Malware directed against Polish banks and institutions in Latin america - "TechnoTron"
There are many interesting aspects of these attacks, starting with their targets, going through your vector of and commitment to the specific functionalities of the malicious executables are used. While the first two axes were examined in detail, binary malicious involved did not attract much attention until the time. The purpose of this article is to provide technical details of this malware for now is very poorly documented.
MALWARE
Distribution channel
As mentioned in the news portal of Poland, the threat is sent with stealth via an attack watering hole, thanks to which a trusted site that was compromised redirected to a fraudulent page that hides an exploit. In the case of the attacks of poles, the starting point was the official site of Komisja Nadzoru Finansowego (the Financial Supervision Authority of Poland):
However, our data indicated that the site of the authority, equivalent in Mexico, the National Banking Commission and Values, it was also redirects to malicious identical; unfortunately, the information published by services of web crawl or for the institution itself had neither confirmed nor mentioned it. According to our records, the redirects came from this site page:
Phase 1: Dropper
If the exploit kit manages to malware infection desired, the payload malicious (a console application, 64-bit) runs on the computer of the victim. Unlike the dropper reported by BAE Systems, this program expects one of three arguments: -l, -e, or - (section 2 in the following figure). While the argument to-l has the same meaning, the remaining two are required to extract binary the next stage from the resources (section 4 in the figure) and to automatically start one of them as a service (section 5):
In section 5 the above figure, the dropper is changing the configuration of a system service to do the malicious payload as a service. The service is configured from the services control manager to start automatically during the system startup; to do so, you need administrator privileges.
Unlike the subsequent phases, in the first one, the threat is not hidden very carefully. It even contains detailed statements that provide information on the state of the execution (in this case, related to the extraction of encrypted resources; however, the debug information as the original names of functions is not present).
The dropper used in a load API dynamically instead of having Windows functions in your import table, which is very well explained in the report by Novetta “Operation Blockbuster” about the Lazarus Group, on page 34. Section 3 of the figure above shows a wrapper of this functionality, which is a system library after the other.
It seems that the attackers denote the second phase as “loader” and the third, which contains the main function of the malware, such as “module”. The loader is decryption, while the module only extracts and runs as well as it is. To reduce their visibility during the forensics analysis, the files take to borrow its time of creation of the shlwapi.dll system. An important feature of the encryption algorithm used is that is it is a chain of encryption similar to RC-4, fairly recent called Spritz. There are already available implementations in C and Python Spritz, and correspond to the following disassembled code for the dropper:
Fase 2: Loader
There are more indicators of the intention to preserve the low profile of the threat. The loader is protected by a packer commercial called the Enigma Protector, and we realized that the module is stored, encrypted, waiting for the loader decipher and release. After a closer look at this protection, we found that there was a not registered copy of Enigma v. 1.31 for 64-bit. It was just as we expected, since malware creators with this level of capacity would not make a mistake as basic as leaving your identity at potential risk of being discovered thanks to the use of a copy, duly registered. However, it is not uncommon for criminals to take advantage of an application-filtered or pirated if it is available.
The attackers that attempt to build a large botnet, in general, do not use packers trade because a good proportion of the manufacturers ' anti-malware detect them in a generic way. Therefore, restrict the potential size of the botnet. But in the case of a targeted attack, using such protection has advantages. An obvious one is that the reconstruction of the original binary, that is, to determine how it was before entering in the process of camouflage, it is almost never easy.
The impression sometimes is that the only machines with 64-bit Windows can be a target of this threat is wrong, since it also drew a variant for 32-bit computers of some of the institutions affected. Although it has the same general structure, this last is not a mere recompilation of the first, but has slight differences: the phases of dropper and loader are combined into one, it uses RC4 encryption in classic and not Spritz, and the phase module is stored in the registry instead of in the file system. In addition, the version of the protector Enigma applied was 3.7, with a single developer license, and apparently was used to protect the binary on January 11, 2017.
Fase 3: Módule
The third and final stage module is relatively large (~730 KB), which contains the main functions of the malware communicated with the C&C and receive orders from the operators. In addition, injected himself in all the sessions started in the Windows system compromised.
The following screenshot shows the situation after loading the module in the tool for disassembly, IDA Pro. The top bar shows the various parts of the binary: the sections of code in blue, and the sections of data in grey and yellow. The difference between the parties-and blue-celestial is that the latter represent the code statically linked to the existing libraries. In addition to the C run-time usual, we identify the link of a library file transfer multi-protocol open source call libcurl (version 7.47.1, published in the February 8, 2016), along with bits of code from projects like OpenSSL and XUnzip. The effect of colors on the bar is not generated in an automatic way: in this case, we had to explicitly marking parts that we consider as code of the linked library and import all of the names of the functions. The sections in blue represent the code written by the attackers..
There is only a URL encrypted housed in the module. The communication is encrypted, but we do not log any because the remote server did not respond at the time of analysis. The module supports quite a few commands; more than enough are of the that characterize him as a Remote Access Trojan (RAT). The dictionary of commands is as follows: “SLEP”, “HIBN”, “DRIV”, “DIR”, “DIRP”, “CHDR”, “RUN”, “RUNX”, “DEL”, “WIPE”, “MOVE”, “FTIM”, “NEWF”, “DOWN”, “ZDWN”, “UPLD”, “PVEW”, “PKIL”, “CMDL”, “DIE”, “GCFG”, “SCFG”, “TCON”, “PEEX”, “PEIN”. Many are self-explanatory (“SLEP” is similar to the English “sleep” for “sleep”, “PKIL” is to kill a process, “UPLD” is the exfiltration of information, “DOWN” is to download, “THE” is to erase a file, etc). It is possible that the original functions of libcurl have been customized to fit the needs of the attackers. Anyway, libcurl is a large project with hundreds of contributors, tens of thousands of lines of code and hundreds of options. The inspection and the accurate analysis of the connection are in process.
Kits of tools, similar to Lazarus
Researchers from BAE Systems have to say about the dropper 32-bit protected with Enigma: “once unpacked it runs a variant of known malware, which was sent as part of the kit of tools of the group Lazarus...”. In addition, Symantec states: “Some strings of code views in the malware used to share common aspects with the code of the malware used by the threat group known as Lazarus”. It is also possible to find a connection in the report by Novetta, such as the already mentioned dynamic loading of API. All these signs lead us to describe the properties crucial a tool kit similar to Lazarus in the following way:
- Malware multi-stage running in cascade
- The initial phase is a console application that expects at least one parameter
- Loaded WINAPIs in a dynamic way
- It uses RC4 or similar with a long key for decryption of the next phase
- The following phases are libraries linked in dynamically loaded as service with the start type SERVICE_AUTO_START (administrator privileges are required for this action)
Our records show activity of various malware like Lazarus in-the-wild recently. However, in order to provide a clearer picture of the case, we need time to gather more relevant information.
A discovery strange
During our research, we found another interesting sample that belongs to the same family of malware. A console application waiting for four parameters call fdsvc.exe (2), which runs in cascade (1). In addition, decrypts the next phase using RC4 with a key of 32 bytes (4). You do not have the last two properties. On the other hand, injects the payload in all of the sessions in the course of Windows; the payload has libcurl v. 7.49.1 linked in statically. What makes this sample particularly interesting is the way in which the final stage parses commands from the operators, who use the Russian language with translit, a method of coding of the cyrillic alphabet with letters of the Latin.
Conclusion
Taking into account the tricks in the code, we venture to say that this is not a re-use of existing code long before these attacks on Polish banks, nor a project discontinued and forgotten. In fact, we observed malware that looks like this example in the last few weeks.
The attackers behind this threat they know well what they are doing, by what the teams response to incidents of financial institutions and other high-profile organizations will not be able to rest fully in the near future. To tell you the truth, that is your work today: I suffer nights without rest!
MALWARE
Comments
Post a Comment