KeyBase Keylogger Malware Family Exposed

Posted on by Unit 42

In recent months, our team has been tracking a keylogger malware family named KeyBase that has been in the wild since February 2015. The malware comes equipped with a variety of features and can be purchased for $50 directly from the author. It has been deployed in attacks against organizations across many industries and is predominantly delivered via phishing emails.

In total, Palo Alto Networks AutoFocus threat intelligence service identified 295 unique samples over roughly 1,500 unique sessions in the past four months. Attacks have primarily targeted the high tech, higher education, and retail industries.

Malware Distribution and Targets

KeyBase was first observed in mid-February of 2015. Shortly before then, the domain ‘keybase[.]in’,  was registered as a homepage and online store for the KeyBase keylogger. Continue reading "KeyBase Keylogger Malware Family Exposed"

Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit

Posted on by Palo Alto Networks

What follows is a detailed analysis of the root cause of a vulnerability we call CVE-2015-X, as well as a step-by-step explanation of how to trigger it. For more on Flash vulnerabilities, we also invite you to read "The Latest UAF Vulnerabilities in Exploit Kits," published May 28 by Tao Yan. 

Not too long ago we came across a sample from the Angler Exploit kit (MD5: 049ff69bc23f36a78d86bbf1356c2f63c), which allegedly exploits CVE-2015-0359. The obfuscated SWF contains an encoded SWF (MD5: d45808cfa6f3cbfb343fdea269fdc375), which is later decoded and loaded into Flash, without getting saved on disk. Here’s a somewhat beautified example of this process:

gal_1

The embedded SWF is heavily obfuscated, but the code has much in common with the source code for Angler EK’s CVE-2015-0313 exploit.

The first thing to do is determine whether the exploit is indeed for CVE-2015-0359. Some researchers think that it’s not. The embedded SWF contains a function we named CheckEnvironment, which eventually does this: Continue reading "Understanding Flash Exploitation and the Alleged CVE-2015-0359 Exploit"

The Latest Flash UAF Vulnerabilities in Exploit Kits

Posted on by Tao Yan

Introduction

Recently, several popular exploit kits, including Angler, Flash EK, SweetOrange, Fiesta andNeutrino[1], have included several use-after-free (UAF) vulnerabilities in Adobe Flash to exploit victims’ browsers. Previously, these exploit kits typically used out-of-bounds access (OBA) vulnerabilities in Adobe Flash, as these types of vulnerabilities can be exploited universally and stably [2], and require less effort to exploit compared to UAF vulnerabilities. In order to detect these newly added UAF vulnerabilities, we analyzed the code found in the exploit kits to determine which vulnerabilities are present and how they are exploited.

Obfuscation in exploit kits

Continue reading "The Latest Flash UAF Vulnerabilities in Exploit Kits"

Cmstar Downloader: Lurid and Enfal's New Cousin

Posted on by Robert Falcone

In recent weeks, Unit 42 has been analyzing delivery documents used in spear-phishing attacks that drop a custom downloader used in cyber espionage attacks. This specific downloader, Cmstar, is associated with the Lurid downloader also known as ‘Enfal’. Cmstar was named for the log message ‘CM**’ used by the downloader.

Unit 42 is aware of threat actors using two toolkits - MNKit and the Tran Duy Linh toolkit - to produce malicious documents that exploit CVE-2012-0158 in order to implant Cmstar. The Cmstar downloader itself has several unique and interesting features, as well as substantial infrastructure overlap with other tools worth discussing. Continue reading "Cmstar Downloader: Lurid and Enfal's New Cousin"

Palo Alto Networks Researcher Discovers 3 Critical Internet Explorer Vulnerabilities

Posted on by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered three new critical Internet Explorer (IE) vulnerabilities affecting IE versions 8, 9, 10 and 11. All three are included in Microsoft’s May 2015 Security Bulletin, and documented in Microsoft Security Bulletin MS15-043. Continue reading "Palo Alto Networks Researcher Discovers 3 Critical Internet Explorer Vulnerabilities"

Trapwot Scareware Activity Spikes in April

Posted on by Josh Grunzweig

In recent weeks, Unit 42 has been monitoring a new e-mail campaign distributing the Trapwot malware family. The Trapwot malware family is considered “scareware” or “rogue antivirus” because it attempts to mislead victims into believing their machine is infected with malware. It disguises itself as an anti-virus product, and attempts to encourage users into purchasing a non-existent protection.

In total, our AutoFocus threat intelligence service has identified 380,000 emails carrying Trapwot in the past 30 days. These 380,000 e-mails have contained over 5,400 unique malware samples. These attacks have primarily targeted the insurance, higher education, and healthcare industries.

Trapwot is just one of many variants of Rogue Antivirus programs that currently plague users. Readers should be skeptical of pop-ups that suggest their system is infected with malware and ask them to purchase a new product. As always, users should also avoid opening attachments delivered over e-mail that they are not expecting, no matter how enticing the content may be. Continue reading "Trapwot Scareware Activity Spikes in April"

PlugX Uses Legitimate Samsung Application for DLL Side-Loading

Posted on by Robert Falcone

Summary

While threat actors using the PlugX Trojan typically leverage legitimate executables to load their malicious DLLs through a technique called DLL side-loading, Unit 42 has observed a new executable in use for this purpose. Threat actors are now using this previously unseen executable, created by Samsung, to load variants of the PlugX Trojan.

Using our AutoFocus threat intelligence service, we have flagged these variants to help users identify related attacks.

Malware Details

This story starts with the analysis of a malicious Word document named 雨傘達動後教會生 態.doc (which translates to “Church ecology after the Umbrella Movement”) that was created with the infamous “Tran Duy Linh” exploit kit. This malicious document exploits CVE-2012-0158 to open a decoy document and execute a custom dropper Trojan named word.exe. Continue reading "PlugX Uses Legitimate Samsung Application for DLL Side-Loading"

2015 Verizon Data Breach Investigations Report (DBIR): Insights from Unit 42

Posted on by Scott Simkin

The 2015 Verizon Data Breach Investigations Report (DBIR) represents the first time Palo Alto Networks has contributed data to this important publication, and we are proud to be part of an intelligence-sharing ecosystem that, in the end, raises the collective bar for everyone in the industry.

While reviewing the findings, a few key points stood out to the Unit 42 team: Continue reading "2015 Verizon Data Breach Investigations Report (DBIR): Insights from Unit 42"

Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets

Posted on by Jen Miller-Osborn

Summary

Palo Alto Networks Unit 42 used the AutoFocus threat intelligence service to identify a series of phishing attacks against Japanese organizations. Using AutoFocus to quickly search and correlate artifacts across the collective set of WildFire and other Palo Alto Networks threat intelligence, we were able to associate the attacks with the group publicly known as “DragonOK.” [1] These attacks took place between January and March of 2015.

DragonOK has previously targeted Japanese high-tech and manufacturing firms, but we’ve identified a new backdoor malware, named “FormerFirstRAT,” deployed by these attackers. See the “Malware Details” section for analysis of the three RATs and two additional backdoors deployed in this persistent attack campaign. Continue reading "Unit 42 Identifies New DragonOK Backdoor Malware Deployed Against Japanese Targets"

Android Installer Hijacking Vulnerability Could Expose Android Users to Malware

Posted on by Zhi Xu

Executive Summary

We discovered a widespread vulnerability in Google’s Android OS we are calling “Android Installer Hijacking,” estimated to impact 49.5 percent of all current Android users. In detail:

  • Android Installer Hijacking allows an attacker to modify or replace a seemingly benign Android app with malware, without user knowledge. This only affects applications downloaded from third-party app stores.
  • The malicious application can gain full access to a compromised device, including usernames, passwords, and sensitive data.
  • Palo Alto Networks worked with Google and major manufacturers such as Samsung and Amazon to inform them of the vulnerability and issue patches for their devices.

Introduction

Continue reading "Android Installer Hijacking Vulnerability Could Expose Android Users to Malware"

FindPOS: New POS Malware Family Discovered

Posted on by Josh Grunzweig

Unit 42 has discovered a new Point of Sale (POS) malware family, which includes multiple variants created as early as November 2014. Over the past few weeks we have been analyzing this malware family, which we have dubbed ‘FindPOS’ due to strings consistently found in each variant.

While this malware doesn’t show strong sophistication, the large number of variants shows prevalence similar to families such as Alina and Backoff. It is clear that FindPOS should be considered a strong threat to Microsoft Windows POS vendors, and measures should be taken to ensure protection.

Workflow

Continue reading "FindPOS: New POS Malware Family Discovered"

Palo Alto Networks Researcher Identifies Critical Internet Explorer Vulnerability

Posted on by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered a new critical Internet Explorer (IE) vulnerability affecting IE versions 8, 9, 10 and 11. This is included in Microsoft’s March 2015 Security Bulletin MS15-018 and MS15-019, and documented in Microsoft Security Bulletin MS15-MAR. Continue reading "Palo Alto Networks Researcher Identifies Critical Internet Explorer Vulnerability"

Have You Seen the Latest Threat Intelligence Research from Unit 42?

Posted on by Palo Alto Networks

Unit 42, the Palo Alto Networks threat intelligence team, gathers, researches and analyzes up-to-the-minute threat data, sharing insights with Palo Alto Networks customers, partners and and the broader community to better protect enterprises and governments from advanced threats.

blog-title-unit42 Continue reading "Have You Seen the Latest Threat Intelligence Research from Unit 42?"

Examining the Cybercrime Underground, Part 1: Crypters

Posted on by Tomer Bar

This post is the first in a new series titled Examining the Cybercrime Underground. Each post will delve into different aspects of how cybercriminals operate, using current examples of tools and techniques. What are their tools of the trade? How do they get them? How do they overcome challenges posed by security and anti-fraud systems? How do criminals profit from scams and turn stolen data into cash? Answering these questions will help readers better understand one of their primary cyberadversaries and use that knowledge to better protect their networks.

What is a crypter?

Crypters are software tools that use a combination of encryption, obfuscation, and code manipulation of malware to make them FUD (Fully Undetectable) by legacy security products. Continue reading "Examining the Cybercrime Underground, Part 1: Crypters"

Palo Alto Networks Researcher Identifies 3 Critical Internet Explorer Vulnerabilities

Posted on by Ryan Olson

Palo Alto Networks researcher Bo Qu discovered three new critical Internet Explorer (IE) vulnerabilities affecting IE versions 9, 10 and 11. All three are included in Microsoft's February 2015 Security Bulletin MS15-009 and documented in Microsoft Security Bulletin MS15-FEB. Continue reading "Palo Alto Networks Researcher Identifies 3 Critical Internet Explorer Vulnerabilities"

Get the latest news, invites to events, and threat alerts

Default Heading

Read the article Right Arrow