di_blog_post

Deep Instinct prevents more advanced threats than any EPP or EDR in the world.

Deep Instinct Blog: Breaking News and Updates

Prevention Platform

Prevention for Applications

Prevention for Endpoints

Products

Prevent Ransomware

Prevent Zero-Day Attacks

Improve EPP Efficacy

Extend & Enhance EDR

Stop Fileless Attacks

Solutions

Deep Learning in Cybersecurity

Our Customers

+ MS Defender

VS Traditional Antivirus

Why Deep Instinct

About Deep Instinct

Newsroom

Careers

Contact Us

Company

Asset Library

Blog

Videos

Training

Resources

Request Demo

Customer Portal

Integrations and Compliance

Quick links

Events & Webinars

Leadership Team

Board of Directors

Partners

Login

content_block

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

chatgpt-malicious-wishes-blog.png

Listing preview

Perspective & Findings

ChatGPT and Malware: Making Your Malicious Wishes Come True

image_media_card

Malicious JARs and Polyglot files: “Who do you think you JAR?”

New MuddyWater Threat: Old Kitten; New Tricks

Polonium APT Group: Uncovering New Elements

Emotet’s Vacation is Over: No Rest for the Wicked

LSASS Memory Dumps are Stealthier than Ever Before

LSASS memory dumps

Malicious Office files: 20+ Years of Microsoft Office Exploits

MIT Explores How Deep Learning is Transforming Cybersecurity

Trending at Deep Instinct

carousel_cards

listing_preview

On March 2nd Microsoft publicly announced it has detected several actively exploited zero-day vulnerabilities which were recently used in-the-wild by 

zeroday.jpg

On March 2nd&nbsp;Microsoft <a href="https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/">publicly announced</a>&nbsp;it has detected several actively exploited zero-day vulnerabilities which were recently used in-the-wild by a threat actor dubbed HAFNIUM, which is believed to be operating from China. The vulnerabilities were used to gain access and subsequently exfiltrate data from accounts hosted on affected MS-Exchange server versions, install web shells for persistence, and steal additional data. Microsoft released an out-of-band security update addressing these vulnerabilities and several others on March 3rd. It is important to note that the vulnerabilities affect only on-prem installations of MS-Exchange servers.Given the enormous popularity of Exchange, the number of server versions affected, and the diverse list of industry sectors HAFNIUM are interested in, the current reported number of 30,000 affected victims will likely grow.<h2>A Chain of Zero-Days</h2>To successfully perform its attacks, the HAFNIUM team used four zero-day exploits. All four vulnerabilities require the exposed Exchange server to be able to receive untrusted connections on port 443.The vulnerability, CVE-2021-26855, originally discovered by the security company DEVCORE and named ProxyLogon, allowed the attackers to establish an authenticated connection with the Exchange server and steal the content of mailboxes stored on it. This specific vulnerability does not require any user interaction, prior privileges, or previously acquired credentials, but only an Exchange server that is willing to accept untrusted connections on port 443.The remaining three vulnerabilities were discovered and observed in an ongoing attack in January 2021 by the security firm Volexity. These vulnerabilities require the attackers to be authenticated with the Exchange server, which is easily acquired by using the previous vulnerability.<ul><li style="font-weight: 400;">CVE-2021-26857 – Allowed the attackers to execute code on the server with the highly privileged SYSTEM account</li><li style="font-weight: 400;">CVE-2021-26858 and CVE-2021-27065 – Both of these vulnerabilities were exploited by HAFNIUM in order write files to any path on the server</li></ul>Combining these previously unknown vulnerabilities allowed the attackers to gain access to their victims’ servers.<h2>Post-Exploitation Actions</h2>Once a server is exploited, HAFNIUM used several tools and techniques to exfiltrate data from the server and gain persistence on the infected machine.First, a web shell was installed to gain persistence and backdoor access to the compromised servers. Open-source PowerShell tools such as <a href="https://github.com/samratashok/nishang">Nishang</a>&nbsp;and <a href="https://github.com/besimorhino/powercat">PowerCat</a>&nbsp;were used to open reverse shells and communicate to remote servers owned by the attackers.Additionally, Microsoft’s own <a href="https://docs.microsoft.com/en-us/sysinternals/downloads/procdump">Procdump</a>&nbsp;tool found in the <a href="https://docs.microsoft.com/en-us/sysinternals/">SysInternals</a>&nbsp;suite was used to dump the memory of the LSSAS process, which can later be used to crack the passwords of the users on the server.<h2>HAFNIUM Victims</h2>HAFNIUM is a threat actor with alleged Chinese origins that finds great interest in targets from the United States such as universities, research facilities, NGOs, and defense contractors.The hacking group has a history of compromising its victims by exploiting vulnerabilities in exposed servers while utilizing open-source projects for command and control and further exploitation.They also seem to be very fond of PowerShell-based tools and US-based VPS (Virtual Private Server) servers as their attacking machines.<h2>How to Protect Yourself</h2>Companies must make sure their systems are patched as quickly as security updates are available. Once the information regarding these attacks became public, it seems attackers from HAFNIUM group and others intensified their attacks targeted at unpatched servers.Deep Instinct urges its customers (and every reader) to update relevant MS-Exchange servers with the latest updates released by Microsoft ASAP. In addition to patching the vulnerabilities, Microsoft <a href="https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/">released guidance</a>&nbsp;and ways for organizations to check if they have been compromised by this attack.The Deep Instinct product includes several layers of protection, <a href="https://www.deepinstinct.com/zero-day-attacks" target="_self">such as zero-day threat protection</a> and protection against malicious Powershell activity. This is done using several components, including a deep learning-based Powershell scanning mechanism. Powershell components, which are known to have been used in the attack, are prevented by Deep Instinct. In addition, Deep Instinct’s deep learning-based static analysis protection scans and protects customers from potentially abused dual-use tools which can be exploited by attackers as they attempt to remain under the radar.Deep Instinct is always on the lookout for new attacks of this kind and does everything in its power to ensure our customers are protected from any threat they might face. We are focused on expanding and monitoring all relevant IoCs and making sure&nbsp;<a href="https://www.deepinstinct.com/product-overview/">Deep Instinct’s cybersecurity product</a>&nbsp;line protects against them. Customers and prospects are invited to contact us for any help needed, or for any questions that arise.Web Shell SHA256 Hashesb75f163ca9b9240bf4b37ad92bc7556b40a17e27c2b8ed5c8991385fe07d17d0 097549cf7d0f76f0d99edf8b2d91c60977fd6a96e4b8c3c94b0b1733dc026d3e 2b6f1ebb2208e93ade4a6424555d6a8341fd6d9f60c25e44afe11008f5c1aad1 65149e036fff06026d80ac9ad4d156332822dc93142cf1a122b1841ec8de34b5 511df0e2df9bfa5521b588cc4bb5f8c5a321801b803394ebc493db1ef3c78fa1 4edc7770464a14f54d17f36dc9d0fe854f68b346b27b35a6f5839adf1f13f8ea 811157f9c7003ba8d17b45eb3cf09bef2cecd2701cedb675274949296a6a183d 1631a90eb5395c4e19c7dbcbf611bbe6444ff312eb7937e286e4637cb9e72944

Hafnium Leveraging Multiple Zero-Days to Attack Microsoft Exchange

Advanced Persistent Threats (APTs) are targeted cyberattacks that persist for an extended period. During this type of attack, intruders access the net

APTs.jpg

Advanced Persistent Threats (APTs) are targeted cyberattacks that persist for an extended period. During this type of attack, intruders access the network and attempt to remain undetected for as long as possible. This allows the bad actor to access intellectual property and other sensitive information or disrupt critical services like utilities. While these threats tend to target organizations in defense, manufacturing, and the financial industry, any organization has the potential to be vulnerable.It is believed that the term APT was coined by the United States Air Force in 2006, and was effective at&nbsp;defining the criteria to differentiate between an APT and an attack by an “ordinary” threat actor:The attack needs to be advanced in the sense that the group consists of highly skilled individuals that are able to utilize rich research and development resources to thoroughly understand its target and develop its own tools and malware, while often exploiting zero-day vulnerabilities. The attack will also be persistent meaning that it has specific goals and will be executed against a defined target, with one of the goals being permanent access to the victim, for future use or until the end goal is achieved. Several tools might be used against the target until it will be successfully infiltrated. This kind of operation might occur over an extended period of years without being detected by the victim.<h3>Advanced Persistent Threat Landscape</h3>Advanced persistent threats emerged in the early 2000s. For example, the Sykipot APT malware family targeted U.S. and U.K. organizations by leveraging flaws in Adobe products from 2006–2013. The targeted nation-states and large organizations including, telecommunications companies, and defense contractors.The resources required for an APT attack to be successful creates the assumption that APT groups are state-sponsored and are part of a country’s espionage apparatus, with the goals of the attack being correlated with the needs of the state. Attributing a group to a state is considered best-effort practice as attribution is extremely difficult, with groups proactively deploying tactics to throw off researchers (false flag operations).APT groups are often named with a number (e.g. APT&nbsp; 2) or with an adjective followed by an animal name. The chosen animal will be tied to the APT’s country of origin. For example, Chinese APT groups will often have the word “panda” in their name (Gothic Panda, Aurora Panda) while Russian APT group names will incorporate the word “bear” (Venomous Bear, Cozy Bear). Some groups are also called after the malware strain they use in their attacks (e.g. Turla).The goals of various APT groups are different and historically are very diverse. One goal may be espionage and information gathering. &nbsp;For example, Energetic Bear (aka Dragonfly), an APT group that is believed to be of Russian origin, was detected several times in the networks of critical infrastructure vendors such as a power plant in Ukraine and an Aerospace vendor in the UK. Although the presence in the target network could’ve been used to harm the victims, it seems that the goal of EnergeticBear was just to be present and gather the information that the operating state requires (although the gathered information may later be used for a future attack).Another goal may be to inflict damage on the target. For instance, the computer worm Stuxnet that was allegedly created by the Israeli Unit 8200 in cooperation with the US Equation Group (which is believed to be part of the NSA). The worm was delivered with a malicious USB stick and spread to Siemens industrial control systems. The attack was successful in slowing down Iran’s nuclear program, reportedly ruining a fifth of Iran’s nuclear centrifuges.Another example of havoc ran by an APT group is the infamous WannaCry attack that started in May 2017, wiping approximately 200,000 computers across the globe and causing billions of dollars in damage. The attack was attributed to the North Korean APT group Lazarus.Objectives tend to be wide and have included <a href="https://securityaffairs.co/wordpress/97430/apt/charming-kitten-phishing-campaign.html" target="_blank" rel="noopener noreferrer">tracking journalists and activists</a> (Iran linked group Charming Kitten aka APT35), <a href="https://threatpost.com/microsoft-russias-fancy-bear-working-to-influence-eu-elections/142007/" target="_blank" rel="noopener noreferrer">meddling in elections </a>&nbsp;(Russia linked group Fancy Bear aka APT 28), and even <a href="https://backendnews.net/2020/07/23/lazarus-group-suspected-of-81-m-bangladesh-bank-heist-persists-in-attacking-banks-globally/" target="_blank" rel="noopener noreferrer">bank heists</a> (allegedly by the aforementioned North Korean Lazarus group).<h3>The Attack Vectors Frequently Used</h3>APTs may use one or more of the following attack vectors to compromise its targets:<ul><li>Spear-phishing attacks– A target receives an email with a weaponized document or link.</li><li>Water-hole attacks – The group will infect a website often used by the target, replacing software and tools with malicious versions, thus making the unsuspecting victim run the malware unknowingly.</li><li>Hardware Supply-chain attacks - Compromising hardware equipment used by the target before it is shipped. This way the equipment will arrive already backdoored and will be used for further attacks.</li><li>Social Engineering - By impersonating an individual that the target usually contacts, which may lull the victim into opening a received file or providing sensitive information, or luring the target to open a link or a document that seems to be relevant to their work (e.g. C.V. sent to an HR person or a link of a sensational video sent to a journalist).</li><li>Physical access to devices in order to infiltrate air-gapped target networks.</li></ul><h3>The Malware Families Commonly Used</h3>Once a victim is compromised, the attacker's deployment can vary. They may deliver a made-in-house malware that is tailored for the specific target, they could use a commonly available malware or deploy by <a href="/glossary/living-off-the-land-lotl" target="_self">living-off-the-land</a>, an approach that utilizes dual-use tools that are already present in the network to minimize the possibility of being detected.Some examples of malware families used by APT groups:<ul><li>MgBot RAT used in a recent attack on targets in India and Hong Kong by an APT group related to China.</li><li>Flame, a modular malware used in attacks on targets in the middle east and is believed to be developed by Israeli and US secret intelligence services as part of a joined operation named Olympic Games.</li><li>Drovorub, a recently discovered malware attributed to the Russian APT 28 and used to infect Linux machines all over the world. The malware can download and upload files, have rootkit capabilities, and can execute commands from its operators.</li><li>Shamoon wiper which is believed to be of Iranian origin. The malware wipes the victim’s hard drives so that the data can’t be restored. The threat actor is mostly interested in the energy and transportation sectors.</li></ul>Advanced Persistent Threats groups are here to stay. In fact, every few weeks there is news of a new APT operation being detected. Just recently it came to light that APT groups linked to China and Vietnam are spreading Covid-19 themed phishing attacks, APT groups have been known to attempt breaching the World Health Organization to gain information on vaccines, testing, and treatments, while a Russian APT group is attacking institutions related to Covid-19 research and vaccine development to steal intellectual property.<h3>Defending Against Advanced Persistent Threats</h3>Defending against Advanced Persistent Threats requires a multilayered approach:<ul><li>No single tool will defend against APTs. An effective defence requires controlling every aspect of your network through up-to-date tools, including Next Generation firewalls and <a href="https://www.deepinstinct.com/product-overview/" target="_self">antivirus software</a>, <a href="https://www.deepinstinct.com/endpoint-protection/" target="_self">endpoint protection</a>, authentication and identity management, SIEMs, and software patching. Each layer of security provides another obstacle for APTs, which are continuously evolving to stay hidden as long as possible. When developing your multi-layered approach keep your focus on prevention, aside from the fact that it's so much cheaper to prevent attacks rather than reacting to them, it keeps your systems cleaner, and gives your SIEM tools a fighting chance against the APTs that do get through.</li><li>Rigorous monitoring. In particular, logins and access requests should be reviewed regularly so anomalies can be spotted and addressed quickly.</li><li>Whitelisting apps. While some end-users might find it frustrating, whitelisting apps ensures that any forced installations are immediately brought to your attention.</li><li>Threat intelligence services. Threat intelligence services use raw data on emerging threats to provide organizations with actionable information. When combined with <a href="https://www.deepinstinct.com/product-overview/" target="_self">next-generation software</a> and endpoint protection, this information allows organizations to uncover threats faster and contain damage sooner.</li><li>Education and awareness for employees. APT groups often gain a foothold through spear-phishing e-mails and social engineering. That means cybersecurity training for all members of an organization is critical. This also includes C-level executives; no one is immune. Today’s spear-phishing email attempts aren’t limited to poorly worded emails from questionable sources. They often mimic legitimate communications. Employees need to be trained (and retrained) on what to look for and what actions to take if they’re uncertain about a link or an attachment.</li><li>An incident response plan. Cybersecurity attacks will happen. It’s critical to have a plan in place for how an organization will respond to APT and other attacks, including system forensics. Organizations should spell out who is responsible for the steps to take to minimize damage and prevent recurrences.</li></ul>Advanced Persistent Threats represent a critical cybersecurity threat that organizations can’t afford to ignore. With the risk of having all their private data exposed, Deep Instinct offers a robust <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">prevention-focused solution</a> to APTs that prevent them from being able to infiltrate in the first place.

How to Defend Against Advanced Persistent Threats

For years ransomware attacks are a significant threat to any organization, no matter its size, field of expertise, yearly revenue or geographical loca

snake-attack.jpg

For years <a href="https://www.deepinstinct.com/2020/04/20/the-evolution-of-ransomware-and-its-culmination-to-the-nameshame-game/" target="_blank" rel="noopener noreferrer">ransomware attacks</a> are a significant threat to any organization, no matter its size, field of expertise, yearly revenue or geographical location. The year 2020 is no exception. Ransomware attacks became more sophisticated, crews operating them learned how to take better advantage of their presence in the victim’s network and new ransomware strains were brought into the world to run havoc and make their creators rich.
One such ransomware is Snake (aka Ekans). It became well known in January after its first sample was uploaded to VirusTotal. The initial sample, found by the MalwareHunterTeam crew, raised a lot of concern as the malware was designed to kill computer processes related to Industrial Control Systems, implying that it was built with victims from the industrial sector in mind. Unfortunately, this concern was justified as after a few months of relative silence, Snake operators deployed the ransomware in a series of targeted and devastating attacks. The crescendo was an attack on the Japanese car manufacturer Honda on June 8th, an attack that made Honda’s operations in Japan and Europe grind to a halt.
Fortunately, <a href="https://www.deepinstinct.com/" target="_blank" rel="noopener noreferrer">Deep Instinct</a> prevents all versions of Snake ransomware. The ransomware is prevented pre-execution, using Deep Instinct’s <a href="https://www.deepinstinct.com/what-is-deep-learning/" target="_blank" rel="noopener noreferrer">deep learning</a>-based <a href="https://www.deepinstinct.com/product-overview/" target="_blank" rel="noopener noreferrer">static prevention engine</a>, and during on-execution, using advanced ransomware behavioral protection.
Moreover, Deep Instinct’s unique deep learning approach ensured Snake ransomware was prevented with a version of our <a href="https://www.deepinstinct.com/architecture/" target="_blank" rel="noopener noreferrer">prediction model (D-Brain)</a> that was released over a year before the malware’s release.
<h2><iframe src="https://www.youtube.com/embed/vjmRFeiBvJ4" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></h2>
Watch the demo of how Deep Instinct prevents Snake Ransomware
&nbsp;
<h3>Less is More</h3>
Snake joins Maze, DopplePaymer, Ako, and others in the lucrative group of ransomware families that target corporations. Instead of relying on sporadic means of distribution, in which the quantity of infections is more important than the “quality” of each infection, Snake chooses specific targets in the corporate world so that each infection will yield much more revenue.
The goal of such ransomware is much more ambitious. Instead of encrypting one machine and demanding the ransom for its contents, they strive to encrypt all the workstations connected to a network. The ransomware takes the time to explore the environment’s topology and critical systems to exploit vulnerabilities, stolen credentials, and poor security hygiene to propagate through the network. The ransom for decrypting all the machines in a corporate network can be millions of dollars, compared to “just” thousands of dollars from an infection of a single workstation.
Snake also belongs to a more niche part of the ransomware world. Together with Megacortex, Snake contains a list of ICS related processes to stop before encryption. Killing these processes allows the ransomware to encrypt the files these programs use and deny the target access to its production-related assets, thus inflicting much greater damage and increasing the possibility of ransom payment.
<h3>The Subtle Serpent</h3>
These three alleged Snake ransomware attacks became public:
<ul>
<li>An attack on the largest private hospital in Europe, Fresenius, on May 6th.</li>
<li>The Italian energy company Enel, that operates in several parts of Europe, on June 7th.</li>
<li>The Japanese car manufacturer Honda on June 8th.</li>
</ul>
And according to several sources, there are possibly more that were kept secret. 
Although it is currently unclear how it found its way into the networks of its victims, bad security practices as shown in the tweet below might give us a hint.
<img class="alignnone wp-image-7105 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt9131e660262cbd91/611a7bfbba865a163e364554/RDP-Exposed.png" width="602" height="685" data-image="1ireu3echdw5">
This screenshot shows computers belonging to Honda and Enel with RDP services openly exposed and accessible from the Internet. An exposed RDP port might be easily exploited using a vulnerability or a brute-force attack.
Other means might have been used by the threat actors, such as phishing attacks, malicious documents or previous malware infections, potentially with several of them used together. It is also unknown what were the specific actions performed by the malicious actors before initiating the encryption process. But we do know, based on the images published by the Snake crew, that in the case of Fresenius, the data was exfiltrated before being encrypted.

<img data-image="f56qxia9br8p" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt1ea00c199141c735/6180e5fa6f9d926e2aceae3a/exfiltrated-data-1000x312.jpg" data-sys-asset-uid="blt1ea00c199141c735" alt="exfiltrated-data-1000x312.jpg">
Credit: BleepingComputer.com
Snake executables are 3-4MB, unsigned, 32-bit EXE files written in the Go programming language. 
There are several Snake samples publicly available. We chose to focus on the sample that was allegedly used in the attack on Honda (SHA256: d4da69e424241c291c173c8b3756639c654432706e7def5025a649730868c4a1) and was initially uploaded with the name nmon.exe to VirusTotal which may indicate the name the attackers chose.
Upon execution, the ransomware will make sure that it is being run only once by using a mutex named “EKANS”.
<img class="alignnone wp-image-7098 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt39313d5d0d3333ec/611a7c04159c951600ac9c8b/ekans.png" width="779" height="244" data-image="ru72iv3yf26n">
Then, it will try to verify that it is running in the victim’s network by trying to resolve Honda’s internal domain name mds.honda.com using DNS and NetBIOS. In the case of <a href="https://www.bleepingcomputer.com/news/security/power-company-enel-group-suffers-snake-ransomware-attack/">Enel</a> the domain name is enelint.global.
<img class="alignnone wp-image-7101 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt51b00879f1b33108/611a7bffa64423165ba4972f/Honda.png" width="824" height="308" data-image="czyr0twpoyhd">
If the resolution is unsuccessful the ransomware will exit without any encryption done. Editing the Windows hosts file in order to provide Snake with a random IP address will not yield any results, which indicates that the malware is not only checking the availability of the domain but also expects it to have a specific IP address.
Looking for the domain name in the strings the malware stores in the computer’s RAM we were able to see what seemed to be an IP address 170[.]108.71.153 or 170[.]108.71.15. We were then able to run the malware using the IP address 170[.]108.71.15 as the resolution for the domain.
<img class="alignnone wp-image-7102 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt45f11c6d7538c19d/611a7bff833125163437f3e3/IP-Address.png" width="339" height="93" data-image="2c561ju0ephj">
Before initiating the encryption, Snake will utilize the Windows firewall in order to block any incoming and outgoing network connections on the victim’s machine that aren’t configured in the firewall. Windows built-in netsh tool will be used for this purpose.
<img class="alignnone wp-image-7103 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt91d7b9abca78ba30/611a7bfe239eb216a30d1b8a/Netsh-tool.png" width="447" height="68" data-image="5dib8bwmypjr"> 
Disconnected from the outside world, Snake will kill the hardcoded processes that may interfere with the encryption. This <a href="https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/" target="_blank" rel="noopener noreferrer">list</a> contains processes related to the industrial world and several security and backup solutions.
Once all the preparations are completed, the ransomware can initiate the encryption process. 
Excluding several system-critical folders and files, all files with extensions included in Snake’s hardcoded <a href="https://mbsd.jp/blog/20200616.html" target="_blank" rel="noopener noreferrer">list</a> are included. The list includes document, virtualization, database, and archive extensions among others.
Every encrypted file will have a random five-character string appended to its extension and the word EKANS appended to the end of the file. For example, our encrypt_me.txt file was changed to encrypt_me.txtDwtwx and the word “EKANS” was added to the end of the encrypted content.
<img class="alignnone wp-image-7099 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blted39123f19304381/611a7c03833125163437f3e7/encrypted-content.png" width="784" height="582" data-image="2qczoholh6nf">
After all, files have been encrypted, netsh is called again in order to disable the firewall.
<img class="alignnone wp-image-7104 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt8d8910fc0b9f3b2b/611a7bfe72e5ce1607451444/path-command.png" width="273" height="38" data-image="t1ex3pladodu">
According to several reports, once the encryption is finished a ransom note should be dropped to C drive and the desktop. In our case, after running the malware several times with different configurations, it didn’t write the ransom note to the disk.
<h3>Conclusion</h3>
The concept of ransomware is rather simple - you encrypt your victims’ files and wait for them to pay. Although this concept hasn’t changed in recent years, ransomware attacks have become more and more sophisticated and targeted, as we witness the gradual change in the priorities, tactics and scale of attacks.
If the attackers are changing their modus operandi, we should change the way we think about ransomware attacks. We should think of the ransomware itself as part of a bigger attack. The attackers might have been present on the network for a while, stealing confidential data that will later be sold to the highest bidder, they might even be there after the ransomware attack is <a href="https://www.bleepingcomputer.com/news/security/chipmaker-maxlinear-reports-data-breach-after-maze-ransomware-attack/">successful</a>. Ransomware is not just an attack on data, but also an attack on confidentiality, the privacy of customers, financial status and company reputation.
Snake ransomware possesses all the above in a single executable. It is also an example of ransomware operators’ entrance into the industrial domain that was previously dominated by state-sponsored APT groups.
We should presume that the ever-growing greed of ransomware creators and operators will drive them to choose bigger and bigger targets with emphasis on critical infrastructures as their victims.
<h2></h2>
<h3>IOCs</h3>
e5262db186c97bbe533f0a674b08ecdafa3798ea7bc17c705df526419c168b60
a5a7e6ddf99634a253a060adb1f0871a5a861624382e8ca6d086e54f03bed493
b17863d41c0b915052fea85a354ec985280f4d38b46d64158a75b17ef89d76da
a8f0ff40d1e624dd2aad4d689ed47a900e4f719923647cacb58d1a4809c7bd31
d4da69e424241c291c173c8b3756639c654432706e7def5025a649730868c4a1
09133f97793186542546f439e518554a5bb17117689c83bc3978cc532ae2f138
edef8b955468236c6323e9019abb10c324c27b4f5667bc3f85f3a097b2e5159a

The Snake Attacks Holding the Industrial Sector Ransom

Over the past month, COVID-19 has significantly changed our lives. It’s changed the way we work, commute (or not), interact with each other, and perha

rendered.jpg

Over the past month, COVID-19 has significantly changed our lives. It’s changed the way we work, commute (or not), interact with each other, and perhaps, interact with our software. For many working from home has required the use of VPN software to connect to our corporate network, conferencing software for remote communication and software programs to complete work tasks. To have access to programs and tools typically installed on office computers, employees working from home may have had to download these same programs to their home computers.
Malware creators and distributors are taking advantage of this unusual situation, delivering fake installers for usually paid programs and VPN clients. This trend was recently observed in a Cryptbot attack Deep Instinct prevented on a customer’s machine.
Although being a lesser-known info-stealer, Cryptbot has been very productive in the last couple of months with thousands of daily infections. Having arrived on the malware scene in the spring of 2019, it has since been providing unsuspecting victims with fake software in exchange for their private digital data.
Cryptbot combines complex evasion techniques and a rather simple social-engineering based distribution strategy to produce an interesting method of attack that manages to stay relatively hidden in the current malware landscape.
<h3>Delivery</h3>
In this latest campaign, Cryptbot is delivered as a Trojan malware. Consistent with the ancient trojan horse, the info-stealer hides within legitimate software in order to be installed by its victims. Over its year of activity, it has been disguised as an installer of a <a href="https://www.bleepingcomputer.com/news/security/fake-vpn-site-pushes-cryptbot-and-vidar-info-stealing-trojans/" target="_blank" rel="noopener noreferrer">free VPN application</a> and as an installer of legitimate commercial software. Delivered either by itself or <a href="https://twitter.com/James_inthe_box/status/1248964446505947136" target="_blank" rel="noopener noreferrer">bundled with other malicious applications.</a> For example, users looking for cracked versions of <a href="https://app.any.run/tasks/d597224b-ffff-43ad-90d9-572295ca24bb" target="_blank" rel="noopener noreferrer">PhantomPDF editor</a>, <a href="https://twitter.com/benkow_/status/1226954519252213761" target="_blank" rel="noopener noreferrer">Adobe Illustrator</a> or <a href="https://twitter.com/MBThreatIntel/status/1226999930255900672" target="_blank" rel="noopener noreferrer">Malwarebytes</a> AV have found themselves installing the info-stealer instead of their preferred programs. The sample we’ve encountered claimed to be an installer for the Glary Utilities suite that consists of several utilities for Windows optimization and cleanup.
<h3>Execution Flow</h3>
<h3><img class="alignnone wp-image-6769 size-full" style="font-size: 16px;" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4a77a7ab89a38640/611a7ce827c23615df85c49e/Execution-Flow.jpg" alt="" width="960" height="720" /></h3>
setup.exe
The attack flow started with a dropper disguised as a Nullsoft installation file simply named setup.exe. Despite having GUI elements in its resources, upon execution, no messages or menus are presented to the user.
<img class="alignnone wp-image-6771 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt4f62a3628564b9cb/611a7ce4c856491607fd0ca5/GUI-in-Resources.png" alt="" width="813" height="413" />
This fake installation file drops three additional executables Install.exe, Notepad2.exe and Util.exe into C:\Program Files\Glary\Utilities\Settings folder and starts them.
1.Notepad2.exe
Notepad2.exe is innocent. It is a benign application written by Florian Balmer as a replacement for the original Notepad. It is undoubtedly used as a decoy file, perhaps to let the victim think that the executable he just ran is a benign Notepad program.
 
2. Install.exe
Install.exe is the sample of Cryptbot. 
The executable is packed with the advanced Themida packer that utilizes virtualization and encryption in order to prevent decompiling and debugging. Once executed by its dropper, the info-stealer utilizes its variety of information-stealing capabilities in order to exfiltrate passwords and data forms stored in installed browsers (Chrome, Firefox, Opera and Comodo Dragon), steal Bitcoin wallets, take screenshots, search for email files, etc.
The gathered data is temporarily stored inside a randomly named folder in ProgramData, for example in our case it was C:\ProgramData\ZYcJHwiWrl0zhlsd\. During our analysis several files and folders were created with the following structure:
<img class="alignnone wp-image-6770 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/04/Folder-Tree-1000x424.png" alt="" width="1000" height="424" />
The file “172773668.txt” stores the response of Cryptbot’s request to hxxp://ip-api in order to resolve the IP address and the location of the victim’s machine. During our analysis, the sample was executed several times from different countries and IP addresses, but the name of the file did not change, which may indicate that it is constant for the specific sample we analyzed.
<img class="alignnone wp-image-6773 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/04/ip-api-1000x328.png" alt="" width="1000" height="328" />
The “Files” folder contains three files and three folders:
<ul>
<li>_Filepasswords.txt contains the passwords that were extracted from the browser (and perhaps from other software if it was installed).</li>
<li>_info.txt contains a detailed report regarding the infected system and the application installed.</li>
<li>_Screen.jpg and as its name implies is a screenshot taken by the malware upon its initial execution.</li>
</ul>
<img class="alignnone wp-image-6772 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/04/info-1000x512.png" alt="" width="1000" height="512" />
<img class="alignnone wp-image-6775 size-large" src="https://www.deepinstinct.com/wp-content/uploads/2020/04/passwords-1000x143.png" alt="" width="1000" height="143" />
<ul>
<li>“Coins” folder contains the data Cryptobot extracts from the Bitcoin digital wallets: ElectronCash, Electrum and Electrum-btcp.</li>
<li>“Broswers” folder stores the information stolen from the installed browsers. On our machine, Cryptbot successfully extracted stored cookies, passwords and forms, as can be seen from the file names.</li>
</ul>
Once all the relevant information is gathered, it is archived into a ZIP file (CTi8uuz5.zip in our case) in its working directory. The ZIP is sent via an insecure connection to its C&amp;C server, hxxp://verf04.info in our case. As the sample continued to try to contact the same expired C2 between several executions, it seems that the domain is hard-coded into the sample. 
<img class="alignnone wp-image-6776 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt3f16d890300a0744/611a7ce11031951645991c37/PCAP.png" alt="" width="977" height="349" />
Finally, a CMD command is executed in order to delete the directory and the Install.exe file.
<table width="100%">
<tbody>
<tr>
<td>"C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\ZYcJHwiWrl0zhlsd &amp; timeout 3 &amp; del /f /q "C:\Program Files\Glary\Utilities\Settings\Install.exe"</td>
</tr>
</tbody>
</table>
&nbsp;
3. Util.exe
Util.exe is an AutoHotKey based malware downloader that is also packed with Themida. AutoHotKey is a scripting language for Windows, that allows users to create macros with assigned keyboard shortcuts in order to automate an assortment of tasks. Such scripts can be compiled into executables and run without AutoHotKey present on a computer.
Usually, the original script can be found in the resources section of an executable and can be extracted in clear text. The script in Utils.exe was encrypted or obfuscated, but we were able to extract relevant strings from the RAM. These strings confirmed what we already suspected from the behavioral analysis.
<img class="alignnone wp-image-6768 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt866129055795f24b/611a7ce960dac31618989b4d/autohotkey_strings.png" alt="" width="577" height="73" />
The first line shows that the downloader checks the IP of the victim as well. It is possible, that is done to geo-restrict the distribution of the malware. The next three lines indicate the URLs of the malicious executables and the names they will receive once they are downloaded. The downloader also checks for the presence of malware analysis tools such as Process Monitor, Registry Monitor, etc. by searching for their window titles. If such Windows are found, Themida will show an error message:
<img class="alignnone wp-image-6767 size-full" src="https://images.contentstack.io/v3/assets/blt1ec077b6b53d6b3e/blt02eff20b203acc8c/611a7ce9d579ec165f22ac19/Themida-Error.png" alt="" width="636" height="238" />
Although the downloaded executable, asfvcxds.exe, is an additional sample of Cryptbot, it is possible that other malware can be downloaded from Cryptbot’s C2s. In the past Cryptbot was downloaded alongside the info-stealer <a href="https://www.bleepingcomputer.com/news/security/fake-vpn-site-pushes-cryptbot-and-vidar-info-stealing-trojans/" target="_blank" rel="noopener noreferrer">Vidar</a> and the malware loader <a href="https://www.gdatasoftware.com/blog/2020/02/35802-bitbucket-abused-as-malware-slinger" target="_blank" rel="noopener noreferrer">NuclearBot</a>.
&nbsp;
<h3>Summary</h3>
While many may debate the morality of using pirated software, from a security perspective, the jury is out, it’s not worth the risk. Most pirated software available with their installers, keygens and cracks are binary files that are veritable “black boxes” for the majority of users. Thus, when installing pirated software, we never know what hides behind the executable. It may be a “harmless” crack or keygen that will manipulate a software to believe it is genuine, but on the contrary, it may also be an info-stealer, a browser hijacker or even a ransomware that may harm our digital lives and cause us to lose our digital data.
Cryptbot’s high infection rate may once again prove that the word “free” attracts a large number of susceptible victims, but as the old adage goes “if you pay peanuts, you get monkeys”. Although Deep Instinct’s customers are protected against such threats in their earliest stages, it is wise to avoid pirated software, especially in corporate networks and for work-related devices.
<iframe src="https://www.youtube.com/embed/0TyznE6Hklw" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe>
IOCs:
Analyzed Samples:
576fc63980d3db3e2bbada7b11b7ff8585b18fa42e01cce219551799e0335510 
9ac61841c5a9716c04d632f9d107a17e94af751573a50b9d2c1d5ce26e32b477 (Notepad2.exe) 
2ee4567751ec4fca4a9390b4743625bee298955cc2cb6375341d673ef0003ab5 
69344b8a53d189c7640d0ada5f74b5febcd7b06e5aa5c4fc01a7c676ec986b67 
fa68fd5f0cfcc8ce799be11c6fde0789feadb0dd49325761b7e21d4ac0dbc000
Network Indicators:
jload08.xyz 
sec03.xyz 
verf04.info 
ip-api.com 
iplogger.org
Related Samples:
4ca17ab04ecf0bbd6ec63b066d3671f2c3b7e0eabd3a79c46e2d68e76366e009 cbd9d835b81a7f49a14e8c919013fec314037d88273c7e7308f88df05d0cfbab f66e7a4f847225c9e39958a2d607d559fadb38100f43a12b9fe4610f6cc604e2 fa68fd5f0cfcc8ce799be11c6fde0789feadb0dd49325761b7e21d4ac0dbc000 5d3d8d0bfd6af56351dee79f6088a51221c2210fe19c64144b9a63fe807a657b 7b3280d4ea71522fc1f7f1e5fd8ffab52515a17dd8284b34269f9e978268f4d9 d874e5ac5ca191dc022710de27863b1fc8d07d4e1841bda0a2fe6ffd4e311ee5 cad3362b516b2f83ef33440ac31e9c4283c9527520d871855b8e1177d620a5bc 7d9b535c162d37f5eac56b33e49160b0c358109ea4500ec0fd922179f01f6da3 c9313803f0867d77531c7002fd7ec7a247be3130a81433527ff373c65b607f41 d9310fee034621873e90efea46a76cac136bc5bf88541f7f70c7b43868aff961 ef658512590641c6579a006bff9cea0e0a56626e286a1e2b9a150ff0f4afdd2d c8ef6ad8afdec1a88c3d4866ff46c3d5b5be5eb91af36d9a4b452d79acab72e8 301637a35db4b2cd6b25bed40a8be0934f3cdb6515e380ada6ad743f184ab41e
Similar Network Indicators: 
 
verf02.top 
jload05.xyz 
jload06.xyz 
jload07.xyz 
jload08.xyz 
sec01.xyz 
sec02.xyz 
jload01.info 
jload02.info 
jload03.info 
jload04.info 
jload09.info 
verf01.top 
verf05.top

Cryptbot: How Free becomes a High Price to Pay

Unit 221B Validates >99% Zero-Day and <0.1% False Positive Threat Prevention Accuracy