Dell SonicWALL UTM Research team received reports of a new zero day exploit targeting newer versions of Internet Explorer in the wild. This zero day exploit targets a use-after-free vulnerability in Internet Explorer. The exploit is packaged in an encrypted SWF file along with JavaScript helper files. On successful exploit, it leads to the download and execution of a Poison Ivy RAT.

The exploit is attempted using the following components:

• Exploit.html: This is the initial entry point of the exploit. It creates an img element and loads Moh2010.swf.
• Moh2010.swf: The SWF is encrypted and obfuscated using DoSWF as shown below. On execution it performs a heap spray and creates an Iframe that leads to Protect.html.

  

• Protect.html: It checks if it is running in Windows XP and Internet Explorer 7 or 8. It is to be noted however that this exploit is also successful on Internet explorer 9 and Windows Vista. We advise Dell SonicWALL customers to refrain from using Internet Explorer until this vulnerability is patched.

  

• Poison Ivy RAT: When the exploit succeeds it downloads and executes a Poison Ivy RAT Trojan. The downloaded Trojan is XOR’ed using the key ‘0x70’ and is decrypted before execution. The Trojan performs the following activities when executed:
  • It creates a copy of itself:
    %temp%/1992218.dat [Detected as “GAV: Poison.NHM (Trojan)”
  • It creates a service to start itself on reboot:
    HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesWmdmPmSN
  • It attempts to contact a remote server which was found to be taken down at the time of analysis

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: SWFExp.G (Trojan)
• GAV: SWFLoad.G (Trojan)
• GAV: Malformed.html.MT.2 (Exploit)
• GAV: Shellcode.GEN_12
• IPS: 8669 Microsoft IE selectAll execCommand Invocation
• IPS: 7370 HTTP Client Shellcode Exploit 68a
• IPS: 4665 HTTP Client Shellcode Exploit 13a

Dell Sonicwall UTM research team have discovered a new FakeAV malware in the wild called Win 8 Security System. FakeAV malware of this nature has been covered before in a previous sonicalert. However, this FakeAV malware is different in that it deploys a rootkit driver as part of its infection process. This makes the malware very difficult to remove.

Although the sample we obtained failed to show any pop-up dialogs we were able to gain information about its intentions through our analysis.

The Trojan uses the following icon:

Upon infection, the Trojan deletes itself. It then makes the following changes to the filesystem

It copies itself to:

• %APPDATA%72706355694bcd40.exe [Detected as GAV: FakeAV.WN8 (Trojan)]

It drops a rootkit to:

• %WINDOWS%system32drivers2a236245d0309b5.sys [Detected as GAV: Rootkit.X (Trojan)]

The file attributes of the rootkit are set to protect it from modification or deletion even in safe-mode.

It adds the following key to the Windows registry to enable startup after reboot:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun “%APPDATA%72706355694bcd40.exe”

A sample of keys added to register the rootkit driver:

• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_2A236245D0309B5000 Service “2a236245d0309b5”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_2A236245D0309B5000 Legacy dword:00000001
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_2A236245D0309B5000 ConfigFlags dword:00000000
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_2A236245D0309B5000 Class “LegacyDriver”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_2A236245D0309B5000 DeviceDesc “2a236245d0309b5”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_2A236245D0309B5000Control ActiveService “2a236245d0309b5”
• HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumRootLEGACY_9DC9B000 DeviceDesc “72706355694bcd40.exe”

The following HTML pages were extracted from the 72706355694bcd40.exe executable during analysis. The pages are used to hook into various browsers such as Internet Explorer and Google Chrome and produce a fake security alert:

We also extracted the following landing pages from the executable:

• http://st777st.com/z.php?ver=2
• http://win8sec.com/?do=payment&ver=2
• http://win8sec.com/?do=minicontact&ver=2

The following screenshot is from the payment landing page:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: FakeAV.WN8 (Trojan)
• GAV: Rootkit.X (Trojan)

Dell SonicWALL Threats Research team came across a new Malware submission that looks like a bot with backdoor functionality. The Malware executable appeared to arrive from a compromised site via drive-by download exploits.

The original Malware executable gets downloaded from maisonwake(REMOVED)/fancybox/a.gif using an image file extension for disguise. The malware author internally appears to be referring this malware as Psychlo NewBoss v1.0.

Infection Cycle

The bot when executed drops a copy of itself on the victim machine and runs it:

• (All Users)MDGAUCC9epNUbnWkqPUVsE9suH5tvi.exe [Detected as GAV: Neojit.A (Trojan)]

It also ensures that the dropped malicious executable runs upon system reboot by adding following registry key:

• HKUSoftwareMicrosoftWindowsCurrentVersionRunEP7gYQcJX: “(All Users)MDGAUCC9epNUbnWkqPUVsE9suH5tvi.exe”

It generates an internal configuration file that uses a GIF header with encrypted content appended to it. A sample of and encrypted & decrypted configuration file is shown below with the internal configuration file format as defined by the malware author:

The malware goes through the user’s Program Files and builds a list of Windows Executable files with IMAGE_FILE_MACHINE_I386 => x86 architecture. It then randomly picks one executable file from the list, runs it and injects malicious code into the legitimate program process.

The legitimate program injected with malicious code creates a Mutex to mark its presence on the system:

• MutexName = “{4012d34795ec88fec6a6d103659a9783}”

It then attempts to connect to the following remote domains at an interval of five minutes to register infection and get further instructions:

 GET /newg/a.php?s=00005c39&m=fdd79d5d654416b63e7b275628ebd57f&u=(Encoded Username)&g=nb.7Y49&o=(Operating System)&ml= HTTP/1.1 User-Agent: Googlebot/2.1 (+http://www.google.com/bot.html) 

A partial list of commands that we encountered while analyzing this malware is shown below:

Psychlo NewBoss v1.0 Commands

• ReadConfigFile
• WriteConfigFile
• LoadDefaultConfigFile
• PrintConfigFile
• Create
• Destroy
• ResetConfigFile
• ParseCommandLine
• SetAppType
• LoadBaseApp
• GenerateNewEncryptedSoftware
• InjectIntoProgramFile
• InstallRegAutoStart
• Install
• Update
• Uninstall

We observed the following logging messages while analyzing this malware:

Psychlo NewBoss v1.0 Logging activity

 SelfName:  Installer: Installing version nb.7Y49 Updating from version nb.7Y49  Injector Manager Dest:  Source file found:  File app decrypted:  Injectable programs found:  Injecting into:  Program code:   Accessing the server... Server.ConfigFile =  nb.7Y49 Update app ->  Download url =  File downloaded MD5 Good Decrypted Temp filename:  File saved:  Running modules ComputerName:  UserName:  

Dell SonicWALL Gateway AntiVirus provides protection against this threat via following signatures:

• GAV: Neojit.A (Trojan)
• GAV: Neojit.A_2 (Trojan)

Dell Sonicwall Threats research team have discovered a new variant of the Cridex Banking Trojan. The Trojan utilizes the blackhole exploit kit for drive-by system infection. The purpose of this Trojan is to steal online banking credentials. It has the ability to intercept encrypted communications between banking websites and their customers.

The infection occurs when visiting a webpage with a malicious blackhole script [Detected as GAV: BlacoleRef.W_8 (Exploit)]:

The Trojan creates the following file on the filesystem:

• %APPDATA%KB01217753.exe [Detected as GAV: Cridex.E_4 (Trojan)]

The Trojan creates the following key in the Windows registry to enable startup after reboot:

• HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionRun KB01217753.exe “%APPDATA%KB01217753.exe”

Upon infection the Trojan injects code into explorer.exe, causing it to send the following sensitive data, encrypted, to a remote C&C server:

In the same manner as in a previous variant, it hooks various Winsock internet communication API’s to intercept incoming and outgoing browser traffic.

It also hooks crypto API’s such as CryptDecrypt, CryptEncrypt, EncryptMessage and DecryptMessage. This is for the purposes of intercepting SSL communication between banking websites and thier customers and injecting html code into webpages to steal credentials. Below is a sample of a decrypted configuration file that we recieved from a remote C&C server:

SonicWALL Gateway AntiVirus provides protection against this threat via the following signatures:

• GAV: BlacoleRef.W_8 (Exploit)
• GAV: Cridex.E_4 (Trojan)