The story of a Trojan Dropper I

Introduction:

Recently, Zscaler ThreatlabZ  received a suspicious file from one of our customers, which 

was named “OrderDetails.zip”. After extracting the executable file from the archive I have 
performed a virustotal scan  to get some information about the file. At that time, very 
few antivirus vendors had definitions in place, which flagged the file as malicious.

As such, I decided to take look at the file in greater detail. After completing the analysis,
I've  decided to blog about the threat. Given the amount of information derived during the analysis, I've decided to divide the blog into multiple parts.

Figure 1:  virus total results

Modern day malware generally implements some kind of packing or obfuscation on the binary, in order to evade antivirus detection. Hence, it’s a good idea to determine which packer may have been used while analyzing the file. In order to do this, I implemented a popular tool called PEiD to check for the existence of a known packer.

Figure 2:  PEiD results

As we can see above, PEiD was not able to pick up anything from this file, but that doesn't mean that the file is not packed. Let’s have a closer look at the file.

While going through the file sections, one of the sections (.data) contained an unusually large amount of data, which at first glance gave the impression that it is obfuscated. This is an important clue and something we have to keep in mind while debugging the file.

Figure 3:  obfuscated data

While looking at the resource section, we can see that the file icon resembles that of a PDF file, which adds to our suspicion. Also, the file is not digitally signed.

Figure 4: File icon at resource section

Lets go further and execute the file. When doing so, I was greeted with a crash report where Windows was telling me that “Adobe.exe” had crashed during execution.

Figure 5:  windows error report 

We knew from the beginning that this was not a proper PDF file and would not therefore work with Adobe Reader. Let’s now look to determine where Adobe.exe exists in the file system. A 
Windows file search reveals Adobe.exe inside the temp folder, which when executed, produces exactly the same result as was shown above 

Figure 6: dropped file named adobe.exe

At the same time, a Wireshark capture was not able to output anything that was of interest.At this point we have adequate evidence to proceed with additional debugging, which i will explain in detail in the 2nd part of this blog post. The story of a Trojan dropper II

Figure 7: wireshark packet capture

The story of a Trojan Dropper II

Analysis:

Lets analyze the PE file in detail and see what it’s up to. Like most malware, this sample was packed and in order to properly analyze it, we must begin by unpacking the binary. Keeping this in mind, I began by debugging the file, hoping to find the reference to the data section in order to determine precisely where the encrypted portion of data was to be found.

Fortunately, I was not disappointed and was soon able to find the reference point.

Figure 1: Obfuscated data 

After further debugging, we are able to see the code decrypted in memory. The decryption occurs in multiple iterations, until the data is completely decrypted.

Figure 2: Decryption of obfuscated data

Now we have a full view of the decrypted code in memory. The portion that was decrypted contains position independent code (i.e shellcode).

Figure 3: Decrypted data in memory

Since the code is decrypted in memory, we can assume that at some point, control will be transferred to that region, which in this case happens immediately. We also can see that the VirtualProtectEx API is used to change the protection of the memory region and by doing so the malware will be able to execute and manipulate the memory.

Figure 4: Change memory protection

After this occurs, control is transferred to the region by an instruction of JMP EDI. Here, EDI will hold the address to which EIP (instruction pointer) lands and we can see that it is the same portion of the 

code that was decrypted earlier.

Figure 5: Control transferred to new code

There's an interesting bit of code here if we look at first couple of instructions on the landed region. We can see a NOP instruction, followed by SUB EAX,EAX and a CALL and POP EBX. If we carefully observe the address that is called, it is that of the POP EBX. This is a common technique found in shellcode and file infectors where one needs to get the address of the region that is currently being executed.

When this CALL is executed, it pushes the return address onto the stack (in this case it is the address of POP EBX). Now POP EBX is executed, as that instruction pops the value from the top of the stack to EBX. The address is then added to a constant of 0x33, to point to the region that is then decrypted by the decryption loop. This reveals more code, after which a JMP instruction transfers the control to the newly revealed code.

Further, I was able to identify another interesting piece of code here. The code below retrieves the address of the PEB (process environment block) and navigates to PEB_LDR_DATA->InLoadOrderModuleList, where it retrieves the names of the loaded modules (DLL’s) .

Figure 6: Fetch base address of kernel32.dll

There's another catch here. The malware looks for specific DLL’s (in this case kernel32.dll), but instead of using the string kernel32.dll to compare with retrieved module names from the PEB, it carries the hash of the DLL names and then calculates the hash value for the retrieved module names and compares them. This allows the malware to make minimum noise and avoid some antivirus rules.

Figure 7: Dll name hash 

Once the malware gets kernel32.dll, it then retrieves the base address of the kernel32.dll, which in this case is 0x7c800000. Now, using the PE file format, the malware moves to the export table of kernel32.dll, as illustrated in the code below,

Figure 8:  Finding exportaddresstable of kernel32.dll

Looking at code above the instruction MOV EBX, DWORD PTR DS:[EAX+78], lands us at the datadirectory-->exportaddresstable of the kernel32.dll. The malware then retrieves the value and adds it to the imagebase (ie 0x7c800000) in order to reach the export table, where it retrieves the address of the exported function. Here too, the malware never uses the names of the function, but instead it uses a stored hash.

After further analysis, we stumble onto another piece of code, which copies data again from the data section to a newly allocated memory region.

Figure 9: Copy more data 

Investigating further, we see that this data is decrypted to reveal what looks like some sort of an address table.

Figure 10: Address table 

The table has significance as it is used as an address calculator, To calculate the address of

the region from where it copies bulk data, Which is further decrypted to form what looks like

a compressed file.

Figure 11: Compressed data

And there it is. Moving ahead, we land in the decompression routine, which quickly reveals that

the data is compressed using “aplib”.

Figure 12: Aplib decompression routine

Once the decompression is completed it does some familiar actions by flushing out the bytes of the original EXE file starting from the imagebase 0x400000 and copy the decompressed data to its new imagebase (i.e 0x400000)

Figure 13: Copy decompressed PE -file 

Finally using “LoadlibraryEx” and Getprocaddress the IAT is rebuild in the memory after which the control is transferred to the new code at the address 0x401021

Figure14: Rebuild IAT in memory

The job of this code is limited. It writes a PE-file which is embedded within itself into the temporary folder as “Adobe.exe” using the api “GetTempPathA”.

Figure 15: Transfer control to OEP

In the end, the file (Adobe.exe) is dropped in the temp folder and executed using the API “ShellExecuteA”.

Figure 16: Execute dropped "Adobe.exe"

A dummy PDF file is also written to the current directory named “Bestellung.pdf”. In a subsequent blog post, we will see why the malware dropped this PDF file.

That’s all for now. In the next post, we’ll continue the analysis of the dropped file “Adobe.exe”

Fake SourceForge site distributes malware

We spotted malware hosted on hxxp://sourceforgechile.net/ a couple of days ago. The website is not currently responding, but appears to been set up as a fake and malicious version of the popular open-source hosting site SourceForge.

sourceforgechile.net was registered on 04/05/213 in the US and is hosted in the Ukraine.

One of the malicious files downloaded was hxxp://sourceforgechile.net/minecraft_1.3.2.exe. Minecraft is a proprietary game with a significant following. Many open-source projects related to the game are hosted on SourceForge.

This file is a pretty nasty piece of malware:

• It hides itself in the Recycle Bin
• It disguises dropped files with names like Desktop.ini
• It registers itself as a Windows service
• It injects code in other threads and DLLs
• It opens and listens to a port
• It connects to about 20 IPs over port 16471
• etc.

This malware is related to the ZeroAccess trojan. The malware makes money by clicking on ads (click fraud) and using the infected PC as part of a wider botnet (zombie PC).

You can get the VirusTotal report here. The detection rate among AV vendors has gone up in the past week, it is now flagged by most vendors.

As usual, be very careful about the files you download and run. In this case, ensure that you're downloading content from the official SourceForge site, not a clone.

UPS Phishing page with malware

For some time now, attackers have been faking popular websites like YouTube to entice users into downloading and installing malicious software disguised as plugin updates or video codecs. I rcently found a page that is using the same technique to distribute a malicious executable through a fake UPS page.

The page is located at hxxp://www.retinamac.ru/UPS/. It has been up for at least three weeks and not yet blacklisted by Google Safe Browsing. At the top is a fake Firefox warning bar (the same type we analyzed earlier) for a missing plugin. It is interesting to note that the page shows the same fake bar to all browsers - it does not attempt to fake a specific implementation for say Internet Explorer or Chrome.

Fake UPS website

The page warns of a missing plugin. All links, buttons and images open a new popup to download  JavaJREInstaller.exe. On 10/31, only 4 AV vendors were detecting the threat out of 43 vendors! Five days later, that count rose to 35 AV vendors. This illustrates how hard it is for AV to detect new threats.

A behavioral analysis of the executable shows that several executables are dropped into a temporary folders:

• C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\00442734.exe
• C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\00445cfa.exe
• C:\DOCUME~1\ALLUSE~1\LOCALS~1\Temp\msuuioeyi.exe
• C:\Documents and Settings\All Users\Application Data\8CAFEE7F380FD13300008CAF61D8DA37\8CAFEE7F380FD13300008CAF61D8DA37.exe

The last executable is registered to run with every startup. This example is very representative of the threats we see on the Internet today - most of the attacker effort goes into hiding the malicious executable from the AV vendors, not into the way the payload is delivered to potential victims. This is true for many exploit kits such as the Blackhole exploit kit, where it is much easier to detect the page used to deliver the executables than the malicious executables themselves.

Fake Flash update with a twist

This summary is not available. Please click here to view the post.

Follow up on the top blacklisted sites

Earlier this week, I researched the top websites blacklisted by Google. I've looked at more of these websites over the last three days to better understand the most common attacks.

The findings are quite disappointing. First, most infected websites are not cleaned up after three days. Webmasters should see a huge drop in their traffic, since only Internet Explorer and Opera users would not receive a warning preventing them from visiting these sites, due to the fact that other browsers use the Google Safebrowsing blacklist. This also means that the owners of these very popular websites have not invested in keeping their website safe, or at least in solutions to detect the blacklisting of their pages, traffic anomalies, or the detection of malicious content.

Second, the injected IFRAMES or JavaScript, redirect to the same type of malicious pages that we've seen for years now, such as fake AV scareware, fake Flash updates, survey scams, etc. That means that users are
still not educated enough to recognize fake software updates and still fall for the same old tricks.

These users won't get much help from their antivirus either. The detection rate of new malicious executables is very low, usually below 25%.

Here are some of the very recognizable malicious landing pages.

Fake Flash Updates

This is exactly the same attack we described in October 2011 (Naked Emma Watson video). A website that looks a lot like YouTube, claims that Flash must be upgraded to watch the sex video of some celebrity.

Fake Youtube page

Warning about Flash upgrade

Only 9 AV vendors out of 42 detect the fake Flash upgrade executable as malicious

Fake AV

This one looks different than the usual fake AV pages, as it is just an image with no animation.

Fake AV page

Detected by 12 AV engines out of 42.

Survey scam

A common way for spammers to profit from users is to get them to do "free" trials in order to earn a gift (or so they claim). This type of scam is very, very common. It's amazing that is still works.

In this example, the spammer uses a fake Youtube page to make the scam appear more legitimate.

Survey scam

I also found out that while Google Safe Browsing might block the infected site, it often does not block the actual malicious domain injected into the page in the form of a malicious IFRAME or JavaScript redirect. This means that other websites infected with the same piece of malware could be missed by Google Safe Browsing and still impact other users.

For webmasters

There are many ways to know when your website is blacklisted. For example, you can register a free account with Google Webmaster Tools. Then look under Health > Malware for any indication of blacklisting. You can also check the Google Safe Browsing diagnostic page for your domain at http://www.google.com/safebrowsing/diagnostic?site=mysite.com. This will tell you not only if your domain is blocked, but also if a portion of your site is compromised before you actually get blacklisted. Finally, you can do some automated checks with the Google Safe Browsing Lookup API. We have released libraries to interact with the API using Perl, Python and Ruby.

Details of a "new" Fake AV page

As I mentioned last week, more Fake AV pages are once again showing up in popular Google searches. Although these malicious pages look the same as they did 2 years ago, the source code is different.



The first thing you notice in the source code is that there is no obfuscation at all. The attacker is not trying to hide anything: CSS is inline, plain-text JavaScript (no obfuscation, no minification or packing) is inline, etc. That makes the pages very easy to track and block. Or it should....however, antivirus vendors are still not able to block the Fake AV executable with an acceptable level of accuracy. As you can see in the video, only 5 out of 42 antivirus engines find anything suspicious. You can easily download the executable with a simple wget command, so it is not hard to gather these samples

Download the malicious executable with wget

The source code is fairly simple. Another interesting fact is that Firefox is handled differently by the page compared to other browsers, meaning that different JavaScript code is run, but the end result is the same as on the other web browsers.

Fake AV page

The JavaScript function used to trigger the malicious file download is called google(). It creates an IFRAME pointing to the malicious executable, which triggers the download prompt without having to leave the page.

The google() function

The animations (blinking text, scanning progress bar, etc.) are all done with animated GIF files.

Overall,these Fake Av pages are low tech, very unique and very easy to track .... but still very effective. Desktop antivirus, often the only protection available to home users, generally fails to block the page and fails again to block the malicious executable.

Malware campaign targeting Opera Mobile

I've stumbled upon hundreds of links targeting Opera Mobile users, to trick them into installing a malware on the device.

The links are in the form of:


hxxp://geqe.net/opera_mini/1965/opera_mini.auto#phpsessid=85cfe7f19a08b6387d0441a9d949bb95

Each has a different phpsessid value. The domain was registered last month (02/12/2012) and does not seem to host any legitimate content.

These pages redirect to another domain, mskmarkets.ru (hxxp://mskmarkets.ru/l.php?l=o4&r=2695&a=29#phpsessid=afe9720a74a56800a2bd682b171e9914) where users are warned in Russian that their browser is out of date:

WARNING! An update your browser!

Your browser version is outdated, your phone is at risk of infection by dangerous virus!

We strongly recommend that you upgrade your browser. To update, click Update.

hxxp://geqe.net/opera_mini/1965/opera_mini.auto#phpsessid=85cfe7f19a08b6387d0441a9d949bb95

Note that a Google Chrome favicon is used and the page leverages the same theme and icons as Opera Mobile. The source code has multiple references to Opera (CSS, links, etc.) and targets WAP-enabled devices.


When the user clicks on the Refresh button, the file browser_update.jar gets downloaded (and possibly installed, I don't have the right device to test). This malicious Java application is currently flagged by 8 of 43 AV engines as an SMS sender. This type of malware is very common on mobile devices. They are used for spam or contact surcharged phone numbers.


According to Wikipedia, Opera has a huge market share in Russia and Eastern Europe, with more than 36% of the browser market (only 2.7% world-wide).


With the lack of effective AV and other security tools on smartphones, especially on low-end devices, mobile users must be very careful about downloading and installing applications, especially outside of the official app stores.

Fake AV: .ru sites used for redirections

This past month, I've seen an increase in hijacked sites redirecting to a Fake AV page. These attacks typically involves three separate phases:

1. The hijacked website redirects users coming from a Google search to an external domain.
2. A website redirects users to the Fake AV page or to a harmless site (mostly bing.com and google.com) depending upon the referer in step #1. This page adds a cookie using JavaScript, and reads it immediately, to make sure the page was accessed by a real browser that supports both JavaScript and cookies.
3. The fake AV page is delivered.

Hijacked sites

I demonstrated last year that the Blackhat SEO attacks had migrated from the most popular searches to more specific searches like buying software online where up to 90% of the links returned are malicious. It comes as no surprise that about 95% of the hijacked sites were found for searches like "purchase microsoft word", "achat windows" ("buy Windows" in French), "precio office 2007" (Italian), etc.

There were 12 hijacked sites being used, with 3 domains representing 90% of the hijacked sites redirecting to a fake AV page:

• politicalcampaignexpert.com (WordPress)
• www.extralast.com (WordPress)
• www.ukresistance.co.uk (blocked by Google Safe Browsing)

Redirection site

The domain used to redirect users from the hijacked sites to the fake AV pages are all .ru sites, with the same URL path:

• bannortim-qimulta.ru/industry/index.php
• daliachuuaroyalys.ru/industry/index.php
• bannortim.ru/industry/index.php
• uaroyalysdaliachu.ru/industry/index.php
• uaroyalys.ru/industry/index.php
• etc.

This page is used to differentiate between real browsers and bots or scanners. It uses JavaScript to write a cookie, and then reads it immediately thereafter. If the cookie is retrieved, the visitor is redirected to a malicious site, otherwise they are redirected to Bing or Google. Here is the snipped of the source code:

JavaScript and Cookie support test

Fake AV page

Fake AV page

Attackers are getting lazy! The fake AV page looks the same as it did two years ago and the source code of the page has barely changed. Fake AV pages used to change every 2-3 weeks when they were found all over the most popular searches, now they are remaining stagnant for six months. Here is the video that shows the Fake AV page in action:


As you can see in the video, the malicious executable is detected by 14 of 43 AV vendors.

Hopefully, one day Google will clean up the search results related to buying software as they did for the most popular searches. Until then, many users will end up on fake stores, fake AV pages or other malicious sites.  

More software-related searches lead to malware

Spammers have done a very good job a hijacking web searches related to buying software online. More than 90% of search results for "buy Microsoft Windows" and similar searches, lead to fake stores on major search engines. Not much has been done by the search engines to clean up these search results.

Since the beginning of 2011, the number of search results for popular queries leading to fake AV pages and malware has dramatically decreased, especially on Google.

I've wondered when attackers would switch from the poisoning popular search phrases, to more targeted searches. In the past few weeks, I've seen more and more spam redirected to malware, where similar searches would previously have led to a fake online store.

For example, the website www.saloncti.com contains multiple spam pages around "buy microsoft office" (be careful if you decide to follow the search results). These spam pages are very similar to the spam pages leading to fake stores.

Spam page on http://www.saloncti.com/?p=1523

Instead of a fake store, the visitor is redirected to at least three types of malware.

Fake AV

One of the malicious redirections is to 31.44.184.89. It hosts a Fake AV page. Although the page looks visually the same as the Fake AV pages I've seen so far, the source code is very different.

Here is a video of the Fake AV page. I quickly got blacklisted (see details below in the post), so I had to reconstruct the page on my local machine. On the real website, I would have been prompted to download an executable, which was malware disguised as an antivirus solution.

Naked Emma Watson video

I've described this malicious page in a previous blog post. Basically, the page looks like YouTube, with a purported video of Emma Waston naked. The "Play" button warns users that they don't have the latest version of Flash and tricks users into installing malware.

Fake Flash installation

Top 10 Famous Celebrity Scandals

This is a variation of the naked Emma Watson video. The page shows a picture of a scantily clad Paris Hilton. Again, the goal is to trick users into installing malware disguised as a Flash update.

The page was hosted on firstuzsoft.rr.nu and was not blocked by Google Safe Browsing. The malicious executable was detected by only 6 AV out of 43. Zscaler's free Search Engine Security add-on for Firefox, does protect against these types of sites.

IP checks

There are multiple redirections between the spam page on the initial site (www.saloncti.com) and the final malicious page (31.44.184.89 or firstuzsoft.rr.nu). The referrer and the IP address are checked along the way. Here is a sample of a redirection from a Yahoo! search, to the malicious domain:

1. http://search.yahoo.com/ra/click?.bcrumb=tfNYWE9Y1t1&p=site%3Asaloncti.com%20software&cq=[...]
2. http://www.saloncti.com/?p=1870 (302 redirection)
3. http://74.63.193.178/tra1/change.php?sid=8 (302 redirection)
4. http://74.63.193.178/tra1/got.php?sid=8 (302 redirection)
5. http://www.communitysupportottawa.ca/cutenews/ip.php (302 redirection)
6. http://www.skibec.ca/castor-kanik/cutenews/ss/2.php (302 redirection)
7.  http://www3.bestiiarmy.rr.nu/?nlqqufcc=kuHa1bKbmpOZi%2BPdzaaUmNnsq56lopva18%2Bfl6Sqnp%2BU1Z3cntKV

After following a couple of search results, my IP address got blacklisted and I was redirected to ask.com instead of the malicious domain.

It is scary, but predictable, to see attackers switching their targets. I hope the search engines will take the threat of malicious executables more seriously than fake stores and clean up their search results. It will be interesting to see who has the best Blackhat SEO skills: people behind fake stores, or people behind fake AV/Flash pages.

More free software repackaged for money

In previous posts, I've shown how popular free software programs are repackaged and sold by scammers, while containing spyware, or are outright replaced by malware. The number of web sites offering such repackaged software has been on the rise in the past weeks [LINK TO PREVIOUS POST]. The most popular repackaged software used to be Flash, antivirus programs and VLC (video player). The list has broadened to contain less-know software such as 7zip (free alternative to Winzip), WinSCP (SCP client for Windows), Filezilla (FTP client), GOM (media player), Notepad++ (powerful text editor), etc.

Here are some of the websites:

Filezilla on http://filezilladownload.net/

VLC on http://downloadflashplayer.org/ advertised a s stand-alone Flash player

WinSCP on http://winscpdownload.com/

7zip on http://7zip-download.org/

Here is a list of 9 similar websites responsible for distributing such malware:

1. hxxp://filezilladownload.net/
2. hxxp://downloadflashplayer.org/
3. hxxp://avi-player.net/
4. hxxp://flv-player.org/
5. hxxp://gom-player.org/
6. hxxp://photoshopfreedownload.net/
7. http://winscpdownload.com/
8. hxxp://7zip-download.org/
9. hxxp://notepaddownload.net/

The files that are downloaded use a similar naming convention - software-setup-win32.exe or software-setup-win32_us.exe: aviplayer-setup-win32.exe, winscp-setup-win32_us.exe, flashplayer-setup-win32,exe, filezilla-setup-win32_us.exe, etc. Their size is always about 1.7MB.

The detection rate amongst AV vendors is very low: only NOD32 was able to find the spyware in the 3 samples I submitted to Virus Total: 1 2 3.

Software repackaged by Conversionads

The software actually makes three changes: it installs the StartNow Toolbar (from Zugo, a company associated with Spyware/Adware), sets MSN as the home page and then sets Bing as the default search engine. All steps are completed by default.

Microsoft packages installed by default

I've found most of these sites through spam comments in forums such as this one on carepages.com:

Links to repackaged software

They are also well referenced by Google. For example, filezilladownload.net shows up at #5 for filezilla download, just after the four search result links to the official filezilla-project.org website

-- Julien