SonicWall Capture Labs Threats Research team has analyzed Dustman malware whose code has similarity with “ZeroCleare” malware and it is suspected to be developed by Iranian hackers. The malware is a 64-bit console executable which contains three encrypted binary files in resource:

 

On execution, the malware creates a mutex “Down With Bin Salman” and if the mutex is already exist or Operating System (OS) Major Version is less than 6, then the malware skips service creation code and jumps directly to the code which gets the valid drives strings in the system:

 

The malware checks, if VirtualBox installed by checking the presence of registry entry “Software\Oracle\VirtualBox” which does not affect the malware execution. The malware now read resource data for resource id “103” in “RCDATA”. The malware decrypts the resource content by performing xor operation with “7070707070707070h” and writes decypted content into “Current Working Directory (CWD)\elrawdsk.sys”:

 

The malware checks for device “VBoxDrv”, if already present the malware then sends service stop request for services “VBoxUSBMon”, “VBoxNetAdp” and “VBoxNetLwf”:

 

The malware uses modified GitHub available “Turla Driver Loader” for bypassing Windows x64 driver signature enforcement to load malicious unsigned driver. The malware reads resource data for resource id “1” in “RCDATA” and decrypts the resource data to get the modified “Turla Driver Loader” using previously mentioned decryption logic and copy it, to “CWD\assistant.sys”: The malware register “CWD\assistant.sys” as “VBoxDrv” service and starts the service. This modified “Turla Driver Loader” is responsible for loading malicious unsigned driver “CWD\elrawdsk.sys”.

 

The malware now reads resource data for resource id “106” in “RCDATA” and decrypts the resource data using previously mentioned decryption logic and writes the decrypted data to “CWD\agent.exe”:

 

The malware gets the valid logical drives strings in the system and if drive types is either “DRIVE_REMOVABLE” or “DRIVE_FIXED” then the malware executes “CWD\agent.exe” passing each drive string as argument which is responsible for overwriting the drives data:

 

The “agent.exe” sends the buffer which contains message “************** Down With Saudi Kingdom, Down With Bin Salman **************” to its component driver (CWD\elrawdsk.sys) which overwrites logical drive data with the buffer data:

 

SonicWall Capture Labs provides protection against these threats with the following signatures:

• Dustman.A
• Dustman.A_2
• Dustman.SYS
• Dustman.SYS_2

SonicWall RTDMI ™ engine has recently detected a Nullsoft Scriptable Install System (NSIS) compiled executable file which executes new variant of ServHelper malware as a final payload. The NSIS binary contains a PowerShell script, which on execution brings another PowerShell script. The second level PowerShell script is responsible for checking and setting execution environment for ServHelper 2.0 malware.

PE Static Information:

 

First Level PowerShell Script:

This PowerShell script perform Base64 decoding, followed by the decryption using Triple Data Encryption Standard (TripleDES) algorithm to get second level PowerShell script. The second level PowerShell script is executed after removing null bytes from the end:

 

Second Level PowerShell Script:

The PowerShell script checks the Read Only Memory (ROM) size, by accessing “SMBiosData” property in System Management BIOS (SMBIOS). If ROM size if less than or equal to 2048 KiloBytes, the malware calls function “clearupper” which removes the temporary files and terminates the execution. The 9th byte is “SMBiosData” represents “[ROM size(in KiloBytes)/64 – 1]”. Checking ROM size can be a used to determining virtual environment or the malware author does not want to execute ServHelper, if victim’s machine does not meet the expected ROM size. If the malware is executed with “Administrators” account then “install” function is executed which is responsible for further ServHelper execution, else “gsdingeku” is executed which is responsible for executing the PowerShell script with escalated privilege:

 

The malware now checks for “TermService” (Remote Desktop Service), if not already present, the malware creates the service setting “ServiceDll” path as “%SystemRoot%\System32\termsrv.dll” and then terminates “TermService” if already running. The malware contains strings variable, which are Base64 decoded, followed by gzip decompression to get the component files(32-bit ServHelper binary, modified 64-bit RDP Wrapper Library, 64-bit ServHelper binary, RDP Wrapper Library configuration, 64-bit RDP Clipboard Monitor executable and 64-bit Microsoft RemoteFX VM Transport library):

 

32-bit ServHelper binary is packed with PECompact (Powerful executable compression for software developers and vendors), 64-bit ServHelper binary and modified 64-bit RDP Wrapper Library are packed with UPX (Ultimate Packer for eXecutables). The malware checks “[System.IntPtr]::Size” to determine Operating System architecture and copies component files to below file locations:

• Modified RDP Wrapper Library – Copies to $env:programfiles\windows mail\appcache.xml
• ServHelper binary – Copies to $env:programfiles\windows mail\default_list.xml
• RDP Wrapper Library configuration – Copies to $env:programfiles\windows mail\cleanuptask.cfg
• RDP Clipboard Monitor executable – If not present already, copies to env:systemroot\system32\rdpclip.exe
• Microsoft RemoteFX VM Transport library – If not present already, copies to $env:systemroot\system32\rfxvmt.dll

The malware changes Remote Desktop Protocol (RDP) port to “7201” and ServiceDLL to “$env:programfiles\windows mail\appcache.xml” for “Remote Desktop Service”. The malware then starts “rdpdr” and “TermService” services. ServiceDLL for “TermService” which is now “Modified RDP Wrapper Library” executes the ServHelper binary.

 

ServHelper 2.0:

The malware decrypts encrypted string “d:\xbl_QpfneNpYlu_.qye” to “c:\aaa_TouchMeNot_.txt” using below decryption logic and uses same decryption logic for decrypting other encrypted strings:

 

The malware now checks the presence of “c:\aaa_TouchMeNot_.txt” (Windows Defender’s goat file), if found then malware terminates the execution:

 

The malware modified user accounts using below batch commands to allow remote desktop access:

• net user wgautilacc Ghar4f5 /del
• net user wgautilacc yysJG0Or /add
• net LOCALGROUP “Remote Desktop Users” wgautilacc /ADD
• net LOCALGROUP “Remote Desktop Users” Deepak /ADD
• net LOCALGROUP “Administrators” wgautilacc /ADD
• net user wgautilacc yysJG0Or

The malware modifies below registry entries:

• HKLM\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections -> 0
• HKLM\System\CurrentControlSet\Control\Terminal Server\FSingleSessionPerUser -> 1
• HKLM\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse -> 0
• HKLM\System\CurrentControlSet\Control\Terminal Server\Licensing Core\EnableConcurrentSessions -> 1
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions -> 1
• HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\wgautilacc -> 0
• HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services\fAllowToGetHelp -> 1

The malware writes victim’s machine information into “%TEMP%\LYNPCDXX”:

 

Network Communication:

The malware sends the information to its Command and Control (C&C) server. Before sending information to the C&C server, malware performs xor operation followed by Base64 encoding:

 

Commands Supported:

• bk
• info
• fixrdp
• reboot
• updateuser
• deployns
• keylogadd
• keylogdel
• keyloglist
• keylogreset
• keylogstart
• sshurl
• getkeylog
• getchromepasswords
• getmozillacookies
• getchromecookies
• search
• bkport
• hijack
• persist
• stophijack
• sethijack
• setcopyurl
• forcekill
• nop
• tun
• slp
• killtun
• shell
• update
• load
• sockt

 

Unavailability of Portable Executable (PE) in any of the popular threat intelligence sharing portals like the VirusTotal and the ReversingLabs at the time of writing this blog indicates its uniqueness and limited distribution:

 

Evidence of the detection by RTDMI(tm) engine can be seen below in the Capture ATP report for this file:

The SonicWall Capture Labs Threat Research Team observed reports of a new variant family of MZP ransomware [MZP.RSM] actively spreading in the wild.

The MZP ransomware encrypts the victim’s files with a strong encryption algorithm until the victim pays a fee to get them back.

Infection Cycle:

The ransomware adds the following files to the system:

• Malware.exe
  • % App.path%\ HOW TO RESTORE ENCRYPTED FILES.TXT
    • Instruction for recovery
  • %App.path%\ [Name]. <Random>

Once the computer is compromised, the ransomware runs the following commands:

The ransomware encrypts all the files and appends the [<Random>]  extension onto each encrypted file’s filename.

After encrypting all personal documents, the ransomware shows the following text file containing a message reporting that the computer has been encrypted and to contact its developer for unlock instructions.

 

We have been monitoring varying hits over the past few days for the signature that blocks this threat:

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: MZP.RSM (Trojan)

This threat is also detected by SonicWALL Capture ATP w/RTDMI and the Capture Client endpoint solutions.