The Italia cyber security expert Marco Ramilli, founder of Yoroi, published an interesting analysis of a quite new InfoStealer Malware delivered by eMail to many International Companies.
I made this quick introduction because the following analysis would probably take the reader to think about specific attribution, but it won’t be so accurate, so please be prepared to have not such a clear conclusions.
Today I’d like to show an interesting analysis of a quite new InfoStealer Malware delivered by eMail to many International Companies. The analysis shows up interesting Code Reuse capabilities, apparently originated by Japanese Attackers reusing an English Speaker Attacker source code. Again I have not enough artifacts to give attributions but only few clues as follows. In the described analysis, the original sample was delivered by [email protected] (with high probability a compromised South Africa account) to one of my spamming email addresses.
|Stage 1: Obfuscation|
|Stage 1: Invoked Command|
A fashionable powershell command drops and executes: hxxp://ssrdevelopments.co.za/a2/off.exe. Powershell seems to be a “must have” in contemporary Malware. Analyzing the “dropping” url and tracking down the time it is in “Index Of” mode (2017-0-13), I suspect it is not a compromised website rather a crafted web server or a compromised host of a dead company.
|Dropping Web Site|
By surfing the Malware propagator website I founded out many malicious executables (sees IoC section) each one showing up specific behaviors such as: password stealers, RAT, and Banking Trojans. Even if the samples were developed for different targets, all of them shared the following basic behaviors:
- Check for victims IP address before getting into Malicious activities (maybe related to targeted activities)
- Install itself into auto execution path
- Tries to fingerprint the target system (such as CPU, HD, Memory, Username, System, etc..)
- Sniff for Keystrokes
I’d like to write a simple analysis for each found sample, but today time is not my friend, so let’s focalize to one of the malicious samples. Let’s get done the received sample by digging into the “second stage” dropped by the pPowerShell “first stage” from ssrdevelopments.co.za/a2/off.exe. After few seconds on second stage (off.exe) it became clear that it was a .NET software. By reversing the interpreted .NET language some clear text comments appeared interesting. Japanese language such as comments and variable names came out from static analysis. Let’s have a look to them.
|Stage 2: Apparently Japanese characters|
|Stage 2: Japanese Names and Self Encoding Structures|
|Stage 2: Xoring function to extract Stage 3|
On my run, the xored payload took the name of GIL.exe; another .NET executable. We are now facing the third stage. By analyzing the decompiled sample it became clear that:
- The coding style was quite different from the previous stage (Stage 2)
- The implementation style was different from the previous stage as well
- The sample was interested in information about the user, the machine, the web services on the PC and to many more windows specific parameters.
|Stage 3: New Language in Strings and Class names|
|Stage 3: New Code Style|
- Hash Stage 1:
- Hash Stage 2:
- Hash Stage 3:
- Persistence: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\kij %APPDATA%\Roaming\kij\kij.exe
- Dropping URL:
- Command and Control:
- Related hashes from harvesting Dropping URL:
As final thought I’d like to highlight the following key concept of that analysis:
- From a single email, the analyst could discover attacker’s assets, mapping them and disarming them (through IoC).
- The analyzed code shows apparent evidences to belonging to different groups of attackers.
- The analyzed samples show code reuse. Code reuse is dangerous because it makes attackers more powerful and extremely quick to change Malware behavior.
Hope you enjoyed.
The original post published by Marco Ramilli on his blog at the following URL:
About the author: Marco Ramilli, Founder of Yoroi
I am a computer security scientist with an intensive hacking background. I do have a MD in computer engineering and a PhD on computer security from University of Bologna. During my PhD program I worked for US Government (@ National Institute of Standards and Technology, Security Division) where I did intensive researches in Malware evasion techniques and penetration testing of electronic voting systems.
I do have experience on security testing since I have been performing penetration testing on several US electronic voting systems. I’ve also been encharged of testing uVote voting system from the Italian Minister of homeland security. I met Palantir Technologies where I was introduced to the Intelligence Ecosystem. I decided to amplify my cyber security experiences by diving into SCADA security issues with some of the most biggest industrial aglomerates in Italy. I finally decided to found Yoroi: an innovative Managed Cyber Security Service Provider developing some of the most amazing cyber security defence center I’ve ever experienced ! Now I technically lead Yoroi defending our customers strongly believing in: Defence Belongs To Humans
The post Info Stealing – The cyber security expert Marco Ramilli spotted a new operation in the wild appeared first on Security Affairs.