskdrknkfswyt.biz
• cqdwgydskztyluwhjzcmmjlfqs.ru
• hiciqglzaqwopnzdmtkdro.com
• xgadhizdspnditwhdaxcjae.info
• bypjgqusdmeanbylqghtvcqkead.org
• civmvcibuhjzuoijxrozaegmfi.biz
• ijrtkzdjbztgattccytojrswsd.com
• igaytdmoqkmfauzdbmrwrceapf.ru
• jbtkscmfuuygmdmdrorodfmp.com
• sougwcinroivgtpvjzijuocagqau.net
• hiufeamaqsyxmntswooronrnvz.biz
• bymncecukrcusxvctsduxceu.info
• prdmzrmreylvkqqodj.com
• sbusxwswayizfepfydtoovvbqhm.ru
• yhayxjzmbpscaypizlnftofl.com
• tkytijfhiaqbymnxkxcwxg.biz

Admin Console

Although we weren't able to access the live admin console as it was password protected, we were able to replicate the setup from the exposed source files (hxxp://vodrasit.su/admin.zip) and it would appear as shown below:

Another directory with browsing enabled exists at hxxp://vodrasit.su/admin/db/. Here the data from infected machines connecting back to the CnC server can be observed:

Before being transmitted from a victim machine, the data is encrypted using RC4 encryption, base64 encoded and then sent via the POST method to the CnC.

Here is the code for first decoding the data using base64 decoding and then RC4 decryption:

After decoding and decrypting, a record is created in the aforementioned directory hxxp://vodrasit.su/admin/db/.

The following a sample of the information stored from an infected victim:

What does this data represent?

This particular record includes the following:

• OS: WINDOWS 7
• Bits: 0 means OS is 32 BIT 
• Country: SOUTH KOREA

We are continuing to track these malicious Domains and IP addresses and advise you to block them too.

- rubin

Analysis of a VBScript bot

Introduction:

In the long list of complex threats that we see daily, it is interesting to see malware that is rather simple but effective in terms of the payload that it carries. At Zscaler ThreatLabZ, we recently 

came across one such innocent looking Bot, which targeted our customers. The file arrived as an attachment to a spam email message. The malware was written in VBScript.

Analysis:

Virustotal scan results show 14 out of 50 vendors detecting the malware.

Figure 1: Virus-total Result

The image below shows the malware opened in notepad. We can see that the file is obfuscated. That’s because the file has a “.vbe” extension (a “.vbe” is an encoded VBscript file), which would otherwise have a “.vbs” extension. The encoding support is provided to prevent people from reading the script.

Figure 2: Obfuscated VBScript

To be persistent, the malware copies itself into the startup folder in Windows (Figure 3)

Figure 3: Copy of Malware in the startup folder

Registry entry created by the malware to run itself at the system startup.(Figure 4)

Figure 4: Windows Registry (run entry)

It also adds a copy of itself to the Windows temporary folder (Figure 5).

Figure 5: Copy of Malware in temp folder

Next, the malware attempts to establish a connection to it's server (here wscript.exe is the Script Engine which executes VBScript).

Figure 6: Network communication

To extract more information we need to decode the file and obtain the original malware code in a readable form. Let's have a look at the decoded file.

Figure 7: Malware install code

The image above shows the code that is responsible for adding entry in the registry which 

allows the malware to execute every time the system starts , Also create it's own copy in the startup, temporary folder.

Another interesting part of this malware is it's ability to communicate over the network. The malware can actually receive a set of commands and execute them in an infected machine

At the time of analysis, the server to which the malware communicates seems to be down. Therefore, in order to fully understand how the malware communicates and also to demonstrate how effective and damaging this Bot is, I have decided to create an HTTP server and issue commands to the bot directly.

We can see from the code below, the wide range of commands that can be executed by this Bot. The commands are simple and self explanatory. 

Figure 8: Remote Commands

Let's see the effects of a few of these commands in detail. The “execute” command is capable of executing additional VBScript statements in the infected machine. The “update” command is issued to update the Bot , while “uninstall” removes the Bot entry from the Windows registry and startup folder.

There are also commands such as “send”, ”recv” and “site-send”. Interesting commands include “enum-driver”, “enum-faf”, “enum-process”, “cmd-shell”, “delete”, “exitprocess”.

Let us execute our server and wait for the Bot to connect to us and send information so we can then issue commands.

Figure 9: Malware callback

As seen in the image above, a “POST” request is made with it's path as “/is-ready”, indicating

that the Bot is up and ready. We can also observe information about the infected machine such as “volumeserialnumber”, “computername”, “username”,“operating system type”, installed

“anti-virus name” etc. To retrieve such information, the malware relies on Windows Management Instrumentation (WMI) queries.

Let us issue the command “enum-driver”. This command fetches the drive name and drive type of the infected machine as seen in the image below.

Figure 10: enum-drive

The next command “enum-faf” enumerates and fetches the content of an input directory or drive of the infected machine.

Figure 11: enum files 

The “enum-process” command fetches a list of processes that are running on the infected system.

Figure 12: enum-process

The “cmd-shell” command will allow the attacker to execute all DOS commands on the infected

system.

Figure 13: Execute Dos Command

Those are just a few of the powerful commands that the malware can execute in the infected system. This gives the malware near limitless power to control and steal data from the infected machine. The Bot and all it's communication are blocked by Zscaler.