Pornography - A Favorite Costume For Android Malware

30% of Internet traffic is in some way related to pornography and this is the primary reason why malware authors are using porn apps to infect large numbers of users. During recent data mining, we noticed an increasing volume of mobile malware using pornography (disguised as porn apps) to lure victims into different scams and stealing personal data or locking phones and demanding ransom payments. We recently wrote about Android Ransomware and an SMS Trojan leveraging pornography to scam victims. In this blog we share the analysis of two adult themed malicious apps - SMS and Infostealer Trojans that we recently spotted.

Case 1: SMS Trojan

Here we look at a Chinese SMS Trojan disguised as porn app. Upon installation, the malware fools the victim by displaying random adult sites, steals sensitive information and sends SMS to predetermined Chinese numbers in the background.

• Name : 浴室自拍
• URL:  http://yg-file.91wapbang[.]com/apk/appad/14461771841467103.apk?uid=ef2592f22af8c568f2b2993467a1e21a
• Package Name : com.uryioen.lkhgonsd
• Flagged by 6/53 AVs on VirusTotal at the time of analysis.

The malware installs the app with a lewd icon as shown below.

Icon

Once a user clicks on the icon, the user will be directed to a random URL from an array defined in the main code module. Interestingly, all the URLs are encoded in base64 format. 

Base64 URLs

List of URLs:

•  http://www.4493[.]com/star/sifang/(aHR0cDovL3d3dy40NDkzLmNvbS9zdGFyL3NpZmFuZy8=)
•  http://m.mnsfz[.]com/h/meihuo/(aHR0cDovL20ubW5zZnouY29tL2gvbWVpaHVvLw==)
•  http://m.4493[.]com/gaoqingmeinv/(aHR0cDovL20uNDQ5My5jb20vZ2FvcWluZ21laW52Lw==)
•  http://www.mm131[.]com/xinggan/(aHR0cDovL3d3dy5tbTEzMS5jb20veGluZ2dhbi8=)
• http://www.5542[.]cc/xingganmeinv/(aHR0cDovL3d3dy41NTQyLmNjL3hpbmdnYW5tZWludi8=)
• http://www.100mz[.]com/a/xingganmeinv/(aHR0cDovL3d3dy4xMDBtei5jb20vYS94aW5nZ2FubWVpbnYv)
• http://m.xgmtu[.]com/( aHR0cDovL20ueGdtdHUuY29tLw==)

The malware is collecting all the device information in the background and sending it to a remote Command & Control (C&C) server as seen below.

Post Request

The C&C server responds back to the bot with further instructions as seen below.

Response

The C&C response in screenshot shows the malware receiving a phone number with content that needs to be sent to that number via SMS. The following code shows how the malware will parse this response and start sending SMS messages.

Send SMS code

SMS

After sending the message, the malware sends another POST request notifying the C&C server about the sent SMS activity.

Post Request

• C&C server - http[:]//www[.]mscdea[.]com:7981

This activity occurs once a day at a random time interval where the malware sends a post request to the C&C server and receives phone numbers with SMS content to be sent out. 

The continuous SMS activity can lead to a significant financial loss for the victim. 

Case 2: Fake Ransomware stealing personal data

The malware in this case is trying to scare the user with a warning screen accusing them of watching child porn. The malware steals victim's personal data in background and send it to C&C server.

• URL: http://maturefuckporn[.]info/download/kyvcuwc/diper/video.apk (down as of now)
• App Name :  video
• Package Name : com.gi.to
• Flagged by 12/53 AV vendors on VirusTotal.

Upon installing the app on device, the user will see a video player icon on the screen.

Icon

Once the user clicks on the icon, the malware displays a fake warning page as seen below. The warning page pretends to be from the Industrial Control Systems - Cyber Emergency Response Team (ICS-CERT) but is different from the classic FBI/Police Ransomware pages.

Warning page

The malicious app does not ask for administrative privileges to lock the device and is fairly easy to remove. We did not find any code for locking the device. The malware harvests inbox messages, contacts & e-mail addresses, which are then relayed to a remote C&C server in the background.

Collecting data

The malware logs the harvested SMS messages & sender's phone number in a specific format to a temporary file as seen in the code snippet above.

C&C construction.

The screenshot above shows the C&C URI construction code. The file containing the stolen data is then sent to the remote C&C server as seen in the network capture below.

Post capture.

The stolen SMS messages being sent to the C&C server in a file.

Inbox messages

The stolen contacts & e-mail addresses being sent to the C&C in a file

Contacts

• C&C server - http[:]//maturefucklist[.]com

Conclusion

We are seeing an increasing number of adult themed Android malware apps using pornography to lure victims. To avoid being  a victim of such malware, it is always best to download apps only from trusted app stores, such as Google Play. This can be enforced by unchecking the "Unknown Sources" option under the "Security" settings of your device.

International Council of Women site leading to Nuclear & Kelihos

Introduction

We recently wrote about a compromised Chinese government site leading to an Angler Exploit Kit (EK) infection cycle. Nuclear EK operators are on par with their Angler EK peers in terms of the activity we are seeing in the wild. During our course of EK hunting, we came across a popular multinational organization, the International Council of Women (ICW), being compromised and leading users to a Nuclear EK landing site. The end user will get infected with the information stealing Kelihos bot if the exploit cycle is successful.

Compromised site - ICW

The following screenshot shows the malicious iframe injected on the compromised website.

Compromised ICW web page

 

The malicious iframe leads users to a Nuclear EK landing site as seen below.

Nuclear EK redirection

The Nuclear EK landing page is heavily obfuscated to evade security software detection as shown below.

Nuclear EK landing page

Upon successful execution of the obfuscated JavaScript, a malicious Flash file is downloaded on the victim's machine as seen below.

Flash Exploit Download

Kelihos Payload Analysis

Upon successful exploitation, a new variant of the Kelihos bot is downloaded and installed on the victim machine. Here are some of the download locations for the Kelihos bot that we have seen in this campaign:

 hxxp://46.63.32[.]75/harsh02.exe
 hxxp://95.65.55[.]6/harsh02.exe        
 hxxp://31.202.178[.]239/harsh02.exe    
 hxxp://37.233.40[.]97/harsh02.exe    
 hxxp://178.136.213[.]107/harsh02.exe

Final Payload Download

Kelihos is a Trojan family that distributes spam email messages. The malware communicates with remote servers to exchange information that is used to execute various tasks, including sending spam email, capturing sensitive information or downloading and executing arbitrary files.

The malware executable file is a Microsoft Visual C++ 6.0 compiled binary with custom packed content stored in the executable's overlay section. Kelihos installs WinPcap, a legitimate and commonly used Windows packet capture library at the following locations:

• %system32%\winpcap.dll
• %system32%\Packet.dll
• %system32%\drivers\npf.sys

Note: %system32% is c:\windows\system32

It uses hard coded User-Agents from the following list when communicating with the remote host:

Crafted User-Agent

Kelihos tries to steal the login credentials of FTP and POP3 applications by monitoring the network traffic of the victim's machine using the installed WinPcap libraries. The bot checks for the presence of the following applications on the victim machine and attempts to steal login credentials, digital currency and other information:

• 3D-FTP
• Bitcoin
• BitKinex
• BlazeFtp
• Bullet Proof FTP
• Classic FTP
• Core FTP
• CuteFTP
• Cyberduck
• Directory Opus
• FFFTP
• FileZilla
• Frigate3
• FTPGetter
• LeapFTP
• FTPRush
• xterm
• PuTTY
• SecureFX
• SmartFTP
• Bitcoin
• BitKinex

The malware extracts stored information such as usernames, passwords and host names from the following browsers:

• Google\Chrome
• Chromium
• ChromePlus
• Bromium
• Nichrome
• Comodo
• RockMelt
• CoolNovo
• MapleStudio\ChromePlus
• Yandex

Kelihos communicates to Command & Control (C&C) servers using HTTP via messages encrypted using the Blowfish symmetric-key algorithm.

Post Infection Communication

Conclusion

Nuclear EK remains a worthy rival to Angler EK, with widespread campaigns, regular exploit payload updates, new obfuscation techniques and new malware payloads. The end malware payload we saw in this campaign was the information stealing Kelihos bot which has extremely low AV detection.

ThreatLabZ is actively monitoring new Nuclear EK infections in the wild and ensuring that Zscaler customers are protected.

Research by Dhanalakshmi PK and Rubin Azad

Chinese Government Website Compromised, Leads to Angler

Introduction

Despite a recent takedown targeting the Angler Exploit Kit (EK), it's back to business as usual for kit operators. On 30-October-2015, ThreatLabZ noticed a compromised Chinese government website that led to the Angler Exploit Kit with an end payload of Cryptowall 3.0. This compromise does not appear targeted and the compromised site was cleaned up within 24 hours. We have noticed some recent changes to Angler, as well as the inclusion of newer Flash exploits. A set of indicators for this compromise is at the end of this post.

Compromised Site

The "Chuxiong Archives" website, www.cxda[.]gov.cn, was compromised with injected code. The site has a similar look and feel to both the Chuxiong Yi Prefecture and Chuxiong City websites and appears somewhat inactive, but surprisingly the site was remediated in less than 24 hours. The full infection cycle from compromised site to encrypted payload is shown in the fiddler session below.

Fig 1. Infection cycle

The injected code was before the opening HTML tag and was heavily obfuscated. The code, shown below, is very similar to other recent compromises we've observed and was present on every page of the site, suggesting a complete site compromise.

Fig 2. Injected script

Consistent with other recent examples, the injected code appears to target Internet Explorer (IE) since Firefox and Chrome consistently throw errors when attempting to execute the code and no redirection occurs. IE has no issues executing the code, however, which unsurprisingly decodes to an iframe leading to an Angler EK landing page:

Fig 3. Decoded injected code

While we did not have access to the server-side code, it likely retrieves landing page URLs from a remote server since we observed iframes leading to multiple different Angler domains within a brief period of time.

Landing Page

The landing page for Angler is immediately recognizable, but with some notable recent changes. For example, instead of using a long block of around seven-character long strings inside divs tag, the newer landing pages use 'li' tags and most of the strings are only about two characters long. Additionally, there's a conspicuous 'triggerApi' function toward the top of the main script block:

Fig 4: Short strings and triggerApi function

Outside of these changes, the functionality of the landing page appears unchanged, and the goal is naturally to serve up a malicious SWF:

Fig 5. Decoded landing page SWF objects

Malicious SWF - CVE-2015-7645

Kafeine already broke the news that Angler is exploiting Flash 19.0.0.207, and we can corroborate that with the samples we've observed.

Fig 6. Flash 19.0.0.207 being exploited

In fact, we compared the sample from his recent post with one obtained from this infection and the structure is identical, with very few changes in the actionscript. The biggest change we saw was in the embedded binary data.

Fig 7. SWF structure, 30-Oct sample on the left, Kafeine's sample on the right

Fig 8. Comparison of binary data, 30-Oct sample on the left, Kafeine's sample on the right

Upon successful exploit cycle, a new CryptoWall 3.0 variant from the crypt13 campaign is downloaded and installed on the target machine. The image below shows a decrypted Command & Control (C&C) communication message from the CryptoWall variant which also contains the total number of files encrypted on the target system:

Fig 9. CryptoWall 3.0 C&C message reporting encrypted file count

Final Thoughts

As stated, this seems to be business as usual for Angler EK operators. While these attacks were not targeted in nature, this is the first instance where we saw EK operators leveraging a government site to target end users. One interesting observation is that we no longer see any Diffie-Helman POST exchange to prevent replaying captured sessions for offline analysis. Additionally, there was a much larger number of C&C servers than we've previously observed, and some of the domain names seem to suggest multi-use hosts (e.g.: spam, bitcoin mining, etc). Note that none of the C&C servers are pseudo-randomly generated domains. ThreatLabZ will continue to track new developments with the Angler Exploit Kit.

Indicators of Compromise

Domain	IP Address	Description
cxda.gov[.]cn	118.123.7.122	Chinese government site
erteilend-taendelt.sewnydine[.]com	104.129.192.32	Angler Domain
repersuasionboldoblique.classactoutlet[.]com	104.129.192.32	Angler Domain
ayh2m57ruxjtwyd5.stopmigrationss[.]com	95.128.181.195	Payment Server
ayh2m57ruxjtwyd5.starswarsspecs[.]com	failed	Payment Server
ayh2m57ruxjtwyd5.malerstoniska[.]com	109.70.26.37,194.85.61.76	Payment Server
ayh2m57ruxjtwyd5.blindpayallfor[.]com	95.128.181.195	Payment Server
flat.splo1t[.]ru	188.127.239.164	C&C connections
sanliurfapastanesi[.]com	95.173.190.210	C&C connections
wesalerx[.]xyz	46.148.18.100	C&C connections
urfakaplanticaret[.]com	95.173.190.210	C&C connections
taigastyle[.]ru	37.140.192.180	C&C connections
flickstudio[.]com	103.21.59.22	C&C connections
mydaycarewebsite[.]com	104.24.102.98,104.24.103.98	C&C connections
sampiyonvitamin[.]com	95.173.190.210	C&C connections
xmest.web-zolotareva[.]ru	82.146.36.185	C&C connections
aandwrentalspm[.]com	142.4.6.13	C&C connections
orucogluelektronik[.]com	95.173.190.210	C&C connections
gaja24[.]pl	91.234.146.241	C&C connections
developmysuccess[.]com	50.30.46.201	C&C connections
20dollarhomebusiness[.]com	50.30.46.201	C&C connections
rizvanogluhafriyat[.]com	95.173.190.210	C&C connections
sanliurfapastanesi[.]com	95.173.190.210	C&C connections
newatena[.]com	95.173.190.210	C&C connections
stalkerbanget[.]com	68.65.120.182	C&C connections
primevisionstudio[.]com	192.185.206.97	C&C connections
i-tem[.]ru	62.173.143.242	C&C connections
localuzzweb[.]com	143.95.32.179	C&C connections
getpostivemind[.]com	158.85.170.253	C&C connections
zemli72.chaukakau[.]ru	62.173.143.242	C&C connections
grandmedianetwork[.]com	111.118.215.77	C&C connections
karakoprudugunsalonu[.]com	95.173.190.210	C&C connections
sanliurfaparke[.]com	95.173.190.210	C&C connections
nsdstudio[.]net	192.185.206.97	C&C connections
meble-simone[.]eu	91.234.146.241	C&C connections
vsedveri33[.]ru	81.177.165.33	C&C connections
osk-wojcikiewicz[.]pl	91.234.146.241	C&C connections
love-deep[.]com	111.118.215.77	C&C connections
turizmkirov[.]ru	82.146.36.185	C&C connections
new.turizmkirov[.]ru	82.146.36.185	C&C connections
avtoreliv[.]com.ua	91.234.34.80	C&C connections
localwebsitepro[.]com	192.185.41.191	C&C connections
makrol[.]net	91.234.146.241	C&C connections
altopics[.]com	111.118.215.77	C&C connections
burnfatquicky[.]com	184.168.221.57	C&C connections
mediaopt33[.]ru	81.177.165.33	C&C connections
otmanad[.]com	91.234.146.241	C&C connections
markossolomon[.]com	104.27.181.171,104.27.180.171	C&C connections
kominki-gorlice[.]pl	91.234.146.241	C&C connections
chaukakau[.]ru	62.173.143.242	C&C connections
crm.ruhtech[.]com	202.160.165.21	C&C connections
takas3aya.xsrv[.]jp	183.90.232.25	C&C connections
famouswhiskybrands[.]com	103.21.59.21	C&C connections
edwardbrownjr[.]com	50.30.46.201	C&C connections
avatar77[.]ru	62.173.143.242	C&C connections
bollywoodupdate[.]net	95.173.190.210	C&C connections
asiaroyaldeveloper[.]com	103.21.59.22	C&C connections
asattyres[.]com	192.185.206.97	C&C connections
records.karika[.]in.ua	91.234.34.80	C&C connections
ppcprofitz[.]com	143.95.32.180	C&C connections
ecodeva[.]ru	62.173.143.242	C&C connections
btcdoubler[.]biz	failed	C&C connections
18dollars1time[.]info	50.30.46.201	C&C connections
urfaeleganceoptik[.]com	95.173.190.210	C&C connections

Infostealer APK Posing as Microsoft Word Document

Recently, we came across a piece of Android malware which was neither a porn app nor a battery status app, but was instead designed to look like a Microsoft Word document. This malicious app portrays itself as a document with an icon resembling Microsoft Word.

Due to the ubiquitous nature of mobile devices, its no wonder that PC based malware techniques are appearing in mobile domains. In early Windows malware attacks, attackers would often name the malicious files with eye-catching titles and use common icons to entice victims to open the file. We're seeing this same practice used for Android based malware.

Overview:
The malware portrays itself as a data file with an icon similar to that used by Microsoft Word documents and is entitled '资料' (Data). It runs with Administrative access and hence cannot be easily uninstalled. Once installed, the malware scans the device for SMS messages and other personally identifiable information such as the IMEI number, SIM card number, Device ID, victim's contact information,  etc. and sends this to the attacker via email.

Malicious APK posing as Microsoft Word File

Technical Details:
Once the malware is installed, it appears on the Android home screen as shown below:

Microsoft Word Icon

Initiation:
As soon as victim tries to start the app, it shows an explicit error stating "Installation errors, this software is not compatible with the phone" and the icon then disappears from the device screen.

Fake Error Message

When this error is being displayed, the app executes a few major functions as noted below:

• Sends SMS messages to a hard-coded number.
• Starts an Android service, named MyService.
• Starts an asynchronous thread (SmsTask) which runs in background.
• Starts another thread named MailTask, which also operates in background.
• Calls phone numbers specified by Attacker.

Sends SMS

Initially malware tries to send the victim's device IMEI code in a message body to a hardcoded number.

Calling SendMsg function

Assets.getInstallFlag gets the IMEI (or ESN number in case of CDMA devices)

IMEI code fetching

And finally sends the message. 

Sending Message

MyService Service:
The main task performed by MyService is to collect all the SMS messages from inbox of the victim's device.  Once that is done, it stores all the messages in its local logs.

Service fetching inbox messages

SmsTask Thread:
Apart from logging SMS messages, MyService was not sending these messages anywhere. This functionality is exhibited in the SmsTask thread.

SmsTask will also read the SMS messages and exfiltrates them.

Fetching inbox messages

Once the messages are collected, the app then sends them to attacker via email.

Calling SendMail method

A username and password for an email id were found hard-coded in the malware.

SendMail functionality

MailTask Thread:
MailTask's main role is to collect contact information from the victim's device and send it to attacker via the same functionality explained in case of SmsTask.

SmsTask Thread

Sending Mail:
The app sets up an SMTP host on port 465 for sending email.

Sending Mail

localMimeMessage contains the necessary data to be sent to attacker via email. In the case of SmsTask as mentioned above, localMimeMessage's body contains an SMS message list and in the MailTask instance, it contains contact numbers from victim's device.

Calling Functionality:
The malware was also designed to call phone numbers provided by an attacker via SMS.
It has a broadcast receiver registered to trigger whenever a new SMS is delivered.
The malware reads the SMS received from the attacker and acts accordingly.

In one instance, malware was trying to fetch phone numbers received in SMS messages and then calling them, as shown in screenshot below:

Broadcast Receiver

We were able to confirm that the campaign was initiated on October 10, 2015 and almost 300+ users had fallen prey to this malware. The attacker was able to successfully retrieve message details and contact lists from the infected users.

The following screenshots shows the list of emails received by the attacker:

Inbox

Further, each email titled "Message list" consists of full SMS conversations from the victims phones and email with subject "Contact list" contains a list of all the phone numbers fetched from victims contact diaries.

Messages from victim's device

Contacts from victim's phone

There were 300+ such emails found in the C&C admin panel. Such malware creates a significant privacy & financial risk as it obtains contact information and private SMS messages.

Prevention:
It is recommended that users download apps only from official Android stores like the Google Play store. If you are infected with malware, you can follow the steps mentioned in our previous blog for removing the malicious app.

Dridex activity continues

Dridex, a banking malware which attempts to steal the victim's banking credentials and system information, continues to remain active in the wild after the recent takedown attempt. Dridex activity went down significantly in September after the takedown operation but we started seeing an uptick in the number of samples in our sandboxes starting early October 2015.

Dridex is distributed via e-mail with a Microsoft Office attachment that leads to the download and installation of the Dridex Trojan executable. The e-mail attachments in these campaigns varied from regular Microsoft Office document files to MHTML files as seen in Figure 1.

Figure 1: Malicious document sent in MHTML format

MHTML, also known as MIME HTML, is a web page archive format used to combine in a single document the HTML code and its companion resources that are otherwise represented by external links (such as images, Flash animations, Java applets, and audio files). The malware authors are known to send the documents containing malicious macro in MHTML format to evade antivirus detection.

The content of the embedded macro was both obfuscated and protected using a basic password that is intended to prevent modification of the macros.  We were able to bypass the password protection and extract the various document components by standard means.

Figure 2 shows an example embedded malicious macro that downloads the Dridex executable from a predetermined server:

Figure 2: Embedded malicious macro to download Dridex

The samples we are seeing in these new campaigns are a mix of unsigned as well as some digitally signed using valid certificates. The format of the URLs hosting the signed Dridex samples changed to 195.37.231[.]2:8080/uniq/load[.]php instead of previously seen URL format 94.250.252[.]13/bt/bt/stata[.]php

The Dridex executable downloaded by above macro (Figure 2) appears to be packaged using a custom packer. This instance of the Dridex Trojan is signed using a certificate with the common name of “Favorite-III” which appears specific to the Dridex malware and which is currently also present in Comodo’s Certificate Revocation List.

Figure 3: Dridex Certificate issued with CN Favorite-III

We also saw following additional certificates used to sign the newer Dridex executables:

• INTEX
• KASHTAN OOO
• Promtorg
• KONSALTING PLUS OOO
• Brand IT 
• AVTOZVIT Scientific Production Private Company
• Afet
• 3 AM CHP
• PJSC "BIZNES AVTOMATYKA"
• Favorite-III
• Private Person Parobii Yuri Romanovich
• SWIFT Weather
• PJSC "BIZNES AVTOMATYKA
• AVTOZVIT Scientific Production Private Company
• Private Person Parobii Yuri Romanovich
• Favorite-III [NEW - seen in October 2015]
• promtorg  [NEW - seen in October 2015]

The following are some recent URLs from which Dridex executables were downloaded:

• 93.170.104.168:443/uniq/load[.]php
• 178.62.7.183:443/uniq/load[.]php
• 195.37.231.2:443/uniq/load[.]php
• 5.2.199.30:8080/uniq/load[.]php
• 113.30.152.165:8080/uniq/load[.]php
• 168.243.33.195:8080/uniq/load[.]php
• 199.175.55.116:8080/uniq/load[.]php

The following are some MD5 sums of signed and unsigned Dridex executables that we have encountered in past month:

Signed

82BB00DCAC6411669CE6AE5A60CBB3B3
9D4225ECDCDA7FE9A5EAE48601919114
2485C741AF50DE986079B6AD9B6C948A
290CD720AECF28773960C8E41172513C
1C21AEB3DC0E30E05630A3F61AAE83F9
0DA24BD7B49A955D8E4624371CCB8E9F
AFADE4E50D147A1FE18ACA8942E3E679

Unsigned

1DE3889FDE95E695ADF6EADCB4829C6D
D7A31449E5F808FDBA0F6D3CF0D6E91C
7519F0D9D5C3B8D072FFCA7DDF213DDA
F2D6DEC39DAEF7ED90AAABB725590B02

Following are the statistics of Dridex executable downloads that we have seen in past six weeks:

Figure 4: Dridex executable downloads in past six weeks

Figure 5: Dridex executable hosting servers

Conclusion

Dridex infections went down considerably after the global takedown operation but we are starting to see a steady increase in the infections this month, which indicates the malware gang's attempt at resurrecting this highly lucrative Botnet. The authors continue to use the tactic of digitally signed malware executable to evade detection with legitimate certificates created specifically for this purpose.

Zscaler ThreatLabZ is actively monitoring this Botnet and ensuring that Zscaler customers are protected.

Research by Tarun Dewan and Nirmal Singh

Chinese Backdoor Zegost delivered via Hacking Team exploit

Introduction

Zscaler ThreatLabZ has been closely monitoring the usage of Hacking Team's leaked exploits in the wild since July, 2015 and recently uncovered the Emissary Panda APT attack leveraging these exploits. In past two months, we've spotted multiple instances of Zegost Backdoor Trojan installation attempts leveraging Hacking Team's Adobe Flash exploit (CVE-2015-5119) payload. These attacks do not appear to be targeted, but the payload involved in the infection cycle has some resemblance to recent APT payloads from HttpBrowser & the PlugX RAT family.

Attack Chain

The infection cycle starts with a legitimate Chinese real estate and shopping site www[.]kongquechang[.]com, which appears to have been compromised by the attackers and contains an injected script. The injected script will cause a series of redirects leading to Hacking Team's exploit payload as seen in Figure 1. The majority of users were led to the original compromised site following a Baidu search.

Figure 1: Compromised Chinese real estate & shopping site

The site www[.]kongquecheng[.]com is still infected but the exploit server appears to be down at the time of writing this blog. Attackers are abusing the Chinese URL shortening service t.cn to redirect victims to the attack server and also Baidu's URL shortening service dwz.cn to deliver the Adobe Flash exploit payload as seen below:

Figure 2: Zegost Backdoor Attack Chain

The Flash exploit payload (CVE-2015-5119) involved here is from the Hacking Team's leaked archive with updated shellcode. Upon successful exploitation, the embedded shellcode will trigger the download and execution of the Zegost executable from a predetermined location.

Figure 3: Hacking Team's Adobe Flash Exploit

Figure 4: Embedded shellcode to download & install Zegost

Zegost Payload Iterations

During the course of our monitoring we observed the attackers switch the malware payload multiple times.

Payload Type #1 - APT RAT like Zegost Installer

Filename:
svhost.exe

MD5:
E04F3C9C2F7BE694628AECCD23E8839D

The Zegost payload was being delivered as part of an installer archive, which is similar in structure to the APT RAT PlugX and HttpBrowser as detailed here. The downloaded installer was svhost.exe, which has following file structure:

Figure 5: APT RAT like Zegost installer archive

The Zegost installer is responsible for dropping the above three files and running the legitimate Ping_Master_Pro utility DATA.exe. The legitimate binary contains the data.dll in the import table, ensuring that the DLL will be loaded before it runs. The data.dll that gets loaded in this case, will be a fake VirtualBox display driver DLL file present in the same directory and it will patch the entry point of the main executable (DATA.exe) file with a jump instruction to run the DLL’s code instead. This technique is also known as DLL Hijacking which ensures that the fake display driver DLL gets loaded by abusing the Windows DLL load order. The DLL’s code is responsible for decrypting and running the Zegost Backdoor payload from the fafentuqiang.png file in the same memory space of the benign executable.

We observed a bug in the persistence module for this payload, which resulted in an incorrect path getting added to the registry entry created by the malware. The result was that upon system reboot the user's machine will no longer be infected with the Backdoor Trojan.

Payload Type #2 - Vanilla Zegost

Filename:
svhost.exe

MD5:
8F3B2C449793BC1538328CCC9BDC9CCD
62C705A0232EA6D4E3E3CE93F7506ACC

A modified Zegost payload was being delivered in decrypted form abandoning the installer archive structure. This payload was recently compiled and purports to be a XLLuaRuntime Dynamic Link Library file as seen below:

Figure 6: Recently compiled Zegost payload

Figure 7: Zegost payload file meta data

During our analysis we noticed that the persistence issue that existed in the previous iteration was resolved in this payload and the malware successfully remained active upon system reboot.

Zegost Infection Cycle

• Zegost Trojan drops a copy of itself in the Windows system directory as %SYSTEMDIR%\Autoexec.exe

• It creates the following registry key to ensure persistence upon system reboot:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Nobug = %SYSTEMDIR%\Autoexec.exe

• We also saw an alternate code for achieving persistence by registering a new Windows Service:

HKLM\SYSTEM\CurrentControlSet\Services\

ServiceName - DirectX dwx

DisplayName - DirectX Remover auy for Windows(R).

ImagePath - %SYSTEMDIR%\Autoexec.exe

• The Trojan reports the infected system information to a predetermined remote server at the following location:

Domain - www[.]svshot[.]com

Server IP - 123.57.54[.]57

Server Port - 8999

• The Command & Control server domain used in this attack was recently registered and points to a dedicated server hosted on the shady Chinese autonomous system - AS37963 (CNNIC-ALIBABA-CN-NET-AP) as seen below:

Figure 8: Command & Control server hosted in China

The same server is also used for the initial Adobe Flash exploitation attempt.

Conclusion

Hacking Team's exploit payloads remain a popular choice among cyber criminals for weaponizing their payloads. This is the first instance of the Zegost Backdoor Trojan being delivered using Hacking Team's exploit. The Zegost Backdoor payload iterations we observed in this attack chain indicates that the author is testing out new payloads.

Zscaler’s ThreatLabZ has confirmed coverage for these exploits and for the Zegost variants, ensuring protection for organizations using Zscaler’s Internet security platform.

Research by: Deepen Desai, Amandeep Kumar