SonicWall Capture Labs Threat Research team recently found a new malware taking advantage of the CoViD19 pandemic which makes disks unusable by overwriting the MBR.

Infection cycle

Upon execution, a number of helper files are dropped inside a temporary folder:

One of the helper files named “coronavirus.bat”, which identifies itself as “coronovirus Installer” performs most of the setup work. It creates a folder named “COVID-19” where all the previously dropped helper files are moved. In order to go unnoticed, “COVID-19” folder is hidden. It further goes on to disable Windows Task Manager, User Access Control (UAC), disables options to add/modify wallpaper after changing the user’s current wallpaper. It also adds entries in registry for persistence.

Coronavirus.bat

The victim is notified of installation and reboot before the system is finally restarted.

run.exe creates a batch file named run.bat to ensure the registry modifications done by “coronavirus.bat” are kept intact besides facilitating execution of “mainWindow.exe”.

MainWindow.exe upon execution displays a window with two buttons showing structure of CoViD19 virus.

One of the button named “Remove virus” is non-functional. Upon clicking on the “Help” button it displays below image.

The sole functionality of the Update.VBS script file is to display below message window.

The other binary which starts execution after reboot is responsible for overwriting the MBR.
The original MBR is first backed up in the first sector before it is overwritten with new one.

MBR overwritten with the new code

Also on the sector 2 of the disk it copies below message

MBR and new code

Henceforth, the victim is displayed below message by the bootstrap code.

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: KillMBR.Corn_A (Trojan)

Indicators Of Compromise (IOC):

• DFBCCE38214FDDE0B8C80771CFDEC499FC086735C8E7E25293E7292FC7993B4C

This threat is also detected by SonicWALL Capture ATP.

SonicWall Capture Labs Threat Research team has come across another variant of Metamorfo banking trojan that tries to take advantage of the global crisis due to COVID-19 pandemic.

This malware was first seen 2 days ago and the domain “masry-corona” that hosts this malware was also created recently with “corona” in the domain name to attract people looking for information regarding coronavirus.

Infection Cycle:

When the malicious web page “hxxps://masry-corona.com/TestCoAPP.zip” is visited, the Zip archive “TestCoApp.zip” gets downloaded onto the victim’s device, it is an archive of an MSI file named “CIADXV95270MBNW.msi”. Once clicked, it gets installed with the help of MsiExec.exe, a built-in Windows Installer.

This MSI file has 48 streams in it and the stream “!_StringData” has the downloader JavaScript code obscured with huge garbage strings.

After extracting and de-obfuscating the !_StringData, we see the below JavaScript code, that downloads the malicious payload.

When the javascript code within the MSI file gets executed, it downloads a ZIP file from the URL  “hxxp://la42.website/pro2/comprobante_771124.zip” using WinHttpRequest. ZIP file contains three files, it then gets decompressed into a 8-letter random string folder “bxkwuRkn” under “C:\ProgramData”. Also, the three files are renamed with 8-letter random strings, which were “qhQRAMSY.exe”, “8SkHjLCy” and “tfg74JRL.dll”.

qhQRAMSY.exe is a legitimate AutoIt script execution program, whose original name was “AutoIt3.exe”.

The actual malicious payload “tfg74JRL.dll” is a variant of Metamormfo. Metamorfo is a malware family that was observed targeting the customers of online financial institutions

It gets executed with the command: “C:\\programData\\qhQRAMSY.exe  C:\\Programdata\\bxkwuRkn\8SkHjLCy C:\\Programdata\\bxkwuRkn\tfg74JRl.dll“. AutoIt, a whitelisted process was being used to load the malicious dll to evade from antivirus detection.

Later, a shortcut file (LNK) was created with the above command in the Windows Start Menu folder to persist after system reboots.

It then modifies several registry key values to disable “AutoComplete”, “Use FormSuggest”, “FormSuggest Passwords”, “FormSuggest PW Ask” under the “HKCU\Software\Microsoft\Internet Explorer\Main”, and “AutoSuggest” under the “HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete”. This allows the malware keylogger function to record the victim’s input.

It connects with the command-and-control (C&C) server informing that it’s been has been infected. The below command “<|LSTU|>” is sent to the server, functioning like a heartbeat.

This variant also starts the Volume Shadow Copy Service (VSS) to create a shadow copy (system restore point) with malicious files in it. Volume Shadow Copy Service is a technology included in Microsoft Windows that can create backup copies or snapshots of computer files or volumes, even when they are in use.

Most antivirus software do not scan volume shadow copies for malware or other security threats. That could be why this malware tries to persist through system restore points and as well to evade from antivirus detections. 

With VSS Service, a shadow copy gets created after the victim’s machine gets infected.

As we are responding to combat the coronavirus (COVID-19) outbreak in the real world, we must also focus on cyber hygiene.

SonicWall Capture Labs Threat Research team provides protection against this threat with the following signatures:

GAV: 8676 Metamorfo.DN

This threat is also detected by SonicWALL Capture ATP w/RTDMI.

IOCs:

URLs:
hxxps://masry-corona.com/TestCoAPP.zip
hxxp://masry-corona.com/TestCoAPP.zip
hxxp://la42.website/pro2/comprobante_771124.zip
hxxp://la42.website/pro2/comprobante_771124.zip

SHA-256:
24e3d85865e6046e747f993dfc3b732d3922e7a1f9a382198cf699a06d83a51f (Zip)
5d413bf1c985529c38399323a7c2698371319332241b4e9bf55a47b51857aca8 (MSI)
237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d (exe)
5160557cac92e174b76a596592592b3e4eac3c9c65dd4d57c91a38c0d0b8f0f4 (dll)
5e07234588a7af03453c082a23f03e41418a1f42fea9c5884f19d8df16ad0fa2 (script)

Domain:
masry-corona.com
la42.website

IP Address:
192.3.157.116
134.0.10.213

With the sudden spike in CoronaVirus related threats it is no surprise that recent ransomware uses the same name. SonicWall Capture Labs Threats Research team observed an Android ransomware that uses scare tactics to make a quick buck.

Sample specifics

Application Name: Coronavirus Tracker

Package Name: com.device.security

Md5: d1d417235616e4a05096319bb4875f57

The permissions requested by the malware application are chosen to enable/start key functionality of the malware:

• “Receive boot completed”  has been included to enable the service RebootReceiver
• “Request ignore battery optimizations” has been included to ensure that the malware is not hibernated into a low power state to conserve battery

Infection Cycle

This ransomware spreads by posing itself as a CoronaVirus Tracker:

Once installed and executed it requests for Accessibility Services and Device Admin permission:

After a few minutes we are shown the ransom screen:

Behind the scenes

The ransom screen can be intimidating at first viewing, as there are threats to leak images and videos from the device if the ransom is not honored. The ransomware screen is picked from a hardcoded URL in the code which re-directs to a Pastebin page:

Even though this malware appears to be a ransomware, in reality this is just a scareware – a malware that uses scare tactics to coax the victim into paying a ransom. There is no evidence of any sort of file encryption or any way to steal/post the images or videos from the infected device.

The malware author demands payment in exchange of a decryption code. However checking the code revealed the presence of this decryption code in clear text:

On entering this code 4865083501 we saw the message “Congrats. You Phone is Decrypted”.

Success Rate

We checked the Bitcoin wallet address mentioned in the ransom note and confirmed that there is not presently significant traffic to this wallet. This indicates that the malware authors have not yet had significant success with this ransomware:

A note of Caution

For anyone who has a device infected by this ransomware, the decryption code is 4865083501. After entering this code the app disappears from the app drawer. This gives the user the impression that the app is no longer on the device. But in reality the app keeps running in the background and can be seen in the list of downloaded apps on the device:

Uninstalling the app is not straightforward because of the Device Admin privilege, and the Uninstall button appear greyed out. The only way to remove the app is to first revoke the Admin rights given to this app via Security ->Device Administration -> Untick Coronavirus Tracker.

SonicWall Capture Labs provides protection against this threat with the following signatures:

• GAV: AndroidOS.Decrypt.RSM (Trojan)
• GAV: AndroidOS.CoronaTracker.RSM (Trojan)

Indicators Of Compromise (IOC):

• d1d417235616e4a05096319bb4875f57

Sometimes even a simple looking code can cause a lot of damage. SonicWall Threats Research team found a new technique used by malware authors that can silently redirect the financial transactions made by a victim to the malware author’s account. SonicWall RTDMI ™ engine has recently detected a malware which examines the clipboard content for the bitcoin address pattern. If malware finds the bitcoin address, it changes the current bitcoin address to malware author’s bitcoin address in the clipboard content.

Due to the length of the bitcoin address and its alphanumeric complexity, users usually prefer to copy and paste the bitcoin address. In this case on a malware compromised machine, the malware works as a man in the middle by switching clipboard content between copy & paste.

The malware’s infection chain involves delivery of a VBScript file inside an archive, as an email attachment. The malware execution involves three layers of VBScript execution which leads to execute the PowerShell script as final payload.

First Layer VBScript:

The malware uses Living Off The Land (LOTL) tactic to stay low while executing on victim’s machine. The VBScript uses mshta.exe to execute second layer VBScript hosted remotely at Pastebin Unified Resource Locator (URL) “http:\\pastebin.com\raw\Mf2k0MGb”. The mshta.exe is considered a member of Living Off The Land Binaries (LOLBins) which are used to bypass application whitelisting defenses:

Second Layer VBScript:

The second layer VBScript again uses mshta.exe to execute third layer VBScript hosted remotely at Pastebin URL “http:\\pastebin.com\raw\x3cbyh8u”. The malware also makes persistence entries to the victim’s machine:

Persistence:

The malware schedules a task to run every one hour, which executes thirds layer VBScript from the Pastebin URL “http:\\pastebin.com\raw\x3cbyh8u” using mshta.exe:

The malware also makes registry entries into “HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run” to ensure its executes on system start:

Third Layer VBScript:

Third layer VBScript executes the final payload which is a PowerShell script:

PowerShell Script:

The PowerShell code is pretty simple but very effective in terms of causing destruction. The malware runs in a infinite loop and examines the clipboard content for bitcoin address pattern, which will be found in case the user has copied bitcoin address to make any transaction. Once the bitcoin address is found in the clipboard, the malware replaces that bitcoin address to malware author’s bitcoin address which is picked from the list of five bitcoin addresses owned by the malware author. The malware uses Get-Clipboard and Set-Clipboard cmdlets to retrieve and change the clipboard content. These cmdlets are supported after PowerShell 7 onwards:

The file is detected by only a few security vendors on popular threat intelligence sharing portal VirusTotal at the time of writing this blog, this indicates its spreading potential:

Evidence of the detection by RTDMI ™ engine can be seen below in the Capture ATP report for this file: