Upatre: Old Dog, New [Anti-Analysis] Tricks

Posted on by Brandon Levene

Malware authors must constantly iterate on their techniques in order to stay relevant in today’s fast moving Information Security environment. The Upatre downloader has been around for nearly three years and has consistently evolved its anti-analysis capabilities to better ensure payload delivery. Using Palo Alto Networks AutoFocus, we identified several thousand functionally identical Upatre binaries with unique hashes that exhibited unusual anti-analysis behaviors. We dove into the most recent phishing campaign to identify the new anti-analysis routines designed to maneuver around behavioral analysis systems.

Diving In

Upatre’s new technique takes advantage of undocumented NtQuerySystemInformation structures. It attempts to call the ZwQuerySystemInformation API a few times to determine the idle time of the system. The ZwQuerySystemInformation API takes a SYSTEM_INFORMATION_CLASS as an argument for what to query. There are several options to query for, all with respective structures. Continue reading "Upatre: Old Dog, New [Anti-Analysis] Tricks"

TDrop2 Attacks Suggest Dark Seoul Attackers Return

Posted on by Bryan Lee

While researching new, unknown threats collected by WildFire, we discovered the apparent re-emergence of a cyber espionage campaign thought to be dormant after its public disclosure in June 2013. The tools and tactics discovered, while not identical to the previous Dark Seoul campaign, showed extreme similarities in their functions, structure, and tools. In this post, we will provide an overview of the original Dark Seoul campaign in 2013, the similarities and differences in tactics, the malware used, as well as attempt to answer the question of ‘why now’? Continue reading "TDrop2 Attacks Suggest Dark Seoul Attackers Return"

Dormant Malicious Code Discovered on Thousands of Websites

Posted on by Yuchen Zhou

Note: This post was updated on November 18, 2015 to reflect new information about the initial discovery of the injected code.

On November 3, 2015, ZScaler reported that a Chinese government website hosting the Chuxiong Archives, www.cxda[.]gov.cn, had been compromised and contained injected code leading to the Angler Exploit Kit. The compromise was apparently remediated within 24 hours of discovery, but is once again exhibiting signs of infection. Continue reading "Dormant Malicious Code Discovered on Thousands of Websites"

Adversaries and Their Motivations (Part 2)

Posted on by Rob Downs

motivations

This post is the second in a blog series describing adversaries and their motivations. In part two of the series, we’ll explore the following top-level actor motivations: Cyber Espionage, Cyber Crime, and Cyber Hacktivism.

Adversary Operational Maturity, Targeting, and Key Roles

Before we start, there are some additional concepts that add context to exploring malicious actor motivations: Continue reading "Adversaries and Their Motivations (Part 2)"

Palo Alto Networks Researcher Discovers Critical Vulnerabilities in Internet Explorer and Microsoft Edge

Posted on by Ryan Olson

Palo Alto Networks researcher Bo Qu was credited with discovery of six new critical Microsoft vulnerabilities affecting Internet Explorer (IE) versions 7, 8, 9, 10 and 11 and Microsoft Edge. These vulnerabilities are covered in Microsoft’s November 2015 Security Bulletin and documented in Microsoft Security Bulletins MS15-112 and MS15-113.

In our continuing commitment to the security research community, these vulnerabilities were disclosed to Microsoft through our participation in the Microsoft Active Protections Program (MAPP) program, which ensures the timely, responsible disclosure of new vulnerabilities and creation of protections from security vendors.

Palo Alto Networks is a regular contributor to vulnerability research. Previous critical Microsoft vulnerability discoveries from the past 18 months included:  Continue reading "Palo Alto Networks Researcher Discovers Critical Vulnerabilities in Internet Explorer and Microsoft Edge"

Bookworm Trojan: A Model of Modular Architecture

Posted on by Robert Falcone

Recently, while researching attacks on targets in Thailand, Unit 42 discovered a tool that initially appeared to be a variant of the well-known PlugX RAT based on similar observed behavior such as the usage of DLL side-loading and a shellcode file. After closer inspection, it appears to be a completely distinct Trojan, which we have dubbed Bookworm and track in Autofocus using the tag Bookworm.

Bookworm’s functional code is radically different from PlugX and has a rather unique modular architecture that warranted additional analysis by Unit 42. Bookworm has little malicious functionality built-in, with its only core ability involving stealing keystrokes and clipboard contents. However, Bookworm expands on its capabilities through its ability to load additional modules directly from its command and control (C2) server. This blog will provide an analysis of the Bookworm Trojan and known indicators of compromise. A later blog will explore the associated attack campaigns and attributions surrounding Bookworm. Continue reading "Bookworm Trojan: A Model of Modular Architecture"

CryptoWall v4 Emerges Days After Cyber Threat Alliance Report

Posted on by Josh Grunzweig

Less than a week after the publication of a thorough report by the Cyber Threat Alliance on the CryptoWall version 3 malware family, it appears that the actors behind the malware have updated the underlying code.

Beginning on October 30, 2015, Palo Alto Networks began seeing instances of this new version of CryptoWall, which some researchers have begun calling version 4. This new version of CryptoWall includes multiple updates, such as a more streamlined network communication channel, modified ransom message, and the encryption of filenames. These changes not only make it more difficult for the victim to identify what files have been encrypted, but also may thwart security protections currently in place for the CryptoWall threat. Continue reading "CryptoWall v4 Emerges Days After Cyber Threat Alliance Report"

Connecting the Dots in Cyber Threat Campaigns, Part 2: Passive DNS

Posted on by Bryan Lee

This is the second part of our series on “connecting the dots,” where we investigate ways to link attacks together to gain a better understanding of how they are related. In Part 1, we looked at how domain WHOIS information can be used to identify connections between malicious domains and potentially the actors who own them. In Part 2 we dive into Passive DNS (PDNS), which allows analysts to look back in time and discover how a domain has been used in the past.

Why Passive DNS?

Before we jump into PDNS, we need to understand DNS, or the Domain Name System.  DNS is often described as the phonebook of the Internet (For our younger readers who may be wondering what a phonebook is, Wikipedia can explain.) Rather than ask users to remember individual IP addresses, DNS instead maps numerical addresses to easy-to-remember domain names, much like a person’s name might be associated with a specific phone number. So instead of memorizing that Google hosts their search engine on 65.199.32.22, you simply need to remember www.google.com. The system solved an enormous usability issue at the onset of the Internet, but unfortunately left room for abuse as well. Continue reading "Connecting the Dots in Cyber Threat Campaigns, Part 2: Passive DNS"

CryptoWall 3, the Cyber Threat Alliance and the Future of Information Sharing

Posted on by Rick Howard

Executive Summary

The Palo Alto Networks vision for threat information sharing is that cybersecurity vendors should share the intelligence that they all individually collect with each other and with whomever else has the capacity to consume it. In that way, each vendor can build more innovative products with that superset of intelligence and better protect their combined customer bases because of it.

Project Redstone, the results of which we announced today, was a 90-day proof-of-concept designed to test the value and practicality of security vendors collaborating against one cyber adversary campaign in the summer of 2015: the campaign associated with CryptoWall version 3.  The project showed immediate tactical success and demonstrated the value of such a collaborative information sharing arrangement. That said, the project also identified four capability gaps that Palo Alto Networks must solve in order to share intelligence on 5,000 adversary campaigns, every day in real time: Continue reading "CryptoWall 3, the Cyber Threat Alliance and the Future of Information Sharing"

Understanding and Preventing Point of Sale Attacks

Posted on by Josh Grunzweig

In recent years, there have been a number of high-profile stories involving the compromise of point of sale (PoS) devices. My research often involves deep reverse engineering and analysis of various malware families targeting PoS devices. As such, I’m often asked about the overall threats that these machines face. In this article I hope to provide a high-level view of the threat landscape currently affecting PoS devices.

Background

The term PoS refers to a machine used by businesses to conduct a retail transaction. If you have ever used a debit or credit card to make a purchase, you’ve likely seen these machines. They often run customized hardware and software, however, the underlying operating system (OS) is more commonly some version of Microsoft Windows, often Windows XP or Windows 7. This trend has shifted slightly in recent years with the popularity of mobile PoS devices, most of which run either Android or iOS. While these are becoming more common in smaller businesses, Windows-based PoS machines still make up the majority, and by association are the devices most heavily targeted by attackers. Continue reading "Understanding and Preventing Point of Sale Attacks"

Palo Alto Networks Researcher Discovers Critical IE Vulnerability

Posted on by Ryan Olson

Palo Alto Networks researcher Hui Gao was credited with discovery of a new critical Internet Explorer (IE) vulnerability affecting IE versions 6, 7, 8, 9, 10 and 11. CVE-2015-2548 is included in Microsoft's October 2015 Security Bulletin and documented in Microsoft Security Bulletin MS15-109. Continue reading "Palo Alto Networks Researcher Discovers Critical IE Vulnerability"

Adversaries and Their Motivations (Part 1)

Posted on by Rob Downs

adversaries1

This blog is the first in a series describing adversaries and their motivations. This part in the series presents underlying concepts and the value proposition for exploring who is attacking a network and why. Continue reading "Adversaries and Their Motivations (Part 1)"

Chinese Taomike Monetization Library Steals SMS Messages

Posted on by zhixu

Mobile app creators are often looking for ways to monetize their software. One of the most common ways to do this is by displaying advertisements to users or by offering in-app purchases (IAPs). Mobile monetization platforms create software libraries that authors can embed into their apps to start earning money quickly. We previously highlighted the dangers of installing apps that enable IAPs using SMS messages, as these apps typically have access to all SMS messages sent to the phone.

Continue reading "Chinese Taomike Monetization Library Steals SMS Messages"

Surveillance Malware Trends: Tracking Predator Pain and HawkEye

Posted on by Rob Downs

Malicious actors employ a range of tools to achieve their objectives. One of the most damaging activities an actor pursues is the theft of authentication information, whether it applies to business or personal accounts. Unless specifically mitigated, this theft often allows an unauthorized actor to masquerade as the victim, either achieving immediate gains or creating a platform from which progressive attack campaigns may launch.

There are a number of threats that endanger the critical secrecy of credentials, including poor operational security practices, social engineering, man-in-the-middle attacks, password hash dumping and cracking, and surveillance malware. In this post, Unit 42 examines various trends in a malware threat set within the surveillance malware category: Predator Pain and its latest derivative, HawkEye. Continue reading "Surveillance Malware Trends: Tracking Predator Pain and HawkEye"

Connecting the Dots in Cyber Threat Campaigns, Part 1: Domain Name WHOIS Information

Posted on by Jen Miller-Osborn

There tends to be some mystery around how to properly analyze infrastructure used in cyber attacks. It is a bit of an art, often involving educated guesses to tie components together. However it is important to note the use of the term “educated guesses," as they’re bound by solid data. An educated guess is defined as “a guess based on knowledge and experience and therefore likely to be correct.” Intelligence analysis is akin to taking a bunch of puzzle pieces and figuring out where each belongs. The pieces of different puzzles are often jumbled together, so part of the analysis is determining which piece belongs to which puzzle and then where in that puzzle. From there an analyst has to establish what the whole puzzle most likely looks like, as analysts never have all of the pieces for any given puzzle.

If it sounds difficult, it often is. These missing pieces are often the most challenging part for threat analysts, but thorough research, analysis, and experience can often fill in the gaps. This series of blogs is intended to explain how analysts tie together attacker infrastructure. We’ll start with what is often the first step – domain name WHOIS information. Continue reading "Connecting the Dots in Cyber Threat Campaigns, Part 1: Domain Name WHOIS Information"

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow