di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

<h4>Don’t Let Application File Uploads Become Malware Downloads</h4>

file-upload-security-blog.jpg

Recent Blog Posts

Listing preview

Perspective & Findings

image_media_card

Recent Blog Posts

listing_preview

BPFDoor Malware Evolves – Stealthy Sniffing Backdoor Ups Its Game

Who is the only NEW vendor in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms?

ChatGPT and Malware: Making Your Malicious Wishes Come True

Top-3 Drawbacks of Content Disarm + Reconstruction (CDR) for Malware Prevention

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Trending at Deep Instinct

carousel_cards

blog-image-bpfdoor-malware.jpg

<h5>What is BPFdoor?</h5>BPFdoor is a Linux-specific, low-profile, passive backdoor intended to maintain a persistent, long-term foothold in already-breached networks and environments and functions primarily to ensure an attacker can re-enter an infected system over an extended period of time, post-compromise.The malware gets its name from its usage of a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> – a fairly unique way of receiving its instructions and evading detection, which bypasses firewall restrictions on incoming traffic.The malware is associated with a Chinese threat actor, Red Menshen (AKA Red Dev 18), which has been observed targeting telecommunications providers across the Middle East and Asia, as well as entities in the government, education, and logistics sectors since 2021.When it was first discovered, approximately one year ago, BPFdoor was noted for its effective and elegant design and its high emphasis on stealth – an essential element in maintaining undetected long-term persistence.Recently, Deep Instinct’s threat lab observed and analyzed a previously undocumented and fully undetected new variant of BPFdoor.<h5>New, Stealthier Variant</h5>Several key differences that make this new variant even stealthier compared to the previous version include the following:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 24%;">&nbsp;</th><th style="width: 38%;">“New stealthy” 2023 variant</th><th>“Old” 2022 variant</th></tr></thead><tbody><tr><td>Encryption</td><td>Static library encryption</td><td>RC4 Encryption</td></tr><tr><td>Communication</td><td>Reverse-Shell</td><td>Bind shell and iptables</td></tr><tr><td>Commands</td><td>No hardcoded commands – all commands are sent through the reverse-shell</td><td>Hardcoded commands</td></tr><tr><td>Filenames</td><td>Not hardcoded</td><td>Hardcoded</td></tr></tbody></table>One of the most significant differences compared to the previous variant lies in the removal of many of its hardcoded indicators, making the newer version more difficult to detect. Since first seen on VirusTotal in February 2023, the new variant remained undetected and is still undetected as of this writing.<h5>BPFdoor Technical Analysis</h5>When executed, the BPFdoor sample will attempt to create and get a lock on a runtime file at “/var/run/initd.lock” and will exit if it fails using that file as a makeshift mutex.<figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt6b1f7a605acf0d71" alt="Figure 1 - BPFdoor " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt6b1f7a605acf0d71/645bce382f97ad6087afc2a7/fig01-lock-mutex.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 1 - BPFdoor "mutex" check</figcaption></figure></figure>If successful, BPFdoor will fork itself and continue to run as a child process and in this context will close its stdin, stdout, and stderr streams, and set itself to ignore the following operating system signals:<table class="text-center"><thead class="bg-grey"><tr><th style="width: 16%;">Signal Number</th><th style="width: 21%;">Signal Name</th><th>Signal Description</th></tr></thead><tbody><tr><td>1</td><td>SIGHUP</td><td>SIGHUP ("signal hang-up") is a signal sent to a process when its controlling terminal session is closed.</td></tr><tr><td>2</td><td>SIGINT</td><td>SIGINT (“signal interrupt”) is a signal sent when a user interrupts a program (Ctrl + C)</td></tr><tr><td>3</td><td>SIGQUIT</td><td>SIGQUIT is a signal sent to terminate a process.</td></tr><tr><td>13</td><td>SIGPIPE</td><td>SIGPIPE is a signal sent when a pipe breaks.</td></tr><tr><td>17</td><td>SIGCHLD</td><td>SIGCHLD is a signal sent when a child process exits.</td></tr><tr><td>21</td><td>SIGTTIN</td><td>SIGTTIN is a signal sent to a process attempting to read from the same terminal session and is blocked.</td></tr><tr><td>23</td><td>SIGTTOU</td><td>SIGTTOU is a signal sent to a process attempting to write to the same terminal session and is blocked.</td></tr></tbody></table>Ignoring these signals hardens BPFdoor against tampering with its processes.Having set up the above, BPFdoor then allocates a memory buffer and creates a socket as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb66f26dd618af2fe" alt="Figure 2 - Socket arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb66f26dd618af2fe/645bce386d595aca93fa2ebf/fig02-socket-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 2 - Socket arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blte9215556a7459197" alt="Figure 3 - Socket creation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte9215556a7459197/645bce388a8445ca97101283/fig03-call-socket.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 3 - Socket creation</figcaption></figure>It will proceed to specify the following socket options using setsockopt:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltff07360ec7be9930" alt="Figure 4 - Setsockopt options" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff07360ec7be9930/645bce388dbb82c3c233f5f4/fig04-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 4 - Setsockopt options</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt0e81a161934c6431" alt="Figure 5 - Call to setsockopt" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt0e81a161934c6431/645bce38e4e69e5cbc037449/fig05-call-setsockopts.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 5 - Call to setsockopt</figcaption></figure>And will read from it in a loop (further described below) using recvfrom:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt7a59c922701ee083" alt="Figure 6 - Recvfrom arguments" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7a59c922701ee083/645bce38065c95739056107a/fig06-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 6 - Recvfrom arguments</figcaption></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt811bbcab6a1bb954" alt="Figure 7 - Recvfrom call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt811bbcab6a1bb954/645bce38367cefb5428f68a2/fig07-loop-call-recvfrom.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 7 - Recvfrom call</figcaption></figure>An interesting point in the above-described flow is that the “addr” parameter is zeroed out in the call to recvfrom; it should point to a specific address from which to read data. The socket is not connected and no bind or listen calls have been made. So, what exactly is going on here?Interpreting the exact arguments that are used to create the socket reveals that the call is structured as follows:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt36f6534323294019" alt="Figure 8 - Socket call" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt36f6534323294019/645bce38367cefe17b8f689e/fig08-socket_eth.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 8 - Socket call</figcaption></figure>This creates the socket as a special packet sniffing socket which is able to read every packet that is sent to the machine from the ethernet layer and above without being bound to any specific protocol.BPFdoor employs this type of packet sniffing socket to read data with recvfrom, even without an “addr” parameter, by using the loop below to search for a specific “magic” byte sequence:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltf3c3312b0751a812" alt="Figure 9 - Looped search for " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf3c3312b0751a812/645bce388929af83080777c5/fig09-read-loop.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 9 - Looped search for "magic" byte sequence (highlighted)</figcaption></figure>“Magic” byte sequence: \x44\x30\xCD\x9F\x5E\x14\x27\x66Once found, the loop will break and BPFdoor will continue to Its next phase of operation.But, that creates quite a lot of traffic that BPFdoor will need to go through.Let’s examine the usage of setsockopt a bit further. When parsing its arguments, we arrive at the following code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt734c1601420f27c9" alt="Figure 10 - Setsockopt attaches BPF" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt734c1601420f27c9/645bce4b7e7e7b9bafe70a08/fig10-setsockopt-args.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 10 - Setsockopt attaches BPF</figcaption></figure>This is where BPFdoor gets its name from. The above code that attaches a <a href="https://en.wikipedia.org/wiki/Berkeley_Packet_Filter" target="_blank">Berkley Packet Filter</a> to the socket; this is the very same mechanism that underpins infosec staples such as libpcap and allows BPFdoor to filter out “uninteresting” types of data coming through its socket.A Berkley Packet Filter can be defined as in the example below, which allows TCP over IPv4:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt89210974b140db77" alt="Figure 11 - BPF example" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt89210974b140db77/645bce4b065c95264056107e/fig11-bpf-example.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 11 - BPF example</figcaption></figure>By setting the socket option SO_ATTACH_FILTER and pointing filter to the following sock_filter_code:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt3a9b0cf5b5fbc758" alt="Figure 12 - BPF sock_filter_code" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3a9b0cf5b5fbc758/645bce4b1f0a4c5876e36beb/fig12-sock-filter-codev3.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 12 - BPF sock_filter_code</figcaption></figure>BPFdoor guides the kernel to set up its socket to only read UDP, TCP, and SCTP traffic coming through ports 22 (ssh), 80 (http), and 443 (https).Because of its positioning at such a low level, BPFdoor does not abide by any firewall rules, and can bypass any firewall restrictions on incoming traffic and listen for packets that otherwise wouldn't have surfaced to the machine's user mode.When BPFdoor finds a packet containing its “magic” bytes in the filtered traffic it will treat it as a message from its operator and will parse out two fields and will again fork itself.The parent process will continue and monitor the filtered traffic coming through the socket while the child will treat the previously parsed fields as a Command & Control IP-Port combination and will attempt to contact it.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt59a3decfdb9a8b40" alt="Figure 13 - Connect to Command & Control" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt59a3decfdb9a8b40/645bce4b8a84453a7a101287/fig13-connect-c2.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 13 - Connect to Command & Control</figcaption></figure>An interesting point to note, this variant of BPFdoor contains a pre-compiled version of <a href="https://github.com/libtom/libtomcrypt" target="_blank">libtomcrypt</a>, an open-source encryption library, as can be seen in the sample’s contained strings, which also offer a few additional insights:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt8e6c0a33246bf7b3" alt="Figure 14 - Contained strings" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8e6c0a33246bf7b3/645bce4b291ca448ab7458bf/fig14-libtom-strings.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 14 - Contained strings</figcaption></figure>We can see that the library was compiled at the beginning of October 2022 using GCC on a system running Red Hat Linux. This may suggest that this variant has been operational significantly earlier than its first appearance on VirusTotal.By compiling our own version of the library in similar fashion and using bindiff to compare against BPFdoor we can see its statically linked exports:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt816a0cb45cfa1a28" alt="Figure 15 - Libtomcrypt bindiff snippet" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt816a0cb45cfa1a28/645bce4b2f97ad7a76afc2ab/fig15-libtom-bindiff.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 15 - Libtomcrypt bindiff snippet</figcaption></figure>Having made the comparison, we determined that BPFdoor is using libtomcrypt functionality to set up a secure and encrypted “reverse-shell” session with its Command & Control. This replaced its previous mechanism.After this session is established, BPFdoor will begin a loop that can be described by the following:<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="bltb2ff1c169f93cb84" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltb2ff1c169f93cb84/645bce3822f9986ff5c5974b/BPFDOORv2Flow.png" style="text-align: center;"/></figure><h5>Conclusion</h5>BPFdoor retains its reputation as an extremely stealthy and difficult-to-detect malware with this latest iteration.Regardless of whether one considers the encryption library compilation time (October 2022) or its initial submission to VirusTotal (February 2023) as indicative of when this sample was first put into use, it is truly amazing how long it has remained fully undetected.<figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt93ffef0dee975742" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt93ffef0dee975742/645d25159c40aa50cb074137/fig16-vt-0detectionv3.png" style="text-align: center;"/></figure><figure style="margin-top: auto;margin-right: auto;margin-bottom: auto;margin-left: auto;text-align: center;width: auto;"><img asset_uid="blt940800074dbf8141" alt="Figure 16 & 17 - 0 VirusTotal detections, 7 different scans." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt940800074dbf8141/645bce4b32acc8af715ee19b/fig17-vt-many-scans.png" style="text-align: center;"/><figcaption style="text-align: center;">Figure 16 & 17 - 0 VirusTotal detections, 7 different scans.</figcaption></figure><h5>IOCs</h5>afa8a32ec29a31f152ba20a30eb483520fe50f2dce6c9aa9135d88f7c9c511d7 – BPFDoor ELF SHA256 /var/run/initd.lock – BPFDoor "mutex”<h5>MITRE ATT&CK:</h5><table class="text-center"><thead class="bg-grey"><tr><th style="width: 20%;">Tactic</th><th>Technique</th><th>Description</th><th style="width: 20%;">Observable</th></tr></thead><tbody><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205 - Traffic Signaling</td><td>Attacker employs “magic” values to trigger response.</td><td>“Magic” byte sequence</td></tr><tr><td>Command and Control Defense Evasion Persistence</td><td>T1205.002 - Traffic Signaling: Socket Filters</td><td>Attacker attaches filter to a network socket.</td><td>Usage of Berkley Packet Filter</td></tr><tr><td>Command and Control</td><td>T1573 - Encrypted Channel</td><td>Attacker employs encrypted Command & Control communication.</td><td>Usage of libtomcrypt</td></tr><tr><td>Execution</td><td>T1106 – Native API</td><td>Attacker calls upon native OS APIs in order to execute behaviors.</td><td>Usage of popen</td></tr></tbody></table>Earlier variant analysis: <a href="https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor" target="_blank">https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor</a>Deep Instinct takes a prevention-first approach to stopping ransomware and other malware using the world’s first and only purpose-built, deep learning cybersecurity framework. We prevent ransomware, zero-day threats, and previously unknown malware in &lt;20 milliseconds, 750x faster than the fastest ransomware can encrypt. Deep Instinct has &gt;99% zero-day accuracy and promises a &lt;0.1% false positive rate. The Deep Instinct Prevention Platform is an essential addition to every security stack – providing complete, multi-layered protection against threats across hybrid environments.

dirty-vanity-blog.jpg

Dirty Vanity: A New Approach to Code Injection & EDR Bypass

cve-2023-23397-blog-image.jpg

Disclaimer: This blog contains sensitive information but since this information is publicly available and at least partially public knowledge we decided not to redact any information as it would cause this post to be irrelevant. Due to the simplicity of the attack and the fact it does not require user interaction we are urging everyone to patch their systems immediately.On March 14, 2023, Microsoft released a security fix for an elevation-of-privilege vulnerability (CVE-2023-23397) in Microsoft Outlook.A specially crafted email can trigger the vulnerability automatically when it is retrieved and processed by the Outlook client. Such an email could lead to exploitation before the email is viewed in the Preview Pane, which allows an attacker to steal credential hashes by forcing the target’s devices to authenticate to an attacker-controlled server.The Computer Emergency Response Team for Ukraine (CERT-UA) reported the vulnerability to Microsoft. Based on Microsoft Threat Intelligence, a Russia-based threat actor used it in attacks to target and breach the network of several governments, military, energy, and transportation organizations in Europe between April and December 2022.MDSec already <a href="https://www.mdsec.co.uk/2023/03/exploiting-cve-2023-23397-microsoft-outlook-elevation-of-privilege-vulnerability/" target="_blank">demonstrated</a> a POC of this attack and security researcher <a href="https://twitter.com/kevthehermit/status/1635981427400400897" target="_blank">@KevTheHermit</a> found a sample of an email attack in the wild.Deep Instinct Threat Lab found additional samples exploiting this vulnerability including the potential attack that was reported by CERT-UA.The samples can be grouped into five distinct clusters. Below is a timeline of the attacks:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt032ce0ad10df7dd6" alt="Figure 1: Timeline of attacks utilizing CVE-2023-23397" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt032ce0ad10df7dd6/6413c20811934c1085402d52/fig1-timeline-of-attacks-utilizing-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Timeline of attacks utilizing CVE-2023-23397</figcaption></figure><h3>Possible Attribution</h3>Microsoft attributed the attack to a Russian-based threat actor. The attacks on Romania, Poland, and Ukraine align with Russian interests, while the attacks on Jordan and Turkey might be related to a different threat actor.This attack vector, which leads to NTLM harvesting, was also <a href="https://unit42.paloaltonetworks.com/xhunt-campaign-new-watering-hole-identified-for-credential-harvesting/" target="_blank">observed</a> in 2020 by Iranian threat actors. Additionally, Russia and Iran have signed a cyber-cooperation <a href="https://www.cfr.org/blog/iran-russia-cyber-agreement-and-us-strategy-middle-east" target="_blank">agreement</a>.The Jordanian foreign ministry has been targeted in the <a href="https://therecord.media/apt34-oilrig-iran-jordan-email-campaign-malwarebytes" target="_blank">past</a> by Iranian threat actors, which might indicate the vulnerability was shared with the Iranians.NTLM harvesting could be used either to hash relay attacks or for offline password cracking, indicating that the attacker either had prior access to the attacked organization or they have knowledge of remote-authentication services that do not require multi-factor authentication.<h3>Hunting for the Vulnerability</h3>Microsoft <a href="https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/" target="_blank">provided</a> a PowerShell script to retroactively search for potentially malicious messages containing the vulnerability. The script looks for three types of messages – note, appointment, and task:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt46f1b647b377698d" alt="Figure 2: Microsoft’s PowerShell code that looks for three specific types of messages" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt46f1b647b377698d/6413c2080c29c7363bf3956f/fig2-microsofts-powershell-code-that-looks-for-specific-messages-from-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: Microsoft’s PowerShell code that looks for three specific types of messages</figcaption></figure>This could indicate that the vulnerability can be triggered by any of those types of messages. If you are using Outlook, you might be familiar with some of them:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt298f779daa396908" alt="Figure 3: How to manually create a legitimate task or appointment" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt298f779daa396908/6413c20858d08575eae5b295/fig3-how-to-legitimately-create-manual-task-appointment-outlook.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: How to manually create a legitimate task or appointment</figcaption></figure>While MDSec used an “appointment” message in their POC, the attacks in the wild used a “task” message:<figure style = "margin: auto; text-align: center;width: 433px;"><img asset_uid="blt398e5bc10dee52f8" alt="Figure 4: IPM.Task property in malicious email ITW" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt398e5bc10dee52f8/6413c2084d478f2618dc953c/fig4-ipm.task-property-in-malicious-itw-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: IPM.Task property in malicious email ITW</figcaption></figure>Using the following query in VirusTotal we found suspected emails with the vulnerability: “content:{490050004d002e005400610073006b00} tag:outlook”If the email also contains a UNC path this means this is a malicious task using the vulnerability.However, we found extracts from emails sent to Polish targets dated in the September timeframe that are not found via the query above:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt76275f2529aacbeb" alt="Figure 5: File from September containing characteristics of CVE-2023-23397" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt76275f2529aacbeb/6413c2081605593a8b0d15d0/fig5-file-from-september-containing-characteristics-of-cve-2023-23397.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: File from September containing characteristics of CVE-2023-23397</figcaption></figure><h3>Conclusion</h3><ul><li>While we found evidence of attacks starting in April 2022, there is a possibility that it was exploited even earlier.</li><li>Due to the fact that we used only publicly available data the actual scope of attacked targets could be much higher.</li><li>Microsoft attributed the attacks to a Russian-based threat actor; however, public evidence might suggest another threat actor exploited the vulnerability as well.</li><li>Since the attack does not require user interaction, we urge everyone using the Outlook application to patch their systems as soon as possible.</li><li>We also suggest running the PowerShell script <a href="https://microsoft.github.io/CSS-Exchange/Security/CVE-2023-23397/" target="_blank">provided</a> by Microsoft to find retroactively malicious emails in the exchange server.</li></ul><h3>IOCs</h3>24.142.165[.]2 101.255.119[.]42 113.160.234[.]229 168.205.200[.]55 181.209.99[.]204 185.132.17[.]160 213.32.252[.]221

CVE-2023-23397: Exploitations in the Wild – What You Need to Know

emotet-returns-2023-blog.jpg

Earlier this week, on Tuesday, March 7th, Emotet was observed for the first time this year sending new malspam to infect victims. This is significant because the last time Emotet was seen sending malicious spam was in <a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">November</a> of 2022. This current wave is different from the one in November, though, including new evasion techniques that we will detail in this blog. Deep Instinct’s Threat Research team has been tracking Emotet over the last year and has written about its periods of silence and reemergence with new tactics. We will continue to track the malware and alert the community to any changes or activity. <ul><li>November 17, 2022: <a href="/blog/emotet-vacation-is-over-no-rest-for-the-wicked" target="_self">Emotet Vacation Is Over: No Rest For The Wicked</a></li><li>June 9, 2022: <a href="/blog/emotet-malware-returns-in-2022" target="_self">Emotet Malware Returns in 2022</a></li></ul>The first to observe and tweet about Emotet’s return was <a href="https://twitter.com/ilbaroni_/status/1633087980561735680" target="_blank">@ilbaroni_</a>: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt06f56e90c1fd7d11" alt="Figure 1: First public observation of Emotet’s return" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt06f56e90c1fd7d11/640a621ee5ffbf108e0bbf3f/fig1-first-public-observation-of-emotets-return.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: First public observation of Emotet’s return</figcaption></figure> <h3>Delivery via Thread Hijacking Emails  </h3>The delivery method that Emotet used is the same as in November, however, this time the attached zip files are not password protected. Deep Instinct’s Threat Research team observed thread-hijacked emails sent to companies around the globe, including in Japan: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt20e3927b313134eb" alt="Figure 2: Thread-hijacked mail in Japanese" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt20e3927b313134eb/640a621e6d0cf81016ab9102/fig2-thread-hijacked-mail-in-japanese.png" height="auto" /><figcaption style = "text-align: center;" >Figure 2: Thread-hijacked mail in Japanese</figcaption></figure> <h3>Changes to Emotet Malspam </h3>In November, Emotet was sending malicious Excel files in the archives. Now Emotet is sending archives with malicious Word files. The Word files include macros that, if enabled, start the infection chain. The first page contains an image that tries to lure the receiver to enable macros: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf706d459b420f0d1" alt="Figure 3: Social engineering lure on first page" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf706d459b420f0d1/640a621ea7d98e0267ed3669/fig3-social-engineering-lure-on-first-page.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Social engineering lure on first page</figcaption></figure> The second page is blank, while pages 3-7 are excerpts from the novel “<a href="https://en.wikipedia.org/wiki/Moby-Dick" target="_blank">Moby-Dick</a>” which are written in white font to make the pages appear blank. The whole document has 14,801 characters and 2,587 words; the text is added as part of an evasion technique. Many security tools will classify a Word document with just an image and a macro as malicious, which is true in most cases. Some people still use macros for legitimate reasons, despite there being little reason to do so with the advances we have made in technology in the 21st century. Adding textual context to a file with macros might fool some security tools into thinking that the file is benign: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9396b636b76e97a8" alt="Figure 4: Changing the font color reveals the hidden text" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9396b636b76e97a8/640a621f325d0044fe5fabb6/fig4-changing-font-color-reveals-hidden-text.png" height="auto" /><figcaption style = "text-align: center;" >Figure 4: Changing the font color reveals the hidden text</figcaption></figure> The Word document in the example contains several long and obfuscated macros which download and execute a ZIP file containing the Emotet DLL from one of several compromised websites. If that’s not enough, the most interesting change made by Emotet that it now artificially inflates the size of the Word document to over 500mb: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt4771a740a24441f5" alt="Figure 5: Zero bytes are added to the end of the document." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4771a740a24441f5/640a621fe35cc90ebcbd3896/fig5-zero-bytes-are-added-to-end-of-document.png" height="auto" /><figcaption style = "text-align: center;" >Figure 5: Zero bytes are added to the end of the document.</figcaption></figure> This is done by simply adding zero bytes at the end of the document. Deep Instinct researchers have <a href="/blog/the-russian-spyagent-a-decade-later-and-rat-tools-remain-at-risk" target="_self">seen this technique previously</a> used to inflate the final payloads, such as executables or DLL files. The result is like the one before, and because the files are so big, many security products and sandboxes don’t scan them, which breaks the automatic analysis and IOC extraction. As mentioned earlier, the macros download a ZIP file from compromised hosts which contain a DLL file which is the Emotet loader. This DLL is also inflated with zero bytes to a file size of over 500mb. The combination of both the initial attack vector and the payload being artificially inflated might completely blind products that solely rely on static analysis. Despite these changes the behavior of the loader appears the same. In the past Emotet used to copy a local version of the certutil.exe; this time Emotet drops a specific version of renamed certutil into “&lt;AppData&gt;\Local\Temp.” The hash of the observed version is: 4224312da8c3a37b95dd78236fca5ca316021c5de6e517d0ddc753ee26932e6a Emotet is still using process injection, therefore, security products that do not rely solely on static detection have a better chance at stopping the current wave. <h3>IOC </h3>DOC: a13b394e4017c0c77faf4fab6c3aea4de3443f11610cc85a1d677249b9b2bc3a DLL: efcf59f4423df8fdacbfa8c3d23b6a3e4722bab65c31ea8a7f32daadddfa7adc For the full list of IOCs (278) visit our <a href="https://github.com/deepinstinct/Emotet-IOCs" target="_blank">GitHub page</a>.

Emotet Again! The First Malspam Wave of 2023

ducktail-blog.jpg

DUCKTAIL: Threat Operation Re-emerges with New LNK, PowerShell, and Other Custom Tactics to Avoid Detection

VSTO-blog.png

<h3>Introduction</h3>Office Visual Basic for Applications (VBA) macros have been a <a href="/blog/types-of-dropper-malware-in-microsoft-office" target="_self">core tool</a> in most threat actors’ arsenals for decades.Their capabilities have enabled clever — and just <a href="https://www.trustedsec.com/blog/malicious-macros-for-script-kiddies/" target="_blank">clever-enough</a> — threat actors to deliver a dizzying array of malware to countless devices around the world. During that time, they have served as what is quite possibly the most commonplace attack vector to infect and compromise Windows PCs. They also acted as a significant component of the first link in a malicious kill-chain that resulted in network compromises, data breaches, and ransomware incidents.This threat landscape prominence has recently been stifled by Microsoft’s long-awaited decision to <a href="https://learn.microsoft.com/en-us/deployoffice/security/internet-macros-blocked" target="_blank">block-by-default</a> any VBA macro in Office files bearing the mark-of-the-web (indicating that the file did not originate from the local machine). This significantly reduced this attack surface and forced threat actors to adapt and explore alternative attack vectors.One of these, which is gaining popularity, is the usage of .LNK (shortcut) files. An example of this can be seen in one of our <a href="/blog/the-dark-side-of-bumblebee-malware-loader" target="_self">recent reports</a>.Another such example is Visual Studio Tools for Office (VSTO). Below we explore some “in-the-wild” examples of how VSTO can become a significant attack vector.<h3>What is VSTO?</h3>A software development toolset, VSTO is available in Microsoft’s Visual Studio IDE. It enables Office Add-In’s (a type of Office application extension) to be developed in .NET and also allows for Office documents to be created that will deliver and execute these Add-In’s.Additionally, VSTO Add-In’s can be associated with the specific Office application they were developed for (Word, Excel, etc.) and will execute every time that application is booted, offering up an interesting persistence option on top of the code-execution ability.VSTO Add-In’s can be packaged alongside Office documents (Local VSTO), or, alternatively, fetched from a remote location when a VSTO-Bearing Office document is opened (Remote VSTO). This, however, may require bypass of trust-related security mechanisms.<h3>VSTO as a Threat Vector</h3>In the current threat landscape’s observed state, VSTO is still an uncommon vector (despite being initially <a href="https://bohops.com/2018/01/31/vsto-the-payload-installer-that-probably-defeats-your-application-whitelisting-rules/" target="_blank">discussed</a> quite <a href="https://twitter.com/gN3mes1s/status/939146796605018113" target="_blank">some time ago</a>). But as is often the case when an esoteric attack vector is involved, it also goes largely undetected by most security vendors, which may lead to it increasing in popularity in the near-term future.VSTO-bearing Office files contain several indicators which differentiate them from non-VSTO Office files, the primary of which is a contained “custom.xml” XML which contains “_AssemblyLocation” and “_AssemblyName” properties used by the Office application to locate the Add-In and install it.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltae692c45fce8c9be" alt="Figure 1 - Example of a " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltae692c45fce8c9be/63da8c54df2bf910c80316e8/fig01-custom-xml-referring-local-vsto-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1 - Example of a "custom.xml" XML referring to a local VSTO Add-In.</figcaption></figure><h3>Local VSTO</h3>When VSTO is employed in its local “flavor” the .NET compiled .DLL “Add-In” and its dependencies are stored alongside the Office document created to execute it, commonly in a “container” such as an .ISO file.In the example detailed below, which targets Portuguese-speaking users, we can see a malicious .ISO file which contains a malicious Word document and a hidden VSTO “Add-In” and its dependencies:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt54d82b8f46d9881c" alt="Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt54d82b8f46d9881c/63da8c54c8540a111ada8b4b/fig02-malicious-iso-hidden-files-not-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2 - Malicious .ISO, Hidden files not shown, as would appear to most users.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blta83b367d030dd885" alt="Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta83b367d030dd885/63da8c545b2c1e6188c56ec2/fig03-malicious-iso-hidden-files-shown.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3 - Malicious .ISO, hidden files shown, mostly dependencies, highlighted - Word document and VSTO "Add-In" payload.</figcaption></figure>Once the victim opens the malicious Word document, they are encouraged to install the “Add-In” in a very similar fashion to the way victims were encouraged to click the “Enable Content” button and allow a malicious VBA macro to execute.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt41d8d794383d1aa8" alt="Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41d8d794383d1aa8/63da8c540cf395166a6e22fb/fig04-word-doc-prompts-user-to-allow-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4 - Word document (“Eventos_CDG_1Maio.docx”) prompts the user to allow "Add-In" installation.</figcaption></figure><figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt1785537237489441" alt="Figure 5 - Malicious " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1785537237489441/63da8c54e480c910d1acbbb7/fig05-malicious-custom-xml-contained-by-eventos-referring-to-hidden-add-in.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5 - Malicious "custom.xml" contained by “Eventos_CDG_1Maio.docx” referring to the hidden “Add-In” present locally on the .ISO file.</figcaption></figure>Once allowed by the user, the malicious “Add-In” will be executed.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltfd8952f6b1cd8776" alt="Figure 6 - VSTO installation prompt." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfd8952f6b1cd8776/63da8c542d94ad4c89edc84d/fig06-vsto-installation-prompt.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6 - VSTO installation prompt.</figcaption></figure>Examining the “Add-In” payload reveals it serves to execute an encoded and compressed PowerShell snippet:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltff7e2e81ed5f2a4f" alt="Figure 7 - " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltff7e2e81ed5f2a4f/63da8c544ad09d10da61ae0b/fig07-eventos_cdg_1maio.dll-payload-core.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 7 - "Eventos_CDG_1Maio.dll” payload “core”.</figcaption></figure>An interesting point of note is that the above code’s parent .NET namespace is “schell_test.” This appears to be a reference to a <a href="https://medium.com/@airlockdigital/make-phishing-great-again-vsto-office-files-are-the-new-macro-nightmare-e09fcadef010" target="_blank">post by Daniel Schell</a>, which predates the appearance of this sample by approximately two weeks.Decoding and decompressing from the above, the snippet is intended to deliver and execute additional PowerShell code from a Command & Control server:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt2deb8b0052b3ec77" alt="Figure 8 - Decoded and decompressed PowerShell snippet." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2deb8b0052b3ec77/63da8c543d28dd4dde642bc5/fig08-decoded-and-decompressed-powershell-snippet.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 8 - Decoded and decompressed PowerShell snippet.</figcaption></figure>Unfortunately, we were unable to obtain this additional 2nd-stage code as it had gone offline prior to our investigation of this sample.<h3>Remote VSTO</h3>VSTO can also be employed in remote fashion, i.e., the Add-In can be stored separately of the Office document created to deliver and execute it. This can make an attack employing VSTO even more challenging to detect or prevent. However, it can also be more complex for an attacker to execute because it requires bypassing various trust-related security mechanisms using a trusted publisher certificate, for example.In the example below, we can see a reference to a remotely stored VSTO “Add-In” taken from a malicious Word document:<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="bltf4e068fa4bdd09dc" alt="Figure 9 - Remote VSTO " src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf4e068fa4bdd09dc/63da8c545ca8a710cf4b7226/fig09-remote-vsto-custom-xml.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 9 - Remote VSTO "custom.xml" XML.</figcaption></figure>Examining the “Add-In” .DLL payload, which was obtained by cross-referencing threat intelligence data, we can see the following contained code which is intended to download a password protected .ZIP archive, extract it in the user’s %\AppData\Local\ folder, and execute a contained “conhost.exe” file.<figure style = "margin: auto; text-align: center;width: autopx;"><img asset_uid="blt29d36f5d1f3a9676" alt="Figure 10 - “3rd stage” payload delivery and execution code." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt29d36f5d1f3a9676/63da8c54e4e29e75dc5df0ee/fig10-3rd-stage-payload-delivery-and-execution-code.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 10 - “3rd stage” payload delivery and execution code.</figcaption></figure>Unfortunately, we were unable to obtain the 3rd-stage archive and its contained payload (“conhost.exe”) as it had gone offline prior to our investigation of this sample.<h3>POC of VTSO Attack Scenarios</h3>Partly as an academic exercise, and partly because the final payloads related to the above-described samples were unavailable, we decided to put together a proof of concept (POC) of how VSTO can be used in multiple types of attack scenarios.

In the above video, you can see a demonstration of our proof of concept delivering and executing a Meterpreter payload as well as establishing persistence on the victim’s machine.The POC code can be found in our public <a href="https://github.com/deepinstinct/VSTO-POC" target="_blank">GitHub repository</a>Please note that we used a simple, highly detectable, Meterpreter payload. This required us to disable <a href="/vs-microsoft-defender" target="_self">Microsoft Windows Defender</a> to film the above video. However, the rest of the POC components went completely undetected.<h3>Conclusion</h3>While VSTO Add-In's are relatively uncommon in the threat landscape due to the capabilities offered both in terms of execution (in theory – an entire fully-featured malware strain can be written and developed in .NET as a VSTO Add-In) and in terms of persistence, we expect more threat actors to adopt and employ them soon. This is particularly true of nation-state and other “high caliber” actors who are more likely to gain the ability to bypass the trust mechanisms present in the Windows environment by means such as a stolen (or otherwise obtained) trusted certificate.<h3>IOCs</h3>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930 E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48 0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151 B3282DC58AD961911D94B712CEA11F649B0BA785D7FF74D7ED9946E1260DD521 40C9D3D58CE5DB0C6D18184E5813C980CD7B72EFC7505C53CD13E60860EF8157 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C hxxps://34.241.171.114/ hxxp://classicfonts.live/<h3>MITRE Mapping</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Execution</td><td>T1204.002User Execution: Malicious File</td><td>User must open a malicious document</td><td>E74DD27FF0BA050BBC006FD579B8022E07B570804588F0E861CC4B1321A3EC48</td></tr><tr><td>Execution</td><td>T1059.001Command and Scripting Interpreter: PowerShell</td><td>PowerShell code is executed</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151</td></tr><tr><td>Defense Evasion</td><td>T1553.005Subvert Trust Controls: Mark-of-the-Web Bypass</td><td>.ISO container file used</td><td>5530F5D20016E3F0E6BBC7FAD83EEC56F118179D4C5D89FC26863C37482F8930</td></tr><tr><td>Defense Evasion</td><td>T1027Obfuscated Files or Information</td><td>Obfuscation used; Password protected file used.</td><td>0526F63486DE882CCF33374DCA4B093219A8FD93014BABE794715F04FF49B151, 78D6A2C0B52E9E5AF8007BC824EFD5846585A3056B3A0E6EFDFA7E60EED48C8C</td></tr><tr><td>Persistence</td><td>T1137.006Office Application Startup: Add-ins</td><td>VSTO Add-In's may be used for persistence</td><td>E62E05D9DE5DAAB900FC32941727870C018D7CFD46E2BAC43EF360B80B3A0B31</td></tr></tbody></table>

No Macro? No Worries. VSTO Being Weaponized by Threat Actors

chatgpt-malicious-wishes-blog.png

Since its release in November 2022, ChatGPT has been gaining popularity, being asked everything from how to explain quantum computing to writing a birthday poem. The big question on everyone’s mind in the cybersecurity industry: Will ChatGPT become a tool for attackers to create and accelerate more sophisticated attacks? Our research below demonstrates how dangerous ChatGPT can be in the wrong hands. There is also the potential for researchers to use this tool to thwart attacks and for software developers to improve their code. However, we did find the AI is better at creating malware than providing ways to detect it. As with most technological advances, malware authors have found ways to abuse ChatGPT to spread malware. Examples of malicious content created by the AI tool, such as phishing messages, information stealers, and encryption software, have all been shared online. OpenAI has taken several measures to prevent misuse of their new tool and implemented mechanisms that can help their software recognize when a user asks it to create malicious content/code. For example, if a person asked ChatGPT to write ransomware, the software checks for flagged words such as ‘steal’ and ‘ransom,’ and refuses to comply. However, as we demonstrate below, there is a way to get past these controls. It comes down to how you ask the question. <h3>It's All About Phrasing </h3>ChatGPT attempts to avoid providing malicious code. In the below image, you can see the reply I got when I asked the software to provide a Go keylogger: <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltf04bbd046f350972" alt="Figure 1: ChatGPT’s refusal to provide a keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltf04bbd046f350972/63c8427ae6cd4a7779d9f929/fig01-chatgpt-refused-to-provide-keylogger.png" height="auto" /><figcaption style = "text-align: center;" >Figure 1: ChatGPT’s refusal to provide a keylogger</figcaption></figure> However, when I rephrased my request and described what the program should do, without using the word ‘keylogger,’ my request was fulfilled. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt198cc2bb388f3945" alt=" Figure 2: Successfully getting a Go keylogger" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt198cc2bb388f3945/63c8427a1864e26d0032af7d/fig02-chatgpt-successfully-creating-go-keylogger.png" height="auto" /><figcaption style = "text-align: center;" > Figure 2: Successfully getting a Go keylogger</figcaption></figure><h3>Go Eddie the AV Evader </h3>To see what other tricks this new puppy could do, and how well the anti-malware solution dealt with them, I decided to ask the AI for a more destructive malware — ransomware. For obvious reasons, I couldn’t just ask for ransomware outright and instead needed to beat around the bush a little in my request, as can be seen below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltd641b177c5591cf9" alt="Figure 3: Successfully getting a Go ransomware" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltd641b177c5591cf9/63c8427a3431f93ff7f79ecc/fig03-chatgpt-successfully-creating-go-ransomware.png" height="auto" /><figcaption style = "text-align: center;" >Figure 3: Successfully getting a Go ransomware</figcaption></figure> The above reply was accompanied by a Go script which did everything that had been requested. All I needed to do was add two missing imports, change the default AES key, as well as the default string ChatGPT used as the dropped text files’ content, and I got a working piece of ransomware. I also removed the bot’s comments to make the program more difficult to detect. Then I compiled the scripts into PE32 and PE64 files, made sure they ran without any issues, and uploaded them to VirusTotal to check how well the anti-malware solutions dealt with them. The results were alarming. Only 4 out of 69 engines detected the PE32, and only 2 out of 71 caught the PE64 version. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt41a233c745211f9b" alt="Figure 4: The PE32 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt41a233c745211f9b/63c8427a83026010f1038cae/fig04-pe32-variant-detection-rate-on-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 4: The PE32 variant’s detection rate on VirusTotal</figcaption></figure> <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1230d55deef0ef1d" alt="Figure 5: The PE64 variant’s detection rate on VirusTotal" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1230d55deef0ef1d/63c8427a08b84c3d9e4c9a63/fig05-pe64-variant-detection-rate-virustotal.png" height="auto" /><figcaption style = "text-align: center;" >Figure 5: The PE64 variant’s detection rate on VirusTotal</figcaption></figure> The files may have been missed because the script that was compiled to create them was written in Go — an uncommon language that was chosen for this research precisely for this reason. Another possibility is that the simplicity of the ransomware, which uses a symmetric encryption algorithm (AES), doesn’t upload any files to a remote IP, like most modern ransomware does, and doesn’t avoid encrypting specific filetypes. In any case, this is still ransomware, and the inability of most anti-malware solutions to detect it, at least statically, demonstrates clearly how dangerous ChatGPT can be when in the wrong hands. <h3>Bug by Design </h3>As previously stated, I had to add imports to the Go ransomware to make it work. A similar thing happened when I asked ChatGPT to create the keylogger — it left the implementation of one of the functions to me, as can be seen in the image below. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt747488b5780f7d87" alt="Figure 6: Omitted file transfer implementation" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt747488b5780f7d87/63c8427ae97936109ef2be6d/fig06-omitted-file-transfer-implementation.png" height="auto" /><figcaption style = "text-align: center;" >Figure 6: Omitted file transfer implementation</figcaption></figure> I had suspected that this might not be a bug, but a way for the AI solution to avoid delivering functioning malware. The message below, which I received from the bot, just made me more confident in my assumption. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt1ac3ef584c795933" alt="Figure 7: Information about message content" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1ac3ef584c795933/63c8427ab2a32b3f99e44c16/fig07-information-about-message-content.png" height="auto" /><figcaption style = "text-align: center;" >Figure 7: Information about message content</figcaption></figure> As you can see, ChatGPT was aware that the provided ransomware code could not be executed, and even knew which libraries were needed to make it run. This, combined with the answer I received after asking the AI why it hadn’t imported these libraries itself, strengthened my belief that the bot provided inexecutable code by design. <h3>Jekyll vs Hyde </h3>Even though ChatGPT can be used to create malware, it can also be used to help security researchers defend against malware. For example, by writing YARA rules to detect different attack techniques. In the below image, you can see an example of a YARA rule which was created to detect MITRE ATT&CK sub-technique T1055.002 (process injection). <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt9aff6f0361088df1" alt="Figure 8: YARA rule to detect process injection, prone to false positives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9aff6f0361088df1/63c8427a1327af10d8774158/fig08-yara-rule-to-detect-process-injection-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 8: YARA rule to detect process injection, prone to false positives</figcaption></figure> This rule was too general and would likely generate a lot of false positives, so I asked the AI for a more specific rule and got the below reply. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blte277265c707d0169" alt="Figure 9: YARA rule to detect process injection, prone to false negatives" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blte277265c707d0169/63c8427a7dbd6a1641ea2d84/fig09-make-above-yara-rule-less-prone-to-false-positives.png" height="auto" /><figcaption style = "text-align: center;" >Figure 9: YARA rule to detect process injection, prone to false negatives</figcaption></figure> This may generate less false positives, but it will also have more false negatives, meaning it will miss more malware that performs process injection. In any case, I wanted to check if the bot would write code that bypassed its own rule, and as can be seen below, even though it had some reservations, it did. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt96a5835ed986ed03" alt=" Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt96a5835ed986ed03/63c8427aca4ee4418bab9b69/fig10-chatgpt-agreement-to-write-malware-that-bypasses-its-own-yara-rule.png" height="auto" /><figcaption style = "text-align: center;" > Figure 10: ChatGPT’s agreement to write malware that bypasses its own YARA rule</figcaption></figure>Apparently, ChatGPT did such a good job at writing the malware that it failed to write a YARA rule that could detect its own work and provided a rule that was prone to false positives instead. All in all, it seems that the AI solution is better at creating malware than providing ways to detect it. <figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt7f1475512190800e" alt="Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt7f1475512190800e/63c842845156964aea434e3c/fig11-chatgpts-inability-to-write-yara-rule-to-detect-its-own-work.png" height="auto" /><figcaption style = "text-align: center;" >Figure 11: ChatGPT’s inability to write a YARA rule to detect its own work</figcaption></figure><h3>ChatGPT as a Research and Analysis Tool </h3>Like many modern tools, ChatGPT has an API that allows third-party applications to query the AI and receive replies using a script instead of the online user interface. Some individuals have already used this API to create impressive open-source analysis tools that can make cybersecurity researcher's jobs a lot easier. Notable examples of such tools are <a href="https://github.com/JusticeRage/Gepetto" target="_blank">Gepetto</a> and <a href="https://github.com/moyix/gpt-wpre" target="_blank">GPT-WPRE</a>, which add meaningful comments to code decompiled using IDA and Ghidra, respectively. Another helpful tool is <a href="https://github.com/fr0gger/IATelligence" target="_blank">IATelligence</a>, a script that extracts the content of the Import Address Table (IAT) from PE files and adds information about MITRE ATT&CK techniques that can be implemented using the imported libraries. These are mere examples of the potential ChatGPT has as an analysis tool, and with some thought and effort this AI might even be able to integrate into SIEM systems and do much of the work currently done by tier-1 analysts. <h3>A Tangled Future </h3>While ChatGPT will not build malicious code for the everyday person who has no knowledge of how to execute malware, it does have the potential to accelerate attacks for those who do. I believe ChatGPT will continue to develop measures to prevent this, but as shown, there will be ways to ask the questions to get the results you are looking for. With the advances in AI-based solutions in general, and the capabilities ChatGPT has demonstrated, it seems that the future of malware creation and detection will be tangled with the advances in the AI field, and their availability to the public. Our opinion is that threat actors will continue to find ways to utilize these tools to their own advantage, and cybersecurity professionals, who from our research benefit less from these tools (at least as for now), will have to find new ways to defend against malware created with them. <h3>Hashes of Generated Ransomware </h3>894853e4422fcc697ec25dc4a6132cda800f66cd77994c0d4918bb7dec33bad3 eddie4-32.exe bedcf4cf0e16da111220f5239b55960847d3893f13a6db6aa7f97ca01150fc77 eddie4-54.exe

malicious-JARs-blog.png

Throughout 2022, Deep Instinct observed various combinations of <a href="https://en.wikipedia.org/wiki/Polyglot_(computing)" target="_blank">polyglot</a> files with malicious JARs.The initial technique dates to around 2018 when it used signed MSI files to bypass Microsoft code signing verification. A year later, in 2019, <a href="https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html" target="_blank">Virus Total</a> wrote about the MSI+JAR polyglot technique. Microsoft decided not to fix the issue at that time. Then in <a href="https://www.securityinbits.com/malware-analysis/interesting-tactic-by-ratty-adwind-distribution-of-jar-appended-to-signed-msi" target="_blank">2020</a>, this technique was again abused in malicious campaigns and Microsoft assigned <a href="https://medium.com/@TalBeerySec/glueball-the-story-of-cve-2020-1464-50091a1f98bd" target="_blank">CVE-2020-1464</a> to address the issue.Despite being fixed, Deep Instinct observed in 2022 that the technique was still in use and included new types of polyglots which do not necessarily exploit the CVE; rather, attackers now use the polyglot technique to confuse security solutions that don’t properly validate the JAR file format.<h3>What is polyglot?</h3>A polyglot file is created by combining two or more file formats together in such a way that each format can be interpreted individually without an error.This is a little tricky as you can’t make polyglots from any arbitrary combination of file formats, although there are quite a few <a href="https://github.com/Polydet/polyglot-database" target="_blank">options</a> to choose from.<h3>Why JAR?</h3><a href="https://en.wikipedia.org/wiki/JAR_(file_format)" target="_blank">JAR</a> files are essentially ZIP archives. What’s special about ZIP files is that they’re identified by the presence of an end-of-central directory record which is located at the end of the archive. This means that any “junk” we append in the beginning of the file will be ignored and the archive is still valid.Other file formats have a special magic header at the beginning of the file, and they should be read from the start, unlike JAR. One of these formats is MSI.If those two are combined, we receive a file that is both a valid MSI and a valid JAR.<h3>The 2022 Campaigns</h3>Throughout 2022, Deep Instinct observed <a href="https://www.jaiminton.com/reverse-engineering/strrat" target="_blank">StrRAT</a> and <a href="https://www.youtube.com/watch?v=YJ8PZ6elyLE" target="_blank">Ratty</a> samples being distributed as polyglots or as JAR files with junk appended in the beginning.Both RATs are known threats. For StrRAT, there is a configuration extractor. For Ratty, we wrote a config extractor of our own, which we shared with the community in GitHub: <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">https://github.com/deepinstinct/RattyConfigExtractor</a>While we couldn’t determine whether the files belong to a single threat actor or to several threat actors, the usage of the Bulgarian hosting “BelCloud LTD” has been observed in many of the samples.Additionally, we found a few Ratty and StrRAT samples that shared the same C2 server.For simplicity we will categorize the files by what is appended to them.<h3>#1 MSI:</h3>Sample 5e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f8197991If we inspect the file with the Linux file command, we see it’s an MSI file:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt2e9f9f745ae627ca" alt="Figure 1: Linux file identifies sample as MSI file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt2e9f9f745ae627ca/63bee84a47588310a1913f9b/fig1-linux-file-indentifies-sample-as-msi-file.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 1: Linux file identifies sample as MSI file</figcaption></figure>However, the file contains a valid JAR as well. Our Ratty configuration extractor was able to successfully extract the C2 server information.This sample has been observed being sent using <a href="https://sendgrid.com/" target="_blank">Sendgrid</a>. While this is not unique, some of the StrRAT samples that were MSI+JAR polyglots have been sent via Sendgrid as well.Some of the StrRAT samples using the MSI+JAR polyglot have been observed spreading with URL shortening services such as cutt.ly and rebrand.ly. In some cases, the samples were hosted on Discord.<h3>#2 CAB:</h3><a href="https://www.file-recovery.com/cab-signature-format.htm" target="_blank">CAB</a> files have a unique magic header and are interpreted from the beginning to the end, which makes them a perfect candidate for a polyglot with JAR files.We have observed both Ratty and StrRAT samples using CAB+JAR polyglots.In particular, we found the Ratty sample f620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de and the StrRAT sample 2f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e571 both using the CAB+JAR polyglot and using the same C2 server, donutz.ddns[.]net<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="bltfb077af360e7081e" alt="Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltfb077af360e7081e/63bee84a7a6762171d821d17/fig2-strRAT-and-Ratty-linked-to-the-same-c2-server.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 2: StrRAT and Ratty (CAB+JAR) linked to the same C2 server donutz.ddns[.]net</figcaption></figure><h3>#3 HEX Trash / Fake PE:</h3>We are not sure if the files were made by mistake or on purpose by the threat actor, but those JAR files have HEX values appended to them:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt05d5b955bdf7dc33" alt="Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt05d5b955bdf7dc33/63bee84a98b11c3ccecf6af5/fig3-sample-with-hex-values-appended.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 3: Sample 19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcf with HEX values appended.</figcaption></figure>The appended textual hex value is of an executable file. While those files are not polyglots because the appended hex is just “junk” text, the Linux “file” command would return “data” such as the file type.In this way attackers can confuse and bypass security solutions that would simply check the type of file using the Linux “file” command.<h3>#4 Binary Junk:</h3><figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt8585c56be6e04e2b" alt="Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data." src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8585c56be6e04e2b/63bee84ad7b1d54534245dfa/fig4-sample-with-appended-binary-data.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 4: Sample 8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cad with appended binary data.</figcaption></figure>This variation is once again not truly a polyglot, and it is not clear if this is a mistake or if it was done on purpose. The appended content seems to be a part of some binary, but the appended data appears to be missing the beginning of the appended file.The result is the same: a valid JAR file that is detected as “data” by checking the file type.<h3>Is this effective? (YES!)</h3>While Ratty and StrRAT are well known threats, some of those appended JAR files receive very low detections in VirusTotal:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt14594c18eb515964" alt="Figure 5: Low detection rate for CAB+JAR polyglot" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt14594c18eb515964/63bee84aab6fbb46e5b71f9c/fig5-low-detection-rate-for-cab-jar-polyglot.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 5: Low detection rate for CAB+JAR polyglot</figcaption></figure>The VirusTotal detection rate doesn’t tell the true capabilities of specific vendors as some products behave differently when files are executed dynamically.That said, we can clearly see that JAR files with appended content can stay undetected, at least until executed, even for known threats.<h3>Can this be any worse? Yes, my friends, it can...</h3>Let’s think about this from a detection engineering perspective. If we failed to identify a JAR file because we relied on the simple file type check, like Linux “file” command, the easy solution would be just to “scan” every file with the JAR extension. If you want to, you can even throw a validation that the file is a valid JAR by checking the presence of the end of a central directory record at the end of the file.However, this is still not sufficient. JAVA does not care about the file extension and will happily execute a valid JAR file with any extension. The only downfall in renaming the “.jar” extension is that the JAR needs to be executed from the command line instead of simply clicking on it to execute.We have created an HTML+JAR polyglot to demonstrate this:<figure style = "margin: auto; text-align: center;width: auto;"><img asset_uid="blt234fc58952190333" alt="Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt234fc58952190333/63bee84a438f80612c397515/fig6-html-jar-polyglot-with-html-extension-properly-rendered-in-the-browser-and-properly-executed-by-jre.png" /><figcaption style = "text-align: center;" style="text-align: center;">Figure 6: HTML+JAR polyglot with html extension properly rendered in the browser and properly executed by JRE</figcaption></figure>This file is also available in our <a href="https://github.com/deepinstinct/JAR-Polyglot-POC" target="_blank">GitHub</a> along with the <a href="https://github.com/deepinstinct/RattyConfigExtractor" target="_blank">Ratty</a> malware configuration extractor.<h3>Conclusion</h3>The proper detection for JAR files should be both static and dynamic. It’s inefficient to scan every file for the presence of an end of central directory record at the end of the file.Defenders should monitor both “java” and “javaw” processes. If such a process has “-jar” as an argument the filename passed as an argument should be treated as a JAR file regardless of the file extension or the output of the Linux “file” command. Incident responders and the cyber community are welcome to use the Ratty malware configuration parser provided from Deep Instinct in case of infection to get to the IOC fast and quickly move on to remediation steps.<h3>MITRE ATT&CK:</h3><table><thead class="bg-grey"><tr><th style="width: 15%;">Tactic</th><th>Technique</th><th>Description</th><th>Observable</th></tr></thead><tbody><tr><td>Initial Access</td><td>T1566.002 Phishing: Spearphishing Link</td><td>Attackers use URL shortening services that leads to the payload.</td><td>Rebrand[.]ly/afjlfvp</td></tr><tr><td>Defense Evasion</td><td>T1036.001 Masquerading: Invalid Code Signature</td><td>Attackers append a signed MSI file.</td><td>85d8949119dad6215ae0a21261b037af</td></tr><tr><td>Defense Evasion</td><td>T1027.001 Obfuscated Files or Information: Binary Padding</td><td>Attackers append junk data at the beginning of the file causing “file” command to return a different file type.</td><td>cb17f27671c01cd27a6828faaac08239</td></tr><tr><td>Command and Control</td><td>T1102 Web Service</td><td>Attackers used Discord's content delivery network (CDN) to deliver malware.</td><td>https://cdn[.]discordapp[.]com/attachments/938795529683480586/941658014962823208/Package_info[.]jar</td></tr></tbody></table>&nbsp;<h3>IOC:</h3>d51d269b62e55d4af8a4bd72dcf3c5115ad27fe5466640041c658c0325194451534a4b0e17723755dd8cbdcdec309004ef59c3dfacb87fac86da4548780d2f1b08921a6b0b2903b9c991acb869930c7cab3cbaf11e002be9c88400af48c3fa2159a02230a78b87c97eebbf7cdba40ea17c7d9411d706fd255c2a6a025584fd9fa9ac4ae704da346a0f3d2960b084d8f314c0fd60a934116e3c75647c713314b647fc7fc1658acfa2f7a0b388bea6b52787f186bf8297ce189a575d547dfbd8e0a80add76ff8ad0e1c3bdab9459546fd724e1f4034248d1542aec1264c02d3857f0e57c84ba1958cabf24cfec4a0d50be6b7bc0e45c639d08a53097494373ae9ee7812ff64dbe51584d3090e008b464510dbb87ac860c68d89e224621755021f941ef2dfa736e9a24a1a29a373357ac249dad99f86f1cc0283ddd4765fa14e54a8d801f58d10dbcd52739fa35aa862286c3fe9606411f0e5f7b8b3fd71f678cadf79ba296aeab13be409ee3ef435f47a8888f7186a062fa481603ec32f3d6b678262e6824f0c4c765e73a7041362d7a3a8d63dab1be91ecf5e80623ac6e2f389eb6a0dcd8c9bc11794837e8f9350e2816ae7a60d148f3e6f436c2645f450feeabf620c4f59db31c7f63e8fde3016a33b3bfb3934c17874dcfae52ca01e23f14de54814775c2f266cafe3d4ddc58bc400360aad8cea95e0d3ee74ceceb927cb3b82f4c6eb0a307657fb46f4a8f6850842d75c1535a0ed807cd3da6b6678102e57174c8d5e01e2bb52c6f5cd7863168085ff81bea970b5309ec180c2e1a299096dff2b36a7df3d0b4d63bbbc529b7a27282e5626300e1353d2596866e4a82165f644f00914f63181c0afbfff41a95f5f1364c61d78ffb250ec8ef3102b3d3bd7003a989289cd6df1b1c38dbda84eb3b286bb8fb7a2af9beb1e55b029dbf861bac83521a2e7ee2558d83e29bceb68a8c4ea0ecce4bddcb05cc0d3b0365522f126d1f19154b831614211de667c2aedd6a4b5b89d4bfc1e129eb402a6300ad2e156dcfe3be7066e6922d7460dea80ca5b7fef8f4abc7b1f056d8f329c03b306e8ca9b0788f1abb67d6f21cf299e2f67a2b414d169e8ab16cc8a61bf698e5c7f14829995e288df18d5f3797079c4962a447509fd4a60e9b76041d0b888bcf32f81979910c14d804efe1db9377bfe3d5e06ba37a4817cc4bd0f6404ed7d705219295e8151056554bca75450d07fcc5df7c1ca4686a2fefbe76cc9fb60343364678ca8744f2d7e93978c0991e376466810adf18262e4a7fb2864c7a87f22e3fa71adb6519496251bb063e4ee3769139a34ccfbdd81ba52b004836da7aaabd5e5e67f87478d00d85589908ba95536822dea356afb5a9148628a7e2207c6e850024c0ba434d928551a303110983871266af840df71bf7427dcff242688c105f04d4aa87806be2d67077cbcab70d47a95b8da25a2a35fe1f1099ed71d8b06f8e78dd741fc2b7d0703f8f70aff6e3975f3b7c8d037b5a0d3d1b8e4a91b2a6c65227c7932dded59e0468a7249fd6bc2b911434b0c7afa2a9d92473e2402a1a3ad357119c579d63fe72f76f147bce32338a4b0b88c3d59dd3e85406ab1b3b273aab7cb7227fae52964eceee84de3d0b8b3565100c1e45dab1b4b5ff7c61f03a198a56714c03ca32d8c04d3a6e6e5058c10a56890a9dcf41ac5e47a22dc1002e89415ee0f37c7f05

Malicious JARs and Polyglot files: “Who do you think you JAR?”

A new MuddyWater threat campaign was discovered by Deep Instinct. We analyze this threat below. 

MuddyWater-Blog.png

New MuddyWater Threat: Old Kitten; New Tricks

SpyAgent-Malware-Blog.png

Deep Instinct Threat Lab researchers have observed changes in the distribution scheme of SpyAgent (A.K.A. TeamSpy/TVRat/TeamBot/Sheldor), a malware that likely originated over a decade ago based on the historical timeline below.&nbsp;SpyAgent is a malware that abuses legitimate, well-known remote access tools (RAT). The recent changes observed by our team allow the malware to stay stealthy while bypassing and evading many security products.&nbsp;Attackers evading existing security controls is a trend we see increasing. This is a problem for the industry as most security solutions that were developed with an “assume breach” mindset will miss these stealthy attacks until is it far too late to stop the damage.&nbsp;&nbsp;<h3>Historical Background on SpyAgent:&nbsp;</h3><ul><li>In a report from <a href="https://web.archive.org/web/20111226101507/go.eset.com/us/resources/white-papers/CARO_2011.pdf" target="_blank">2011</a>, a malware named “Sheldor” used DLL search order hijacking to abuse TeamViewer 5.0 for malicious activities.</li><li>In a report from <a href="https://web.archive.org/web/20130508171555/https:/www.crysys.hu/teamspy/teamspy.pdf" target="_blank">2013</a>, a malware named “TeamSpy” used DLL search order hijacking to abuse TeamViewer 6.0 for malicious activities. The report also shows a relationship between “Sheldor” and “TeamSpy.”</li><li>In a report from <a href="https://vms.drweb.com/virus/?_is=1&i=8415393" target="_blank">2016</a>, a malware named “Spy-Agent” used DLL search order hijacking to abuse TeamViewer 6.0 for malicious activities. The report contains unique URI patterns that the malware uses to communicate with the C&C server.</li><li>SpyAgent’s main capabilities are leveraged to enhance the usage of TeamViewer by hooking some of the functions used by legitimate applications.</li><li>The most important thing that SpyAgent does is obtain the client's unique ID, which is required to connect to a computer using TeamViewer.</li><li>Other hooks disable logging and hide the GUI of the application to make it stealthy and avoid detection.</li></ul><h3>10 years later:&nbsp;</h3><ul><li>A report published in <a href="https://www.trendmicro.com/en_us/research/21/k/campaign-abusing-rats-uses-fake-websites.html" target="_blank">2021</a> showed that the “Spy-Agent” malware has been observed shifting from hijacking TeamViewer to hijacking “Safib Assistant,” a Russian replica of TeamViewer.</li><li>The report demonstrates the distribution scheme of the malware, using fake crypto applications as a theme.</li><li>The fake applications are actually downloaders of multiple malware families, which include different RATs and stealers, such as RedLine. “SpyAgent” is one of the downloaded malware families.&nbsp;</li></ul><h3>Recent Changes&nbsp;</h3>In May 2022, a small change was observed in the fake crypto campaign first seen in 2021. Instead of using NSIS or Inno Setup droppers, executable files over 700MB were used to evade detection. This is because many security products limit the size of scanned files to compensate for performance issues. This is similar to the way the “Quartz.dll” SpyAgent files are inflated to 1GB+, as noted in the 2021 report. This is done by simply appending a large overlay of zeros to the file, and this technique allows the file to be compressed to the actual size without the overlay.&nbsp;&nbsp;<figure style = "float: none;width: auto;max-width:auto;"><img asset_uid="blt102c6360c03796fb" alt="Figure 1: Overlay of zeros appended at the end of the file to inflate its’ size to avoid detection" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt102c6360c03796fb/63459a085e9a09115c79d6c9/russian-spyagent-fig1.png" /><figcaption >Figure 1: Overlay of zeros appended at the end of the file to inflate its’ size to avoid detection</figcaption></figure>Due to their large size, the files are not stored in public malware repositories or sandboxes.&nbsp;The large overlayed executables are droppers which use Microsoft’s .NET ClickOnce launch utility “<a href="https://app.any.run/tasks/379dee24-c7f4-4255-a581-64d218fbe9f5/" target="_self">AppLaunch.exe</a>” to download and execute malware files from the web.&nbsp;More malicious files related to this change can be found by <a href="https://www.virustotal.com/gui/file/0cfdd88e61fc93fbdc189de21b2cdaec357c2d8a82cddb532db894530d7d9a66/relations" target="_self">searching</a> the included txt file inside the zip:&nbsp;<figure style = "float: none;width: 395px;max-width:395px;"><img asset_uid="blt8ce5dfe10c64c982" alt="Figure 2: Contents of the text file included in the zip archive" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8ce5dfe10c64c982/63459a078c820a10568b92e0/russian-spyagent-fig2.png" /><figcaption >Figure 2: Contents of the text file included in the zip archive</figcaption></figure><figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="bltccc00e625446508b" alt="Figure 3: More archives containing the same text file" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/bltccc00e625446508b/63459a08b8e4f9110c2ef96c/russian-spyagent-fig3.png" /><figcaption >Figure 3: More archives containing the same text file</figcaption></figure>The text translates from Russian into:&nbsp;<ol><li>We execute the client inside the archive&nbsp;</li><li>We enter our wallets to receive payments&nbsp;</li><li>We are happy everyday because of the profit!&nbsp;</li></ol>In June 2022, additional changes were observed.&nbsp;The SpyAgent theme is no longer related to crypto applications.&nbsp;The dropper files are once again Inno Setup files, however, they no longer download any additional malware except “SpyAgent” bundled with “Safib Assistant.”&nbsp;Since “Safib Assistant” is a legitimate tool, similar to TeamViwer, just less known, this change lowers the detection rate for the campaign as the only real malware is “SpyAgent.”&nbsp;However, as previously was reported, the “SpyAgent” DLL files are very large.&nbsp;<a href="https://attack.mitre.org/techniques/T1027/001/" target="_self">T1027.001</a> is a known MITRE technique that adversaries use to “decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files. This may also reduce the likelihood of being collected for analysis. Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.”&nbsp;Example file&nbsp; 1565d137d235b65af1d1e4963ebc02eaf36cc81f870534674983bc6f67e5e274 is an Inno Setup file that during the writing of this article was detected by four security vendors:&nbsp;&nbsp;<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blteafcc1b7aee600af" alt="Figure 4: Detection rate at first submission (2022-07-18 06:04:01 UTC)" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blteafcc1b7aee600af/63459a073aad9e1061a0b515/russian-spyagent-fig4.png" /><figcaption >Figure 4: Detection rate at first submission (2022-07-18 06:04:01 UTC)</figcaption></figure>This file is inside three different zip files, which are not related to a crypto theme.&nbsp;The dropper silently installs “Safib Assistant,” the software’s main executable hash is b8dde42c70d8c4a3511d5edffbc9f7f0c03dbda980e29693e71344f76da6bb0f and it is detected by only two security vendors, although it is not malicious without the SpyAgent DLL:&nbsp;&nbsp;<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blta72402839e4df85a" alt="Figure 5: Metadata of the “Safib Assistant” main executable" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blta72402839e4df85a/63459a0759c8ec116d140164/russian-spyagent-fig5.png" /><figcaption >Figure 5: Metadata of the “Safib Assistant” main executable</figcaption></figure>The SpyAgent C&C server is thief[.]lol which resolved during the analysis to the IP address 185.125.206[.]172.&nbsp;&nbsp;During our investigation, the C&C was still working, allowing us to confirm that the malware bundled with “Safib Assistant” is indeed “SpyAgent:”&nbsp;<figure style = "float: none;width: autopx;max-width:auto;"><img asset_uid="blt8e6b9196b6a5b3b1" alt="Figure 6: SpyAgent C2 panel" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8e6b9196b6a5b3b1/63459a089bac8c116ac5aaba/russian-spyagent-fig6.png" /><figcaption >Figure 6: SpyAgent C2 panel</figcaption></figure><h3>Conclusion&nbsp;</h3>Both TeamViewer and “Safib Assistant” are legitimate remote admin tools, however, without the spy-agent malware DLL which adds stealth they are less useful for cybercriminal operations.&nbsp;&nbsp;On the other hand, there are several other legitimate remote admin tools that don’t require any additional malicious DLL files to be stealthy which are used as-is by cybercriminals.&nbsp;Deep Instinct classifies such tools as dual-use because they are 3rd-party software that is not necessarily allowed to be used in a corporate network as it can be used maliciously.&nbsp;Deep Instinct blocks the Safib Assistant application.&nbsp;<img asset_uid="blt9330fd6adbcf9974" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9330fd6adbcf9974/6345b7bfa75f39138053b89d/russian-spyagent-fig7_new.png" height="auto"/><h3>MITRE ATT&CK:&nbsp;</h3><table><thead class="bg-grey"><tr><th width="15%" style="width: undefined; height: auto;height: auto;"> Tactic</th><th width="20%" style="width: undefined; height: auto;height: auto;"> Technique</th><th width="40%" style="width: undefined; height: auto;height: auto;"> Description</th><th width="25%" style="width: undefined; height: auto;height: auto;"> Observable</th></tr></thead><tbody><tr><td>Discovery&nbsp;</td><td>T1082 System Information Discovery&nbsp;</td><td>SpyAgent computes environment hash as an MD5 of the string created by concatenating the following:&nbsp;&nbsp;Value 1 = to_uppercase(crc32(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid))&nbsp;Value 2 = to_uppercase(crc32(HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName))&nbsp;Value 3 = to_uppercase(crc32(user name))&nbsp;Value 4 = to_uppercase(crc32(computer name))&nbsp;</td><td>&lt;C&C domain&gt;/&lt;C&C path&gt;?id=&lt;9digit number&gt;&stat=&lt;environment hash&gt;&nbsp;</td></tr><tr><td>Defense Evasion&nbsp;</td><td>T1027.001 Obfuscated Files or Information: Binary Padding&nbsp;</td><td>SpyAgent’s quartz.dll was artificially inflated to the size of 1GB&nbsp;</td><td>e2eea1960d77aa8a7153ff448601974c&nbsp; – 7z file containing “Safib Assistant” bundled with SpyAgent’s quartz.dll&nbsp;</td></tr><tr><td>&nbsp;</td><td>&nbsp;</td><td>SpyAgent’s dropper executable was artificially inflated to the size of 700MB&nbsp;</td><td>c72710b4c1f85eca7d1441e1191faa9b – zip file containing dropper.&nbsp;</td></tr><tr><td>&nbsp;</td><td>T1574.002 Hijack Execution Flow: DLL Side-Loading&nbsp;</td><td>SpyAgent hooks and patches various API functions called by the original DLLs used by TeamViewer and Safib Assistant&nbsp;</td><td><a href="https://www.welivesecurity.com/2011/01/14/sheldor-shocked/" target="_self">tv.dll</a>&nbsp;<a href="https://blog.avast.com/a-deeper-look-into-malware-abusing-teamviewer" target="_self">msimg32.dll</a>&nbsp;avicap32.dll&nbsp;quartz.dll&nbsp;</td></tr><tr><td>&nbsp;</td><td>T1140 Deobfuscate/Decode Files or Information&nbsp;</td><td>SpyAgent comes with a config file (.cfg) that contains an encrypted configuration. The bitmap file (.bmp) is used for deriving the key to decrypt the config file&nbsp;</td><td>80896fc71f5f9825a554858e15988713 – bmp file&nbsp;6f496789009980fe92070f4e0d670797 – cfg file&nbsp;</td></tr><tr><td>Command and Control&nbsp;</td><td>T1219 Remote Access Software&nbsp;</td><td>SpyAgent’s quartz.dll uses the “Safib Assistant”&nbsp;</td><td>8002d9e5851728eb024b398cf19de390 - Assistant.exe&nbsp;</td></tr><tr><td>&nbsp;</td><td>&nbsp;</td><td>SpyAgent’s avicap32.dll uses TeamViewer&nbsp;</td><td>28c4c35aed7949277a9c68a04a113114 - TeamViewer.exe&nbsp;</td></tr><tr><td>&nbsp;</td><td>T1071.001 Web Protocols&nbsp;</td><td>SpyAgent uses HTTP for command and control&nbsp;</td><td>&lt;C&C domain&gt;/&lt;C&C path&gt;?id=&lt;9digit number&gt;&stat=&lt;environment hash&gt;&nbsp;</td></tr></tbody></table>&nbsp;<h3>IOC&nbsp;</h3>1565d137d235b65af1d1e4963ebc02eaf36cc81f870534674983bc6f67e5e274&nbsp;Active Spy Agent C2:&nbsp; 23.19.227[.]217&nbsp; 45.66.151[.]237&nbsp; 108.62.118[.]48&nbsp; jmai[.]ink&nbsp;

The Russian SpyAgent – a Decade Later and RAT Tools Remain at Risk

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)

Deep Instinct Included in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms (EPP)

Deep Instinct Threat Lab

From Deep Instinct Threat Lab.