Huge Botnet Attacking Italian Companies

On January 18 a colleague of mine (Luca) called me telling a malicious email was targeting Italian companies. This is the beginning of our new analysis adventure that Luca and I run together.

The email pretended to be sent by "Ministero dell' Economia e delle Finanze" the Italian Department of Treasury  and it had a smart subjects such as:

• Codici Tributo Acconti
• F24 Acconti-Codice Tributo 4034

The attacker knows very well the Italian Fiscal Year since those modules are very popular from company administration employees at that time. The attacker would probably exploit this attack path reaching out as many companies as possible. The email address was not coming from the "Ministero dell' economia e delle Finanze" at all, it was coming from the following addresses:

• info@amber-kate.com
• info@fallriverproductions.com

The email looks like :

Malicious eMail

A simple link pointing to a high reputation domain was popping out the default browser and downloading the following Javascript file. The high level of obfuscation and the way the content was provided was so suspicious to be worth to follow the analysis.

Infection: Stage 1 Obfuscated

After a deobfuscation phase the javascript looked much more easy te be read from a human side.

Infection: Stage 1 Clear Text

A romantic "drop and execute" section was happening. A GET connection to 239outdoors.com/themes5.php was dropping a file named 1t.exe and later on the same script was able to execute the dropped file.  The file 1t.exe was running on the victim machine contacting the Command and Control waiting for further commands.

The new sample looks like GootKit, a weaponized version of Banker Malware.  The malware installs itself and contacts Command and Control asking "what to do" and sending the "stolen credentials" directly to the Command and Control server. Details on IPs, Persistencies and so on, is provided in the IoC section, but todays we wont describe GootKit, we got access to the Dropping site !  

We want to figure out if we might help victims to deactivate the malicious botnet by providing as much as possible details without focusing on reverse the Malware per se since appears to be known. 

By getting further analyzing the dropping web site we immediately understood that the same URL was dropping another threat. The parallel threat the dropping website was spreading to the world was called "Nuovo Documento 2008" and it was a .bat file as follows.

New Threat Stage 1

That executable .bat file on a first stage opens up a browser pointing to a legitimate image but later on it uses an notorious technique called "certutil for delivery of file" to drop and execute an another file. This technique is well described here  by carnal0wnage. Basically the attacker uses the certutil.exe program do download a Base64 encoded payload, to decoded it and to run it. This technique is very silent since the User-Agent of certutils.exe is not suspicious because it needs to connect outside the company networks to check certificates, so not much IPS rules on it. The dropped file name unslss.exe appears to be very close to the previous analyzed one (1t.exe) it contacts the same C&C and it behaves in the similar way.   But again we wont focus on reverse such a malware but rather we wont be able to reach the highest number of IoC to protect as much as possible the victims. By analyzing the Dropping website we founded that a significative number of connections had additional referrers, so we decided to focus our attention on how many DNS were pointing to such a domain. We did it and the result was quite impressive (please see the Dropping URLS IoC Section). 

Following the research on the dropping website we found an interesting log within all the connection coming from possible victims. We collected that log, and we built the following possible infection list (possible Victims). We wont publish the Victims IP addresses but if you can prove you are legitimated by your company to ask that logs we can give you (for free, of course)  the IP addresses we've found related to your company. Please contact cert@yoroi.company. A detailed list of possible infected networks follows. 

Possible Victims:

• ACI informatica s.p.a.
• • AGOS-AS
  • AGSM Verona Spa
  • ASGARR Consortium GARR
  • Acantho S.p.a
  • Alfanews S.r.l.
  • Ambrogio s.r.l.
  • Asco TLC S.p.A.
  • Autostrade-as
  • BT Italia
  • BT Italia S.p.A.
  • Banca Monte Dei Paschi Di Siena S.P.A.
  • Brennercom S.p.A.
  • COLT Technology Services Group Limited
  • Camera dei deputati
  • Cesena Net srl
  • Clouditalia Telecomunicazioni S.p.A.
  • Comune Di Brescia
  • Comune di Bologna
  • Consortium GARR
  • Consorzio per il Sistema Informativo
  • Costacrociere-as
  • Duebite-as
  • E4A s.r.l.
  • Energente S.r.l.
  • FASTNET SpA
  • FASTWEB SPA
  • FINECO Banca del Gruppo Unicredit
  • Fastweb
  • Forcepoint Cloud Ltd
  • GenyCommunications
  • Global Com Basilicata s.r.l.
  • H3G Italy
  • Hynet S.R.L.
  • IBSNAZ
  • ICT Valle Umbra s.r.l.
  • InAsset S.r.l.
  • InfoCamere SCpA
  • Infracom Italia S.p.A.
  • Inrete s.r.l
  • Insiel- Informatica per il sistema degli enti loca
  • Integrys.it di Stefania Peragna impresa individual
  • Intred S.p.A.
  • KPNQWest Italia S.p.a.
  • LEPIDA
  • Lepida S.p.A.
  • Liguria Digitale S.C.p.A.
  • Linea Com S R L
  • Linkem spa
  • Lombardia Informatica S.p.A.
  • Mandarin S.p.A.
  • Mc-link SpA
  • Metrolink S.R.L.
  • Ministero dell'Interno
  • Mnet srl
  • NGI SpA
  • Nemo S.r.l.
  • Nordcom S.p.a.
  • Officine Informatiche Srl
  • Progetto Evo S.r.l.
  • Provincia di Reggio nell'Emilia
  • Qcom spa
  • Raiffeisen OnLine GmbH
  • Regione Basilicata
  • Regione Toscana
  • Regione Veneto
  • STI ADSL
  • Sardegnait-as
  • Societa' Gestione Servizi Bp S.p.A.
  • TELEX S.r.l.
  • TWT S.p.A.
  • Telecom Italia
  • Terra S.p.a.
  • Time-net S.r.l.
  • Tiscali SpA
  • Trenitalia SpA
  • Trentino Network S.r.l.
  • Universita' degli Studi di Milano
  • Venis S.p.A.
  • Videotime SPA
  • Vodafone Group Services GmbH
  • Vodafone Italia DSL
  • Vodafone Omnitel B.V.
  • Vodafone Omnitel N.v.
  • WIIT S.p.A.
  • Welcome Italia S.p.A
  • Wind Telecomunicazioni
  • Wind Telecomunicazioni SpA
  Following the found IoC provided by the long "analysis journey". I managed this analysis over the night, so I am sure there would be some imprecisions, but I preferred to speed up the entire analysis process to give the opportunity to block such infamous threat as soon as possible.

  
  

  Hope it helps the community.

  Original Early Warning (Italian): Yoroi Early Warning

  IoC:
  • eMail:
  • • info@amber-kate.com
    • info@fallriverproductions.com
  • Dropping URLS:
  • • 185.61.152.71
    • 239outdoors.com
    • bentlabel.com
    • cdvdautomator.com
    • cloudblueprintprogram.com
    • cnchalftone.com
    • comedyyall.com
    • conticellolaw.com
    • couplesdoingbusiness.com
    • dvoper.com
    • equinnex.com
    • ericandchrissy.com
    • evelynleekley.com
    • expungementstennessee.com
    • flaveme.com
    • grkisland.com
    • healingfoodconsulting.com
    • hertzsynergy.com
    • hollywoodisruption.com
    • home-sphere.com
    • integrativenutritiontherapy.com
    • jdkanyuk.com
    • kineloveclips.com
    • kylesinger.com
    • legionchristmas.com
    • menshoesonlinestore.com
    • microtiasurgery.com
    • movielotbar.com
    • muiienweg.com
    • niarhoslondon.com
    • opsantorinitours.com
    • progunjobs.com
    • rocketpak.com
    • scottishwindowsolutions.com
    • silkygames.com
    • snapshotsandwhatnots.com
    • snotterkind.com
    • solespin.com
    • strangerthanchristmas.com
    • synchronr.com
    • taramadden.com
    • terento.website
    • theargumint.com
    • thegildedwren.com
    • thejourneytogodsheart.com
    • thesaltybody.com
    • topsantorinitours.com
    • tuftandneedles.com
    • videospanishlessons.com
    • vovachka.com
    • wall-runners.com
    • war-arena.com
    • www.scottishwindowsolutions.com
    • z1logistics.com
    • zayantetinyhomes.com
    • zefeed.com
  • Command and Controls
  • • 185.44.105.97 
    • ns15.dreamsinthesun.com
    • bdi2.nomadicdecorator.com
    • elis.k9redemptionrescue.com
    • api.hailstorm360.com
    • cerera.survivalbid.com
    • mark.k9redemptionrescue.org
    • nsc.dayswithsunrays.com
    • at.moonbeammagic.com
    • ssl.vci-cfo.com
    • sip3.propertiesandprojects.com
    • host1.jodiray.com
    • note.lawrencechoy.com
    • note.lawrencechoy.com:80
    • 185.44.105.97:80/200
    • note.lawrencechoy.com:80
  • Hashes
  • • 63d6927881d4978da4e162c17d82e9c009d0a93e
    • 7ea33f51b6c4aa54beee7fd878886339c22d2232
    • 8cae0dc9255978a35cfd8db64cbe80001400de9b
    • 839ff9f4c3980ac67d4cbef296520ee364a0911f
    • 8cae0dc9255978a35cfd8db64cbe80001400de9b
  
  

The post Huge Botnet Attacking Italian Companies appeared first on Security Boulevard.

from Huge Botnet Attacking Italian Companies

Info Stealing: a new operation in the wild

Attack attribution is always a very hard work. False Flags, Code Reuse and Spaghetti Code  makes impossible to assert "This attack belongs to X". Indeed nowadays makes more sense talking about Attribution Probability rather then Attribution by itself. "This attack belongs to X with 65% of attribution probability" it would be a correct sentence.

I made this quick introduction because the following analysis would probably take the reader to think about specific attribution, but it wont be so accurate, so please be prepared to have not such a clear conclusions.

Today I'd like to show an interesting analysis of a quite new InfoStealer Malware delivered by eMail to many International Companies. The analysis shows up interesting Code Reuse capabilities, apparently originated by Japanese Attackers reusing an English Speaker Attacker source code. Again I have not enough artifacts to give attributions but only few clues as follows. In the described analysis, the original sample was delivered by sarah@labaire.co.za (with high probability a compromised South Africa account) to one of my spamming email addresses.

The obtained sample is a Microsoft Word document within macro in it. The macros were heavily obfuscated by using four rounds of substitutions and UTF-8 encoding charsets (which, by the way, is super annoying). The following image shows the obfuscated macro code with UTF-8 charsets.

Stage 1: Obfuscation

 By using oletools and "tons" of cups of coffee (to be awake until late night to make recursive steps) I finally was able to extract the invoked command, showed in the following image.

Stage 1: Invoked Command

A fashionable powershell command drops and executes: hxxp://ssrdevelopments.co.za/a2/off.exe. Powershell seems to be a "must have" in contemporary Malware. Analyzing the "dropping" url and tracking down the time it is in "Index Of" mode (2017-0-13), I suspect it is not a compromised website rather a crafted web server or a compromised host of a dead company.

Dropping Web Site

By surfing on the Malware propagator web site I founded out many malicious executables (sees IoC section) each one showing up specific behaviors such as: password stealers, RAT and Banking Trojans. Even if the samples were developed for different targets, all of them shared the following basic behaviors:

• Check for victims IP address before getting into Malicious activities (maybe related to targeted activities)
• Install itself into auto execution path
• Tries to fingerprint the target system (such as CPU, HD, Memory, Username, System, etc..)
• Sniff for Keystrokes

I'd like to write a simple analysis for each found sample, but today time is not my friend, so let's focalize to one of the malicious samples. Let's get done the received sample by digging into the "second stage" dropped by the powershell "first stage" from ssrdevelopments.co.za/a2/off.exe. After few seconds on second stage (off.exe) it became clear that it was a .NET software. By reversing the interpreted .NET language some clear text comments appeared interesting. Japanese language such as comments and variable names came out from static analysis. Let's have a look to them.

Stage 2: Apparently Japanese characters

While the sample pretends to be compiled from "Coca-Cola Enterprise" (maybe a target operation against Coca-Cola ? Or a targeted operation agains Coca-Cola Suppliers ? So why it ended up to my inbox ? Anyway ... ) google translator suggests me that Japanese characters are in text: such as the "Entry Point", "Class names" and "Function Names". 

Stage 2: Japanese Names and Self Encoding Structures

It was not hard to figure out that Stage 2 was auto-extracting bytes from itself (local variables) and saving them back to hard drive after having set up auto execution registry key on windows local registry.  The following image shows the xoring function used to decrypt converted bytes to the real payload. 

Stage 2: Xoring function to extract Stage 3

On my run, the xored payload took the name of GIL.exe; another .NET  executable. We are now facing the third stage. By analyzing the decompiled sample it became clear that:

• The coding style was quite different from the previous stage (Stage 2)
• The implementation style was different from the previous stage as well
• The sample was interested on information about the user, the machine, the webservices on the PC and to many more windows specific parameters.

Stage 3:  New Language in Strings and Class names

Stage 3: New Code Style

By closely investigating Stage 3, the analyst would probably notice the heavy presence of "decorators", a different format in the definition style and last but not least the code composition. Everything looks like belonging to different single developers. The variable language, the comments structure and the general usage of terms, takes the analyst to believe in having found two different developers belonging to different cultures (maybe countries). Finally the malware looks for users, computes, and webservices informations and drops everything up to C2 by posting parameters to : ssrdevelopments.co.za/cgi-bin/

IoC:

Following the principal IoC for the described threat.

• Hash Stage 1:
• • 7f1860673de9b1c2e6f7d6963a499e8ba4e412a1
  • bf4a26c9e52a8cacc7afd7d95d197bff1e47fb00
• Hash Stage 2:
• • ac55ee783f3ed0bd23eccd01040a128dc6dc7851
• Hash Stage 3:
• • 6a38e4acd9ade0d85697d10683ec84fa0daed11c
• Persistence: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\kij %APPDATA%\Roaming\kij\kij.exe
• Dropping URL:
• • ssrdevelopments.co.za
• Command and Control:
• • ssrdevelopments.co.za/cgi-bin/
• Related hashes from harvesting Dropping URL:
• • 62c9d2ae7bafa9c594230c570b66ec2d4fa674a6
  • b15b69170994918621ceb33cb339149bdff5b065
  • 55abcfb85e664fbc8ad1cb8b60a08409c2d26caa
  • f843427e9b7890f056eaa9909a5103bba6ffb8fd
  • f2b81e66fcb1032238415b83b75b3fe8bf28247d
  • cab90f7c935d355172b0db123d20b6a7d1403f65
  • c1ba30d7adec6d545d5274f95943f787ad4c03e7
  • ed9959bb0087f2c985b603cee0e760f3e0faaab15
  • c93851627ffd996443f85d916f3dbedd70e0ff69
  • 144b34b4816062c2308a755273159e0460ffd604
  • 98293b80ccf312a8da99c2b5ca36656adebd0d0f 
  • 2875d1b54337b1c17c8f4cd5f6b2d579667ee3d9 
  • 0b4299ffb3f9aa59e19dd726e79d95365fe1d461
  • 46bb0b10d790a3f21867308e7dcdeb06784a1570
  • 0960726560a94fbbb327aa84244f9588a3c68be8 
  • a480a75c3af576e5656abadb47d11515a18a82be
  • 2ba809c53eda2a475b1353c34f87ce62b6496e16
  • 5b0c3071aa63e18aa91af59083223d3cceb0fa3c 
  • dc780bf338053e9c1b0fdf259c831eb8a2768169

As final thought I'd like to highlight the following key concept of that analysis:

• From a single email, the analyst could discover attacker's assets, mapping them and disarming them (through IoC). 
• The analyzed code shows apparent evidences to belonging to different groups of attackers.
• The analyzed samples show code reuse. Code reuse is dangerous because it makes attackers more powerful and extremely quick to change Malware behavior.

Hope you enjoyed.

The post Info Stealing: a new operation in the wild appeared first on Security Boulevard.

from Info Stealing: a new operation in the wild

ShadowBrokers Leak: A Machine Learning Approach

During the past few weeks I read a lot of great papers, blog posts and full magazine articles on the ShadowBrokers Leak (free public repositories: here and here) released by WikiLeaks Vault7.  Many of them described the amazing power of such a too...

from ShadowBrokers Leak: A Machine Learning Approach

Crypt0l0cker Revival !

A couple of days ago a colleague of mine gave me a "brand new" malicious content delivered by a single HTML page. The page was sent to an email box as part of a biggest attack. I found that vector particularly fun and so I'd like to share some of the steps who took me through a personal investigation path made not for professional usage but just for fun.

At first sight the HTML page looks like the following image.

Figure1: Attack Vector. A simple HTML page

A white backgrounded HTML page with a single line test on it saying: "print this document please". But what document ? Honestly I am in front of one of the ugliest "fake email" I ever seen. But let's move on and se what it really carries on. Opening the HTML content with a simple editor we might see a suspicious obfuscated Javascript. We are facing a first obfuscation stage. 

Figure2: Obfuscated First Stage

Since Javascript is an interpreted language (such as .NET or .Java) is not hard to understand its behavior, indeed after some rounds of "substitutions" and "concatenations" it easy to get the following clear text result showing the end of the first stage.

Figure3: Clear Text First Stage

That script is going to create an additional "script tag" on the current document by injecting an external script from: "https://s3-us-west-2.amazonaws.com/s.cdpn.io/14082/FileSaver.js". The injected script will be called with the following code signature: "saveAs(blob, 'image.js');" with 2 arguments: 

1. blob. The raw content of "big_encoded_data" (please refer to Figure3)
2. image.js. The saving name

In order to better understand what that function saveAs(blob, image.js) does we need to analyze the external FileServer.js. The entry point of the external script is the function "saveAs(arg1, arg2)" which has been defined as follows:

Figure4: FileServer.js Original Entry

saveAs(blob, name) is a simple wrapper function headed to FileServer constructor which is defined as follows:

Figure5: FileServer.js constructor

The script saves the "blob" content to the temporary folder giving to it a specific name (image.js in our case). As you might notice from the script content: "Apple do not allow window.open, see http://bit.ly/1kZffRI " if the victims opens the file with Safari/Mail the attack vector will have no effect since Safari/Mail does not allow you to trigger the script on "window.open" event. This is why I did't see any file when I opened the infected HTML content. Back to the original script (Figure3) we see the aveAs function called on page.load so the resulting image.js is going to be saved in the temporary local folder, in case of email clients, it will be triggered as soon as saved! So lets move on our next stage: the big_encoded_data variable (Figure3) which is going to be saved as image.js file. The big_encoded_data owns a first obfuscation stage made by encoding the downloader in base64. Once decoded from base64 and beautified the results looks like the following image

Figure6: Stage 2 base64 decoded obfuscated downloader

The downloader is still obfuscated by a high number of simple returning array-strings variables. It took almost 45 minutes to decode the entire second stage downloader. The resulting downloader is shown in the following image.

Figure7: Second Stage Downloader

A first check on fileSystem API and on the Element Type is super interesting (at least to me). We are analyzing an attack based on a specific file system, Windows native. The deobfuscated downloader grabs a file from "http://mit.fileserver4390.org/file/nost.bgt" and saves it to a temporary directory. By using ActiveXObject (Windows native) it saves the file and it runs it through command line c["run"]("cmd.exe /c " + f + g, "0"); where f takes the temporary folder f = b["GetSpecialFolder"]("2"); and g takes the temporary name g = b["GetTempName"]();.

This is the end of the second stage downloader.

The downloaded file is a PE Executable packed as well. Fortunately the used packer is the PiMP Stub by Nullsoft: a quite famous installer used by several software house.

Figure8: NullSoft Installer

The PiMP installer takes .dlls and runs them as the resulting software. The used resources are compressed in its own body by a well known algorithm: .7zip. Kation.DLL is the only DLL included in the dropped file and so it is the run DLL by PiMP installer. Kation wraps out ADVAPI32.DLL and KERNEL32.DLL as you might see from Figure9. ADVAPI32 is a core Microsoft library which includes the Microsoft encryption libraries such as: EncryptFileA, EncryptFileW and so on and so forth. It's not hard to guess a new Ransomware infection from that API calls.

Figure9: Usage of Encryption Libraries

From a static analysis prospective it becomes clear that some of the used strings are dynamically allocated. For example in sub_10001170 (frame 0XBC) several UFT-16 strings within decryption loop are involved showing out the control flow passing to Etymology.Vs (Figure11).

Figure10: Setting the running pointer

Figure11: Decoding Functions

The real behavior is hidden into the Etymology.Vs encrypted file included in the PiMP solution as well. Running the infected sample it disclosures its real behavior: shown in Figure12.

Figure12: Ransom Request

Here we go,  we have just discovered a brand new Crypt0L0cker ! it asks for bitcoin (Figure13), of course.  Looking at network communications, a Domain Name Generator Algorithm (DNGA), [wow, it sounds new from CryptoL0Cker !] fires up as soon as the dropped file is executed. It looks for valid registered subdomains belonging with divamind.org.  Until a valid Command and Control answers to the CryptoLocker client it hides itself and performs simple DNS query as follows:

 28  imadyxaro.divamind.org 

 29  irel.divamind.org 

 30  awwtodufir.divamind.org 

 31  ogisirigu.divamind.org 

 32  yzijyvy.divamind.org 

 33  uqekfr.divamind.org 

 34  ydoc.divamind.org 

 35  yzukyfyku.divamind.org 

 36  upenigy.divamind.org 

 37  qhera.divamind.org 

 38  ijywiqezy.divamind.org 

 39  efuca.divamind.org 

 40  ygbm.divamind.org 

 41  ejrdip.divamind.org 

 42  usen.divamind.org 

 43  ahydenuj.divamind.org 

 44  ghxsykegaja.divamind.org 

 45  ekohob.divamind.org 

 46  ifyvas.divamind.org 

 47  iqimub.divamind.org 

 48  usegi.divamind.org 

 49  yjeqicoht.divamind.org 

 50  rtibola.divamind.org 

 51  ucnpive.divamind.org 

 52  aminevkjude.divamind.org 

 53  pwiregaty.divamind.org 

 54  irol.divamind.org 

 55  abswuhupnt.divamind.org 

 56  erelo.divamind.org 

 57  ulefuw.divamind.org 

 58  ogax.divamind.org 

 59  ezelilijxn.divamind.org 

 60  ulymobutol.divamind.org 

 61  obehilebac.divamind.org 

 62  yfycodolul.divamind.org 

 63  iwesvxynd.divamind.org 

 64  kcoma.divamind.org 

 65  ydqpibc.divamind.org 

 66  ykotifehut.divamind.org 

 67  ewuzivy.divamind.org 

 68  imocyfyt.divamind.org 

 69  fjep.divamind.org 

 70  ibeb.divamind.org 

 71  isafexuh.divamind.org 

 72  izemireli.divamind.org 

 73  kgorihukyho.divamind.org 

 74  udupose.divamind.org 

 75  iqyk.divamind.org 

The process to contact the Command and Control in order to exchange key and to notify the attacker could be very time consuming, in some of my runs it took until 2 hours depending on the available Command and Control at the time being. It would be very nice to have extra time to reverse the DNGA but unfortunately my weekend time is ending up. 

Figure13: Ransom Request Web Page

Development language is French, and many piece of code reminds me the "gaming world".   The main Command and Control domain is registered in Moscow (RU) and the registrant is "privacy protected".

Results for Target: divamind.org

Created Date :	2017-02-07T12:37:10Z
Updated Date :	2017-02-08T10:38:54Z
WHOIS Server:	whois.pir.org

Results for Target: divamind.org

Created Date :	2017-02-07T12:37:10Z
Updated Date :	2017-02-08T10:38:54Z
WHOIS Server:	whois.pir.org

The ransom page (available on the following link) is registered by EPAG Domain Sercives GmbH (Bonn, Germany) and is written in Franc language: 

http://x5sbb5gesp6kzwsh.hoptrop.pl/uum2j9ku.php?user_code=&user_pass=&page_id=0

Ok Let's have some brand new IoC:

Malicious hashes:

2649cba6ca799e15c45fa59472031cc9087a5ade

6ef0e56b27cfd3173aeded9be9d05e97d8e36da3

7292f20a0909f5f9429d5c1ec2896cf8f57a40a2

0b7b7201310638a74dba763c228d8afe77303802

2d36b1bf1c37d6f5b47fe36bd2c5bac81b517774

Malicious urls:

http://mit.fileserver4390.org/file/nost.bg
http://x5sbb5gesp6kzwsh.hoptrop.pl
http://xiodc6dmizahhijj.onion

DNGA:
- base dns: XXXXXXX.divamind.org

Extension:
.?????? (6 characters)

Strings:
HOW_TO_RESTORE_FILES

Enjoy your new IoC

marketing

from Crypt0l0cker Revival !