Fake AV and PRISM warning on hijacked website

While many individuals are concerned about privacy in light of PRISM, some malicious actors are using the program to scare naive users into installing ransomware. Since August 23rd, we have seen about 20 domains that carry FakeAV and Ransomware. These websites seem to have been hijacked. They are all hosting the malicious content over port 972 and use similar URL patterns. Here are a couple examples:

• kringpad.websiteanddomainauctions.com:972/lesser-assess_away-van.txt?e=20
• miesurheilijaaantidiabetic.conferencesiq.com:972/realism_relinquish-umbrella-gasp.txt?e=21
• squamipi.worldcupbasketball.net:972/duty_therefore.txt?e=21

The malicious files seem to be changing. It started with the classic FakeAV, then switched to a fake PRISM warning. In both cases, the goal is to scare the target into paying the attacker to "fix" their computer.

FakeAV

FakeAV remains a popular technique to lure targets into paying attackers. Most of the instances of FakeAV we have reported earlier were running a fake computer scan in the browser. This time it appeared as a Desktop application.

FakeAV scan of the computer

FakeAV claims to have found threats

The scan claims to have found 18 threats. Two have been cured, but the victim must pay to get the remaining 16 threats taken care of.

Some of the malicious behaviors of this FakeAV variant

PRISM warning

The other malware is interesting. The attacker uses the recent news about PRISM to claim that the victim's computer has been blocked because it accessed illegal pornographic content. The victim has to pay $300 through MoneyPak, a prepaid card service.

No less than 5 federal agencies are "blocking" your computer!

Victim needs to pay up $300 to get his computer back.

Both malware connect to the same couple of IP addresses over ports 80 and 443 that include:

• 37.139.53.199
• 64.120.167.162
• 64.191.122.10

I expect attackers to take advantages of the upcoming UK laws on accessing adult content online to send new types of fake warnings to UK victims.

Kelihos botnet: What victims can expect

There is has been a recent surge in security blogs warning users to be extra cautious of a new spin on an old threat.  Kelihos is a botnet which utilizes P2P communication to maintain its CnC Network.  With all of the attention around Kelihos, it should be no surprise that 30/45 AV vendors are detecting the latest installer.  I took some time to analyze recent threat reports that came through our malicious/suspicious files queue, to see if I could find anything to add.  It didn't take long to find a now infamous iteration of this botnet installer in action.  In particular, I found a file called "rasta01.exe".

Besides the common naming convention of this threat, there are many other factors which gave this infection away at a glance.  Firstly, the use of P2P style communication via SMTP raised an eyebrow.  This particular instance called out to 159 distinct IP addresses.

A small portion of the SMTP calls made from a standard instance of Kelihos

Secondly, we observed the overt way the botnet installs several packet capturing utilities and services.  This is done so that the infection can monitor ports 21, 25, and 110 for username and password information.

Everything you need to monitor packets is created/dropped here.

Next, I noticed that the botnet attempts to categorize it's new victim by using legitimate services to gather intelligence.  In this instance, the malicious file actually queried the victim IP address on Barracuda Networks, SpamHaus, Mail-Abuse, and Sophos.  These services primarily exist to notify users of abuse seen on the site or IP address.  Kelihos is using it to to determine if the new victim is already seen as malicious or not.  If the victim isn't seen in the CBLs (Composite Block Lists) yet, then it may be used as either a Proxy C&C or Spam-bot.

References to CBL's from each location will determine what role the victim plays in the botnet.

A final point to make about this threat is that it makes no attempt to hide exactly how loud it is regarding network activity.  We noted a spike in TCP traffic across a distinct 563 IP addresses in the span of two minutes.  Network administrators should take extra care in monitoring users with anomalous levels of traffic.  A single node giving off so much traffic to different services in such a small window could be used to identify potential victims.

Expack continues exploiting Java vulnerability

Exploit kits available in the wild tend to follow a trend by exploiting vulnerabilities reported in various browser components which are commonly deployed. Recently, we have seen an increase in exploitation of a year old vulnerability reported in the JRE component of JAVA (CVE-2012-1723). Exploitation of this vulnerability in JRE allows a attacker to download malware onto a victim's machine and execute it. Let's looks at an analysis of such an exploit kit recently found in the wild.

Exploit Kit URL:

hxxp://174.142.240.91/577ac477f62d4873cf41dc834d107b7c/influences-portal.php

When accessed, the above exploit URL executes obfuscated JavaScript and loads an applet into the browser as shown below:

Obfuscated source code:

Let's analyze the above obfuscated JavaScript code by de-obfuscating it. While de-obfuscating the JavaScript code, we noticed that the code has multiple layers of obfuscation. For the scope of this article, lets skip ahead to the end of the de-obfuscation process. 

As usual, the exploit kit request loads content based on the version of the browser and versions of different plugins installed in a browser by running browser/plugin detection logic embedded in obfuscated JavaScript. The exploit kit targets vulnerabilities in JRE (Java) and Adobe components of the browsers.

Let's take a look at following de-obfuscated code which loads malicious applet into browser:

The following code calls the relevant functions above, depending upon the JRE version found on the victim's machine:

The applet is executed by the browser, which then downloads a malicious .jar file from following URL,

hxxp://174.142.240.91/577ac477f62d4873cf41dc834d107b7c/influences-portal.php?gKoRO=UfhqAFb&gCTEVgSTdQbZjI=wUkSXV 

The de-complied code of the downloaded .jar file is also heavily obfuscated. 

VT Result: 13 / 45

MD5:  361b0e1eab5e647315e6873ea16ca720

This .jar files exploits the vulnerability in the JRE, which allows the attacker to download additional malware and execute it the browser context.

 

 VT Result: 13 / 46 

MD5: a151fdce265ba4fcab1b36bd624d330f

A Trojan then connects to the CnC server by sending POST data and in response, the CnC server replies with 'STATUS-IMPORT-OK'.

After receiving command 'STATUS-IMPORT-OK' from the CnC server, The Trojan then downloads another malware file (6.exe) from the same domain which looks to be a variant of ZerooAccess rootkit. The detection rate for the '6.exe' is also fairly low on VT.

VT-Result: 6 / 46  

MD5: b152b3d170dc089b057fbbe3d6393764

Exploitation of browser components such as Java and Adobe plugins by exploit kits are now a very common reason for enterprise PCs to become compromised. My colleague Krishanan Subramanian recently blogged about a rise in Red Kit Exploit Kit Activity, which also addressed the same vulnerability in Java. It is vital that enterprises ensure that browser plugins are always patched and up to date, something enterprises regularly fail to do. In the case Java, given the now regular stream of 0days that it has inspired, you may want to seriously consider disabling Java altogether, at least at the browser level, something that you can read about in a previous blog post entitled: Are you vulnerable to yet another Java 0Day exploit?

Pradeep

Malicious .jar files hosted on Google Code

Recently we blogged about Google Code hosting malware. Within a month we have observed a second instance where malicious .jar files are being hosted on Google Code. Using Google code to distribute malware seems to increasing in popularity, no doubt due not only to the free hosting provided, but also the positive reputation of the google.com domain. This indicates that there is presently inadequate validation performed by Google prior to content being uploaded to the Google Code site. In this case, a simple anti-virus scan would have found following pieces of malware.

Google Code URLs: 

hxxp://update-java.googlecode.com/

hxxps://code.google.com/p/update-java/


 
Hosted Files:

 
Both files 'update.jar' and 'Client.jar' have an MD5 of '0521c911e442cd9eec927d8439731a76' and a size of '3,626' bytes.
 
VirusTotal Result:

URL Scan: 7 / 38 detections

File Scan: 28/45 detections

ZULU Result: 100/100 score
ZULU rules which are flagging .jar files as malicious.

The two projects are hosted on 'code.google.com' by the same uploader who has an email ID of 'daicadad...@gmail.com'. The second project is also currently live (hosted at "hxxp://code.google.com/p/update-java-download/") and contains the same 'Client.jar' file. You will note that other links within the projects like 'Project Home, 'Wiki', 'Issues', etc. contain minimal information about the project, suggesting that malware hosting was the only goal.

Malicious piece of Java code in 'Client.jar' file:

 

This .jar file basically takes a URL as input and downloads a file from the given URL. The same type of .jar file was previously analyzed and mentioned in an earlier Zscaler blog.

The release date on the 'Download' link indicates Apr 26, 2013, but we have observed in the Zscaler logs, the same file being hosted on "hxxp://heckraiser.fileave.com/youtube/YouTube.jar" as far back as July 24, 2011.  

In the past, we have seen sites like Dropbox, Google Code and other free hosting providers being leveraged to deliver malware. Free hosting providers, especially those with a positive reputation are becoming popular for attackers to serve malicious content. Enterprises and end users alike, should consider any third party content, regardless of location, to be untrusted until it has been appropriately scanned.

Pradeep

Anatomy of an ongoing Drive-by-Download campaign

While doing a weekly review of our logs, we stumbled upon thousands of transactions that seem to be a part of an ongoing malware campaign. We found compromised websites that redirect the browser to an exploit kit, further leading to a drive-by-download dropper. The source was traced to originate from blackhat SEO redirections (yandex[.]ru). 

The attack can be dissected into two stages, an injected malicious script which redirects to a domain and a second stage in which the domain sends the browser through an HTTP 302 redirect that finally leads to the landing page. The 302 redirection domains resolved to an IP range 192[.]133[.]137[.]0/24. The landing page domains were having a very low TTL and were hosted in sub-net 109[.]236[.]80[.]0/24 (AS49981). The server is hosted in NL. The campaign leveraged a DGA (Domain Generation Algorithm) along with Dynamic DNS to deliver the payload and the domains which delivered the exploit were ending with a [.info] TLD. The following snapshot shows some of the sample redirection and dynamically generated landing page domains. 

The mechanism of the attack is as follows. Firstly, a malicious redirection script is injected into the webpage: 

This is followed by a 302 redirect, which then leads to the exploit kit landing page. 

The exploit kit favors the g01pack, which delivers a multistage exploit. Initially, it detects the browser plugins and versions thereof and then serves the exploits accordingly. At the time of analysis, I was using Java v1.6 release 26. The landing page was as follows: 

As seen, the landing page also tries to deliver a Flash exploit. Unfortunately, at the time of analysis I was getting a 404 response for the SWF payload. 

The applet is loaded with the "applet_ssv_validated" passed as an undocumented parameter to the applet, which allows the attacker to carry out a JVM security bypass. The applet then makes the call to the malicious JAR file. 

The JAR file tries to exploit CVE-2012-0507 and drops the malicious executable. The snapshot summaries the code which carries this out.  Only two anti-virus vendors detected this JAR file as seen in this VirusTotal Report. 

The dropped EXE files are Ransomware/Fake AV/ZeroAccess Trojans, depending upon the payload delivered. Our Behavioral Analysis Engine flagged these files as malicious and the VirusTotal Report shows that 10/46 Anti-virus vendors detected this at the time of analysis. Also shown are some screen shots of the Ransomware/Fake AV after successful infection. 

Given it's rocky history with security, there has and will always be some buzz about new exploits against Java Plugins. Attackers will continue to own browsers as long as the Plugin is enabled and vulnerable. Refer to this post to learn how to stay protected from exploit kits. Wishing you happy & safe browsing ! 

CookieBomb still dropping malicious content

Cookiebomb is malicious obfuscated javascript injected into legitmate sites.  We've talked on this blog about compromised sites before, but this one appears to still be fully functional and actively spreading malicious content to unsuspecting users.  The talent at MalwareMustDie is onto their shenanigans as well.  As they have mentioned, this is a multi-redirection exploitation that uses two stage obfuscation to hide it's malicious payload.  The curious thing about this situation is that few AV vendors have taken note of the good research.  The final dropped file is being detected by only 7/45 vendors.

Below is the analysis of a single sample taken from the final list of infected sites we have seen propagating this threat.

First, there is the obfuscation of a small JS inclusion into a potentially legitimate site.  This is where the CookieBomb sets a name, special variable, expiry date, and access path for the eventual infection.  If the cookie is not readily available, it will create one for you and redirect you to another obfuscated hidden iFrame.  Once the hidden site is visited, it will read the cookie's expiry date and provide redirection and infection at a later point to avoid security vendor detection.

Figure 1: Obfuscated Code

Please note that the comment at the top of the image ("/*0f24908*/") is changed and is not therefore useful for detection.

Figure 2: De-obfuscated code from Fig.1

In the deobfuscated code above, we see another URL delivered in a 1px iFrame.  Going to this site leads to yet another obfuscated page, where the real magic happens.  The very first thing that it does is attempt to confirm the version of browser plug-ins the attackers are up against.

Depending on the version installed, it will send the next portion of the attack.

The final step sends the malicious payload that the attackers went to so much trouble to obfuscate.  
 

Attack URLs

Obfuscated content from the obfuscated content

The final drop for this content is a malicious executable that is delivering a small Trojan.  At the time of research, only 7/45 vendors were detecting this content as malicious.

Fiddler session with malicious content being dropped.  (Readme.exe in this case.  Calc.exe in others.)

For the last several weeks, this attack has impacted the below sites:

•  hxxp://www.citytavern.com/
• hxxp://www.usadu.cz/park-en/
• hxxp://bluen.de/jobborse/
• hxxp://bluen.de/
• hxxp://www.niblackfuneralhome.com/
• hxxp://www.kinwindsor.com/
• hxxp://www.mtldesign.net/
• hxxp://javiervazquez.me/ernesto/fdjw3hv7.php
• hxxp://www.cmfurniturerental.com/
• hxxp://sdrs.splashtop.com/strs01/macupdatenotes/en-us/strs01.html
• hxxp://www.nauticodiver.de/tauchbas.htm
• hxxp://www.tmv-alsace-vtt.com/f/parcours.htm
• hxxp://www.cmstaging.com/
• hxxp://educationdegreeonlines.com/benefit-from-studying-with-the-laptop/
• hxxp://www.gute-reise-berlin.de/aussteller.html
• hxxp://lexespana.com/comunes                                                                                                          
• hxxp://livehappylife.com/
• hxxp://corpdeli.com/
• hxxp://www.sudan-sudan.com/sudan/architecture-sudan-sudan.html
• hxxp://www.cmfurniturerental.com/index.php?main_page=index&cPath=114&zenid=8557f58ea51118a7bd633015e3b954ec
• hxxp://www.cherokeecountysc.com/id26.html
• hxxp://www.gute-reise-berlin.de/startseite.html
• hxxp://www.selbstversuch-spanien.de/
• hxxp://educationdegreeonlines.com/
• hxxp://www.nauticodiver.de/schule.htm
• hxxp://bluen.de/uber-uns/
• hxxp://www.nauticodiver.de/impresssum.htm
• hxxp://www.imschuh.de/
• hxxp://www.nauticodiver.de/preisliste.htm
• hxxp://familyreunion.blackamericaweb.com/
• hxxp://bluen.de/jobborse/spezialist-in-akustikversuch/
• hxxp://www.uppertraining.com/blog/cisco-mobile-apps-cover-a-surprising-range-of-functionality/
• hxxp://www.opheij.nl/contact.html
• hxxp://www.hotelmirallac.com/castellano/tarifas.htm
• hxxp://www.sugargrovechamber.org/member_listing/34/curt+john+karas,+cpa,+mba,+pc/
• hxxp://www.kinwindsor.com/favicon.ico
• hxxp://glassdoctor-denver.calls.net/?gclid=CPLt2r3F-LgCFUFyQgodZxwAjQ
• hxxp://bluen.de/jobborse/spezialist-in-logistikplanung/
• hxxp://dreamliftgifts.com/faq.html
• hxxp://www.gute-reise-berlin.de/kontakt.html
• hxxp://www.plomberiumpierrefonds.ca/robinets-de-cuisine/
• hxxp://www.cerexagri.nl/
• hxxp://www.mrbouncehouse.com/
• hxxp://guia.lexespana.com/familia/servicio-domestico/extincion-del-contrato/
• hxxp://www.nauticodiver.de/start.htm
• hxxp://corpdeli.com/lunch-menu
• hxxp://www.hotelmirallac.com/castellano/habitaciones.htm
• hxxp://www.nauticodiver.de/
• hxxp://www.heapoil.org
• hxxp://www.mtldesign.net/aboutus.htm
• hxxp://www.le-vieux-four.com/
• hxxp://www.cleargridsolutions.com/developer.html
• hxxp://www.horseridingfun.com/
• hxxp://educationdegreeonlines.com/2013/07/

The most notable site here is splashtop.com, however, the malicious content has since been removed.  Since AV seems to be uninterested in protecting against this threat, it is advisable to make sure your browsing is safe through other means.

Technical Research: Krishnan Subramanian

Facebook phishing: manual session hijacking

We have reported a number of Facebook phishing pages and scams on this blog. Attackers always come up with clever ideas to fool users in order to obtain their credentials. One of these phishing tricks is a "poor-man" session hijacking attack whereby the user is fooled into copying and pasting a Facebook URL containing the session ID or other credentials into a malicious page. I'll describe such an example that I spotted this past weekend.

The phishing page starts with the usual bait, a video. This time, no sex, but instead an opportunity to watch "Jackie Chan died after perfecting a deadly stunt. Jackie Chan falls from a building of 12 floors."

Jackie Chan died!

The user must click to verify his age, another common trick to get users to click on the page. This displays a list of steps to "verify your age" which involve clicking on another link, copying a link from the window opened, and submitting the data.

Steps to "verify" the user age

The new window points to Facebook. The window is too small for the user to understand what he is copying. Also, instead of opening a page, the URL used is "view-source:https://www.facebook.com...". This makes it one step harder for the user to understand that the window displays a page from Facebook.

Popup window open by the phishing page

When the user copies and pastes their Facebook URL into the 3rd party web page, they're also sending their authentication token used share content. Once this is done, the scammer can now post content on the user's behalf.

Fortunately, Facebook reacted quickly to this particular scam. The Facebook  popup is not valid anymore and it shows the following warning:

Warning from Facebook

When subsequently logging into Facebook after viewing the scam, I also received a warning about phishing pages:

Warning about phishing pages

It looks like Facebook has reacted much faster than they have in the past and added additional warnings for end users. I was asked by Facebook to review my timeline for any suspicious activating just after I logged in. Hopefully more Facebook users will learn about these phishing techniques and will be able to spot them early on.