## RIT Information Security

### It's 10 p.m. Do you know whom your kids are chatting with online?

SANS Tip-of-the-Day - Thu, 02/26/2015 - 22:47

### The Enemy on your Phone

Malware Alerts - Thu, 02/26/2015 - 05:00

Many people believe that there are no malware programs on smartphones. There was a time when there was some truth in this. A few years ago mobile platform operators originally designed their products with very high security levels. Mobile operating systems did not allow malicious programs to easily seize control and make themselves at home on devices.

Sadly that's no longer the case. Mobile devices are fundamentally different, they can do much more. A modern smartphone is a full-blown working tool, an entertainment center and a tool to manage your personal finances. The more it can do, the more attractive it is to cybercriminals. They want to steal a slice of that pie and the more tempting the prize, the more they create malicious applications, and invent methods to infect computers and to distribute malware.

Since Q1 2012, the number of malicious programs has grown more than tenfold, to exceed 12,000,000 in Q4 2014

The evidence for this is clear when we look at the rapid growth in the numbers of mobile Trojans. The rate of growth is impressive: since Q1 2012, the number of malicious programs has grown more than tenfold, to exceed 12,000,000 in Q4 2014.

The number of detected malicious installation packages

Looking at the types of malicious programs is also revealing. It is easy to see that SMS Trojans and multi-purpose backdoors are giving way to malicious adware and Trojan bankers. However, just because a specific type of malware is losing its market share, this doesn't mean it is disappearing: it should be also remembered that the overall number of malware programs targeting mobile devices keeps growing.

Distribution of mobile malware by function (files from Kaspersky Lab's collection)

Malware writers don't create tons of malicious programs to build up a private collection or show off on some forum. All malware programs find their victims, and it is at times surprising to see how a seemingly innocuous loophole can allow them onto users' mobile devices.

Do it yourself

Believe it or not, users often infect their mobile devices with their own hands.

The ways to get malicious code on a regular computer without any user involvement are well known. Cybercriminals hack websites, users visit the sites and a hidden frame is opened in their browsers to download malware on to the victim machine using an arsenal of exploits.

On mobile platforms, everything is different. The underlying principles behind these platforms mean there are almost no vulnerabilities that would enable cybercriminals to attack a device without the user's knowledge and consent. So criminals need some help from users: Trojans must be installed and launched by their intended victims. It's like the old joke about the first, primitive virus: 'please delete all your important data and reformat your hard drive'.

A classic method to make money with mobile malware is to send premium-rate SMS messages from your phone

Installing programs is one of the weakest places in mobile platforms, especially Android. Under iOS, you have to spend time fiddling around before you can install a program from anywhere other than App Store; however, Android allows users to do that by checking just one box in the settings. Once that's done, the system will check the digital signature of any installation package, and theoretically that should protect your device against malicious programs. But here's the snag: there are no Android certification centers, so anyone can create their own signature. Of course cybercriminals just sign off their own security confirmation and the installation goes ahead without a hitch when the user clicks 'OK'.

And many users do click 'OK'. After all, it's often easier than investigating everything about the app you're allowing onto your device.

Information security is usually far from the thoughts of a regular user. People love a bargain and find it hard to resist a free download of a useful program or a favorite game from some helpful-looking website. Often the application, once installed, will work as expected, except that money is drained from the phone's account at an alarming rate, and the user's credit card will soon get empty… Or, if users are invited to watch an exclusive video on an interesting site, perhaps they'd take a minute to update their Flash Players?

Fake Adobe Flash Player update page. Users are told to update an outdated version of Flash Player on their devices

Inexperienced users do not know that the update process for software on smartphones is different than on computers, so cybercriminals can trick them into installing anything under the guise of a useful upgrade.

Cybercriminals are extremely aggressive and astute when pursuing their targets: malicious applications are typically distributed in the form of various tempting software programs, games, porn clips or players for watching porn.

Where to find malware

Since users have to install malicious programs on their smartphones with their own hands, cybercriminals need to somehow entice them to a web resource where the malware is available. "Black SEO" is one of the methods used to do that. Black SEO is a type of search optimization that encourages search engines to display a link to the preferred malicious resource at the top of the search results. As soon as the site receives a top position in the search results, a harvest of unwitting users can be reaped.

A bored user types "Android games download" in a search engine and receives a link to web-site in the first or second line at the top of search results. That site may indeed contain games, but they come with some unpleasant extras. People tend to trust the sites from the top lines of search results. Users think that since thousands of people visit a web-site, it will also have the game or program they are looking for. Users do not think about security. That's a big mistake.

To bring the malicious site to the top of the search results, cybercriminals often use botnets: thousands of bots send search requests to Google and Yandex and visit the cybercriminals' site, boosting its ranking. Links to the cybercriminals' site are also published on all types of forums, bulletin boards, and in comments on news sites. The crawler bots of search engines find them there, so the rankings grow even faster.

Of course search engines try to stop this abuse of their services. They block hundreds of malicious sites. But that's not a big problem for cybercriminals: they keep creating and promoting new sites with the help of automatic tools.

SMS spam is yet another means of enticing users to sites containing malicious applications. It could be a simple, non-targeted mass-mailing of messages containing a link to the site: at least some of the recipients will follow the link. As soon as such program lands on somebody's smartphone, it will start to send SMS messages containing the malicious link to the owner's entire contact list. A message from a person you know raises few suspicions, especially if the text looks natural, so many do indeed follow the link they received, hoping to see some photos or jokes that their friend is sharing. But once opened, the site actually hosts malware samples from the cybercriminal.

Another method allows cybercriminals to exploit the popularity of legitimate resources. Cybercriminals hack popular online resources high visitor traffic, such as news sites, online stores, specialized portals. If the site's software contains known vulnerabilities, a code is embedded to the page and redirects the users to another site containing malware. If no vulnerabilities could be found, cybercriminals can still try to steal the site admin's credentials by using phishing and social engineering. If they succeed they can do anything to the site, including posting malware on the site itself.

Fake Android Market

In addition mobile malicious applications are distributed "almost honestly" – via app stores. This might be a legitimate program containing embedded malicious code; a specially created application which imitates some useful functionalities; or a bare-bones malicious program, with just a name and an icon as a camouflage.

Such programs are usually uploaded to unofficial app stores which either neglect security measures altogether or only take a cursory look at the content that gets published. However, there have been cases when dangerous programs got uploaded to official app stores – Google Play and even Apple App Store, which is historically more secure. Naturally, the manufacturers promptly clean their stores, but cybercriminals never sit on their hands either.

How cybercriminals make money

Once malware lands on your smartphone, it starts its mission of making money for its owner, naturally at your expense. A modern mobile device is a real goldmine for a cybercriminal; it only takes the appropriate mining skills.

Mobile malware: methods of making money

Expensive tricks

The least damaging money-spinner used by cybercriminals is obtrusive adware. It doesn't do much harm, but it doesn't take long for all those pop-up ads to get annoying. Getting rid of them is often more of a challenge: it takes quite an effort to find out which program is actually producing the banners. It could be Angry Birds HD, or it could be that something that has a name you cannot read aloud and masquerades as a system application.

There is also a curious category of fake apps that do nothing at all – neither good nor bad – but still cost good money. Some of these are clear dummies on offer in paid-apps sections of application stores, like a program that promises to make you rich but only displays an image of a diamond on the smartphone's screen. Others pretend to be useful applications, such as antivirus programs, and demand payments from the user for protection against Trojans that have supposedly overrun the device.

A classical method to make illegal money with mobile malware is to send SMS to premium-rate numbers. A Trojan running on your phone simply sends several premium-rate SMS messages and drains your account. Your phone service provider sends money from your account to the renter of the premium-rate number (the cybercriminal) without asking any questions, since premium-rate numbers are still a popular way to pay for different types of online services.

Ransomware Trojans for PCs are abundant. Recently, they've started emerging on mobile devices. The scam is simple: once installed on your mobile device, the Trojan displays a screen making threats and demanding a ransom. You can no longer work with your device. All you can do is to enter the special code that they promise to send you as soon as you pay them a specified amount of money.

Message displayed by this ransomware sample: "Your phone has been blocked for viewing banned porn (Pedophilia, Zoophilia)! All photo and video materials have been sent for further investigation. To unblock your phone and delete this material, you must pay a 1,000-ruble fine within 24 hours. To do this, top up number XXXX at the nearest payment kiosk. Warning! If the fine is not paid, all data will be made public"

It is impossible to delete the Trojan unless you hard reset the settings and the contents of the device's flash memory. For many the value of the data on the device makes it worth paying the ransom. However, the cybercriminals do not always send the unblock code even after the ransom is paid.

However, none of the above scams are anything like as costly as this relatively new way of stealing from mobile device owners. In recent years mobile banking services have become increasingly popular. Every major bank has developed an app that allows clients to manage their money from their smartphone or, at the very least, use SMS banking services.

Mobile banking #malware threats increased since 2013 - from less than 100 to 13,000 by Oct. 2014

Suddenly many smartphones are the key to bank accounts – often to several accounts at the same time. This offers many opportunities to make illegal profits – and promises greater rewards than the traditional SMS and ransomware scams of old. Not surprisingly, cybercriminals have been quick to embrace this new opportunity.

The statistics clearly show how much interest mobile virus writers have in users' bank accounts. At the start of 2013, there were less than a hundred Trojan bankers in Kaspersky Lab's collection; at the October 2014, there are more than 13,000 of them.

The number of detected banking malware programs

Banking Trojans are enjoying a surge in popularity all over the world but Russia is facing the brunt of this boom. Russia is a place where malware writers test-run their creations before using them in other countries.

Geography of mobile banking threats. January – October 2014
(Number of attempted installations of banking Trojans)

For cybercriminals, SMS banking is the easiest path to other people's money. It doesn't even require new tools – existing SMS Trojans work just fine. Banks often assume the client's phone is a trusted environment and follow SMS instructions without query.. Clients can send money from their bank accounts to their own or somebody else's mobile phone account. Using that feature, the cybercriminals send an appropriate SMS and send money from the victim to their phone number. After that it is easy to withdraw the money using advanced mobile payment systems.

Quite often, banking Trojans work in partnership with computer Trojans; Faketoken is one example. When the user's computer is infected with a banking Trojan it waits until they visit their online banking account. Then the malware program becomes active and displays a window to the user, asking them to download an Android application which is allegedly required to securely confirm the transaction. Gullible users obediently install Faketoken on their smartphones. After that it is only a matter of time: the malware on the computer steals the credentials, and the cybercriminals gain access to the user's banking account. They make a transaction and Faketoken intercepts the one-time confirmation code (mTAN) sent by the bank in an SMS. In the end some Vasily P. collects a hefty sum of money divested from the user's account, and cashes it immediately at an ATM. We saw this piece of malware attacking users in 55 countries, including Germany, Sweden, France, Italy, the UK and the USA.

A third method is to use independent mobile banking Trojans which can masquerade as a mobile banking applications or simply spoof the banking application's interface. The Trojan gets hold of the users' credentials and sends the information to its C&C server. The cybercriminal uses the intercepted data to make a transaction. Svpeng is a good example of this tactic. This mobile Trojan opens a window on top of a legitimate application window, imitating the banking applications of the largest Russian and Ukrainian banks.

Phishing window imitating the bank's own application

Using these programs, cybercriminals can strip you of all your savings in an instant, drain your accounts and close your deposits. They can also put you in debt by running up your entire available credit.

Don't dig a hole for yourself

The proportion of malicious applications among all applications installed by users varies from country to country. Here are the figures for some countries for January – October 2014 (according to Kaspersky Security Network data):

Vietnam 2.34% Switzerland 0.36% Poland 1.88% India 0.34% Chezh 1.02% Canada 0.23% France 0.84% Germany 0.18% Belgium 0.74% Brazil 0.17% China 0.73% Italy 0.09% Ukraine 0.70% Austria 0.07% Russia 0.69% USA 0.07% Mexico 0.62% Hong Kong 0.05% Spain 0.54% New Zeland 0.05% Belarus 0.50% Norway 0.04% Iran 0.38% Japan 0.01%

The fact is it's fairly easy to protect yourself against all these sophisticated mobile threats. Mobile platform developers have taken good care of security and the user is often the weakest link in the security chain. This is good and bad at the same time. It's a problem because many users don't pay much attention to their security. But the plus side is that you only need to follow a few simple recommendations to safeguard yourself against all the above threats.

We recommend that you follow the following simple rules.

• Do not jailbreak / root your smartphone. While it will give you extra opportunities on your phone, it will also give the green light to cybercriminals.
• On an Android phone, disable the option of installing software from untrusted sources.
• Install a mobile security product on your phone. It will analyze all applications before installation.
• Try not to follow any links arriving in SMS, even if they come from people you know.

### Don't get hooked by a Phishing expedition

SANS Tip-of-the-Day - Wed, 02/25/2015 - 22:07

### Don't let spyware control your computer use

SANS Tip-of-the-Day - Tue, 02/24/2015 - 22:47

### If your personal information is stolen, four steps to take

SANS Tip-of-the-Day - Mon, 02/23/2015 - 22:28

### If you suspect malware is on your computer - Stop, Confirm, Scan

SANS Tip-of-the-Day - Sun, 02/22/2015 - 20:48

### Stop. Think. Click: Seven Practices for Safer Computing

SANS Tip-of-the-Day - Sat, 02/21/2015 - 23:31

### Letting Family or Friends Use Your Employer's Computers Can Be Bad for You

SANS Tip-of-the-Day - Fri, 02/20/2015 - 23:38

### Use a password in only one place.

SANS Tip-of-the-Day - Thu, 02/19/2015 - 22:44

### Equation Group: from Houston with love

Malware Alerts - Thu, 02/19/2015 - 04:00

In 2009, an international scientific conference on Energy and Space technologies was held in Houston, USA. Leading scientists from several countries were invited to attend. As is traditional for such events, the organizers sent out a post-meeting CDROM containing a presentation with the best photos from the event. It is unlikely that any of the recipients expected that while they were enjoying the beautiful pictures and memories a nation-state sponsored Trojan Horse was activating silently in the background.

Photo slideshow played from the CD

Interestingly, it looks as if most of the attendees brought pens and paper instead of laptops.

Self-elevating Autorun

The disk contains two files in the root folder, an autorun.inf and autorun.exe. This is typical of many CDROMs. The autorun.inf simply executes the main EXE from root.  Here's what it looks like:

[AutoRun]
open=Autorun.exe
icon=Presentation\Show.exe,0

More interesting is the autorun.exe binary, which has the following attributes:

Date of compilation 2009.12.23 13:37:33 (GMT) Size 62464 bytes MD5 6fe6c03b938580ebf9b82f3b9cd4c4aa

The program starts by checking the current user's privileges. If the current user has no administrative rights, it tries to elevate privileges using three different exploits for vulnerabilities in the Windows kernel. These vulnerabilities were patched by the following Microsoft patches:

• MS09-025
• MS12-034
• MS13-081

Considering the date the CDROM was shipped, it means that two of the exploits were zero-days. It's notable that the code attempts different variants of kernel exploits, and does so in a loop, one by one, until one of them succeeds. The exploit set from the sample on the CDROM includes only three exploits, but this exploitation package supports the running of up to 10 different exploits, one after another. It's not clear whether this means that there is also a malware with 10 EoP exploits in it, or whether it's just a logical limitation.

The code has separate payloads for Windows NT 4.0, 2000, XP, Vista and Windows 2008, including variations for certain service pack versions. In fact, it runs twice: firstly, to temporarily elevate privileges, then to add the current user to the local administrators group on the machine, for privilege elevation persistence.

Such attacks were crafted only for important victims who couldn't otherwise be reached #EquationAPT #TheSAS2015

If these actions are successful, the module starts another executable from the disk, rendering the photo slideshow with pictures from the Houston conference.

At the end, just before exiting, the code runs an additional procedure that does some special tests. If the date of execution fell before 1 July 2010 and it detects no presence of Bitdefender Total Security 2009/2010 or any Comodo products, it loads an additional DLL file from the disk named "show.dll", waits for seven seconds, unloads the DLL and exits.

If the date fell after 1 July 2010, or any of the above products are installed, it drops execution immediately.

The "Show" Begins – introducing DoubleFantasy

The main loader and privilege escalation tool, "autorun.exe" fires up a special dropper, which is actually an Equation Group DoubleFantasy implant installer. The installer is stored as "show.dll" in the "Presentation" folder of the CDROM.

The DLL file has the following attributes:

Date of compilation 2009.03.20 17:42:21 (GMT) Size 151'552 bytes MD5 ef40fcf419954226d8c029aac8540d5a Filename show.dll Short Description DoubleFantasy installer

First it locates data in the resource section, unpacks (UCL) and XOR-decrypts configuration data from one of the resources.

Next it creates the following registry keys:

• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}
• HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}\Version

After that it sets the (Default) value for "Version" subkey as "008.002.000.003", which identifies the implant version.

It also attempts to self-delete on the next reboot, which fails if it's started from the CD.

When run by the exploitation package "Autorun.exe", the program already has administrative privileges from one of the three exploits. However, the code checks again if it's running with administrative privileges, and attempts to elevate using just two kernel vulnerabilities:

• MS09-025
• MS12-034

This indicates that the DoubleFantasy installer has been designed to run independently from the disk from Houston with its "Autorun.exe".  In fact, we've observed the independent use of the DoubleFantasy installer in other cases as well.

The installer checks for security software using a list of registry keys and values stored in the resource section. The keys are checked in quite a delicate "non-alarming" way using key enumeration instead of direct key access. List of top level keys checked:

• HKLM\Software\KasperskyLab\protected\AVP7\profiles\Behavior_Blocking\profiles\pdm\settings
• HKLM\Software\KasperskyLab\AVP6\profiles\Behavior_Blocking\profiles\pdm\settings
• HKLM\Software\Agnitum\Outpost Firewall
• HKLM\Software\PWI, Inc.
• HKLM\Software\Network Ice\BlackIce
• HKLM\Software\S.N.Safe&Software
• HKLM\Software\PCTools\ThreatFire
• HKLM\Software\ProSecurity
• HKLM\Software\Diamond Computer Systems
• HKLM\Software\GentleSecurity\GeSWall

If any of them exist, the installer will mark the system by setting a special registry key:  HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}\MiscStatus

The mark will be in the form of {CE0F7387-0BB5-E60B-xxxx-xxxxxxxxxxxx} for the (Default) value data and will then exit.

If no security software is identified, it will unpack (UCL) and XOR-decrypt the main payload, which is extracted into %system%\ee.dll.

The module looks as if it was built using a set of components or libraries that perform:

• Privilege escalation (it seems to be an early version of the same lib used in autorun.exe)
• Security software detection
• Resource parsing and unpacking

This library code supports Win9x and the Windows NT family from NT4.0 to NT6.x. It should be mentioned that these libraries are not very well merged together. For instance, some parts of the code are unused.

Here's what the DoubleFantasy decoded configuration block looks like:

Decoded DoubleFantasy configuration block

Some of the C&Cs from DoubleFantasy configuration:

• 81.31.34.175 (Czech Republic)
• 195.128.235.231 (Italy)

The DoubleFantasy malware copied into the victim's machine has the following properties:

Date of compilation 2009.03.31 15:32:42 (GMT) Size 69'632 bytes MD5 b8c0eb946de83fe8440fefbacf7de4a2 Filename ee.dll Short Description DoubleFantasy implant

It should be noted that both the installer and the malware appear to have been compiled several months before "autorun.exe" from the CDROM, suggesting that they are more or less generic implants. It also suggests that the "autorun.exe" was probably compiled specially for the CDROM-based attack.

The DoubleFantasy Malware is the first step in the infection of a victim by the #EquationAPT Group #TheSAS2015

The Equation Group's DoubleFantasy implant is a validator-style Trojan which sends basic information about the system to the attackers. It also allows them to upload a more sophisticated Trojan platform, such as EquationDrug or GrayFish. In general, after one of these sophisticated platforms are installed, the attackers remove the DoubleFantasy implant. In case the victim doesn't check out, for example, if they are a researcher analysing the malware, the attackers can simply choose to uninstall the DoubleFantasy implant and clean up the victim's machine.

In fact, there are several known versions of the DoubleFantasy payload. The disk from Houston used version 8.2.0.3; while other versions were mostly delivered using web-exploits.

Decrypting configuration blocks from all known DoubleFantasy samples, we obtained the following internal version numbers:

• 8.1.0.4 (MSREGSTR.EXE)
• 008.002.000.006
• 008.002.001.001
• 008.002.001.004
• 008.002.001.04A (subversion "IMIL3.4.0-IMB1.8.0")
• 008.002.002.000
• 008.002.003.000
• 008.002.005.000
• 008.002.006.000
• 011.000.001.001
• 012.001.000.000
• 012.001.001.000
• 012.002.000.001
• 012.003.001.000
• 012.003.004.000
• 012.003.004.001
• 013.000.000.000

Interestingly, the most popular versions are 8 and 12:

We will describe some of the versions that we managed to discover including 8.2.0.3, 8.1.0.4 and 12.2.0.1.

DoubleFantasy Payload v.8.2.0.3 Md5 b8c0eb946de83fe8440fefbacf7de4a2 Size 69'632 bytes Type Win32 GUI DLL Timestamp Tue Mar 31 14:32:42 2009 (GMT) Filenames ee.dll, actxprxy32.dll

This module uses a technique known as DLL COM hijacking which provides a capability to load the code in different processes.

Initialization

First of all, it checks if the running module is named "ee.dll" and, if so, will undertake the final installation steps:

• Try to find configuration settings in registry key HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}\TypeLib, in value "DigitalProductId". If this value exists it decodes it using base64 and decrypts using RC5 (with a 16-bytes HEX key: 66 39 71 3C 0F 85 99 81 20 19 35 43 FE 9A 84 11).
• It copies itself to one of the two variants of filenames. Then it substitutes one of the system components by renaming and replacing the original.
Original File Registry Key Registry Value New Value
(Variant 1)
New Value
(Variant 2)
linkinfo.dll HKLM\System\CurrentControlSet\ Control\SessionManager\KnownDLLs LINKINFO LI.DLL LINK32.DLL hgfs1.dll HKLM\SYSTEM\CurrentControlSet\ Services\hgfs\networkprovider ProviderPath hgfs32.dll hgfspath.dll midimap.dll HKLM\SOFTWARE\Microsoft\ Windows NT\CurrentVersion\Drivers32 midimapper midimapper.dll midimap32.dll actxprxy.dll HKCR\CLSID\ {C90250F3-4D7D-4991-9B69-A5C5BC1C2AE6}\ InProcServer32 (Default) actxprxy32.dll actxprxyserv.dll
• Set 64-bit value from config to (Default) value of HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}\TypeLib key in form of {8C936AF9-243D-11D0-xxxx-xxxxxxxxxxxx}, it seems to be used later as victim ID when connecting to C&C server.
• Set (Default) value of HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}\Version to "008.002.000.003" string.
• Upon the creation of a key it performs additional steps to set KEY_ALL_ACCESS rights for Everyone.
• Update start time, encode and write back config to registry value HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}\DigitalProductId

If an error occurs, it sets HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{6AF33D21-9BC5-4f65-8654-B8059B822D91}\MiscStatus\(Default) value to "0". Registry value {CE0F7387-0BB5-E60B-8B4E-xxxxxxxxxxxx} then contains xor-encrypted error code.

If there is an initialization error, if the hosting process is "explorer.exe" or "avp.exe", it supresses any exceptions and continues execution. This could indicate that if there were any errors in these processes they must not be shut down because of them.

To correctly hijack the replaced COM objects, the code exports a set of functions bound to original DLL files.

DllGetClassObject = actxprxy.DllGetClassObject
DllRegisterServer = actxprxy.DllRegisterServer
DllUnregisterServer = actxprxy.DllUnregisterServer
DriverProc = midimap.DriverProc
GetProxyDllInfo = actxprxy.GetProxyDllInfo
NPCancelConncection = hgfs1.NPCancelConncection
NPCloseEnum = hgfs1.NPCloseEnum
NPEnumResource = hgfs1.NPEnumResource
NPFormatNetworkName = hgfs1.NPFormatNetworkName
NPGetCaps = hgfs1.NPGetCaps
NPGetConnection = hgfs1.NPGetConnection
NPGetResourceInformation = hgfs1.NPGetResourceInformation
NPGetResourceParent = hgfs1.NPGetResourceParent
NPOpenEnum = hgfs1.NPOpenEnum
modMessage = midimap.modMessage
modmCallback = midimap.modmCallback

The implants periodically run checks against a special file defined in config. If that file has changed since the last check, or at least a week has passed since the last check, it does the following:

• Perform a connectivity check via public domains (specified in config, i.e. "www.microsoft.com" and "www.yahoo.com") using HTTP POST requests.
• If Internet access is available, connect to one of two C&C IPs or hostnames (specified in config: i.e. 81.31.34.175 and 195.128.235.23). Standard HTTP/HTTPS ports 80 and 443 are probed.
• Send a POST request to the C&C with additional headers "EIag: 0d1975bfXXXXXXXX9c:eac',0Dh,0Ah" – where XXXX XXXX – is part of ClientID
• Request additional data: victim ID, version, MAC address. The data is encrypted using RC5 and encoded using Base64. (RC5 key: 8B 4C 25 04 56 85 C9 75 06 33 C0 5E C2 08 31 F6).

The C&C communication code performs the following:

• Received data is decoded using Base64 and decrypted using RC5. The result is interpreted as a backdoor command.
• Results of the command execution are sent back to the C&C. It then attempts to fetch the next command from the server.
• Uninstalls itself if it can't connect to the C&C server within 180 days (configurable).

The following commands are supported by the backdoor:

Cmd code Command Name Description Download&Run Group J (0x4a) Create File Create an empty file; if file already exists get its size. D (0x44) Append File Append chunk of data to a file (created by the "J" cmd). V (0x56) Run or Copy

Check CRC16 of file received via D command, delete it if the check fails.
Depending on the commands flag:

• Copy file to a new location
• Load file as a DLL
• Start file as a new process
Upload Group K (0x4b) Get File Size Get file size. S (0x53) Read File Read file specified by 'K' command, send it to C&C. It can delete the file after transfer (under some condition). Service Group ` (0x60) Get Info Collect info (IP and MAC addresses, implant version, system proxy server, Windows Registered Owner and Organization, Windows version and ProductID, Locale/Language and Country, Windows directory path, connection type, list of all HKLM\Software subkeys). p (0x70) Set Victim ID Prepare to change Victim ID. u (0x75) Set Interval Change C&C connection interval (seven days by default). v (0x76) Set C&C IP Change primary C&C IP address. x (0x78) Set File Path Change path and name of File-under-inspection. (0x80) Read File Delete file specified in command. B (0x42) Reset Victim ID Change Victim ID to the one set by Set Victim ID command:
Subcmd 0 – reconnect to C&C
Subcmd 1 – reset RC5 context
Subcmd 2 – uninstall DoubleFantasy Payload v.8.1.0.4 Location %System%\MSREGSTR.EXE MD5 9245184228af33d3d97863daecc8597e Size 31'089 Type Win32 GUI EXE Timestamp Wed Mar 22 18:25:55 2006 (GMT) Version Info FileDescription  Registration Software
CompanyName  Microsoft Corporation
FileVersion        4.00.950
InternalName    MSREGSTR
OriginalFilename  MSREGSTR.EXE

Compared to version 8.2, version 8.1 implements the same tasks slightly differently.

Differences:

• This is an EXE file running as a service process.
• Configuration data stored in the overlay of the file, instead of in resources.
• Other registry keys are used as a config storage – set of subkeys under HKLM\Software\Microsoft\Windows\CurrentVersion\Setup\Common
• RC6 encryption and Base64 encoding is not used. The network traffic data is sent in plaintext or simply XOR-encrypted.
• The number of supported remote commands is only four.
• The command encoding type is different.
• Supports Windows 9x family.
DoubleFantasy Payload v.12.2.0.1 Location %System%\actxprxy32.dll MD5 562be0b1930fe5de684c2c530619d659
769d099781220004540a8f6697a9cef1 Size 151552 Type Win32 GUI DLL Timestamp Wed Aug 04 07:55:07 2004 (GMT), probably fake

The implementation of version 12.2 is similar to version 8.2, although it is twice the size due to the addition of a big new library.

The main purpose of this new library to steal user names and passwords from:

• live running Internet Explorer or Firefox browser memory
• Internet Explorer proxy configuration, stored in the Windows registry
• Windows protected storage (up to Windows XP)
• Windows authentication subsystem (Vista+)

In addition to browsers, the library can also inject malicious code and read the memory of other processes in order to obtain and decrypt users' passwords. The same library is also used inside the main EQUATIONDRUG orchestrator and TRIPLEFANTASY modules.

The library gathers stolen credentials and then probes them when accessing proxy server while connecting to the Internet, and, if a probe was successful, the valid credentials are encrypted with RC6 and encoded with BASE64 to be used later.

In this version the data encryption RC6 key is:
66 39 71 3C 0F 85 99 81 20 19 35 43 FE 9A 84 11

The traffic encryption RC6 key is:
32 EC 89 D8 0A 78 47 22 BD 58 2B A9 7F 12 AB 0C

The stolen user data is stored in the Windows registry as @WriteHeader value, inside two random keys in the   HKLM\SOFTWARE\Classes\CLSID\{77032DAA-B7F2-101B-A1F0-01C29183BCA1}\Containers node

Summary

The disk used in the Houston attack represents a rare and unusual operation for the Equation Group. We presume that such attacks were crafted only for important victims who couldn't otherwise be reached, for instance, through a web-based attack vector. This is confirmed by the fact that the exploitation library had three exploits inside, two of which were zero-days at the time.

The DoubleFantasy Malware is usually the first step in the infection of a victim by the Equation Group. Once the victim has been confirmed by communicating with the backdoor and checking various system parameters, a more sophisticated malware system is deployed, such as EquationDrug or Grayfish.

During the upcoming blogposts, we will continue to describe the more sophisticated malware families used by the Equation Group: EquationDrug and GrayFish.

### Never respond to an email asking for personal information

SANS Tip-of-the-Day - Wed, 02/18/2015 - 21:44

SANS Tip-of-the-Day - Tue, 02/17/2015 - 20:46

### BE2 Extraordinary Plugins, Siemens Targeting, Dev Fails

Malware Alerts - Tue, 02/17/2015 - 18:37

Our November post introducing our BlackEnergy2 (BE2) research described new findings on the group's activity. We presented both details on their plugins and significant findings about some of their targets and victims. In this post, let's examine several additional plugins more closely, targeting details around BE2 Siemens exploitation, and some of their unusual coding failures.

We previously introduced an unknown set of plugins and functionality for the linux platform, six in total. For the windows platform, we collected 17 plugins. The last post noted the difficulty in collecting on this group. We finish descriptions for our set in this post.

bs
cert
dstr
fs
grc
jn
kl
prx
ps
rd
scan
sn
ss
tv
upd
usb
vsnet

We also collected plugins for the MIPS/ARM architectures, as noted in the previous BE2 post.

weap
ps
nm
snif
hook
uper

Extraordinary Functionality

Let's first examine some of the newest and most surprising Windows plugins. It's interesting that all of these plugins use a custom "FindByHash" function to evade detection schemes and to slow analysis...

The "Destroy" plugin, dstr

8a0a9166cd1bc665d965575d32dfa972
dstr.dll, 26,474 bytes
CompiledOn: 2014.06.17 08:42:43

The most troubling plugin in the list is the "dstr" plugin. It is a Windows-only plugin. It was used to overwrite data by the BE2 actor, destroying data stored on hard drives by overwriting file contents. While its use may be intended to cover their tracks, it is heavy handed to use this type of tool to cover one's tracks in a network. Most likely it is a tool of sabotage, much like the Destover wiper seen on Sony Pictures Entertainment's networks. However, it's interesting that the BE2 developers created wiper code different from the Destover and Shamoon wiper malware we saw in the Saudi Aramco and SPE attacks. Instead of re-using the commercial EldoS RawDisk drivers in their malware, the BE2 developers wrote their own low-level disk and file destruction routines. It's also a much more chilling deployment of wipers - instead of a poorly defended media studio, it was delivered to ICS environments.

In order to overwrite stored data on all Windows versions, the dstr plugin supports both user-mode and kernel-mode wiper functionality, which is somewhat surprising. The component maintains both an embedded win32 library and win64 driver modules for its kernel mode functionality. They are rc4 encrypted.

User-mode functionality

The plugin identifies device id's for the system's HDD and creates a handle to the system's physical drive, with "GENERIC_READ or GENERIC_WRITE" access. Several calls to DeviceIoControl collects data on the physical location of the volume, and the size and properties of this disk. It uses DeviceIoControl with the IOCTL_DISK_GET_DRIVE_GEOMETRY control code in order to retrieve Bytes Per Sector value. dstr then wipes out all open handles to the disk by dismounting it with the FSCTL_DISMOUNT_VOLUME control code.

This routine prepares the system for overwrite and ensures no conflicts for plugin file I/O. Then it makes multiple WriteFile calls to write a zeroed out buffer to disk.

The dstr plugin maintains code for unlocking and deleting the BE2 driver from disk, furthering the group's goal of keeping their traces hidden from researchers. And notice the FindByHash set of calls above, this sfc_os call disables Windows File Protection for a minute while an application can delete or modify the locked file. So this plugin and its call can proceed and delete the driver.

The plugin looks over all the services in the %system32%\drivers folder and checks the write permission. If access is provided, it unlocks the file, rewrites the embedded driver under the existing driver name and launches it.

Drivers and kernel mode functionality

Decrypted 32-bit driver

c4426555b1f04ea7f2e71cf18b0e5b6c
driver.sys, 5,120 bytes
2014.06.10 13:12:22 GMT

Decrypted 64-bit driver

2cde6f8423e5c01da27316a9d1fe8510
driver.sys, 9,136 bytes
2014.06.10 13:12:04 GMT

The 32-bit and 64-bit drivers are identical and compiled from the same source code. These small Windows drivers are supposed to support FAT32 and NTFS file systems, and contain two large code implementation mistakes. In spite of these flaws, it is clear that the author's goal was to parse a file system and then write random data across files.

Extraordinary Fails

These coding fails are unique to this dstr plugin, suggesting a development team effort behind the plugin set code.

Fail #1: The authors reversed the routines for FAT32 and NTFS data wiping when checking the presence of the "FAT32" string in the first 1024-bytes of the system drive.

Fail #2: In the FAT32 routine the Root Directory Sector Number is calculated and is dealt as the absolute offset inside the file rather than next multiplying this number by the bytes per sector

In comparison, there is no such mistake in the NTFS routine and the calculation of the MFT offset is implemented properly:

Goal - File Content Corruption

Apart from that, it is interesting that the authors implement NTFS wiping in an unusual way with strange logic compared to FAT32 'straightforward' wiping. The plugin accomplishes checks for FILE records and at first skips them. Then under certain conditions it rewrites non-FILE record sectors with random buffer which probably corresponds to some file contents and proceeds looping. Then it ends up rewriting the first sectors of MFT and MFT mirror.

ee735c244a22b4308ea5d36afee026ab
grc.dll, 15,873 bytes
2013.09.25 07:19:31

This plugin creates a backup communications channel to yet another legitimate service. Most likely this backup channel is used to cloak outbound communications on monitored networks. We have seen APT using everything from Twitter to Google Docs to hide communications in plain sight, and this time the abused service is Google Plus.

This plugin implements the standard Windows HTTP services to interact with Google Plus over https, seeking to find a png file.

The plugin is provided with a specific Google Plus id to connect with, and uses the OLE stream Windows structured storage API along with the GDI+ bitmap functions to handle and parse this png file. This png file content is actually encrypted data containing the new BE configuration file just as it was obtained using 'normal' C&C communication.  It is encrypted with RC4, just like the embedded dstr drivers. But unlike to the 'typical' RC4 BE decryption scheme that uses RC4 once, here it uses RC4 three times: once with hardcoded key found in the grc binary, the second time using the key extracted from the previous decrypted result, and the third time using the 'id' machine's identifier that is normally served as the encryption key during the C&C communication.

Universal serial bus data collection plugin, usb

0d4de21a2140f0ca3670e406c4a3b6a9
usb.dll, 34,816 bytes
2014.03.21 07:02:48

The usb plugin collects all available information on connected USB drives, and writes out all of these details to a text file, packs it, provides to the main BlackEnergy code, which communicates to a c2.

It uses multiple api calls to collect information on multiple types of connected usb storage devices. It enumerates all usb storage devices connected to the system and retrieves data from all, including SCSI mass storage devices. And, most interestingly, it may be the first implementation of BadUSB-related techniques in APT re-purposed COTS malware that we have seen in the wild.

The code queries scsi devices directly and sends them two types of SCSI commands. The first command with the opcode 0x1A which corresponds to MODE SENSE may result just in the logging of the failed call ('SendSCSICommand return false' message).

The second type of SCSI command remains mysterious. It uses undefined opcode 0xf0 and there is no direct evidence of its purpose as it is stated to be vendor specific. This mysterious opcode is referenced around the same time frame of the plugin development in BadUSB offensive research http://algorithmics.bu.edu/twiki/bin/view/EC521/SectionA1/Group5FinalReport. Here, it is noticed in the USB traffic generated by an SMI controller tool. To be specific, there are two calls with the opcode 0xf0 in the code, each passed its own parameters. One of the parameters, 0x2A, is mentioned in the paper to return the string containing the firmware version, NAND flash ID, and controller part number. But this returned information is not logged anywhere.

Also the code loops to retrieve detailed physical data about every attached storage device:

• number of cylinders
• media type (floppy, fixed hard drive, removable media, etc)
• number of tracks per cylinder
• sectors per track
• number of bytes per sector
• physical disk size in bytes
• Device Instance ID

Motherboard and firmware data collection plugin, bios

4747376b00a5dd2a787ba4e926f901f4
bs.dll, 210,432 bytes
2014.07.29 00:40:53

The bios plugin gathers low level host system information:

• BIOS
• motherboard
• processor
• OS

It uses several techniques to gather this information:

• WMI
• CPUID
• win32 api

As a Windows Management Instrumentation (WMI) client application, it initializes COM and connects to the \\root\cimv2 namespace to use the IWbemServices pointer and make WMI requests. The code executes wql queries ("wql" is "sql for wmi", a subset of sql) to gather victim host details, like the query "SELECT Description, Manufacturer, Name, ProcessorId FROM Win32_Processor". Here are several queries from the BlackEnergy2 plugin code:

• SELECT Description, Manufacturer, Name, ProcessorId FROM Win32_Processor
• SELECT Product, Manufacturer, Version FROM Win32_BaseBoard
• SELECT Name, OSArchitecture, Version, BuildNumber FROM Win32_OperatingSystem
• SELECT SerialNumber, Description, Manufacturer, SMBIOSBIOSVersion FROM Win32_BIOS

These wql calls provide the attacker with the data like the lines below:

Description=Intel64 Family 6 Model 60 Stepping 3
Manufacturer=GenuineIntel
Name=Intel(R) Core(TM) i7-4710MQ CPU @ 2.50GHz
ProcessorId=1FEAFBCF000116A9

Product=7MPXM1
Manufacturer=AsusTek
Version=??

Name=Microsoft Windows 8.1 Pro
OSArchitecture=64-bit
Version=6.3.9600
BuildNumber=9600

SerialNumber=7DTLG45
Description=A12
Manufacturer=AsusTek
SMBIOSBIOSVersion=A12

This selectivity is fairly usual. And the plugin does not modify its own behavior based the collected values. What can we infer about the selection of only these values, as they are only being collected and sent back to the attackers? Here are some possibilities:

• the attackers want to evade sandbox and honeypot/decoy environments, and use this collected data to id the host system.
• the attackers have prior knowledge of the environment they are attempting to penetrate, down to the equipment make. Or, they have an idea of the types of hardware they would expect or want to see. In ICS and SCADA environments, these details could be very valuable for an attacker setting up shop. These details could aid in establishing persistence, evaluating true resource capacity and capabilities, tracking down the source of the equipment, or aiding further lateral movement
• the attackers know nothing about the network they are penetrating. They are collecting this information to better understand where this plugin really is running in the victim environment and planning their next moves

When using standard win32 api, the application implements calls to retrieve information on system locales. Oddly, there is special handling for one nordic locale in this particular plugin, "Norwegian-Nynorsk".

The CPU data collection functionality first calls the Intel cpuid instruction directly. It also directly handles multi-cpu systems and each of their feature sets. This SMP support is hard coded into the plugin.

Targeting details for BE2 actor events are interesting. When focusing on research sites and energy engineering facilities, the group remotely exploited Siemens' Simatic WinCC systems. In these events, the attackers attempted to force the ccprojectmgr.exe process to download and execute a specific BlackEnergy2 payload. Let's examine a couple of example targets here. Based on the different delays for return, the attacks were possibly not automated.

Target A:

The first exploit attempt ksn recorded was March 2014. The attackers returned with a second failed attempt to exploit that same research system on April 2014, approximately 30 days, 2 hours later.

Target B:

The BE2 actor then attacked a new target system in May 2014 and failed, and returned with an exploit attempt on that same system in July 2014.

So it looks like there may be a timing cycle to their visits, but the volumes here are too low to be significant.

In all four of these attempts on two different targets, the attackers tried to download their payload from hxxp://94.185.85(dot)122/favicon.ico. The payload changed slightly from March 2014 to the very end of July 2014, presenting the following md5(s). All of these droppers are BE2 malware, modify an existing kernel driver service like "ACPIEC" and start it to load the BE2 kernel module. Note that the attackers planned on re-using the same c2 for the first target, but changed the callback c2 for the second target. None of these components are signed:

fda6f18cf72e479570e8205b0103a0d3 → drops df84ff928709401c8ad44f322ec91392, driver, debug string:"xxxxxxxx.pdb". C2: 144.76.119.48 (DE, Hetzner Online AG, AS24940)
fe6295c647e40f8481a16a14c1dfb222 → drops 39835e790f8d9421d0a6279398bb76dc, driver, debug string:"xxxxxxxx.pdb". C2: 144.76.119.48 (DE, Hetzner Online AG, AS24940)
ac1a265be63be7122b94c63aabcc9a66 → drops b973daa1510b6d8e4adea3fb7af05870, driver. C2: 95.143.193.131 (SE, Internetport Sweden AB, AS49770)
8e42fd3f9d5aac43d69ca740feb38f97 → drops f4b9eb3ddcab6fd5d88d188bc682d21d, driver. C2: 46.165.222.6 (DE, Leaseweb Germany GmbH, AS16265)

### The Desert Falcons targeted attacks

Malware Alerts - Tue, 02/17/2015 - 12:50

The Desert Falcons are a new group of Cyber Mercenaries operating in the Middle East and carrying out Cyber Espionage across that region. The group uses an arsenal of homemade malware tools and techniques to execute and conceal its campaigns on PC and Mobile OS.

#FalconsAPT is the 1st known campaign to be fully developed by Arabic #hackers to target the Middle East #TheSAS2015

The first Desert Falcons operations were seen in 2011 and the group made its first infections in 2013. By the end of 2014 and beginning of 2015 the group was very active.

Full report

The full report can be found here.

FAQ Where are the Victims Located?

There are more than 3,000 victims in 50+ countries. Most of them are found in Palestine, Egypt, Israel and Jordan, but others have been discovered in Saudi Arabia, the UAE, the US, South Korea, Morocco, Qatar and others.

Who are the Victims?

The attacks targeted several classes of victim, including Military and Government organizations, employees responsible for health organizations, combating money laundering, economic and financial institutions, leading media entities, research and educational institutions, energy and utilities providers, activists and political leaders, physical security companies and other targets that have access to important geopolitical information.

How are the victims infected?

Malware writers use a variety of technical and social engineering methods to deliver their files and encourage victims to run them, creating an effective infection vector. Examples include a fake website that promises to publish censored political information and asks users to download a plugin to view a video (the plugin contains the malware). Another example involves the use of spear phishing emails or social network messages to deliver malicious files using an extension override (e.g. malicious files ending with .fdp.scr would appear .rcs.pdf).

Sample of documents and videos used in spear phishing

What are the goals of the operations?

The attackers are looking for sensitive intelligence information that could help them in further operations or even extortion. The victims are targeted for the secrets in their possession or intelligence information relating to their positions in governments or important organizations.

More than 1 million files were stolen from victims. Stolen files include diplomatic communications from embassies, military plans and documents, financial documents, VIP and Media contact lists and files.

Who are the attackers and what do we know about them?

The Desert Falcons operators are native Arabic speakers. There are about 30 of them working in three teams. Some of their identities are already known. The attackers are running three campaigns to target different types of victim.

Where are the attackers based?

The attackers are based in Palestine, Egypt and Turkey.

Which malware do they use to infect their victims?

There are three main backdoors used to infect victim devices:

Computer backdoors

• The Main Falcons Trojan
• The DHS* Spyware Trojan

Computer Backdoors give the attackers full scope to use keyloggers and screenshotters, access files and even make audio recordings. DHS naming is used by the attackers to describe the nickname initials of one of the developers (D** H*** Spyware).

Mobile Backdoor

• A mobile backdoor targeting Android devices.

How did you become aware of this threat? Who reported it?

We became aware of the threat during an incident investigation in the Middle East.

Is it still active?

The operation is very active and is currently in peak condition. We are continuously identifying new samples and victims for all related campaigns.

How is this different from any other Cyber espionage attacks?

Desert Falcons are the first known Cyber espionage attacks to be fully developed and operated by Arabic speakers to target the Middle East. It has affected a stunning range of victims, stealing more than 1 million special files.

Is this a nation-state sponsored attack?

The profiles of the targeted victims and the apparent political motives behind the attacks make it possible that Desert Falcons operations could be nation state sponsored. At present, though, this cannot be confirmed.

Why this name?

The falcon is a rare bird that has been highly prized for a centuries in desert countries in the Arab world.  It is a symbol of hunting and sharp vision. The Desert Falcons are proficient cyberhunters with carefully chosen targets, all of whom are thoroughly investigated before the attack and closely watched after being infected.

How can users protect themselves?

Kaspersky Lab products detect and block all variants of the malware used in this campaign:

Trojan.Win32.DesertFalcons
Trojan-Spy.Win32.Agent.cncc
Trojan-Spy.Win32.Agent.ctcr
Trojan-Spy.Win32.Agent.ctcv
Trojan-Spy.Win32.Agent.ctcx
Trojan-Spy.Win32.Agent.cree
Trojan-Spy.Win32.Agent.ctbz
Trojan-Spy.Win32.Agent.comn
Trojan.Win32.Bazon.a

### A Fanny Equation: "I am your father, Stuxnet"

Malware Alerts - Tue, 02/17/2015 - 04:00

At the Virus Bulletin conference in 2010, researchers from Kaspersky Lab partnered with Microsoft to present findings related to Stuxnet. The joint presentation included slides dealing with various parts of Stuxnet, such as the zero-days used in the attack.

Perhaps the most interesting zero-day exploit from Stuxnet was the LNK exploit (CVE-2010-2568). This allowed Stuxnet to propagate through USB drives and infect even machines that had Autorun disabled.

It was discovered during the 2010 research into Stuxnet that the LNK exploit has earlier been used in another malware, supposedly a Zlob PE, that pointed to "fanny.bmp".

Back in 2010, very few people paid much attention to a piece of malware that used the LNK exploit prior to Stuxnet. Zlob is a large malware family and these kinds of crimeware-grade samples are rarely of interest to researchers digging into zero-days and nation-state sponsored operations.

However, during our 2014 research into the Equation group, we created a special detection for the group's exploitation library, codenamed "PrivLib". To our surprise, this detection triggered a worm from 2008 that used the Stuxnet LNK exploit to replicate, codenamed Fanny.

What's so Fanny?

This PrivLib-boosted Worm, which spreads using the Stuxnet LNK exploit and the filename "fanny.bmp" was compiled on Mon Jul 28 11:11:35 2008, if we are to trust the compilation timestamp. It arrived in our December 2008 collection from the wild, so the compilation might very well be correct.

"Fanny my name" could be an introductory message from the authors

The 2008 "Fanny.bmp" Worm is detected by Kaspersky Lab products as Trojan-Downloader.Win32.Agent.bjqt. The malware includes the LNK exploit, which means that it is a piece of malicious software that used the Stuxnet LNK exploit before Stuxnet!

The second Stuxnet exploit (MS09-025)

If one piece of malicious software that used an exploit from Stuxnet before Stuxnet is a good catch, a second Stuxnet exploit makes it even more interesting.

The second exploit used to be a zero-day when Fanny was operational. This means that Fanny used two zero-days to replicate, both of which were later used by Stuxnet. The specific vulnerability used for privilege escalation was patched with MS09-025:

"The security update addresses these vulnerabilities by correcting the methods used for validating a change in specific kernel objects, for validating the input passed from user mode to the kernel, and for validating the argument passed to the system call. The security update also addresses a vulnerability by ensuring that the Windows kernel cleans up pointers under error conditions."

The same exploit was later used in an early Stuxnet module from 2009, which was embedded into a large binary built using the Flame platform. That Stuxnet module, also known as "atmpsvcn.ocx" or Resource 207 was the technical link between Stuxnet and Flame. This story has previously been covered in our post.

#Fanny used two zero-days to replicate, both of which were later used by #Stuxnet #EquationAPT #TheSAS2015

While the vulnerability exploited by both the Stuxnet/Flame module and Fanny is the same, the implementation of the exploit is different. The exploit in Stuxnet targets a specific OS version, while Fanny is designed to be universal and is capable of running on multiple platforms. It has a unique shellcode and exploit-triggering procedures for:

• Windows NT 4.0
• Windows 2000
• Windows XP
• Windows 2003
• Windows Vista, 2008 and possibly others from NT6.x family

The implementation of the exploit in Fanny is more complex than in Stuxnet: instead of running just one payload the authors created a framework to run as many payloads as they want by replacing a system service call dispatcher nt!NtShutdownSystem with their own custom pointer from  theuser-space as shown in the next figure.

Fanny injected its own system service call dispatcher

This enables a persistent trampoline from user-mode to kernel-mode. This feature was not present in the Stuxnet module but there are other similarities. For instance, it seems that both the developers of Stuxnet and of Fanny follow certain coding guidelines such as the usage of unique magic numbers from each function call. Most of the returned results are simply disposed but they are still part of the code. This could be the remains of a debug version of the code which could potentially log every step in the code to ease the tracking down of an error while testing. In complex systems where kernel and user-space code is running with no interaction this seems a logical and even essential method. Again, it's implemented both in the Stuxnet code and in Fanny. See next figure.

Stuxnet (on the left) and Fanny (on the right) using magic return values

The Fanny Malware

So, what is Fanny essentially? It is a USB Worm with a sophisticated backdoor that uses the so-called "Stuxnet LNK vulnerability" to automatically execute from the USB drive even if Autorun has been disabled. It can elevate privileges to the local System using kernel exploit and drops and registers additional modules. It attempts to connect to a C&C server and deploys additional components if connection is available. If not, it uses the USB drive as a carrier to send/receive requests to and from the operator via a hidden storage area created in raw FAT structure.

Typically a victim plugs in a new USB drive and opens it with Windows Explorer. You can visually observe the two stages of infection from the USB which take seconds to execute.

Fanny modules MD5 0a209ac0de4ac033f31d6ba9191a8f7a Size 184320 Type Win32 DLL Internal name dll_installer.dll Compiled 2008.07.28 08:11:35 (GMT)

This file is a DLL with two exports (to install and uninstall the malware). It contains a xor-encrypted config in binary resource with number 101. The config determines malware behavior: there is a command to deploy malware on the current system, URLs for the C&C server and local filenames and paths used to install embedded malware components.

Fanny components inside the main executable

Upon starting it checks the following mutexes:

• Global\RPCMutex
• Global\RPCMutex

Where is a 1-byte long integer taken from the config. If any of these mutexes exist, the code doesn't run. It means that another instance of the same code is running. InstanceNum most likely identifies a variant or generation of Fanny preventing the same version from reinfecting the system but allowing for different versions to run (possibly to enable enforced update of components).

The module also checks another important byte in its configuration. This byte is a counter that is decreased during successful system infection. When the counter reaches a minimal value of one the module cleans up the USB drive and stops spreading the worm. In this way the attackers limit the maximum length of the Worm's killchain.

If the module is named "fanny.bmp" (the file name that Fanny uses to spread via USB drives) the module self-installs from the USB drive.

As part of the initial infection process Fanny attempts to elevate current privileges if the user has no administrative rights on the current system. It uses a vulnerability patched by MS09-025 for that purpose. Only if the elevation succeeds does the malware attempt to connect to the C&C server using a URL which is stored in the config:

Below is a sample request issued by the malware:

User-Agent: Mozilla/4.0 (compatible;)

The malware expects the C&C server to reply with an HTTP 200 response and append a 0x7f-xored string that has a second stage URL. The second stage response may contain an executable file body which is saved on disk and executed.

The C&C server is currently sinkholed by Kaspersky Lab, but according to our pDNS records it previously pointed to the following IP address:

• 210.81.22.239
IP information

The following describes the stages that were identified during the analysis of the initial and embedded components of Fanny.

Infection

The module searches for fanny.bmp in the root of disk drives starting from drive D: and copies it to the following locations:

• %WINDIR%\system32\comhost.dll
• %WINDIR%\system32\mscorwin.dll

Why does Fanny make two copies of itself? Actually, there is a minor difference between these two files. Fanny patches its config in the resource section of one of the files (comhost.dll). The patched data is the value of remained maximum length of the Fanny killchain. "mscorwin.dll" is the original file copied as-is from the removable drive. So far, one copy is used for infecting other USB drives, the other is loaded on the system boot.

It also copies all *.lnk files from the USB drive to "%WINDIR%\system32\" in order to reuse them when infecting other attached USB drives. Note that there may be more than one LNK file, because each LNK contains a distinct path to the DLL which gets loaded. As far as the letter of a new drive on the target system is unknown, Fanny uses several LNKs for the most common drive letters. This method was improved later in Stuxnet, which used a relative DeviceID-dependent path to the USB drive. However, even that method required several LNK files (up to four) because of different relative paths on different versions of Windows, but that's far fewer than an almost full set of letters from the Latin alphabet.

Persistence

Fanny creates the following registry value to achieve persistence:
HKLM\System\CurrentControlSet\Control\MediaResources\acm\ECELP4\Driver.

This is not a common way to make code start automatically on a system boot and it's extremely invasive, but it guarantees that the module is loaded in the address space of each process in the system, including some critical processes such as lsass.exe and services.exe running as SYSTEM user.

When the module is loaded it checks other values that start from "filter" in the same registry key, i.e.:

• HKLM\System\CurrentControlSet\Control\MediaResources\acm\ECELP4\filter2
• HKLM\System\CurrentControlSet\Control\MediaResources\acm\ECELP4\filter3
• HKLM\System\CurrentControlSet\Control\MediaResources\acm\ECELP4\filter8

The values contain a hosting process name and a path to a DLL or EXE file. If the current process name contains the value set as hosting process, then the module loads a DLL or starts a new process (in case of EXE file) depending on target file extension.

This is a map of the processes and modules that are used in Fanny:

Process Fanny module Short Description winlogon c:\windows\MSAgent\AGENTCPD.DLL USB backdoor explorer c:\windows\system32\shelldoc.dll Windows Explorer rootkit lsass c:\windows\system32\mscorwin.dll USB worm USB Worm

The code of the actual Worm is part of %WINDIR%\system32\comhost.dll export with ordinal 4 (name of export is "dll_installer_4"). The DLL is a modified next-generation Worm which is copied to every attached USB drive with all related LNK files stored in Windows\System32 directory. This module is distributed by mscorwin.dll which is part of the lsass system process.

Windows Explorer Rootkit

The rootkit functionality is provided by a shelldoc.dll file loaded in the Windows Explorer process. It hides some Fanny-related files (LNK-files and fanny.bmp) in Windows Explorer by removing them from the list of items in the foreground window that uses SysListView32 control (normally Windows Explorer window).

Some screenshots with disappearing files were demonstrated previously, however sometimes this approach may raise suspicions. Here is what it looks like if the user opens a system32 directory with Explorer:

Seven Fanny-related file icons disappeared in Windows Explorer

Apparently, it looks as if some of the file icons were cut off. In addition some of standard directories seem to be missing due to a bug in the rootkit code. It appears as if this component was not tested properly by the authors.

There is an interesting part of the code in USB Backdoor DLL which at first glance doesn't make much sense. It takes some hardcoded constants and generates a random value which is saved to a registry key.

Fanny generates random values that are saved to the registry

Then it moves the current executable which is hosting the DLL to c:\windows\system32\msdtc32.exe. After that the executable path is appended to HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell registry value which makes this executable run on system boot.

The trick to mimic the behavior of traditional malware was used to avoid revealing further secret activities #Fanny

This may look like a traditional way for malware to add itself to autostart, but don't be fooled by that. The purpose of this move is to make certain automated systems and software, such as those based on sandboxes and emulators, believe that they have caught some known malware and not to let it run further. It seems that the component is so unique that the authors decided to avoid the risk of looking even more suspect. It might seem a paradox, but the authors prefer this code to be detected as malware if someone is checking it. The trick is to mimic the behavior of some traditional cybercriminal malware, a bot, and get detected as soon as possible, thereby not revealing any further secret activities. Considering that this component was spreading via USB drives and could pop up on many systems, discovering it as a traditional bot would put it in lower risk zone and as a result the malware would probably end up being deleted without proper analysis.

This might explain why this code was detected as a variant of Zlob malware in the past and no one paid proper attention to it.

USB Backdoor

One of the modules, agentcpd.dll, is a backdoor that was designed to work as an advanced reconnaissance tool for air-gapped computers that are normally used in highly secure facilities. The backdoor waits for a USB drive to be plugged in and if that's a new disk, it instantly allocates some space for a hidden container using its own FAT16/FAT32 filesystem driver.

This is what the FAT root directory looks like before and after plugging a USB drive into an infected machine:

Hexdump of raw disk partition before and after plugging into an infected machine

On top of this hexdump the drive label "MYDRIVE" can be found (corresponding hex bytes are underlined with green). It is followed by a single byte flag value (0x08 in hex) which, according to Microsoft, means ATTR_VOLUME_ID. Each entry in this root directory table is 32-bytes long.

Subdirectory entries such as Pictures, Music, Documents and Work occupy 63 bytes, because of the long filename FAT feature. There are two variants of subdirectory names – short and long. A subdirectory entry uses a flag 0x10 following the short directory name, which, according to Microsoft, means ATTR_DIRECTORY.

The last record inserted by Fanny (highlighted in red) uses an invalid directory name and a flag 0x18, which combines ATTR_VOLUME_ID and ATTR_DIRECTORY. This combination of flags is not documented according to current FAT specifications and the whole entry is therefore ignored by filesystem drivers as if it were a data corruption or a bad block. As a result this entry is not visible in Windows, Mac OS and Linux and probably all other implementations of FAT driver.

It's possible that #Fanny was used to map some of the future targets of #Stuxnet #EquationAPT #TheSAS2015

While Fanny doesn't rigorously protect data in hidden storage (it doesn't mark the allocated space as bad blocks, probably to avoid attention), it changes the filesystem driver hint value indicating where to look for the next free cluster. In this way it reserves disk space of approximately 1Mb in size to use for a hidden storage.

When Fanny detects a new USB drive, with the help of its own FAT driver it looks into the root directory and locates the entry which starts with magic value 51 50 40 98 (see above). It then uses the offset which follows the flag value of 0x18. On the figure above it is set to 0x001e9c00. This offset on the same USB disk will have another magic value D0 CF CE CD serving as a marker for the beginning of the hidden storage:

Hexdump of Fanny hidden storage with list of running processes

Once Fanny has allocated space for hidden storage it populates the storage with basic information about the current system: i.e. OS Version, Service Pack number, computer name, user name, company name, list of running processes, etc.

This secret storage is also used to pass commands to computers that are not connected to the Internet. According to Fanny code, the container may carry additional components and internal commands: such as to copy certain file from the local filesystem to the USB drive (locations are defined as parameters, the file is set hidden and system file attributes), or to update the configuration block. It uses RC4 with the following hard-coded key to protect critical information:

18 05 39 44 AB 19 78 88  C4 13 33 27 D5 10 6C 25

When the USB drive travels to another infected computer connected to the Internet it can be used to carry important files and provide a way to interact with the operator. This simple and extremely slow method of communication is not used by traditional cybercriminals, that is why the whole code looks like a toolkit for professional cyberespionage. This component is one of the rare malware samples from a new class of malware called USB-Backdoors.

If you find this or a similar code of USB-Backdoor on some of your systems this is an indicator of a professional cyberattack.

Sinkholing and victim statistics

We sinkholed the Fanny C&C server and collected victim statistics, shown below. In total, we observed over 11,200 unique IPs connecting to the sinkhole server over a period of five months:

At the moment, the vast majority of victims are located in Pakistan (a whopping 59.36%). Indonesia and Vietnam follow at great distance, with 15.99% and 14.17% respectively. The infection numbers in other countries are probably too small to be relevant.

Of course, this could raise the question: was Pakistan the true target of Fanny? To be honest, we do not know. The current infection situation might be different from what it was in 2008-2010. Considering that there are still over ten thousand victims worldwide, the number back in 2009 might have been much, much higher – perhaps even as high as  50,000 infections. It may be relevant that Pakistan is a top target for the Equation group's other malware, along with Russia and Iran.

Conclusion

With Fanny, we begin yet another chapter in the story of Stuxnet, the Equation Group and Flame. Created in 2008, Fanny used two zero-day exploits. These two were added to Stuxnet in June 2009 and March 2010. Effectively, it means that the Equation group had access to these zero-days (and others) years before the Stuxnet group did.

While the true target of Fanny remains unknown, its unique capability to map air-gapped networks and communicate via USB sticks indicate a lot of work went into gaining the ability to access these air-gapped networks. As a precursor for the versions of Stuxnet that could replicate through the network, it's possible that Fanny was used to map some of the future targets of Stuxnet.

Another unusual fact is the very high number of infections coming from Pakistan. Since Fanny spreads only through USB sticks, which is rather slow, this indicates that the infection began in Pakistan, possibly before many other countries.

Was Fanny used to map some highly sensitive networks in Pakistan, for an unknown purpose, or was it used in preparation for Stuxnet? Perhaps time will tell.

### Securing your wireless network - priceless!

SANS Tip-of-the-Day - Mon, 02/16/2015 - 22:00

### Equation: The Death Star of Malware Galaxy

Malware Alerts - Mon, 02/16/2015 - 13:55

"Houston, we have a problem"

One sunny day in 2009, Grzegorz Brzęczyszczykiewicz1 embarked on a flight to the burgeoning city of Houston to attend a prestigious international scientific conference. As a leading scientist in his field, such trips were common for Grzegorz. Over the next couple of days, Mr Brzęczyszczykiewicz exchanged business cards with other researchers and talked about  the kind of important issues such high level scientists would discuss (which is another way of saying "who knows?").  But, all good things must come to an end; the conference finished and Grzegorz Brzęczyszczykiewicz flew back home, carrying with him many highlights from a memorable event. Sometime later, as is customary for such events, the organizers sent all the participants a CDROM carrying many beautiful pictures from the conference. As Grzegorz put the CDROM in his computer and the slideshow opened, he little suspected he had just became the victim of an almost omnipotent cyberespionage organization that had just infected his computer through the use of three exploits, two of them being zero-days.

A rendezvous with the "God" of cyberespionage

It is not known when the Equation2 group began their ascent. Some of the earliest malware samples we have seen were compiled in 2002; however, their C&C was registered in August 2001. Other C&Cs used by the Equation group appear to have been registered as early as 1996, which could indicate this group has been active for almost two decades. For many years they have interacted with other powerful groups, such as the Stuxnet and Flame groups; always from a position of superiority, as they had access to exploits earlier than the others.

The #EquationAPT group is probably one of the most sophisticated cyber attack groups in the world #TheSAS2015

Since 2001, the Equation group has been busy infecting thousands, or perhaps even tens of thousands of victims throughout the world, in the following sectors:

• Government and diplomatic institutions
• Telecoms
• Aerospace
• Energy
• Nuclear research
• Oil and gas
• Military
• Nanotechnology
• Islamic activists and scholars
• Mass media
• Transportation
• Financial institutions
• Companies developing encryption technologies

To infect their victims, the Equation group uses a powerful arsenal of "implants" (as they call their Trojans), including the following we have created names for: EQUATIONLASER, EQUATIONDRUG, DOUBLEFANTASY, TRIPLEFANTASY, FANNY and GRAYFISH. No doubt other "implants" exist which we have yet to identify and name.

The #EquationAPT group interacted with other powerful groups, such as the #Stuxnet and #Flame groups #TheSAS2015

The group itself has many codenames for their tools and implants, including SKYHOOKCHOW, UR, KS, SF, STEALTHFIGHTER, DRINKPARSLEY, STRAITACID, LUTEUSOBSTOS, STRAITSHOOTER, DESERTWINTER and GROK. Incredible as it may seem for such an elite group, one of the developers made the unforgivable mistake  of leaving his username: "RMGREE5", in one of the malware samples as part of his working folder: "c:\users\rmgree5\".

Perhaps the most powerful tool in the Equation group's arsenal is a mysterious module known only by a cryptic name: "nls_933w.dll". It allows them to reprogram the hard drive firmware of over a dozen different hard drive brands, including Seagate, Western Digital, Toshiba, Maxtor and IBM. This is an astonishing technical accomplishment and is testament to the group's abilities.

Over the past years, the Equation group has performed many different attacks.  One stands out: the Fanny worm. Presumably compiled in July 2008, it was first observed and blocked by our systems in December 2008. Fanny used two zero-day exploits, which were later uncovered during the discovery of Stuxnet. To spread, it used the Stuxnet LNK exploit and USB sticks. For escalation of privilege, Fanny used a vulnerability patched by the Microsoft bulletin MS09-025, which was also used in one of the early versions of Stuxnet from 2009.

LNK exploit as used by Fanny

It's important to point out that these two exploits were used in Fanny before they were integrated into Stuxnet, indicating that the Equation group had access to these zero-days before the Stuxnet group. The main purpose of Fanny was the mapping of air-gapped networks. For this, it used a unique USB-based command and control mechanism which allowed the attackers to pass data back and forth from air-gapped networks.

Two zero-day exploits were used by the #EquationAPT group before they were integrated into #Stuxnet #TheSAS2015

In the coming days, we will publish more details about the Equation group malware and their attacks. The first document to be published will be a general FAQ on the group together with indicators of compromise.

By publishing this information, we hope to bring it to the attention of the ITSec community as well as independent researchers, who can extend the understanding of these attacks. The more we investigate such cyberespionage operations, we more we understand how little we actually know about them. Together, we can lift this veil and work towards a more secure (cyber-)world.

Indicators of compromise ("one of each"): Name EquationLaser MD5 752af597e6d9fd70396accc0b9013dbe Type EquationLaser installer Compiled Mon Oct 18 15:24:05 2004 Name Disk from Houston "autorun.exe" with EoP exploits MD5 6fe6c03b938580ebf9b82f3b9cd4c4aa Type EoP package and malware launcher Compiled Wed Dec 23 15:37:33 2009 Name DoubleFantasy MD5 2a12630ff976ba0994143ca93fecd17f Type DoubleFantasy installer Compiled Fri Apr 30 01:03:53 2010 Name EquationDrug MD5 4556ce5eb007af1de5bd3b457f0b216d Type EquationDrug installer ("LUTEUSOBSTOS") Compiled Tue Dec 11 20:47:12 2007 Name GrayFish MD5 9b1ca66aab784dc5f1dfe635d8f8a904 Type GrayFish installer Compiled Compiled: Fri Feb 01 22:15:21 2008 (installer) Name Fanny MD5 0a209ac0de4ac033f31d6ba9191a8f7a Type Fanny worm Compiled Mon Jul 28 11:11:35 2008 Name TripleFantasy   MD5 9180d5affe1e5df0717d7385e7f54386 loader (17920 bytes .DLL) Type ba39212c5b58b97bfc9f5bc431170827 encrypted payload (.DAT) Compiled various, possibly fake   Name _SD_IP_CF.dll - unknown MD5 03718676311de33dd0b8f4f18cffd488 Type DoubleFantasy installer + LNK exploit package Compiled Fri Feb 13 10:50:23 2009 Name nls_933w.dll MD5 11fb08b9126cdb4668b3f5135cf7a6c5 Type HDD reprogramming module Compiled Tue Jun 15 20:23:37 2010 Name standalonegrok_2.1.1.1 / GROK MD5 24a6ec8ebf9c0867ed1c097f4a653b8d Type GROK keylogger Compiled Tue Aug 09 03:26:22 2011 C&C servers (hostnames and IPs): DoubleFantasy: advancing-technology[.]com
avidnewssource[.]com
charging-technology[.]com
computertechanalysis[.]com
config.getmyip[.]com - SINKHOLED BY KASPERSKY LAB
globalnetworkanalys[.]com
melding-technology[.]com
myhousetechnews[.]com - SINKHOLED BY KASPERSKY LAB
newsterminalvelocity[.]com - SINKHOLED BY KASPERSKY LAB
slayinglance[.]com
successful-marketing-now[.]com - SINKHOLED BY KASPERSKY LAB
taking-technology[.]com
techasiamusicsvr[.]com - SINKHOLED BY KASPERSKY LAB
technicaldigitalreporting[.]com
timelywebsitehostesses[.]com
www.dt1blog[.]com
www.forboringbusinesses[.]com EquationLaser: lsassoc[.]com - re-registered, not malicious at the moment
gar-tech[.]com - SINKHOLED BY KASPERSKY LAB Fanny: webuysupplystore.mooo[.]com - SINKHOLED BY KASPERSKY LAB EquationDrug: newjunk4u[.]com
newip427.changeip[.]net - SINKHOLED BY KASPERSKY LAB
ad-servicestats[.]net - SINKHOLED BY KASPERSKY LAB
subad-server[.]com - SINKHOLED BY KASPERSKY LAB
aynachatsrv[.]com
damavandkuh[.]com
fnlpic[.]com
nowruzbakher[.]com
sherkhundi[.]com
quik-serv[.]com
arabtechmessenger[.]net
amazinggreentechshop[.]com
foroushi[.]net
technicserv[.]com
honarkhaneh[.]net
parskabab[.]com
technicupdate[.]com
customerscreensavers[.]com
darakht[.]com
ghalibaft[.]com
247adbiz[.]net - SINKHOLED BY KASPERSKY LAB
webbizwild[.]com
roshanavar[.]com
afkarehroshan[.]com
thesuperdeliciousnews[.]com
goodbizez[.]com
meevehdar[.]com
xlivehost[.]com
gar-tech[.]com - SINKHOLED BY KASPERSKY LAB
honarkhabar[.]com
techsupportpwr[.]com
webbizwild[.]com
zhalehziba[.]com
wangluoruanjian[.]com
islamicmarketing[.]net
noticiasftpsrv[.]com
coffeehausblog[.]com
havakhosh[.]com
bazandegan[.]com
sherkatkonandeh[.]com
mashinkhabar[.]com
charmedno1[.]com
cribdare2no[.]com
dowelsobject[.]com
following-technology[.]com
forgotten-deals[.]com
housedman[.]com
industry-deals[.]com
listennewsnetwork[.]com
phoneysoap[.]com
quik-serv[.]com
rehabretie[.]com
speedynewsclips[.]com
teatac4bath[.]com
unite3tubes[.]com
unwashedsound[.]com TripleFantasy: arm2pie[.]com
brittlefilet[.]com
cigape[.]net
crisptic01[.]net
fliteilex[.]com
itemagic[.]net
micraamber[.]net
mimicrice[.]com
rampagegramar[.]com
rubi4edit[.]com
rubiccrum[.]com
rubriccrumb[.]com
team4heat[.]net
tropiccritics[.]com Equation group's exploitation servers: standardsandpraiserepurpose[.]com
suddenplot[.]com
technicalconsumerreports[.]com
technology-revealed[.]com IPs hardcoded in malware configuration blocks: 149.12.71.2
190.242.96.212
190.60.202.4
195.128.235.227
195.128.235.231
195.128.235.233
195.128.235.235
195.81.34.67
202.95.84.33
203.150.231.49
203.150.231.73
210.81.52.120
212.61.54.239
41.222.35.70
62.216.152.67
64.76.82.52
80.77.4.3
81.31.34.175
81.31.36.174
81.31.38.163
81.31.38.166
84.233.205.99
85.112.1.83
87.255.38.2
89.18.177.3 Kaspersky products detection names:
• Backdoor.Win32.Laserv
• Backdoor.Win32.Laserv.b
• HEUR:Exploit.Java.CVE-2012-1723.gen
• HEUR:Exploit.Java.Generic
• HEUR:Trojan.Java.Generic
• HEUR:Trojan.Win32.DoubleFantasy.gen
• HEUR:Trojan.Win32.EquationDrug.gen
• HEUR:Trojan.Win32.Generic
• HEUR:Trojan.Win32.GrayFish.gen
• HEUR:Trojan.Win32.TripleFantasy.gen
• Rootkit.Boot.Grayfish.a
• Trojan.Boot.Grayfish.a
• Trojan.Win32.Agent.ajkoe
• Trojan.Win32.Agent.iedc
• Trojan.Win32.Agent2.jmk
• Trojan.Win32.Diple.fzbb
• Trojan.Win32.DoubleFantasy.a
• Trojan.Win32.DoubleFantasy.gen
• Trojan.Win32.EquationDrug.b
• Trojan.Win32.EquationDrug.c
• Trojan.Win32.EquationDrug.d
• Trojan.Win32.EquationDrug.e
• Trojan.Win32.EquationDrug.f
• Trojan.Win32.EquationDrug.g
• Trojan.Win32.EquationDrug.h
• Trojan.Win32.EquationDrug.i
• Trojan.Win32.EquationDrug.j
• Trojan.Win32.EquationDrug.k
• Trojan.Win32.EquationLaser.a
• Trojan.Win32.EquationLaser.c
• Trojan.Win32.EquationLaser.d
• Trojan.Win32.Genome.agegx
• Trojan.Win32.Genome.akyzh
• Trojan.Win32.Genome.ammqt
• Trojan.Win32.Genome.dyvi
• Trojan.Win32.Genome.ihcl
• Trojan.Win32.Patched.kc
• Trojan.Win64.EquationDrug.a
• Trojan.Win64.EquationDrug.b
• Trojan.Win64.Rozena.rpcs
• Worm.Win32.AutoRun.wzs
Yara rules:

rule apt_equation_exploitlib_mutexes { meta: copyright = "Kaspersky Lab" description = "Rule to detect Equation group's Exploitation library" version = "1.0" last_modified = "2015-02-16" reference = "https://securelist.com/blog/" strings: $mz="MZ"$a1="prkMtx" wide $a2="cnFormSyncExFBC" wide$a3="cnFormVoidFBC" wide $a4="cnFormSyncExFBC"$a5="cnFormVoidFBC" condition: (($mz at 0) and any of ($a*)) }

rule apt_equation_doublefantasy_genericresource { meta: copyright = "Kaspersky Lab" description = "Rule to detect DoubleFantasy encoded config" version = "1.0" last_modified = "2015-02-16" reference = "https://securelist.com/blog/" strings: $mz="MZ"$a1={06 00 42 00 49 00 4E 00 52 00 45 00 53 00} $a2="yyyyyyyyyyyyyyyy"$a3="002" condition: (($mz at 0) and all of ($a*)) and filesize < 500000 }

rule apt_equation_equationlaser_runtimeclasses { meta: copyright = "Kaspersky Lab" description = "Rule to detect the EquationLaser malware" version = "1.0" last_modified = "2015-02-16" reference = "https://securelist.com/blog/" strings: $a1="?a73957838_2@@YAXXZ"$a2="?a84884@@YAXXZ" $a3="?b823838_9839@@YAXXZ"$a4="?e747383_94@@YAXXZ" $a5="?e83834@@YAXXZ"$a6="?e929348_827@@YAXXZ" condition: any of them }

rule apt_equation_cryptotable { meta: copyright = "Kaspersky Lab" description = "Rule to detect the crypto library used in Equation group malware" version = "1.0" last_modified = "2015-02-16" reference = "https://securelist.com/blog/" strings: $a={37 DF E8 B6 C7 9C 0B AE 91 EF F0 3B 90 C6 80 85 5D 19 4B 45 44 12 3C E2 0D 5C 1C 7B C4 FF D6 05 17 14 4F 03 74 1E 41 DA 8F 7D DE 7E 99 F1 35 AC B8 46 93 CE 23 82 07 EB 2B D4 72 71 40 F3 B0 F7 78 D7 4C D1 55 1A 39 83 18 FA E1 9A 56 B1 96 AB A6 30 C5 5F BE 0C 50 C1} condition:$a }

1 pseudonym, to protect the original victim's identity >>
2 the name "Equation group" was given because of their preference for sophisticated encryption schemes >>

### The Great Bank Robbery: the Carbanak APT

Malware Alerts - Mon, 02/16/2015 - 11:20

The story of Carbanak began when a bank from Ukraine asked us to help with a forensic investigation. Money was being mysteriously stolen from ATMs. Our initial thoughts tended towards the Tyupkin malware. However, upon investigating the hard disk of the ATM system we couldn't find anything except a rather odd VPN configuration (the netmask was set to 172.0.0.0).

At this time we regarded it as just another malware attack. Little did we know then that a few months later one of our colleagues would receive a call at 3 a.m. in the middle of the night. On the phone was an account manager, asking us to call a certain number as matter of urgency. The person at the end of the line was the CSO of a Russian bank. One of their systems was alerting that data was being sent from their Domain Controller to the People's Republic of China.

Up to 100 financial institutions have been hit.Total financial losses could be as a high as $1bn#TheSAS2015#Carbanak When we arrived on site we were quickly able to find the malware on the system. We wrote a batch script that removed the malware from an infected PC, and ran this script on all the computers at the bank. This was done multiple times until we were sure that all the machines were clean. Of course, samples were saved and through them we encountered the Carbanak malware for the first time. Modus Operandi Further forensic analysis took us to the point of initial infection: a spear phishing e-mail with a CPL attachment; although in other cases Word documents exploiting known vulnerabilities were used. After executing the shellcode, a backdoor based on Carberp, is installed on the system. This backdoor is what we know today as Carbanak. It is designed for espionage, data exfiltration and remote control. Each bank robbery took 2-4 months, from infecting the first computer to cashing the money out #TheSAS2015 #Carbanak Once the attackers are inside the victim´s network, they perform a manual reconnaissance, trying to compromise relevant computers (such as those of administrators') and use lateral movement tools. In short, having gained access, they will jump through the network until they find their point of interest. What this point of interest is, varies according to the attack. What they all have in common, however, is that from this point it is possible to extract money from the infected entity. The gang behind Carbanak does not necessarily have prior knowledge of the inner workings of each bank targeted, since these vary per organisation. So in order to understand how a particular bank operates, infected computers were used to record videos that were then sent to the Command and Control servers. Even though the quality of the videos was relatively poor, they were still good enough for the attackers, armed also with the keylogged data for that particular machine to understand what the victim was doing. This provided them with the knowledge they needed to cash out the money. Cash out procedures During our investigation we found several ways of cashing out: ATMs were instructed remotely to dispense cash without any interaction with the ATM itself, with the cash then collected by mules; the SWIFT network was used to transfer money out of the organisation and into criminals' accounts; and databases with account information were altered so that fake accounts could be created with a relatively high balance, with mule services being used to collect the money. Infections and losses Since we started investigating this campaign we have worked very closely with the law enforcement agencies (LEAs) tracking the Carbanak group. As a result of this cooperation we know that up to 100 financial institutions have been hit. In at least half of the cases the criminals were able to extract money from the infected institution. Losses per bank range from$2.5 million to approximately $10 million. However, according to information provided by LEAs and the victims themselves, total financial losses could be as a high as$1 billion, making this by far the most successful criminal cyber campaign we have ever seen.

Losses from #Carbanak per bank range from $2.5 million to approximately$10 million #TheSAS2015

Our investigation began in Ukraine and then moved to Moscow, with most of the victims located in Eastern Europe. However thanks to KSN data and data obtained from the Command and Control servers, we know that Carbanak also targets entities in the USA, Germany and China. Now the group is expanding its operations to new areas. These include Malaysia, Nepal, Kuwait and several regions in Africa, among others.

The group is still active, and we urge all financial organizations to carefully scan their networks for the presence of Carbanak. If detected, report the intrusion to law enforcement immediately.

For a full description of the campaign, IOCs and list of infections please see our report.

To check your network for Carbanak's presence, you can also use the open IOC file available here.

FAQ What is Carbanak?

Carbanak is the name we use for an APT-style campaign targeting (but not limited to) financial institutions. The main difference with other APT attacks is that attackers do not see data but money as their primary target. We say APT-like, however the attack is not strictly speaking Advanced. Strictly speaking, the main feature defining the attackers is Persistence.

We name the backdoor Carbanak since it is based on Carberp and the name of the configuration file is "anak.cfg".

What are the malicious purposes of this campaign?

The attackers infiltrate the victim´s network looking for the critical system they can use for cashing money out. Once they have stolen a significant amount of money (from 2.5 to 10 MM USD per entity), they abandon the victim.

Why do you think it is significant?

Banking entities have always been a primary target for cybercriminals. However it was almost always through their customers. This time attackers are targeting financial entities directly in an unprecedented, determined, highly professional and coordinated attack, and using any means from the target to cash as much money out as possible, up to an apparently auto-imposed limit.

Can you explain the timeline of the campaign?

According to what we know, the first malicious samples were compiled in August, 2013 when the cybercriminals started to test the Carbanak malware. The first infections were detected in December, 2013.

On average, each bank robbery took between two and four months, from infecting the first computer at the bank's corporate network to cashing the money out.

We believe that the gang was able to successfully steal from their first victims during the period of February-April 2014. The peak of infections was recorded in June 2014.

Currently the campaign is still active.

Why didn´t you make the details public until now?

Since we started working on this campaign we have collaborated with the different LEAs involved in the investigation and helped them as much as possible. As it remains an open investigation, we were asked not to share any details until it was safe to do so.

Have you reached victims and Computer Emergency Response Teams (CERTs) in those countries where you have detected the incidents?

Yes, this investigation turned into a joint operation between Kaspersky Lab's Global Research and Analysis Team and international organizations, national and regional law enforcement agencies and a number of Computer Emergency Response Teams (CERTs) worldwide.

One of our main goals was to disseminate our knowledge of the campaign and IOCs among all detected and potential victims. We used national CERTs and LEAs as the distribution channel.

How did you contribute to the investigation?

We're helping to assist in investigations and countermeasures that disrupt malware operations and cybercriminal activity. During the investigations we provide technical expertise such as analyzing infection vectors, malicious programs, supported Command & Control infrastructure and exploitation methods.

How was the malware distributed?

Attackers used spear phishing emails with malicious attachments against employees of the targeted financial institutions, in some cases sending them to their personal email addresses. We believe the attackers also used drive by download attacks, but this second assumption is still not 100% confirmed.

What is the potential impact for victims?

Based on what the attackers stole from victims, a new victim faces potential losses of up to 10 million \$. However this figure is arbitrary based on what we know: nothing limits the potential loss once an institution is infected.

Who are the victims? What is the scale of the attack?

Victims are mainly institutions in the financial industry; however we have also found traces of infections in POS terminals and PR agencies. For a sense of the scale of the attack please see the different charts and maps we provide in our report.

As with many malware campaigns there are a variety of companies/individuals analyzing the malware, resulting in requests to the Command and Control server. When we analyze those servers, all we see are the IPs and possibly some additional information. When this additional information is not present, and when the IP cannot be traced back to its owner, we mark it as an infection.

Based on this approach our analysis concludes that Russia, the US, Germany and China are the most affected countries.

How are corporate users protected against this type of attack? Does Kaspersky Lab protect their users?

Yes, we detect Carbanak samples as Backdoor.Win32.Carbanak and Backdoor.Win32.CarbanakCmd.

All Kaspersky Lab's corporate products and solutions detect known Carbanak samples. To raise the level of protection, it is recommended to switch on Kaspersky's Proactive Defense Module included in each modern product and solution.

We also have some general recommendations:

• Do not open suspicious emails, especially if they have an attachment;
• Update your software (in this campaign no 0days were used);
• Turn on heuristics in your security suites, this way it is more likely that such new samples will be detected and stopped from the beginning.

### Protect your home wireless networks

SANS Tip-of-the-Day - Sun, 02/15/2015 - 20:53

SANS Tip-of-the-Day - Sat, 02/14/2015 - 20:58