Details of Lokibot - Malspam

#Lokibot #malspam
new stub.exe
https://www.virustotal.com/#/file/c57d35326f21f5e5453cee9075a8923a157c60de2935b28de8765c266289f3f9/community
dumped #lokibot
https://www.virustotal.com/#/file/80945428e65ed1a75597a0855e02d04bf721ec9ee74eeec6ca8908ec00d98995/detection
Dropped
sha256 C:\Users\admin\AppData\Roaming\F63AAA\A71D80.exe 4878c77955611f9641100aae97867c5d3bd4183aa8ddf4b45ca453990f5f51fa 

IOC details:

Connections
Malicious IP address: 91.234.99(.)171
Malicious url hxxp://dealinproces(.)com/doll/Panel/five/fre.php


post by
newWorld

Interesting File in VT:

Today, one of the malware researchers reported a VirusTotal link in the twitter. The interesting part is the file's creation time and mentioning of sample seen in the wild.

The sample in the VT

https://www.virustotal.com/#/file/87d8b704dbdbbb5c4e0a36c1e31af1ea3d1bd3afd06d52450e54366545e45426/detection

First Seen in the wild

ExifTool detail

The above screenshot of the comments from malware researcher on twitter.

Post made by
newWorld

Analysis of Potentially Unwanted Application

During the log analysis, our malware researcher spotted a virus detection where an URL getting blocked as malware. Let us analyse this case:

Blocked URL: 

Malicious URL

We visited the URL in control environment which is dedicated to malware analysis. It downloads a PE file as Update.msi. Meanwhile, we checked in the VirusTotal for the URL scan results and if any downloading of the file gets cross verified by VirusTotal. 

VT result for the malicious URL

We traversed to the detection rate for the downloaded file which is flagged as a potentially unwanted application (PUA). ESET detection as CrossRider which is PUA variant. 

File Hash- VT result

When we checked the relationship tab on the VirusTotal page, it shows another archive file which gets flagged many antimalware engines listed on the VirusTotal page. They all detect the sample as Adware.Googupdate. 

Related File in the VirusTotal

VirusTotal Links for the reader's reference:

URL Detection:

 https://www.virustotal.com/#/url/124a8cc1d8e495d2743f2e1cc133bc94030fe6fa5701e2bc9117af1f9146c250/detection

Downloaded File:

https://www.virustotal.com/#/file/1fcb0b24ccb223ed3e2850c639beed7adb67fc88139b5fa1d4e4624388c04f3e/detection

Related File:

https://www.virustotal.com/#/file/484e15a36175153957f17ddca6d7422b2bb38c2c9c7f0263dd4365e3587b7f42/detection

Analysis of the Malware file:

The file is a potentially unwanted application. It falls under the family of Googupdate variants and crossrider variants.

It will target the web browsers and change the settings so that it can perform start page hijack, search page hijack in that infected systems.

Dissecting of that given binary in controlled environment:

We found following things:

It looks for the browser:

000000004F30   000010006930      0   %ProgramFiles%\Google\Chrome\Application\%BROWSNAMEC%.exe

000000004FA8   0000100069A8      0   %ProgramW6432%\Google\Chrome\Application\%BROWSNAMEC%.exe

000000005020   000010006A20      0   %LOCALAPPDATA%\Google\Chrome\Application\%BROWSNAMEC%.exe

000000005098   000010006A98      0   %LOCALAPPDATA%\Chrome\Application\%BROWSNAMEC%.exe

000000005100   000010006B00      0   Google Chrome

00000000511C   000010006B1C      0   Chrome

00000000512C   000010006B2C      0   %s\chrome.exe

000000005148   000010006B48      0   select * from win32_process where executablepath like "%%BROWSNAMEC%.exe"

0000000051DC   000010006BDC      0   executablepath

0000000051FC   000010006BFC      0   Mozilla Firefox

This file checks for the following information:

000000005240   000010006C40      0   SOFTWARE\Microsoft\Windows NT\CurrentVersion

00000000529C   000010006C9C      0   CurrentMajorVersionNumber

0000000052D0   000010006CD0      0   CurrentMinorVersionNumber

000000005304   000010006D04      0   CurrentVersion

000000005324   000010006D24      0   ProgramW6432

000000005340   000010006D40      0   %d--%d--%d

000000005358   000010006D58      0   username

000000005370   000010006D70      0   select * from win32_computersystem

0000000053BC   000010006DBC      0   serialNumber

0000000053D8   000010006DD8      0   select * from win32_volume

000000005410   000010006E10      0   filesystem

000000005428   000010006E28      0   version

000000005438   000010006E38      0   select * from win32_bios

00000000546C   000010006E6C      0   serialnumber

000000005488   000010006E88      0   select * from win32_physicalmedia

0000000054E8   000010006EE8      0   BINRES

0000000054F8   000010006EF8      0   explorer.exe

000000005518   000010006F18      0   %s %s %s "%s" "%s" "%s" %d "%s" %s

000000005560   000010006F60      0   Software\CLASSES\CLSID\{9563BC59-9556-4805-8CD4-886781779D8D}

These are the sites found in the memory:

000000006800   000010009000      0   http://b.wehelptoyou.com

000000006A58   000010009258      0   v3u5r5i9.ssl.hwcdn.net

000000006BE8   0000100093E8      0   d1mib3adbtgkgp.cloudfront.net

Identification:

-Check whether any weird behaviour in the web browser settings i.e. changes in the web browser settings.

-Any changes in the start page (homepage) instead of your favourite home page or default browser page.

-Check for more kind of popup ads.

Recommended actions: 

-Don't open popup ads, since it may lead to the installation of this sort of PUA files in your system.

-Use recommended adware cleaner. But, most of the AV products will remove these stuff. A proper update is important.

Is it possible for internet service provider to serve popup ads in the user machine?

The answer is yes it is possible. Many shady ISPs are already serving popup ads to their customers. Initially, the user may receive a non-malicious popup ad, and ask the user to submit the email id to receive bills via email. After that, the users will receive more such ads and end up in the suspicious popup ads.

How to find your ISP perform shady popup ads?

Users can find the popup ads in the web browser when they connect their handheld devices, smartphones, and laptops to a particular network but when they connect to other networks they would not observe any popup ads. So we determine that ISP is the culprit.

How to block these ads?

The best option is to install adblocker products at the browser level. Several adblocking plugins available for the popular browsers.
In ISP level, we recommend filtering options in the router's access management which will stop such popup ads by ISP provider.

Post by
newWorld

Analysis of Foreign Ransomware

Analysis

Hash of the File: 232ca9cefd0b1b0d2cc11c11090124720cbf90778210e30c3e9f8841512dfd22

File type: EXE file

Static analysis

This ransomware code starts checking for running OS platform details and the conditions failed then it triggers Dr. Watson error. It then retrieves a handle to the current window station for the calling process using “GetProcessWindowStation”. The code again to query the details of WinMajor details and if the condition fails then it triggers Dr Watson error.

  call    __get_winmajor

.text:3A2F8D8D                 add     esp, 4

.text:3A2F8D90                 push    eax

.text:3A2F8D91                 call    __invoke_watson_if_error

.text:3A2F8D96                 add     esp, 18h

Further it retrieves the GetActiveWindow and uses the “GetLastActivePopup ()” to Determines which pop-up window owned by the specified window was most recently active.

Retrieving volume details:

     call    ds:SetErrorMode

.text:3A2E34FF                 push    0C8h            ; cchBufferLength

.text:3A2E3504                 lea     eax, [ebp+68h+RootPathName]

.text:3A2E3507                 push    eax             ; lpszVolumeName

.text:3A2E3508                 call    ds:FindFirstVolumeW

.text:3A2E350E                 push    offset aVolumes ; "\nVolumes:\n"

.text:3A2E3513                 call    _wprintf

.text:3A2E3518                 lea     eax, [ebp+68h+RootPathName]

.text:3A2E351B                 pop     ecx

.text:3A2E351C                 mov     dword_3A31E898, esi

.text:3A2E3522                 lea     ecx, [eax+2]

Ransomware needs find the volume details and then proceed for encrypting the file. Malware code retrieving FindFirstVolume+FindNextVolume gives all the volumes present including Windows reserved and system recovery partition. The return value is a unique GUID for the volume which can also be found in registry (HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume).

Observed behavior

File created: "%APPDATA%\info.exe

Looking for the following processes to terminate:

"taskkill /f /im oracle.exe"

"taskkill /f /im sqlite.exe"

"taskkill /f /im sql.exe"

Deleting Volume shadow copy to not allowing the backup restoring functionalities in the windows system:

"vssadmin.exe" with commandline "Delete Shadows /All /Quiet"

Auto-start registry entry:

Key: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"

 Value: "ENCRYPTER"

Physical location of the file matches: "%APPDATA%\info.exe"

Key: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"

Value: "USERINFO"

"%APPDATA%\recovery.txt"

  

These registry entries are to maintain the persistence of the malware in the infected system.

Ransom Notes:

"Hello!All your files have been encrypted by usIf you want restore files write on e-mail – fileskey(at)qq(.)com or fileskey(at)cock(.)li"

hxxp://qq(.)com

Analysis of New variant of Ransomware in Development stage

OVERVIEW

This week we spotted a new variant ransomware in the development stage. Currently, it appeared to be testing phase and very less AV vendors flag this sample. We dubbed this ransomware as ‘Target ransomware’. In this post, our team analyzed this ransomware variant.

Sample Details

File Hash (SHA-256):

5aac7c3cbfdef10e36e779a3b331fee0666898587c6a82ed7b0804c6d9fb16cd

File Size: 181248 bytes

PE type: EXE

Packer: UPX packer

Sample

We searched this sample in VirusTotal and it found to be first uploaded from Japan. And no major AV flagged this sample at the time of writing.

Figure 1 Detection rate in VT

Figure 2 First Submission of this sample - from Japan

First Submission detail says that sample was uploaded from Japan it is not sure that whether the sample developed in Japan or targeted in testing phase against Japan. We checked the strings and most of them are junk and not readable. So we need to unpack the ransomware sample first.

Current status

Appends ".ransomwared" extension. Encrypts only "Documents/target.txt" for now. So currently it didn't encrypt any other files in the system.

Aadhar malware

Overview

Today we spotted malicious app which appears to be like fake Aadhar mobile app. Aadhar is the identity card provided by Indian Government to the Indian citizen, 12 digit unique-identity number issued to all Indian residents based on their biometric and demographic data. It will be linked to bank accounts, and other basic services like telecom (sim card) services, etc. of the citizen of India. Aadhaar is the world's largest biometric ID system, with over 1.19 billion enrolled members as of 30 Nov 2017.

Data Leak

The recent reports asserted that INR 500 (roughly seven USD) via Paytm and details such as name, address, postal code, photo, phone number, and email were retrieved. But authorities denied that the breach allowed access to millions of Aadhaar cardholders' details, saying the search facility is available for the purpose of grievance redressal to designated personnel. After this news hit in the media, supporters of privacy started questioning the security concerns.

Malicious Aadhar Application

Hash (SHA-256): d1170fa637def71e9fd50fbaf1a6c180edaa07859c09d67654302587ab1e9689

File type: Android apps

File Size: 11931 KB

We started analysis of this sample in our controlled environment. After extracting the ‘classes.dex’ file from the original application, we converted the dex file to the jar file format for understanding the code.

Figure 1 Dex to jar file

When we decompiled the code we got the interesting code to view.

Figure 2 Aadhar class

This application has the code for most of the Aadhar functionalities such as Biometric related items, barcode reader (it’s part of Aadhar card), notification response, OTP response, and resident profile.

Figure 3 Aadhar functionality

Conclusion

Many people in India do not opt anti-malware solutions for their smartphones. More importantly, the user's awareness can combat these kinds of mobile malware. 

Locky ransomware comes with outstanding statement

OVERVIEW

A recent variant of Locky ransomware comes with an outstanding statement as the point of entry. Spam message comes with the subject as the outstanding statement which contains JavaScript file as customer statement.

File Hash (SHA-256): 381272f158b754bf189dce4f7376fa8573583afa1e6659d0e85934080824f4cd

File Size: 13 KB

We observed the malicious domains contacted by this JavaScript file.

                                  DELIVERY

This malware got distributed via spam mail which contains malicious Javascript file as email statement. Once the victim executed the JavaScript (email statement) file, they will end up in infection. Let us see the malicious domain contacted by the JavaScript file:

Malicious Domain

hxxp://www.vayvonvietcombank24h(.)net/wp-content/plugins/duplicator/installer/77805e1530d.html

hxxp://www.tinhnghenanovienhanlam(.)com/bkw.php?pdah

hxxp://www.tinhnghenanovienhanlam(.)com/bfw.php?xmk

hxxp://www.tindungvietcombank24h(.)com/zg.php?voa

hxxp://www.tinchapvpbank-hn(.)com/zc.php?gtdc

This malicious domain becomes the point of serving Locky ransomware files to the victim machines. Specifically the malicious domain ‘vayvonvietcombank24h(.)net’ downloads the Locky ransomware sample and get executed.

The full malicious url is hxxp://vayvonvietcombank24h(.)net /tOldHSYW?

                                        INFECTION

Figure 1 Downloaded Locky sample

We also observed the variants in the domain extension:

Figure 2 Observed pattern in the malicious domain

Analysis of Locky sample

File Hash (SHA-256): da3ab88c61deabf4cb4d296cc0b4a586eeedc89e87adc4ea648ab8fe6a41346c

File Size: 151 KB

We executed the Locky sample in the controlled environment and observed the behavior. It creates runonce entry as follows. 

Figure 3 Registry entry

                                                 ENCRYPTION

Figure 4 Files added after execution (..doc extension added)

A large number of files created and it is the behavior of ransomware file that modifies other files in the system. We found ‘..doc’ extension in all the encrypted files. That read_me.html file is a ransomware note contains details of payment method and tor link. The below snapshot is the details of the readme HTML:

Figure 5 Readme HTML (payment methods)

                                                 Threat Indicator

IOC details:

File Hashes:

SHA 256: da3ab88c61deabf4cb4d296cc0b4a586eeedc89e87adc4ea648ab8fe6a41346c

SHA 256: 381272f158b754bf189dce4f7376fa8573583afa1e6659d0e85934080824f4cd

Malicious domain:

vayvonvietcombank24h(.)net

tinhnghenanovienhanlam(.)com

tindungvietcombank24h(.)com

tinchapvpbank-hn(.)com

TOR Link:

n224ezvhg4sgyamb(.)onion/sup.php

File extension added by this variant of ransomware:

‘..doc’

Registry key:

Key: HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"  

Value: "BROWSERUPDATECHECK"

Physical location: %appdata%/<lockysample>

                                   Conclusion

We recommend the users to apply the IOC details to block the infection. In this case, malicious JavaScript file comes as statement distributed via email campaign. We recommend the users to be more cautious on attachments from unknown users. Updated anti-malware with anti-ransomware modules for combat the ransomware attacks.

Threat Intelligence source:

Executive Summary
This post comprises of important things in TI (Threat Intelligence) sources and it will be helpful for the detection against threats. Even in the cases of incident handling and response purposes, CTI will be a bullet point.

Sources

http://s3.amazonaws.com/alexa-static/top-1m.csv.zip

(This is top one million sites mostly for whitelisting purpose)


https://docs.google.com/spreadsheets/u/1/d/1H9_xaxQHpWaa4O_Son4Gx0YOIzlcBWMsdvePFX68EKU/pubhtml

(APT list in spreadsheet)


https://intel.malwaretech.com/

(Botnet Tracker)



http://osint.bambenekconsulting.com/feeds/c2-ipmasterlist.txt

(C&C Tracker)



http://s3-us-west-1.amazonaws.com/umbrella-static/index.html

(Top one million sites- mostly for whitelisting purpose)


Conclusion
We will add more to this list in upcoming post, please watch this space.

Post by
newWorld

Today in computer virus world:

November 2, one of the important day in the computer virus world. In 1988 November 2nd, the Morris worm was released by its author, Robert Tappan Morris. It was the first worm to get wide media attention.

Source of the image is wikipedia

The wikipedia says "According to its creator, Robert Tappan Morris, the Morris worm was not written to cause damage, but to gauge the size of the Internet. It worked by exploiting known vulnerabilities in Unix sendmail, finger, and rsh/rexec, as well as weak passwords."

Quick Sample Analysis

File detail:

File Name: Micrbarin.exe

MD5: 21AE834BDD5B89BACACCA4D51CF82148

Size: 3.64 MB

NSIS installer file

This file is NSIS installer, we found inside the strings.

Behavioural Analysis

Executed the Micrabarin.exe in the controlled environment to observe the behaviour. We got new processes comes in the memory and windows security alert block the process by stating that the file is adobe flash player. And those new processes are having flash player icon.

Registry traces:

HKEY_CURRENT_USER\Software\TektonIT

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server\Parameters

HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\ShellNoRoam\MUICache "C:\Documents and Settings\All Users\rutserv.exe" Data: Adobe Flash Player 27.0 r0

HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\ShellNoRoam\MUICache "C:\Documents and Settings\All Users\rutserv.exe"   Data: Adobe Flash Player 27.0 r0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "sys"

Data: c:\ProgramData\rutserv.exe

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server\Parameters "CalendarRecordSettings"

Data: (data too large: 1182 bytes)

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server\Parameters "FUSClientPath"

Data: C:\Documents and Settings\All Users\rfusclient.exe

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server\Parameters "InternetId"

Data: (data too large: 352 bytes)

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server\Parameters "notification"

Data: (data too large: 563 bytes)

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server\Parameters "Options"

Data: (data too large: 1391 bytes)

HKEY_CURRENT_USER\Software\TektonIT\Remote Manipulator System\Server\Parameters "Password"

Data: (data too large: 256 bytes)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "C:\Documents and Settings\All Users\rutserv.exe"

Data: C:\Documents and Settings\All Users\rutserv.exe:*:Enabled:Adobe Flash Player 27.0 r0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List "C:\Documents and Settings\All Users\rutserv.exe"

Data: C:\Documents and Settings\All Users\rutserv.exe:*:Enabled:Adobe Flash Player 27.0 r0

File created

c:\Documents and Settings\All Users\rfusclient.exe

c:\Documents and Settings\All Users\rutserv.exe

Post made by

newWorld