Friday, December 13, 2013

Bitcoin Mining Operation Seen Across Numerous Malware Families

The talent over at Malwarebytes broke a story this week regarding Fake Flash Player phishing attempts dropping malicious content onto victim machines for the purpose of mining Bitcoins.  The threat tricks users into thinking that they are downloading a new version of Flash Player.  In actuality, the threat drops a few malicious executables (stored in "[username]/AppData/Roaming/Data"), called Control.exe and svchost.exe.  Once the threat is up and running, it communicates over a specific port for the purposes of mining Bitcoins. 

I did some digging of my own to see if there are other such instances of phishing attacks made by this threat.  I found a variant as described in MalwareBytes blog based on the dropped files and the string ".pw/blam/flashplayerv".  The end result was an additional 21 files which display similar network traffic patterns as those mentioned in the companion blog.

The network patterns which I'm matching on is any executable which makes a connection to  178[.]33[.]111[.]19 on port 9000.  I gathered packet captures for many of these threats phoning home in this way.  The results were overwhelming identical as seen below:


The conclusion we can reach is that Bitcoin mining is proving to have reached a point where it is profitable enough to be on the radar for scammers.  Administrators should take note of the traffic patterns mentioned here and monitor for similar transactions.  It should also be stated that the above list contains some still active download locations for this threat, and that the VT results can be confusing.  All of the MD5s mentioned above are detected across the board as different threats ranging from InfoStealers to Backdoor trojan droppers.  This shows that regardless of the initial focus of the malicious executable, bitcoin mining is still a profitable enough for scammers to bundle into their ill-gotten gains.
Posted by Chris Mannon at 4:58 PM 0 comments

Thursday, December 5, 2013

Google Docs Scam Stealing Passwords

Scammers are up to mischief again by tricking users into clicking false webmail widgets.  The core goal of any phishing attempt is to compromise the victim's access to a particular service.  Usually this is done by posing as the service the attacker wants to hijack from the victim, and sending the username and password information back to the attacker.  I've seen plenty phishing schemes in the past but what follows is the most blatant attempt at tricking users I've ever seen.  Get ready...


Nothing says legitimacy like what must have been Adobe Reader's Myspace page layout from 2004.  Among the URL mentioned in the pic, other instances were seen as well to be related.

  • hxxp://hasanalkhalaf.com/goglefiles-docs/2013gdocs/index.htm
  • hxxp://bikecenteraracati.com.br/site/images/stories/ngdocs/login.html
  • hxxp://4mtrust.org/2013gdocs/login.htm
  • hxxp://kidneywisestp.org/kas_file/gdocs/
  • hxxp://shareddocumentation.escuelajuanadeasbaje.edu.mx/
  • hxxp://www.regnodellegno.it/tmp/sfile/googledocs/index.html
  • hxxp://www.sgp.geodezja.org.pl/warszawa/images/stories/r/doc/file.index.htm
  • hxxp://maso2.cl/wp-n/index.htm
  • hxxp://www.chuchuguazastyle.com/lord/vhyvyvvyvyvy/
  • hxxp://atcproject.ru/plugins/user/2013/2013googledocs/index.htm
  • hxxp://www.myhawkslanding.com/site/plugins/doc/file.index.htm
  • hxxp://ideid.in/olaat/gdocs/
  • hxxp://casasnogeres.com/googledocs/googledrive/google/index.htm
  • hxxp://cr-magazin.ch/cach/googledocss/googledocss/sss/
  • hxxp://www.studiobanel.com/en/wp-admin/googledocfileap/
  • hxxp://www.colerainezomba.org.uk/phpthumb/gdocs/index.htm
  • hxxp://www.atlasfernsehdienst.de/joomla/delonghi-kundendienst-muenchen.de/components/com_user/ngdocs/login.html
If you happened to click through one of these links to "Log In" with your username and password, this is what you didn't seen in the background.

Whoops
Afterwards, the victim will find that whatever option they chose will land them at Google's HomePage.  In the tested instance seen above, it was observed that the attacking site was hosted in India.

Mind your Clicks.
Posted by Chris Mannon at 11:44 AM 0 comments

Wednesday, November 27, 2013

Sharik Back for More After Php.Net Compromise

Sharik is a Trojan which injects itself into legitimate processes and adds registry entries for an added level of persistence.  The infection also sends information about the victim's PC to a remote server.  The threat can also receive commands from a known CnC server to download further malicious files.  The point of origin in this case is almost always a compromised website as discussed previously in a colleague's blog.  At the time of research, I had not pinpointed the initial infection for this threat.  The end result of the Trojan infection appears to be identical to past iterations of this threat.

The following are known drop points for this threat:
  • hxxp://69.64.70.25/301940a6b4673c67bd421220bb092fdc/justice-corresponding.php?zf=322d305457%26Be=2g55562e312f2j2j3155%26N=2d%26WT=L%26pP=i
  • hxxp://corp-firewall.com/6.exe
  • hxxp://66.11.227.108/0c3dcf60e6a7a6d2821831740af2cd59/optimum-bi.php?Jf=7172407038%26Ve=3b707139413a3e3e4170%26u=38%26sE=R%26q%29=w
  • hxxp://main-firewalls.com/6.exe
  • hxxp://main-firewalls.com/6.exe?
  • hxxp://lessnvanor.info/calculator.exe
  • hxxp://173.201.34.30/fabba93c6d389652ec249d95d79b9a43/connecticut-session.php?m7d%29-7-7g=8ew68aw68d%26-%21009GrVe=w88c8dw6wdw7wbwbwd8c%26h__%28D5V%2A_VI=ww%266U1P%2AJ0C9O%2A_V%21B=aGP%2Al%21FY%2A1_81%21C%26C8%21-N6%2AN=8y%2A%2AJk_%288XR_
  • hxxp://216.224.186.70/setup.exe
  • hxxp://61.152.158.37/da4fc29e32968439fd700e495d4e8903/instructors-spectrum.php?110b00aab11a001bba=-h-z76-b-e%260ba1a111a0b=-b7677-9-g-z-e-e-g76%26a0bab000ab01=-y%260bba0b01b1a00b1a=100a1a0100b110%26ba00aab0101ab1=11aab0b1bb10
  • hxxp://193.106.172.140/index.php
Many of these files have already been talked about in other blogs, especially for the the corp-firewall.com and main-firewalls.com drop sites.  What helped me tie all of these infectious files together was their distinct phone home traffic.  Every instance mentioned above displays the same phone home behavior albeit to different locations.  Below is the phone home activity displayed by all of the above trojans:

  • hxxp://174.70.149.96:35618/5239438/u491236/index.php
  • hxxp://50.88.254.49:35618/ci5Xud?feVStUWVtcBMjoAOg=qLPueIKdPtnm&KNXWYseFaHCidA
  • hxxp://80.15.218.122:35618/8DVQ6mm?xKKolchGvVMvI=SfipwkaWliPWrc
  • hxxp://50.88.254.49:35618/OGbJfx1ro?yXvViVNepTrkRlNJ=AwqRMHHpLqJXAD&qagYnRxnYQYSpIEcB=lFAIbxdmjHO&eFTsEVSmSYpCtMbdm
  • hxxp://68.102.186.119:35618/618342/d4921412/index.php
  • hxxp://50.88.254.49:35618/UkMlaX?FpvxpKdwTaBxKVBD=kkEAvywTFQIBomL&BDKBeMIRwgNa
  • hxxp://50.88.254.49:35618/KrU1qi1nu?SmjxtvpdphspkM=mxBoWXdFowVQLbm&PwkjWlqBMyBEf=qqePnpwIekn&YddGxrkSWPJgfe
  • hxxp://68.102.186.119:35618/618342/d4921412/index.php
  • hxxp://68.102.186.119:35618/jTORvR4mk?UkJmcNFNATO=NNpFbHCwxSRrRAHc&kIhIDgpeUOl=ILTtrQjWgYYOfAgJk
  • hxxp://78.167.119.210:35618/3W7a8ph?AMhxEPvNUERWTHOK=oykAeQgptMTkJ&YxYLAodNKB
  • hxxp://87.160.74.191:35618/suFTmE?FjRJTTyREjklwuELn=fSqlGVwMPjOin&bfGborcmWbla
  • hxxp://96.58.105.16:35618/3Pkppd?osWurwLDMTivWmgac=xvxKVqTCeXfNBDuqe&YVkeMBlqIHTwg=rnTHuVwBKUMfjDVi&KOdCbidxJEVB
  • hxxp://68.102.186.119:35618/cuw8y2?kwLQWFDmiQVKYmo=roVUdIwlxngKeJ&ilPweGjCVPFi
  • hxxp://70.90.19.69:35618/618342/g1048234/index.php
  • hxxp://109.29.222.118:35618/7x9pkn?KOwQrSdXnqXdAgJAA=FnHRwvBPgcIXuDA&rkWmaTRhJcWGAXtF=rnwXgTDkUrVXmfJdi
  • hxxp://107.213.251.143:35618/618342/h491274/index.php
  • hxxp://96.244.246.64:35618/493247/i423479/index.php
  • hxxp://74.71.202.23:35618/493247/i423479/index.php
  • hxxp://67.87.103.199:35618/493247/i423479/index.php
  • hxxp://69.92.46.228:35618/tY0pcd?soRLbxjFdVCeo=YjcGWaFpmwdyG
  • hxxp://68.118.249.206:35618/4Jdbqg5xi?UPrmDhcakwJtH=uHicfgSQWPsLJVa&uqHNsOpuWIEUKSQf=wqQOkoPieCTVsj&EuYAbtgNJHxoj=fYFukcVftXpEWOL
  • hxxp://69.92.46.228:35618/O2Wgky1ex?sKhnFBxHVOsAg=ArsWCCCVkgevlo
  • hxxp://64.251.129.122:35618/IFmZnn?LhnRHjJjcBP=YhfseyodnwkJi&NkAEOSEPXxUvwFan=orpPSnPiuFDuk&NeIxkIOJpWkH
  • hxxp://24.237.39.65:35618/5923/u82364286/index.php
  • hxxp://69.92.46.228:35618/SHPdiz?EApYkqAbAlYxWkG=jvBlaYDMbla
  • hxxp://24.151.47.183:35618/i2dBru5br?WOvpdgXBvbjRAI=lghnceNceN&vIBagHuAExoRd=eCYwmudMPJoyXsaj&RouLOdQJEXYJEJ
  • hxxp://69.92.46.228:35618/OKlHrt?wpOcUyyXtpGXCdFj=RJOWxyDOepMWDG&cDAbmAKpjg
  • hxxp://78.112.119.85:35618/5923/j41824612/index.php
  • hxxp://76.100.9.18:35618/PUU06dl?mUlCxcKquOICm=rMOvgjltEicp
  • hxxp://72.218.201.207:35618/nfCdkN?tOKAOFdkuIre=slKVYfIUkDpnM&OqnMeKxfwdyCQJ=wUGxeQRcvtDMwIoj&NpyeBDYjrurEkfc=sWJWvGdFTOkRAD
  • hxxp://173.30.185.44:35618/s6fjdU?UgFIrOJJWsjmQo=HmgyBypGXbTwHKL&UHqwbRQgtNcnCfsO=amBRUJFjWSdqagRyj
  • hxxp://68.82.210.42:35618/Igchv87fj?uNytyqkbJTVXEaBLH=aGnHwxpDNVcUReQf&uxLwEfRGPLBm=CmNinWfybrpgRj&EoOhaxhdbID=dSdbmpJOAj
  • hxxp://68.82.210.42:35618/FJEE7rn?qiXtdIHxpFmGE=KsmiFMHufteqwVd&dVOoTpCMVBDQm
  • hxxp://72.82.61.239:35618/36414/g977123/index.php
  • hxxp://173.30.185.44:35618/AHA24?VwweLQojXjqRbIi=KQIGDkFqLvGD&MVhIYJPKADM=fCeuCMPJGsmH&KBFYwYDElgmTTtHxe
  • hxxp://81.139.129.74:35618/36414/j481261/index.php
  • hxxp://98.254.127.113:35618/30468/83427g/index.php
  • hxxp://222.254.155.130:35618/30468/83427g/index.php
The transaction I'll be focusing on here is the very last bullet point.  After the infection occurs on the victim's PC, it creates an autostarter that hooks into explorer.exe to add a level of resilience to hinder standard AV removal methods.  At the time of research, the MD5 (fa33c07e27e4a1e9f1ecdf1172f12562) was being detected by 8/46 AV engines on Virustotal.



The main function of Sharik is to leave the victim open to further infection.  To do this, the infection will set up a backdoor and communicate with it's CnC.  The attacker can choose to attack the victim further later on.  The standard communication between the victim and attacker appears to take place on a non-standard port 35618.  Given the high volume of variants of this threat, it is advised to close this port or at least monitor it for suspicious activity.







It should also be noted that many of the above mentioned download locations are involved in other threats.  For example, main-firewalls[.]com is very closely related to Nymaim ransomware.  Another example is the md5, 771cc060cf15fc29290a0109c1cf7669, which is a Fareit variant.  So what is a ransomware application and a FTP stealing trojan doing displaying the same phone home activity as a resilient backdoor Trojan?  This activity hasn't been tied to on specific group at the time of research, but administrators and users should be on notice.  Where there is smoke there will inevitably be fire.  So if you suspect you or the users you are responsible for are seeing HTTP traffic like the above mentioned, then it definitely merits further investigation. Mind your clicks.
Posted by Chris Mannon at 11:54 AM 0 comments

Thursday, November 7, 2013

CVE-2012-1889 is still alive!

In  Zscaler’s daily scanning, we identified an instance where CVE-2012-1889 (MSXML Uninitialized Memory Corruption Vulnerability) is still alive. Lets take a look.

The site hxxp://wm.17wan.info:9999/zx/zip.html?mag.fznews.com.cn is a Chinese site, which targets online gamers by serving malicious code which exploits Microsoft XML Core Services. This attack allows  a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. The site serves highly obfuscated code to evade antivirus solutions. 
VirusTotal lookup
https://www.virustotal.com/en/file/3eaf208c67ec268b969f260f55ef7d70fd06f3b086a6dcc9fdfb57758dd62240/analysis/1380076165/
You can see the highly obfuscated code served by the malicious site in the screen shot below.

The highlighted code shows that the a CLSID object is being used, which is exploited by parsing long strings of the letter “A”. This CLSID object is related to the vulnerability detailed in CVE-2012-1889.
Lets take a look at a beautified version of this code.

This highlighted section shows the suspicious function, which leverages the shell code for exploiting the vulnerability.

Here function heapLib() performs a heap spray. You can see the complete series of functions utilized in the full attack.
Let's decode the script which is shown in first screen shot

The decrypted source code shows that random named parameters are used for obfuscation of the original code. The chunks of code are combined into a final code snippet, which is then decoded again for making the actual shell code. Here you can see that the variable “t” is using the “MYKEY” parameter and “MYKEY” is using the “MY” parameter to construct the final chunk. This final chunk is again decoded by the function utf8to6() and nbcode(), which are defined in the source code for the final payload and that is used by the window object. At the end of the code the “t” variable generates the final javascript snippet which executes the shellcode.

This is the javascript which is generated at variable “t”.  Again, this script is obfuscated. Obfuscation is primarily used by malware authors to avoid antivirus detection. It should be noted that malware authors do not always leverage 0-days, in fact most technical attacks utilize known vulnerabilities as attackers know that a large percentage of PC users have not applied the latest patches.

An interesting observation is that the javascript is written in such a way that it only works on IE. It avoids delivering an unnecessary heap spray when loaded in another browser. That’s why when you open this site with IE it crashes IE and while opening with any other browser it works fine. It does however attempt to serve alternate malicious files to other browser users such as the samples described below.

Here you can see the sourcode contains a link which drops a malicious Rar file.

VirusTotal lookup

https://www.virustotal.com/en/file/b732b09a6cacd78a8c6a789e8ee17b8c741de2c0234886decf6ce1807808c305/analysis/


HTTP Transactions 

This site makes a connection with following sites
  •   Js.users.51.la 
  •  Web1.51.la:82
Zscaler provides complete protection for these threats.


Posted by viral at 11:02 PM 0 comments

Wednesday, October 30, 2013

NHIC Spam Harvesting Victim's Information

Scammers and spammers are known to capitalize on user's news hungry interests.  In the past year, they've tricked users into clicking on malicious links in e-mails, blog comments and social media posts on anything from the Royal Baby to the U.S Government shutdown.  The end result of these attacks varies from scam to scam, but the tactic remains the same.  Provide just enough intrigue and official looking graphics or text to peak the user's curiosity and take advantage of less savvy users.  This time they seem focused on exploiting victim's interest in health care plans offered by the National health Information Center (NHIC), a US government run health information referral service.


Stock image which leads to a false enrollment form

This e-mail has been through circulation for awhile now and shows no signs of letting up.  This usually marks the success of a spam campaign.  Victims will be disappointed to find that they are not actually signing up for preventive health treatment, but are actually signing themselves up to be victims of Personally Identifiable Information (PII) theft. Clicking through to this link will actually execute an obfuscated JavaScript snippet which will lead the user to a contact information request form.




Less savvy users may think this is part of the process to apply to the NHIC, but this is actually an elaborate fraud to convince users to willingly provide their PII so that it can be sold or used in further attacks later on.



User's should take extra care when it comes to handling their e-mail attachments and links.  No matter how official a site looks, there should always be a degree of caution when handing out your PII over the internet.
Posted by Chris Mannon at 12:48 PM 0 comments

Tuesday, October 29, 2013

Nuclear Exploit Pack Getting More Aggresive

Churning through our logs, we recently observed a significant rise in the number of transactions involving the Nuclear Exploit Pack, which has been in the news for quite some time now. In the past week, we stumbled upon thousands of transactions involving the Nuclear Exploit Pack infestation.

 We could see the whole exploit chain in our logs and the exploit kit was hosted mainly originating from the following IPs:

 198[.]50[.]235[.]204
198[.]50[.]235[.]203
198[.]50[.]235[.]174
198[.]50[.]235[.]152
198[.]50[.]235[.]36

 Whois information on this net block range shows that these IPs are hosted in Russia (no surprises here!).


A few transactions were also found at the IP: 158[.]255[.]6[.]117 (this may be related to a campaign posted by @malwaremustdie).

Some sample referral URLs, which lead to the exploit kit are shown below:
fouce[.]paroyourjob[.]info
bluesevs[.]likedating[.]info
datzone[.]onlinesdating[.]info
www[.]jornaiserevistas[.]com
www[.]noticiasaominuto[.]com
www[.]johnjones1[.]com
goodzdatin[.]work4wheelsa[.]info
www[.]tyleroralsurgery[.]com
kempmeek[.]com

Upon examining one of these infected sites, a typical Nuclear Exploit pack pattern was observed. A series of 304/302 redirects that finally leads to the exploit kit landing page as shown below. 






The landing page contained an obfuscated JavaScript payload that was deobfuscated to get the original JavaScript plugin detection and applet/pdf injection code. It was similar to what we typically see from the. Blackhole Exploit Kit.

The applet is used to make a call to the malicious jar file which uses CVE-2013-2460, as shown here. The following screenshot, shows the JAR file exploiting the vulnerability. The JAR file then downloads and invokes the malicious executable. a recent VT report shows a poor detection ratio for the JAR file. 


We managed to collect 19 malware samples that were dropped by this exploit kit. Most of them were Spyeye/Zbot drops, Ransomware, W32.Caphaw, Injection Trojan, Proxy Trojan, Keylogger, Spam Bot etc. The following reports detail the malware found:

 https://www.virustotal.com/en/file/36eec2b80586211f14bd7f9af3dc68afec629fc9f3071933e959570ac58d87be/analysis/1382745996/
https://www.virustotal.com/en/file/beb0f5929f886a505b31a98f6ae9b4b02bb303088f1c8ecd74ef6516189e4248/analysis/1382746009/
https://www.virustotal.com/en/file/45b3e40cb392489251dec6b24f575c4281570f427b83a6d4d983c86ace35fc7e/analysis/1382746036/
https://www.virustotal.com/en/file/4b708d1ee0d0bac61825ed9ede005978a5610d60fce27b69c2b862fd65e2c07e/analysis/1382746051/
https://www.virustotal.com/en/file/f2219983385daa9d1fadb144088f84d154775dca3002f82e855897f7e8b40d04/analysis/1382746068/
https://www.virustotal.com/en/file/2bb3bc2ebf299d853ddff54c142849882dfa6fc9fa32620cf2ddd01507606e8e/analysis/1382746101/
https://www.virustotal.com/en/file/0d7feaa9595c23828b1d1e7ca898da9a694b151b0a8c87350e001e8f8b7e3fb8/analysis/1382746122/
https://www.virustotal.com/en/file/42d8cb1b05b6d9ed5adabfb2f3184738378b4bbf72b39139bab37de764e99b4a/analysis/1382746135/
https://www.virustotal.com/en/file/d671fd25f75323d74621c6c9e520dd84f64b2ed2588a58838e65283e9067b8c9/analysis/1382746303/
https://www.virustotal.com/en/file/fecdc7eb44508a80e548955945737e2739ec2a6f9f8c4c05d35869a73f82ec2c/analysis/1382746155/
https://www.virustotal.com/en/file/288fae8c7a7f34e36e1ace80fd73392cffc83e53dfdb1961252296692499463e/analysis/1382746167/
https://www.virustotal.com/en/file/b94e93b4b25b1ff7d0dbc8aa3f6c5af80ee0afc4005eddb52d364a59ab8e308a/analysis/1382746305/
https://www.virustotal.com/en/file/8b543c1cce54aec0b6c4b85102bb2a5ffa7f10e69dab19a8812d7b069e84ee5d/analysis/1382746188/
https://www.virustotal.com/en/file/5f84ab5ac0548d2257084e6542d7fd5678bf3f8175f0b8c6e9098a3187f7e4bb/analysis/1382746200/
https://www.virustotal.com/en/file/cbb32fba48f0029b1e6191130b0e68fe44c8364303badd8fc485a1c4d7bf4fc7/analysis/1382746211/
https://www.virustotal.com/en/file/233d56bd1d40608c6302760b4920a4b9daf60df7e32f23fd9f5210603dcb313a/analysis/
https://www.virustotal.com/en/file/2d7df365e65a9415611411aa44c8ed6d7439bfa3c2dfbf21afaff3fd520a79e3/analysis/1382746237/
https://www.virustotal.com/en/file/02e440ccb37a82b3fea48c03849af40ed9110069b555b50f3fa79945dd7caa08/analysis/1382746252/
https://www.virustotal.com/en/file/93167da47833a257ac2d231e10d0b8f8d1f33c4727521fb5bcf6a189522f3e0f/analysis/1382746259/

 Java, software that runs on over one billion devices and is even used to authorize/authenticate tokens in banking applications, continues to be exploited. The Nuclear Pack follows this same pattern, as the authors have taken a recent Java CVE and crafted it into the exploit kit. It is always advisable to disable java on your computer to prevent falling victim to an attack that leads to credential leakage, information theft and becoming a bot. Stay safe and happy Browsing!
Posted by Krishnan Subramanian at 8:12 AM 0 comments

Wednesday, September 18, 2013

A New Wave of WIN32/CAPHAW Attacks - A ThreatLabZ Analysis

Introduction and setting the context

Over the last month, the ThreatLabZ researchers have been actively monitoring a recent uptick in the numbers of Win32/Caphaw (henceforward known as Caphaw) infections that have been actively targeting users' bank accounts since 2011.  You may recognize this threat from research done by WeLiveSecurity earlier this year in regards to this threat targeting EU Banking sites.  This time would appear to be no different.  So far, we have tied this threat to monitoring it's victims for login credentials to 24 financial institutions.

About Win32/Caphaw 

The Caphaw trojan is a financial malware attack that functions similarly to the Carberp, Ranbyus, and Tinba threats according to analysis done by WeLiveSecurity Researcher, Alekandr Matrosov. These attacks are carried out utilizing stealth tactics both on and off the wire.  Caphaw avoids local detection by injecting itself into legitimate processes such as explorer.exe or iexplore.exe, while simultaneously obfuscating its phone home traffic through the use of Domain Generated Algorithm created addresses using Self Signed SSL certificates.  This limits the ability of traditional network monitoring solution to dissect the packets on the wire for any malicious transactions.  Caphaw attacks major European banks and previous analysis has shown that the malware is most active in the UK, Italy, Denmark and Turkey. This is especially prevalent considering the mapped known infected nodes seen here. 

The geoip (location) information derived from the infected host is of special significance to this malware. The malware leverages the following legitimate URL: hxxp://j.maxmind.com/app/geoip.js to discover geoip information about its freshly infected victim.  Administrators should view this transaction as a starting point for their investigation into any suspicious activity. It is not a malicious service, but illustrates how malware writers can leverage even legitimate services. The infection uses the output of this script to extract location information about the infected host/victim.

At the time of research, we were unable to identify the initial infection vector.  We can tell that it is more than likely arriving as part of an Exploit Kit honing in on vulnerable versions of Java.  The reason we suspect this is that the User-Agent for every single transaction that has come through our Behavioral Analysis (BA) solution has been: Mozilla/4.0 (Windows XP 5.1) Java/1.6.0_07.

The UserAgent for known drop locations of this are manipulating users with Java version 1.6.07
The variation in the dropped executable is different across every instance, so its no wonder standard AV is having a problem keeping up (1/46 at time of research). This AV performance also indicates that the likelihood of someone proactively catching this infection inside their network is fairly low at the time of this writing.

Use of DGA 

A domain generation algorithm (or DGA) represents an algorithm seen in various families of malware to generate a large number of quasi-random domain names.  These can be used to identify the malware's command and control (CnC) servers so that the infected hosts can "dial home" and receive/send commands/data. The large number of potential rendezvous points with randomized names makes it extremely difficult for investigators and law enforcement agencies to identify and "take down" the CnC infrastructure. Furthermore, by using encryption, it adds another layer of difficulty to the process of identifying and targeting the command and control assets. 
What initially drew us to this threat was the use of DGA following the execution of the dropped malicious package. We ran three test instances of the attack sequence in our Behavior Analysis (BA) lab to illustrate the use of DGA in the malware's attack sequence:

Instance 1
cso0vm2q6g86owao.thepohzi.su
5qloxxe.tohk5ja.cc
k2s0euuz.oogagh.su

Instance 2
v8ylm8e.thepohzi.su
2g24ar4vu8ay6.tohk5ja.cc
d6vh5x1cic1yyz1i.oogagh.su

Instance 3
t2250p29079m6oq8.thepohzi.su
 ngb0ef99.tohk5ja.cc
nxdhetohak91794.oogagh.su

The pattern ("ping.html?r=") is commonly known to be used by past versions of Caphaw.  Don't panic straight away if you see this string in your user logs however as it is also commonplace among sites that use "outbrain.com" services.  You'll want to look for any URI path that uses /ping.html?r= that does not contain "/utils/".  Hopefully that helps narrow the search to see if you've encountered transactions similar to the following screenshot.
DGA is used to hide the phone home activity of the initial detection
Across all 64 distinct samples we've collected of this threat thus far, there have been 469 distinct IPs where there has been a call to a DGA location.  A small sample of those illustrate the connection between the phone home data collected via network logs and the BA of the Caphaw samples.

The DGA used here shows a connection between Caphaw phone home activity and Sandboxed samples of the threat in question

Use of SSL encrypted communications

The initial indicators were in the form of mysterious self-signed SSL traffic between end user hosts and various points of presence on the Internet, potentially components of the malware’s CnC infrastructure.  See the screenshot below showing the self signed SSL cert. used in the malware communication:
Packet capture indicating a localhost self-signed SSL certificate used in communication
Other screenshots below show the SSL handshake between the infected hosts and the remote CnC servers:
SSL communication between infected host(s) and the remote CnC servers

Following the SSL handshake 


Another SSL handshake prefacing the communication with the remote CnC server

Malware file analysis

A binary executable (.exe) file is created in the attack sequence and masquerades as a .php file. This executable is created using Microsoft Visual C++ and the creator has not removed the debugging information from the final executable.
Both the location of where this file is dropped and the name of the file itself is selected quasi-randomly. For example, in one of the test instances we found this to be: 

 C: Documents and Settings\user\ApplicationData\Sun\Java\Deployment\SystemCache\6.0\9\typeperf.exe

During the three instances of malware execution we ran in our BA lab, we observed the following executables and their drop locations:

\Documents  and  Settings\%USER%\ApplicationData\Sun\Java\utilman.exe
\Documents  and  Settings\%USER%\ApplicationData\Microsoft\Proof\eventtriggers.exe
\Documents  and  Settings\%USER%\ApplicationData\Microsoft\Office\cliconfg.exe

The malware makes the following significant API calls: 
  • LoadLibrary
  • GetProcAddress
  • Virtualalloc

Malware API calls 
The  malware executable checks to see if it is running in a VM environment and also ensures that the host on which it is installed is connected to the Internet (failing which it will not run).

The malware also exhibits persistence by creating the following autorun entry in the registry:

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run    dfrgntfs.exe      Unicode     C:\Documents and Settings\user\Application Data\Sun\Java\Deployment\SystemCache\6.0\9\typeperf.exe*  success or wait   1     B8EF5F      RegSetValueExA

Further, the executable when run, modifies the explorer.exe process to ensure that it's self-signed certificates are not cached and it also hides inside the explorer.exe process to ensure that the protection banner is hidden for a stealthier execution: 

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3      2500  dword 3     success or wait   1      DAEF5F      RegSetValueExA

HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings  DisableCachingOfSSLPages      dword 1     success or wait  1     DAEF5F      RegSetValueExA

HKEY_USERS\Software\Microsoft\Internet Explorer\Main  NoProtectedModeBanner   dword 1     success or wait   1     DAEF5F      RegSetValueExA

The malware then augments system processes to hinder its removal, once again for persistence: 

328   C:\WINDOWS\system32\wscntfy.exe     B30000      344064      D4 1E 5E EA 74 1E 9F 25 F9 CC 18 A3 28 FD 93 C3 1E 78 1D 8C AC 81 22 5F D3 DF AB 7E 34 3E 49 B5 D4 7A 45 F5 5D 15 72 6E 0F 93 F6 4C 2F E6 6D 31 16 6C E1 DD BB 23 F7 71 6D 06 A7 40 D7 A7 EB FE 12 70 30 28 92 BD 7F 1D 41 BE 44 5F 38 97 F5 27 E9 14 29 96 D1 28 05 C5 E5 D4 C8 72 94 D8 6A 11 EF 63 1D B4 89 A5 B8 FE 23 F2 1E C0 71 0E 18 7D 5B 74 B7 20 A1 5A 5F CE 27 FC 53 7E E7 D7 55 72 31 BA 28 54 33 25 22 88 A2 15 45 59 CE A5 CF 64 23 A7 AB E3 A4 4C C4 08 79 FC 5C BE 9C D1 FE 87 58 22 A4 B5 7D 64 29 E4 30 EC 87 D3 5D 1F F5 2B 4F A9 56 42 B9 6C B2 77 BD 90 C5 42 39 03 9E FD 93 E1 91 42 AF F8 1B 69 FD 2A 5E 5B 02 0A B4 6D FE FE 73 0C AE 6C AD D6 36 C3 6D EA 48 B5 85 58 E3 94 81 07 09 18 66 9F 63 79 8F C4 3D B1 CB D3 72 6C 45 4B 9B A3 3C 44 0B 61 57 98 7D 98 83    success or wait   1      DA8FB2      WriteProcessMemory
   1612     164   7C8106E9    DC5A7B      C:\WINDOWS\explorer.exe success or wait   1     CC004D      CreateThread

Scope of the threat and impact

Further evidence of this being Caphaw exists in the banking information that it is listening for once it is injected into key Windows Processes.  Amongst all samples analyzed, we found the following 24 major banks' sites were actively being monitored by the infection primarily to seek out the victim's online banking credentials. This is based on data pulled from an added thread to explorer.exe process.
  • Bank of Scotland
  • Barclays Bank
  • First Direct
  • Santander Direkt Bank AG
  • First Citizens Bank
  • Bank of America
  • Bank of the West
  • Sovereign Bank
  • Co-operative Bank
  • Capital One Financial Corporation
  • Chase Manhattan Corporation
  • Citi Private Bank
  • Comerica Bank
  • E*Trade Financial
  • Harris Bank
  • Intesa Sanpaolo
  • Regions Bank
  • SunTrust
  • Bank of Ireland Group Treasury
  • U.S. Bancorp
  • Banco Mercantil, S.A.
  • Varazdinska Banka
  • Wintrust Financial Corporation
  • Wells Fargo Bank
Strings found in explorer thread added by Capchaw


ThreatLabZ continues to monitor the Internet for this threat and it's propagation. The lab is also engaged currently in dissecting this threat further in order to obtain more information about its attack methodology, scope and impact. 

 Written by Sachin Deodhar & Chris Mannon (ThreatLabZ)






Posted by Chris Mannon at 12:35 PM 3 comments
Subscribe to: Posts (Atom)