June | 2014 | FireEye Blog

Turing Test in Reverse: New Sandbox-Evasion Techniques Seek Human Interaction

June 24, 2014 | By Sai Omkar Vashisht and Abhishek Singh | |

Comments

Last year, we published a paper titled Hot Knives Through Butter, Evading File-Based Sandboxes. In this paper, we explained many sandbox evasion methods-and today’s blog post adds to our growing catalog.

In the past, for example, we detailed the inner workings of a Trojan we dubbed UpClicker. The malware was notable for a then-novel technique to evade automated dynamic analysis systems (better known as sandboxes). UpClicker activates only when the left mouse button is clicked and released — a sign that it is running on a real, live, human-controlled PC rather than within an automated sandbox.

If the malware determines it is running in a sandbox, it lies dormant so that the sandbox doesn’t observe any suspicious behavior. Once the sandbox incorrectly clears it as a benign file, UpClicker goes on to a real computer to do its dirty work.

Last year, our colleague Rong Hwa shared the technical details of another sandbox-detecting Trojan called BaneChant. Like UpClicker, BaneChant uses human interaction to ascertain whether it is running in a virtual-machine environment, activating only after it detects more than three left clicks.

Since then, we’ve seen a spate of new malware that pushes the concept further. The newest sandbox-evading malware counters recent efforts to mimic human behavior in sandbox environments.

This blog post describes three tactics that FireEye has discovered in recent attacks.

Sandbox evasion: a primer

Most sandbox-evasion techniques fall into one of three categories:

Human interaction. This category includes malware that requires certain actions on the user’s part (a sign that the malicious code is running on a real-live PC rather than within an automated sandbox).

Configuration specific. Malware in this category takes advantage of the inherent constraints of file-based sandboxes. For example, knowing that a sandbox can spend, say, five minutes running suspicious code for analysis, malware creators can create code that automatically lies dormant for a longer period. If the code is still running after that, it’s probably not in a sandbox.

Environment specific. In this category, malware checks for telltale signs that its code is running in widely used VM environments. It checks for obscure files unique to VMware, for instance, or VM-specific hardware drivers.

The first category of sandbox evasion is one of the trickiest to counter. To fool sandbox-detecting malware, some vendors now simulate mouse movement and clicks in their virtual-machine environments to mimic human activity. But malware authors are upping the ante with even more sophisticated sandbox detection and evasion techniques.

To scroll is human

One malware we discovered lies dormant until the user scrolls to the second page of a Rich Text Format (RTF) document. So simulating human interaction with random or preprogrammed mouse movements isn’t enough to activate its malicious behavior.

Here’s how it works:

RTF documents consist of normal text, control words, and groups. Microsoft’s RTF specification includes a shape-drawing function, which includes a series of properties using the following syntax:

{\sp {\sn propertyName } {\sv propertyValueInformation}}

In this code, \sp is the control word for the drawing property, \sn is the property name, and \sv contains information about the property value. The code snippet in Figure 1 exploits a vulnerability that occurs when using an invalid \sv value for the pFragments shape property.

Figure 1: Code exploiting vulnerability in the RTF pFragments property

A closer look at the exploit code reveals a series of paragraph marks (./par) that appears before the exploit code.

Figure 2: A series of \.par (paragraph marks) that appears before the exploit code

The repeated paragraph marks push the exploit code to the second page of the RTF document. So the malicious code does not execute unless the document scrolls down to bring the exploit code up into the active window—more likely a deliberate act by a human user than simulated movement in a virtual machine.

When the RTF is scrolled down to the second page, then only the exploit code triggers, and as shown in Figure 3.0, it makes a call to URLDownloadToFileA function from the shell code to download an executable file.

Figure 3: Exploit code

In a typical file-based sandbox, where any mouse activity is random or preprogrammed, the RTF document’s second page will never appear. So the malicious code never executes, and nothing seems amiss in the sandbox analysis.

Two clicks and you’re out

Another sandbox-evading attack we spotted in recent attacks waits for more than two mouse clicks before executing. The two-click condition aims to more accurately determine whether an actual person is operating the targeted machine—most people click mouse buttons many times throughout the day—or a one-time programmed click designed to counter evasion techniques.

Here’s how this technique works:

The malware invokes the function Get AsyncKeyState in a loop. The function checks whether any mouse buttons are clicked by looking for the parameter 0×01, 0×02, or 0×04. (The parameter 0×01 is the virtual key code for the mouse’s left button, 0×02 is the code for the right button, and 0×04 is the code of the middle button.)

The instruction “xor edi edi” sets the edi to 0. If any of the buttons is pressed, the code invokes the instruction “inc edi,” as shown in Figure 4. After that, the instruction “cmp edi,2” checks whether the left, right or middle mouse buttons have been clicked more than two times. If so, code exits from the loop and gets to its real work. Otherwise, it stays under the radar, continuously checking for more mouse clicks.

Figure 4: Assembly code for evasion employing left, middle or right mouse clicks

Slow mouse, fast sandbox

Another recently discovered evasion technique involves checking for suspiciously fast mouse movement. To make sure an actual person is controlling the mouse or trackpad, malware code checks how quickly the cursor is moving. Superhuman speed is a telltale sign that the code is running in a sandbox.

This technique also makes use of the Windows function GetCursorPos, which retrieves the system’s cursor position. In the example malware code shown in Figure 5, GetCursorPos returns 614 for the x-axis value and 185 for the y-axis value.

Figure 5: Malware making first call to API GetCursorPos

After few instructions, malicious code again calls GetCursorPos to check whether the cursor position has changed. This time the function returns x= 1019 and y = 259, as shown in Figure 6.

Figure 6: Malware making second call to API GetCursorPos

A few instructions after the second GetCursorPos call, the malware code invokes the instruction “SUB EDI, DWORD PTR DS:[410F15]”. As shown in the figure 5.0, the value in EDI is 0×103 (259 in decimal) and DS:[410F15] = 0xB9 (185 in decimal). The value 259 and 185 are the Y coordinates retrieved from the two GetCursorPos calls. If the difference between the two Y-coordinate measurements is not 0, then the malware terminates.

Figure 7: Subtracting the Y coordinates to detect whether the cursor is moving too quickly to be human-controlled

In other words, if the cursor has moved between the two GetCursorPos calls (which are only a few instructions apart), then the malware concludes that the mouse movement is simulated. That’s too fast to be a real-world mouse or track pad in normal use, so the code must be running in a sandbox.

A growing challenge

Cybersecurity is a constant arms race. Simulating mouse movement and clicks is not enough to fool the most advanced sandbox-evading malware. Now malware authors are incorporating real-world behaviors into their evasion strategies.

Simulating these behaviors—the way actual people scroll documents, click the mouse button, and move the cursor— is a huge challenge for cybersecurity. Anticipating future evasion techniques might be even tougher. Expect malware authors to employ more novel techniques that look for that human touch.

In the paper “Hot Knives Through Butter: Evading File Based Sandboxes,” we’ve outlined 15 prior evasion techniques that have been used by advanced malware in real attacks to bypass file based sandboxes. We plan to continue updating the evasion series as we come across new techniques used by the latest threats and advanced malwares to bypass file based sandboxes.

Cybersecurity in Heterogeneous Environments: A Podcast with Tom Hankins of Pacific Northwest National Laboratory

June 23, 2014 | By Richard Bejtlich | |

Comments

As technology continues to evolve and become more cutting edge, it may not initially be as secure as it needs to be. When you consider more heterogeneous environments with multiple operating systems, applications, and considerable open source development, a robust cybersecurity initiative becomes a must.

I recently had the opportunity to sit down with Tom Hankins, Cybersecurity Operations Manager at Pacific Northwest National Laboratory, a part of the Department of Energy (DoE), to discuss the cybersecurity challenges faced by national laboratories, and how to effectively deal with them.

To listen to the podcast in full, click here.

In an increasingly hostile cyber environment, Hankins believes that making the case to senior management to take the cybersecurity plunge shouldn’t be all too difficult: “it’s only hard if you don’t get yourself out of your little cyber cage and present your case. You have to write these things down. You have to come up with a marketing plan, and you have to execute it.” Hankins continued, “the typical pushback is that we’re going to interrupt the business. And while you will be somewhat service interrupting - that does happen - you also need to address how you’re going to get that job done with minimal impact and how the impact of losing integrity, losing availability, losing confidentiality is a much larger problem.”

Tom will present his approach to dealing with these challenges at the Gartner Security & Risk Management Summit, June 23-26 in Washington, DC.

CRN’s “Women of the Channel” Highlights Growing Role in Cybersecurity

June 20, 2014 | By FireEye Inc. | |

Comments

In a male dominated industry like cybersecurity, it is not often that women are recognized for their contributions to the field. However, as the industry grows and more women step forward into the field and offer themselves as role models, we hope to see a shift in our industry. FireEye has seen this shift start to happen within our own company with five females at the executive level and eight VPs; and we’re thrilled that this recognition goes beyond our own corporate culture.

This year, CRN announced its Women of the Channel project, which recognized 340 female executives for their accomplishments over the past year, as well as the long-term impact that their work is having on the channel and technology sector. It is a special recognition of those female channel executives who have risen in the ranks of their organizations.

CRN editors were also tasked with selecting 100 executives from that very list for special recognition as “The Power 100: The Most Powerful Women in the Channel,” which honors those who have earned a special distinction, one based on an exemplary record of success, as well as a high level of influence in the channel.

FireEye’s own Kristi Houssiere has been recognized as one of the year’s most influential women in business, and has also been recognized as one of this year’s “Power 100.” She has made a significant impact on the FireEye team and has played a tremendous role in delivering cybersecurity solutions as well as marketing our message and brand with and through the channel.

Kristi Houssiere serves as FireEye’s senior director of global partner marketing, and is responsible for the company’s marketing initiatives and strategies for all indirect routes to market, including alliance and distribution partners. In 2014, she helped advocate and expand FireEye’s highly successful global partner program, “FUEL,” which has reached over 700 partners worldwide. It also continues to drive more than 90 percent of FireEye sales through channel partners.

Robert Faletra, CEO of the Channel Company, had some encouraging words to say about the honorees: “It is our privilege to acknowledge the exceptional achievements of the women in this year’s Power 100.” He continued, “We are committed to raising the visibility of the contributions of women in the channel, and we applaud the far-reaching influence of these executives who are defining today’s channel and helping to shape its future.”

When asked to give advice for young women looking to succeed in the workplace, Kristi stated, “Work to build a solid foundation in selling, as it is essential to any successful career. Ask questions, get involved, listen and create trust with your partners, customers and work teams.”

We are honored to have Kristi at FireEye and hope that her example will lead other women to take hold of the cybersecurity industry.

FireEye’s Threat Analytics Platform Honored as Best Cloud Service at Interop Japan

June 19, 2014 | By FireEye Inc. | |

Comments

The theme of this year’s Interop Japan was “To an Increasingly Interconnected World,” with a focus on how organizations can manage a future where interconnectivity between endpoints, devices, infrastructure and everything else continues to increase exponentially. Many of the vendors at the show focused on the infrastructure required to support such a vision, particularly on delivering the “as-a-service” cloud deployment model, big-data and Software Defined Networking (SDN) needed to create a connected world.

What were conspicuously underrepresented in the conference were the solutions that would secure such an interconnected world. That the judges at Interop chose FireEye’s Threat Analytics Platform (TAP) as the Best of Show for the Cloud Services category from all of the innovative “connected world” solutions was a nod to the importance of security in this new world.

FireEye COO, Kevin Mandia accepts the award for “Best of Show for Cloud Services” at Interop Japan

As companies and governments move towards greater interconnectivity, securing the requisite infrastructure is only going to get exponentially harder. Organizations today already have challenges securing and monitoring all of their network equipment, endpoints, and security equipment. It is not uncommon for organizations to see millions or even billions of events a day from their infrastructure. Unfortunately, collecting the information is the easy part, finding the events that matter is the hard part. Sophisticated attackers know this as well and prey upon the inability of organizations to find evil in all of the noise to continuously target specific industries with a variety of malware and non-malware based attacks.

Protecting organizations from these threats require a different solution paradigm and FireEye’s Threat Analytics Platform (TAP) was created to specifically solve this challenge. TAP is a security incident detection and response management platform specifically designed to help organizations secure themselves by finding the events that matter and remediating the issue before any damage can be done. It applies interlinked strategic intelligence on threat actors and threat intelligence gleaned from the front lines for faster detection and response to malware & non-malware based-attacks across network, host and event data. Delivered as a hosted security Platform-as-a-Service (PaaS) solution, TAP leverages a highly scalable and secure architecture to scale as necessary without burdening the organization with the operational complexity, hardware infrastructure or support resources required for traditional on premise solutions.

The FireEye TAP team is pleased to be acknowledged by Interop Japan on the importance of our mission to help our customers find evil and secure themselves from determined adversaries. We are committed to continuing to deliver on our mission and we have a lot of new exciting capabilities that we are launching soon. Stay tuned to our upcoming TAP announcement by subscribing to the FireEye blog today.

What are you doing? – DSEncrypt Malware

June 18, 2014 | By Jinjian Zhai and Jimmy Su | |

Comments

Executive Summary

Have you ever downloaded and installed a large Android application that had very few actual UI elements or functionality? Recently, FireEye Labs mobile security researchers have discovered a new kind of mobile malware that encrypts an embedded Android application with an attachment in an asset folder – concealing all malicious activities within a seemingly benign application.

The malware app disguises itself as the Google Play store app, placing its similar icon close to the real Google Play store icon on the homescreen. Once installed, the hacker uses a dynamic DNS server with the Gmail SSL protocol to collect text messages, signature certificates and bank passwords from the Android devices.

The relationship between the main application, the attached application and the malicious classes are shown below.

Fig. 1. The relationship of the mask app and the embedded malware.

Fig. 1. The relationship of the masked app and the embedded malware.

The malware package name is com.sdwiurse and the app title is “google app stoy.” Android users can’t remove the app once the device is infected because the “uninstall” function is disabled and the app continues to run as services in the back-end. These services can be killed manually but will restart once the Android phone is restarted.

Owing to the unique nature of how the malware is packaged, as of June 13, 2014, the Virus Total score for this app is only 3 out of 51 anti-virus vendors. Because most vendors only use signature-based algorithms to detect malware, they fail to detect the malicious content concealed within apps that appear to be basic or run-of-the-mill.

Fig. 2. The Virus Total detection out of 52 AV vendors. The score is updated until 06/13/2014.

Fig. 2. The Virus Total detection out of 51 AV vendors. The score was taken on 06/13/2014.

The app we observed only has 711 lines of code but is over 1.7MB in size upon downloading. The single largest file, named “ds,” is embedded in the asset folder and is 597KB. After decryption and decompression however, the real dex package file expands up to 2.2MB with the full malware. The little amount of code in the superficial app is one of the evasion techniques used by the hackers to mask the malicious classes that swell the app’s size.

User Experience

After installation, a new icon of “googl app stoy” is shown on the Android homescreen. The icon is the same as “Google Play” to confuse users into clicking it. Once clicked, the app asks for administrator privileges of the device as shown in figure three.

Fig. 3. The newly installed icon on Android desktop and the activation page.

Fig. 3. The newly installed icon on the Android desktop and the activation page.

When we observe the app in action, the sole user interface for the app contains pops up saying “Program Error” and “It’s Deleted!” when translated to English from Korean. Next, the app terminates and a notification message appears reading “Unfortunately, google app stoy has stopped.” After this occurs, the app icon on the homescreen is removed, tricking the user into thinking it’s gone as shown in figure four.

Fig. 4. The misleading "uninstillation" page and Toast message.

Fig. 4. The misleading “uninstalling” page and Toast message.

However, when opening “Setting->Apps,” we can still find the app in the “Downloaded” tab and “Running Apps” tab. Furthermore, in the “Downloaded” tab, the app cannot be stopped or uninstalled:

Fig. 5. The app can't be removed in the "Setting-Downloaded" page.

Fig. 5. The app can’t be removed in the “Settings-Downloaded” page.

In the “Running Apps” tab, there are five services running that were started by the malicious app:
1. uploadContentService
2. UninstallerService
3. SoftService
4. uploadPhone
5. autoRunService

Fig. 6. The 5 background services started by the app. You won't discover them unless digging into the long list of "Running" tab.

Fig. 6. The 5 background services started by the app. You won’t discover them unless digging into the long list of “Running App” tab.

Decryption

The file is encrypted using the javax.crypto package of Java Cryptographic Extension (JCE) framework as shown below.

Fig. 7. Decipher code.

The cryptographic algorithm is based on the Data Encryption Standard (DES). The key string is “gjaoun” as shown in the code below. After the file is decrypted, it’s loaded as the dex class:

Fig. 8. The embedded and encrypted dex file.

Fig. 8. The code of decryption and class loading for the embedded file.

All the malicious activities and services happen in the loaded dex file.

Malicious Methods

In the source code of the malicious dex package, “class.dex” is decompressed from the decrypted file “x.zip.” Analyzing this code, we found there are three ways to steal private information from the infected Android device. We will first introduce how the malware works and then analyze the network traffic as evidence of the malicious behaviors.

1. SMS Message Theft

Fig. 9. The code to steal personal SMS.

In the code, ak40.txt is a file in /storage/sdcard0/temp/ folder containing a string. When the content equals to “1,” the SMS message is sent to an email address. The email address and password are stored among other files in /storage/sdcard0/temp/. The hacker is smart enough to use the Gmail SSL protocol to evade the signature detection in network traffic by most AV vendors.

2. Signature Certificate and Key Theft

Fig. 11. The code to steal signature certificate and keys.

The variable v1 is the phone number of the compromised Android phone, while the Url.getSDPath() is the “temp” folder in the mounted storage:

Fig. 12. The location of the temporary folder that the malware app uses to collect signature certificate and keys.

The same zip file is named as “all.zip” to upload to a server and also named as “{PHONE_NUMBER}_npki.zip” to send through Gmail as an attachment.

3. Bank Account Password Theft

Fig. 13. The code to steal personal bank account and password.

Network Traffic

We have intercepted the network traffic of the malicious app in the FireEye Mobile Threat Prevention (MTP) Platform to verify the malicious activities we found in the code above.

1. SMS Message Transmission

Because the destination, including the email address and the password is stored in a cached file on the phone, we have replaced it with a testing email account and redirected a testing SMS to the newly created email address to simulate the scenario of receiving SMS in the MTP platform. Here is an example of the SMS messages that we have intercepted from the testing email account:

Fig. 14. The testing email and SMS we intercepted in the FireEye MTP platform.

The time stamp shows the email address received the content (at 9:39 PM) of the victim’s incoming SMS (at 9:38 PM) within 1 minute.

2. Signature Certificate and Key Transmission

We captured the PCap information in the FireEye MTP platform. The PCap shows that the “all.zip” is uploaded to domain “dhfjhewjhsldie.xicp.net”.

Fig. 15. The PCap of the signature certificate and keys.

The same file is renamed to {PHONE_NUMBER}_npki.zip and sent as Gmail attachment using SSL configuration. The picture below shows the signature certificate file and signature primary key after unzipping from the attachment that the malware app leaks to the SMTP server.

Fig. 16. The content of the signature certificate and keys.

3. Bank Account Password Transmission

We have found email evidence containing victims’ bank accounts and passwords and worked with Google’s Gmail team to take down hacker’s email accounts.

A 360° View of Cybersecurity – FireEye Incident Detection & Response Virtual Summit

June 17, 2014 | By FireEye Inc. | |

Comments

The 2014 IDR Summit is officially in the books, and we at FireEye wanted to be the first to say, “thank you,” for making this year’s summit our most successful yet. We brought cybersecurity experts and practitioners from around the world together to learn about and discuss the most pressing cybersecurity issues facing organizations today. Here are some of the highlights:

Kicking off the conference on Tuesday, Mark Weatherford shared his unique insights on the changing landscape of cybersecurity. To watch a recording of Mark’s session, click here.
Jen Weedon, Manager of Threat Intelligence for FireEye Labs offered attendees insight into the latest threat trends including shifts in the threat landscape, threat groups’ techniques and the activity’s impact. To view the recording of her presentation, click here.
Providing an overview of FireEye’s Threat Prevention Platform, CTO Dave Merkel showed how the integrated components of the platform can significantly improve an organization’s security posture. To view the recording, click here.
With high profile security breaches, the retail industry has recently captured headlines. Jason Rebholz, senior consultant at Mandiant, a FireEye Company, discussed the tactics that targeted financial attackers use and how you can help protect your network. To view the recording of his session, click here.
Richard Bejtlich, chief security strategist, moderated an expert panel discussion entitled, “Beyond SIEM: Enterprise Security Monitoring.” An interactive session focusing on audience interaction, this panel discussed topics like: data collection priorities, deriving context from events and integrating threat intelligence to improve detection and speed response. To view a recording of this panel discussion click here.

If you enjoyed our virtual summit, please join us in Washington, DC on October 7-8 for MIRcon 2014. MIRcon features authorities on incident response, malware analysis, reverse engineering and computer forensics sharing experiences and approaches to benefit each attendee.

Security professionals can expect high-value networking and peer-to-peer engagement. Participants will see new technology demonstrated and discuss ideas and receive recommendations about how best to defend against and respond to sophisticated attackers. Register for MIRcon 2014.

This year’s summit could not have been possible without our sponsors. Thank you to all of our sponsors: Hewlett Packard, Bradford Networks, Imperva, McKinsey & Company, Guidance Software and Accuvant for helping us make this year’s IDR Summit a success.

A Not-So Civic Duty: Asprox Botnet Campaign Spreads Court Dates and Malware

June 16, 2014 | By Amanda Stewart and Grace Timcang | |

Comments

Executive Summary

FireEye Labs has been tracking a recent spike in malicious email detections that we attribute to a campaign that began in 2013. While malicious email campaigns are nothing new, this one is significant in that we are observing mass-targeting attackers adopting the malware evasion methods pioneered by the stealthier APT attackers. And this is certainly a high-volume business, with anywhere from a few hundred to ten thousand malicious emails sent daily – usually distributing between 50 and 500,000 emails per outbreak.

Through the FireEye Dynamic Threat Intelligence (DTI) cloud, FireEye Labs discovered that each and every major spike in email blasts brought a change in the attributes of their attack. These changes have made it difficult for anti-virus, IPS, firewalls and file-based sandboxes to keep up with the malware and effectively protect endpoints from infection. Worse, if past is prologue, we can expect other malicious, mass-targeting email operators to adopt this approach to bypass traditional defenses.

This blog will cover the trends of the campaign, as well as provide a short technical analysis of the payload.

Campaign Details

Figure 1: Attack Architecture

The campaign first appeared in late December of 2013 and has since been seen in fairly cyclical patterns each month. It appears that the threat actors behind this campaign are fairly responsive to published blogs and reports surrounding their malware techniques, tweaking their malware accordingly to continuously try and evade detection with success.

In late 2013, malware labeled as Kuluoz, the specific spam component of the Asprox botnet, was discovered to be the main payload of what would become the first malicious email campaign. Since then, the threat actors have continuously tweaked the malware by changing its hardcoded strings, remote access commands, and encryption keys.

Previously, Asprox malicious email campaigns targeted various industries in multiple countries and included a URL link in the body. The current version of Asprox includes a simple zipped email attachment that contains the malicious payload “exe.” Figure 2 below represents a sample message while Figure 3 is an example of the various court-related email headers used in the campaign.

Figure 2 Email Sample

Figure 3 Email Headers

Some of the recurring campaign that Asporox used includes themes focused around airline tickets, postal services and license keys. In recent months however, the court notice and court request-themed emails appear to be the most successful phishing scheme theme for the campaign.

The following list contains examples of email subject variations, specifically for the court notice theme:

Urgent court notice
Notice to Appear in Court
Notice of appearance in court
Warrant to appear
Pretrial notice
Court hearing notice
Hearing of your case
Mandatory court appearance

The campaign appeared to increase in volume during the month of May. Figure 4 shows the increase in activity of Asprox compared to other crimewares towards the end of May specifically. Figure 5 highlights the regular monthly pattern of overall malicious emails. In comparison, Figure 6 is a compilation of all the hits from our analytics.

Figure 4 Worldwide Crimeware Activity

Figure 5 Overall Asprox Botnet tracking

Figure 6 Asprox Botnet Activity Unique Samples

These malicious email campaign spikes revealed that FireEye appliances, with the support of DTI cloud, were able to provide a full picture of the campaign (blue), while only a fraction of the emailed malware samples could be detected by various Anti-Virus vendors (yellow).

Figure 7 FireEye Detection vs. Anti-Virus Detection

By the end of May, we observed a big spike on the unique binaries associated with this malicious activity. Compared to the previous days where malware authors used just 10-40 unique MD5s or less per day, we saw about 6400 unique MD5s sent out on May 29^th. That is a 16,000% increase in unique MD5s over the usual malicious email campaign we’d observed. Compared to other recent email campaigns, Asprox uses a volume of unique samples for its campaign.

Figure 8 Asprox Campaign Unique Sample Tracking

Figure 9 Geographical Distribution of the Campaign

Figure 10 Distribution of Industries Affected

Brief Technical Analysis

Figure 11 Attack Architecture

Infiltration

The infiltration phase consists of the victim receiving a phishing email with a zipped attachment containing the malware payload disguised as an Office document. Figure 11 is an example of one of the more recent phishing attempts.

Figure 12 Malware Payload Icon

Evasion

Once the victim executes the malicious payload, it begins to start an svchost.exe process and then injects its code into the newly created process. Once loaded into memory, the injected code is then unpacked as a DLL. Notice that Asprox uses a hardcoded mutex that can be found in its strings.

Typical Mutex Generation
1. “2GVWNQJz1″
Create svchost.exe process
Code injection into svchost.exe

Entrenchment

Once the dll is running in memory it then creates a copy of itself in the following location:

%LOCALAPPDATA%/[8 CHARACTERS].EXE

Example filename:

%LOCALAPPDATA%\lwftkkea.exe

It’s important to note that the process will first check itself in the startup registry key, so a compromised endpoint will have the following registry populated with the executable:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Exfiltration/Communication

The malware uses various encryption techniques to communicate with the command and control (C2) nodes. The communication uses an RSA (i.e. PROV_RSA_FULL) encrypted SSL session using the Microsoft Base Cryptographic Provider while the payloads themselves are RC4 encrypted. Each sample uses a default hardcoded public key shown below.

Default Public Key

—-BEGIN PUBLIC KEY—-

MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDCUAUdLJ1rmxx+bAndp+Cz6+5I’

Kmgap2hn2df/UiVglAvvg2US9qbk65ixqw3dGN/9O9B30q5RD+xtZ6gl4ChBquqw

jwxzGTVqJeexn5RHjtFR9lmJMYIwzoc/kMG8e6C/GaS2FCgY8oBpcESVyT2woV7U

00SNFZ88nyVv33z9+wIDAQAB

—-END PUBLIC KEY—-

First Communication Packet

Bot ID RC4 Encrypted URL

POST /5DBA62A2529A51B506D197253469FA745E7634B4FC

HTTP/1.1

Accept: */*

Content-Type: application/x-www-form-urlencoded

User-Agent: <host useragent>

Host: <host ip>:443

Content-Length: 319

Cache-Control: no-cache

C2 Commands

In comparison to the campaign at the end of 2013, the current campaign uses one of the newer versions of the Asprox family where threat actors added the command “ear.”

if ( wcsicmp(Str1, L”idl”) )

{

if ( wcsicmp(Str1, L”run”) )

{

if ( wcsicmp(Str1, L”rem”) )

{

if ( wcsicmp(Str1, L”ear”)

{

if ( wcsicmp(Str1, L”rdl”) )

{

if ( wcsicmp(Str1, L”red”) )

{

if ( !wcsicmp(Str1, L”upd”) )

C2 commands	Description
idl	This commands idles the process to wait for commands
run	Download from a partner site and execute from a specified path
rem	Remove itself
ear	Download another executable and create autorun entry
rdl	Download, inject into svchost, and run
upd	Download and update
red	Modify the registry

C2 Campaign Characteristics

For the two major malicious email campaign spikes in April and May of 2014, separate sets of C2 nodes were used for each major spike.

April	May-June
94.23.24.58	192.69.192.178
94.23.43.184	213.21.158.141
1.234.53.27	213.251.150.3
84.124.94.52	27.54.87.235
133.242.134.76	61.19.32.24
173.45.78.226	69.64.56.232
37.59.9.98	72.167.15.89
188.93.74.192	84.234.71.214
187.16.250.214	89.22.96.113
85.214.220.78	89.232.63.147
	91.121.20.71
	91.212.253.253
	91.228.77.15

Conclusion

The data reveals that each of the Asprox botnet’s malicious email campaigns changes its method of luring victims and C2 domains, as well as the technical details on monthly intervals. And, with each new improvement, it becomes more difficult for traditional security methods to detect certain types of malware.

Acknowledgements:

Nart Villeneuve, Jessa dela Torre, and David Sancho. Asprox Reborn. Trend Micro. 2013. http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-asprox-reborn.pdf

Mergers and Acquisitions: When Two Companies and APT Groups Come Together

June 12, 2014 | By Jen Weedon | |

Comments

With Apple’s purchase of Beats, Pfizer’s failed bids for AstraZeneca, and financial experts pointing to a rally in the M&A market, the last month was a busy one for mergers and acquisitions. Of course, when we first see headlines of a high profile company’s plans for a merger or acquisition, we rush to think of the strategic and industry implications of such a deal. But underneath the “what ifs” and “visions for the future,” is a darker side of M&A that doesn’t make the headlines: the routineness with which companies are breached and crucial data is stolen when two high-profile organizations look to join together.

Over the last few years, concerns over economic espionage have led to greater scrutiny of mergers and acquisitions involving foreign companies – particularly in industries with sensitive technologies and operations that could pose broader economic and security threats. However, entering into a merger or acquisition with a foreign company is not the only way nation-states conduct economic espionage via cyber means, nor are nation-states the only perpetrators of intellectual property theft.

From our experience responding to these breaches, we’ve seen targeted threat actors actively pursuing companies involved in mergers and acquisitions in two ways:

Breaching one of the merging or acquired company’s subsidiaries’ and/or partners’ networks to ultimately gain access to the targeted company’s environment and information
Compromising and stealing information from a company involved in business talks with a foreign enterprise in order to provide the other side with an insider advantage in the negotiations

From One Friend to Another: Taking Advantage of Trusted Relationships Between Companies

Some threat groups compromise an organization’s environment and then move laterally over a connected network to a partner or subsidiary, while others rely on social engineering tactics, such as the use of phishing emails that appear to be from employees at the partner company. We have seen China-based threat groups previously compromise targets by taking advantage of trusted relationships and bridged networks between companies. Regardless of their method of entry, these actors are often in search of the same thing: intellectual property and proprietary information that can provide their own constituents with a business advantage, whether through adopting a rival’s technology and products, securing advantageous prices, or any other tactic that could give them a leg up.

We investigated one incident in which two threat groups compromised a company shortly after it acquired a subsidiary. The threat actors used their access to the initial company’s network to move laterally to the subsidiary, which had recently developed a proprietary process for a significant new healthcare product. Once inside the subsidiary’s network, the threat groups stole data that included details on the product’s test results. We believe the threat groups sought to give that data to Chinese state-owned companies in that industry for fast-tracking the development of their own version of the groundbreaking product.

Cheating the System: Insider Advantages in Negotiations

We have also seen threat groups compromising organizations involved in merger or acquisition talks with Chinese entities, likely in an effort to steal data that could give negotiators and decision makers valuable insider information with which to manipulate the outcome of the proposed transaction. Unlike other types of economic espionage operations, the threat groups in this type of scenario are generally not in search of a company’s intellectual property. Instead, these actors look for data such as executive emails, negotiation terms, and business plans and information; all of which could benefit the negotiators by giving them insight into the victim company’s financial situation and negotiation strategy.

During one investigation, we found that a China-based threat group had compromised a company that was in the process of acquiring a Chinese subsidiary – a move that would have significantly increased the victim company’s manufacturing and retail capacity in the Chinese market. The threat actors accessed the email accounts of multiple employees involved in the negotiations in what was likely a search for information pertaining to the proceedings. We believe that the threat group then used the stolen information to inform Chinese decision makers involved in the acquisition process, as the Chinese government terminated the talks shortly after the data theft occurred.

What can we expect?

Companies involved in mergers and acquisitions need to be aware of the risks they face from threat actors intent on conducting economic espionage. Entering into a merger or acquisition with an organization that has unidentified intrusions and unaudited networks places a company at risk of compromise from threat actors who may be waiting to move laterally to the newly integrated target.

Similarly, companies, and the law firms representing them, involved in negotiations with Chinese enterprises face risks from threat groups seeking to provide the Chinese entity with an advantage in negotiations. Compromise and economic espionage can have profound impacts on a company’s finances and reputation at any time, but particularly when they are risking hundreds of millions to billions of dollars on M&A.

In many cases as well, there are broader issues of national security, so it’s imperative that companies seek to recognize and mitigate these risks as part of their M&A processes moving forward. Even governments sometimes attempt to mitigate these risks by conducting national security reviews and occasionally rejecting bids based on their findings.[i] Threat actors from many countries engage in economic espionage, making for a wide and varied threat landscape that cannot be handled by the government alone. For examples of just how diverse and crowded a space the targeted threat landscape is becoming, see our recent blog posts on Molerats, Saffron Rose, and Russia and Ukraine.

[i] “The Committee on Foreign Investment in the United States (CFIUS).” U.S. Department of the Treasury. 20 Dec. 2012. Web. 28 May 2014.

Clandestine Fox, Part Deux

June 10, 2014 | By Mike Scott | |

Comments

We reported at the end of April and the beginning of May on an APT threat group leveraging a zero-day vulnerability in Internet Explorer via phishing email attacks. While Microsoft quickly released a patch to help close the door on future compromises, we have now observed the threat actors behind “Operation Clandestine Fox” shifting their point of attack and using a new vector to target their victims: social networking.

An employee of a company in the energy sector recently received an email with a RAR archive email attachment from a candidate. The attachment, ostensibly containing a resume and sample software program the applicant had written, was from someone we’ll call “Emily” who had previously contacted the actual employee via a popular social network.

FireEye acquired a copy of the suspicious email – shown below in Figure 1 – and attachment from the targeted employee and investigated. The targeted employee confirmed that “Emily” had contacted him via the popular social network, and that, after three weeks of back and forth messaging “she” sent her “resume” to his personal email address.

Figure 1: Sample email illustrating how “Emily” attacks a victim employee

Working our way backwards, we reviewed “Emily’s” social network profile and noticed a few strange aspects that raised some red flags. For example, “her” list of contacts had a number of people from the victim’s same employer, as well as employees from other energy companies; “she” also did not seem to have many other “friends” that fit “her” alleged persona. “Her” education history also contained some fake entries.

Further research and discussions with the targeted company revealed that “Emily,” posing as a prospective employee, had also contacted other personnel at the same company. She had asked a variety of probing questions, including inquiring who the IT Manager was and what versions of software they ran – all information that would be very useful for an attacker looking to craft an attack.

It’s worth emphasizing that in the instances above, the attackers used a combination of direct contact via social networks as well as contact via email, to communicate with their intended targets and send malicious attachments. In addition, in almost all cases, the attackers used the target’s personal email address, rather than his or her work address. This could be by design, with a view toward circumventing the more comprehensive email security technologies that most companies have deployed, or also due to many people having their social network accounts linked to their personal rather than work email addresses.

Details - Email Attachment #1

The resume.rar archive contained three files: a weaponized version of the open-source TTCalc application (a mathematical big number calculator), a benign text copy of the TTCalc readme file, and a benign PDF of Emily’s resume. The resume was a nearly identical copy of a sample resume available elsewhere on the Internet. The file details are below.

Filename	MD5 Hash
resume.rar	8b42a80b2df48245e45f99c1bdc2ce51
readme.txt	8c6dba68a014f5437c36583bbce0b7a4
resume.pdf	ee2328b76c54dc356d864c8e9d05c954
ttcalc.exe	e6459971f63612c43321ffb4849339a2

Upon execution, ttcalc.exe drops the two files listed below, and also launches a legitimate copy of TTCalc v0.8.6 as a decoy:

%USERPROFILE%/Application Data/mt.dat %USERPROFILE%/Start Menu/Programs/Startup/vc.bat

The file mt.dat is the actual malware executable, which we detect as Backdoor.APT.CookieCutter. (Variants of this family of backdoor are also referred to as “Pirpi” in the security industry). In this case, the malware was configured to use the following remote servers for command and control:

swe[.]karasoyemlak[.]com
inform[.]bedircati[.]com (Note: This domain was also used during Operation Clandestine Fox)
122.49.215.108

Metadata for mt.dat:

Description	MD5 hash
md5	1a4b710621ef2e69b1f7790ae9b7a288
.text	917c92e8662faf96fffb8ffe7b7c80fb
.rdata	975b458cb80395fa32c9dda759cb3f7b
.data	3ed34de8609cd274e49bbd795f21acc4
.rsrc	b1a55ec420dd6d24ff9e762c7b753868
.reloc	afd753a42036000ad476dcd81b56b754
Import Hash	fad20abf8aa4eda0802504d806280dd7
Compile date	2014-05-27 15:48:13

Contents of vc.bat:

@echo offcmd.exe /C start rundll32.exe “C:\Documents and Settings\admin\Application Data\mt.dat” UpdvaMt

Details - Email Attachment #2

Through additional research, we were able to obtain another RAR archive email attachment sent by the same attackers to an employee of another company. Note that while there are a lot of similarities, such as the fake resume and inclusion of TTCalc, there is one major difference, which is the delivery of a completely different malware backdoor. The attachment name this time was “my resume and projects.rar,” but this time it was protected with the password “TTcalc.”

Filename	MD5 hash
my resume and projects.rar	ab621059de2d1c92c3e7514e4b51751a
SETUP.exe	510b77a4b075f09202209f989582dbea
my resume.pdf	d1b1abfcc2d547e1ea1a4bb82294b9a3

SETUP.exe is a self-extracting RAR, which opens the WinRAR window when executed, prompting the user for the location to extract the files. It writes them to a TTCalc folder and tries to launch ttcalcBAK.exe (the malware dropper), but the path is incorrect so it fails with an error message. All of the other files are benign and related to the legitimate TTCalc application.

Filename	MD5 hash
CHANGELOG	4692337bf7584f6bda464b9a76d268c1
COPYRIGHT	7cae5757f3ba9fef0a22ca0d56188439
README	1a7ba923c6aa39cc9cb289a17599fce0
ttcalc.chm	f86db1905b3f4447eb5728859f9057b5
ttcalc.exe	37c6d1d3054e554e13d40ea42458ebed
ttcalcBAK.exe	3e7430a09a44c0d1000f76c3adc6f4fa

The file ttcalcBAK.exe is also a self-extracting Rar which drops and launches chrome_frame_helper, which is a Backdoor.APT.Kaba (aka PlugX/Sogu) backdoor using a legitimate Chrome executable to load the malicious DLL via side-loading. Although this backdoor is used by multiple threat groups and is quite commonly seen these days, this is the first time we’ve observed this particular threat group using this family of malware. The malware was configured to communicate to the command and control domain www[.]walterclean[.]com (72.52.83.195 at the time of discovery) using the binary TCP protocol only. The file details are below, followed by the malware configuration.

Filename	MD5 hash
chrome_frame_helper.dll	98eb249e4ddc4897b8be6fe838051af7
chrome_frame_helper.dll.hlp	1b57a7fad852b1d686c72e96f7837b44
chrome_frame_helper.exe	ffb84b8561e49a8db60e0001f630831f

Metadata	MD5 hash
chrome_frame_helper.dll	98eb249e4ddc4897b8be6fe838051af7
.text	dfb4025352a80c2d81b84b37ef00bcd0
.rdata	4457e89f4aec692d8507378694e0a3ba
.data	48de562acb62b469480b8e29821f33b8
.reloc	7a7eed9f2d1807f55a9308e21d81cccd
Import hash	6817b29e9832d8fd85dcbe4af176efb6
Compile date	2014-03-22 11:08:34

Backdoor.APT.Kaba Malware Configuration:

PlugX Config (0x150c bytes):

Flags: False True False False False False True True True True False

Timer 1: 60 secs

Timer 2: 60 secs

C&C Address: www[.]walterclean[.]com:443 (TCP)

Install Dir: %ALLUSERSPROFILE%\chrome_frame_helper

Service Name: chrome_frame_helper

Service Disp: chrome_frame_helper

Service Desc: Windows chrome_frame_helper Services

Online Pass: 1234

Memo: 1234

Open Source Intel

The domain walterclean[.]com shares registration details with securitywap[.]com:

The following domains are registered to QQ360LEE@126.COM

Domain: walterclean[.]com Create Date: 2014-03-26 00:00:00 Registrar: ENOM, INC.

Domain: securitywap[.]com
Create Date: 2014-03-26 00:00:00
Registrar: ENOM, INC.

Conclusion

In short, we attributed these attacks to the same threat actor responsible for “Operation Clandestine Fox,” based on the following linkages:

The first-stage malware (mt.dat) is a slightly updated version of the Backdoor.APT.CookieCutter malware dropped during Operation Clandestine Fox
Based on our intel, Backdoor.APT.CookieCutter has been used exclusively by this particular threat group
Finally, the command and control domain inform[.]bedircati[.]com seen in this activity was also used during the Clandestine Fox campaign

Another evolutionary step for this threat group is that they have diversified their tool usage with the use of the Kaba/PlugX/Sogu malware – something we have never seen them do before.

As we have noted in other blog posts, APT threat actors take advantage of every possible vector to try to gain a foothold in the organizations they target. Social networks are increasingly used for both personal and business reasons, and are one more potential threat vector that both end-users and network defenders need to think about.

Unfortunately, it is very common for users to let their guard down when using social networks or personal email, since they don’t always treat these services with the same level of risk as their work email. As more companies allow their employees to telecommute, or even allow them to access company networks and/or resources using their personal computers, these attacks targeting their personal email addresses pose significant risk to the enterprise.

Acknowledgements

The author would like to acknowledge the following colleagues for their contributions to this report: Josh Dennis, Mike Oppenheim, Ned Moran, and Joshua Homan.

Introduction to Strategic Thought

June 5, 2014 | By Richard Bejtlich |

I plan to address strategic thought as applied to digital security in a series of posts. Here I would like to briefly introduce the concept and offer a simple example.

Joint Publication 1 (JP-1), Doctrine for the Armed Forces of the United States, helps illuminate the strategic approach to digital security. JP-1 defines three levels of warfare: strategic, operational and tactical. Above the strategic level one can place the overall goal of the digital security program, as one might place the overall goal of a military or political endeavor. Below the tactical level one can similarly place tools or technology – the weapons one might employ when conducting tactical maneuvers. Taken as a whole, the five levels appear as shown in Figure 1.

Figure 1. Five Levels of Strategic Security

Using a strategic security framework enables a digital defender to build a more effective and durable program. A strategic security system doesn’t start with tools and tactics; instead, it begins by setting one or more overall mission goals. The strategy-minded chief information security officer (CISO) obtains executive buy-in to those goals, which works at a level understood by technicians and non-technicians alike. Next the CISO develops strategies to implement those goals, organizes and runs campaigns and operations to support the strategies, helps his or her team use tactics to realize the campaigns and operations, and procures tools and technology to equip the team.

Figure 2 shows an example of one strategic security approach to minimize loss due to intrusions, using a strategy of rapid detection, response, and containment, along with network security monitoring-inspired operations/campaigns, tactics and tools.

Figure 2. Five Levels of Strategic Security Example

Most security professionals – and by association policymakers and leaders taking advice from those practitioners and engineers – fixate on the tools, and to a lesser degree, the tactics of the digital security problem. Goals, strategies and campaigns aren’t usually a consideration because technicians, administrators, programmers and the like spend their time working with tools. The extent of their tactical involvement is thinking about creative ways to use their tools. The communities that tend to think in terms of goals, strategies and campaigns – think tanks, policy analysts and so on – have traditionally not engaged with the technicians to bring the entire strategic security approach to bear on modern challenges.

As shown in Figure 2, “detecting intruders” is actually shorthand for a rich strategic security program – one whose goal is minimizing loss through a strategy of rapid incident detection, response and containment. Security teams run operations to match threat intelligence against security event data and hunt for novel intruders as needed. They tactically collect, analyze, escalate and resolve incidents and the related data using tools suited for those functions.

It is crucial, however, that the ultimate goals and strategy remained linked with the tools at the bottom of the process. If that chain decouples, the outcome could be disastrous, where technical reality makes strategic theory obsolete. For example, a program built on monitoring the network will fail if all network traffic is encrypted. The tools at the bottom of the process will not be able to “see” the contents of network traffic and will be less effective when trying to identify suspicious and malicious activity. In this dysfunctional case, the tools’ inability to deliver required data to the personnel conducting tactical endeavors and operational campaigns will prevent the program goal from being achieved.

In future posts, I will elaborate on these concepts to demonstrate how they improve enterprise security.

Note: This post is adapted from a research paper by the author, published through The Brookings Institution as Strategy, Not Speed: What Today’s Digital Defenders Must Learn From Cybersecurity’s Early Thinkers.

White Paper

Protecting Your Data, intellectual Property, and Brand from Cyber Attacks

Webcast

Product Demo

White paper

Advanced Targeted Attacks

White paper

Spear Phishing Attacks

Video

Security Reimagined – Technology, Intelligence, Expertise

Brochure

FireEye Corporate Overview

Blog

Monthly Archives: June 2014

Turing Test in Reverse: New Sandbox-Evasion Techniques Seek Human Interaction

Sandbox evasion: a primer

To scroll is human

Two clicks and you’re out

Slow mouse, fast sandbox

A growing challenge

Cybersecurity in Heterogeneous Environments: A Podcast with Tom Hankins of Pacific Northwest National Laboratory

CRN’s “Women of the Channel” Highlights Growing Role in Cybersecurity

What are you doing? – DSEncrypt Malware

A 360° View of Cybersecurity – FireEye Incident Detection & Response Virtual Summit

A Not-So Civic Duty: Asprox Botnet Campaign Spreads Court Dates and Malware

Mergers and Acquisitions: When Two Companies and APT Groups Come Together

Introduction to Strategic Thought