Search this Blog
Showing posts with label infostealer. Show all posts
Showing posts with label infostealer. Show all posts

Monday, June 14, 2021

Digital artists targeted in RedLine infostealer campaign

2021-06-17: updated with information from Twitter user ARC

In this post, we'll look at a campaign, that targeted multiple 3D or digital artists using NFT, with malware named RedLine. This malware is a so called "infostealer" or "information stealer" that is capable of extracting sensitive data from your machine (such as wallet information, credentials, and so on). As a side-note; NFTs, or non-fungible tokens, are digital tokens tied to assets that can be bought, sold and traded.

This blog post is divided into four parts:

  • Introduction: provides an overview of what happened
  • Analysis: analysis of the attack and the malware used
  • Detection: how to detect and remove the malware (skip to Detection if you just want to clean this up)
  • Prevention: how to prevent this from happening again
  • Conclusion: a brief conclusion and additional thoughts

Introduction

From at least last Thursday, 10th of June 2021, multiple users report on Twitter that they got hacked after being approached to create new digital art. These users, accomplished digital artists and publishing their work on NFT marketplaces, were approached either via Instagram, Twitter DM (message) or directly via email. The attacker has masqueraded themselves behind multiple personas, often claiming to be from South Korea. A few of the users that reported the attack:


Ariel:

 

fvckrender:


 

Nicole:

 

 

ARC:

 

 

Cloudy Night:

 

 

There are many, many more examples - however, we won't list them here. Of note is Ariel's tweet, where you can note the presence of a file named "Rizin_Fight_Federation_Presentation.scr". I'll circle back to that in the next section, Analysis.


Analysis

After scouring the internet for a while, I was unable to discover any of the files mentioned by the artists that reported the attack, that is until I stumbled upon Cloudy Night's tweet - their screenshot included a link to a website "skylumpro.com".



 

 

 

 

 

 

As expected, this is not the legitimate website, but rather a clever copycat of the real Skylum product website (to note, the real website is: https://skylum.com/luminar-ai-b). After clicking the "Download Now" button, a file named "SkylumLuminar (NFT Beta).rar" is downloaded, which you need to unzip with the password "NFT", as we can observe from Cloudy Night's tweet.

The unzipped content looks as follows:



 

 

 

 

 

 

 

One of the first things you may notice is the large filesize of the so called beta version. As you've seen from before in Ariel's tweet, the filesize was 745MB, while this file is a whopping 791MB!

But why is this file so large and why does it matter? 

  • The attacker has appended their original file with a large chunk of overlay data; to put it simply - a bunch of extra data that does nothing.
  • The attacker has increased the filesize this much to try and evade antivirus software and scanning tools; for example, a well-known service to scan suspicious files, VirusTotal, only accepts files up to 650MB, while some antivirus scanners may not even scan a file this large.
  • While you could upload the original RAR file; the attacker has password-protected it and VirusTotal will be unable to scan it properly. You could re-package it, but the file itself may not be scanned.

Having said all that, after removing the excessive overlay, a much more reasonable filesize is obtained: 175KB. This new file's properties are:

Of note is the creation or compilation time: this is the date and time the file has originally been created. While this can be spoofed, I do not believe it is the case here. This time matches with when the attack appeared. It is however highly likely more files, such as the one in Ariel's tweet, do the round.

This file will then execute a new file; which is the RedLine infostealer malware. This file has the following properties:

Note the creation time is different: set in 2042 - this is obviously faked by the attacker to reveal when exactly it has been created. However, with the above data, we can assume it was created in the last 5 days or so.

As mentioned before, once you execute the SkylumLuminarNFTBetaVersion.exe file, you will be infected with the RedLine infostealer malware. ProofPoint has reported on this malware first in March 2020: New Redline Password Stealer Malware. This malware has many capabilities, including, but not limited to:

  • Steal username and password from browsers;
  • Collect extensive system information;
  • Execute commands, such as downloading and uploading other files, opening links and so on;
  • Steal cryptowallet information - both from Chrome extensions as well as typical wallet.dat files. The extensions targeted are:
    • YoroiWallet
    • Tronlink
    • NiftyWallet
    • Metamask (refer also to Nicole's tweet)
    • MathWallet
    • Coinbase
    • BinanceChain
    • BraveWallet
    • GuardaWallet
    • EqualWallet
    • JaxxxLiberty
    • BitAppWallet
  • Steal data from other software, such as:
    • Steam;
    • Telegram;
    • FTP clients such as FileZilla.

The screenshot below displays part of RedLine's functionalities:



 

 

 

 

 

 

 

 

 

 

 

 

RedLine will first gather some basic information about your machine, such as the machine name, external IP address, your geography and so on. It gathers external information by querying one of the following IP lookup services:

  • https://api.ipify.org
  • https://icanhazip.com
  • https://wtfismyip.com/text
  • http://bot.whatismyipaddress.com/
  • http://checkip.dyndns.org 

Note these services are not malicious, they are simply being used by the attacker to gather more information. Interestingly enough, RedLine will use SOAP HTTP (POST) requests to its command and control server (the server or machine controlled by the attacker where your data will end up) using the following IP: 

  • 185.215.113.60;
  • On port 59472;
  • This IP resides in the Seychelles.

Another domain and IP observed is (from ARC's tweet above, the files in that archive were almost 600MB):

  • xtfoarinat.xyz;
  • On IP 92.38.163.189;
  • This IP also has sinaryaror.xyz resolve to it, another RedLine command and control server.

One may also observe connections to tempuri.org. This is a default placeholder for web services, and is not atypical when using SOAP over HTTP. Tempuri is not malicious.

Finally, after receiving all this data, the attacker can start logging into your accounts, attempt to steal your tokens, impersonate you and so on. The attacker can also install other malware if they wish, such as ransomware.

What now? Detection

 

Good news:

The variant discussed in this blog does not appear to persist: in other words, after a reboot, its process will not be active anymore, at least for the variant discussed in this blog post.

Bad news:

Everything else - unfortunately, RedLine works pretty fast and a few minutes are enough to exfiltrate all your data and for the attacker to fully compromise all your accounts.

Luckily for us, RedLine stealer should be detected by most commercial and free antivirus software products on the market. A few recommendations to get rid of the RedLine variant discussed in this blog post - note this may not fully cover the variant you encountered: 

  1. Contact your NFT provider, cryptowallet provider and so on as soon as possible via telephone call or another computer and inform them of what happened; ask for a temporary block of your account or to at least temporarily block any funds from now on.
    >>>     It is very important you do this first! <<<

  2. If you can, change your credentials from another machine; such as your phone, your partner's laptop, ... Note it's recommended to change your credentials at least for your email accounts and for your wallets - focus on the most important accounts first! If you do not have this possibility, continue with the steps below.

  3. Open Task Manager, go to the Details tab and search for any process with the following names:
    1.  SkylumLuminarNFTBetaVersion.exe;
       Flamingly.exe;
       FieldTemplateFactory.exe;
      PaintingPromoProject;
       Alternatively, the name of the file you executed      . 
    2. Now, kill the process by right-clicking on it  > select End Process (or End Task).

  4. If you have a firewall or proxy, block the IPs 185.215.113.60 and 92.38.163.189.

  5. Run a scan with your currently installed antivirus and a scan with an alternative product, for example, Malwarebytes (has a free version);
    1. You can also use Eset's Online Scanner (free): https://www.eset.com/int/home/online-scanner/

  6. Enable the Windows Firewall: https://support.microsoft.com/en-us/windows/turn-microsoft-defender-firewall-on-or-off-ec0844f7-aebd-0583-67fe-601ecf5d774f
    1. While this might not have much impact at this point, it will give you an additional layer of protection from other threats;
       
  7. Delete all the files you have previously downloaded if they still exist on your system; if you'd like me to analyse them, you may send me a copy first;

  8. If the above scans have turned up:
    • Clean: have you executed the file? 
      1. If not, you are not infected. 
      2. If you did, and the scanners turn up with nothing, it's possible your current antivirus product has blocked the attack. 
      3. You might also want to Refresh your PC to have peace of mind.
    • Not clean (there were detections): let the above product (e.g. Malwarebytes or Eset) clean them up and reboot your computer.

  9. Finally, reset all (or the rest of) your credentials. Do this only when you know your machine is clean! Alternatively, reset your credentials from another machine as indicated earlier.

It's important to follow these steps as soon as possible to prevent any damages. 


Prevention

You've come this far, or perhaps you simply skipped to this part - arguably the most important one: to prevent this attack from happening in the first place. So how can this be achieved?

  1. First and foremost: ensure you are using Windows 8.1 or later. Older Operating Systems, such as Windows 7, are no longer supported by Microsoft and have additional vulnerabilities attackers may exploit;

  2. Install an antivirus and enable the Windows Firewall. It does not matter if the antivirus is free or not; paid versions do offer more features, but a free version will do just as much.
    1. Starting from Windows 10, Windows Defender should protect adequately from attacks such as the one described in this blog post. Other free alternatives are Kaspersky's free cloud antivirus and Malwarebytes.
    2. When you get any file, scan it with your antivirus first! (typically done by right-clicking on the file or folder) 
    3. When in doubt, upload the file to VirusTotal. Note however the tactics used here: if there's a really large file, it may not be able to be scanned properly - this can be an indication of malicious intent!

  3. Set UAC (User Account Control) to the maximum level: Always Notify - this will stop some additional attacks (you will get more prompts; if you do, take a pause and verify what's on the screen should indeed be executed). Here's how to do that: https://www.digitalcitizen.life/how-change-user-account-control-uac-levels/

  4. Enable file extensions: some extensions, such as .scr, historically a screensaver file; are in fact executables - which could contain malicious code, as was the case in Ariel's tweet. Do not open or run these files. This will also protect you against the "double extensions" trick. A file named commission.jpg.exe will now be visible as such - if file extensions are disabled, you would see commission.jpg - see the difference? Here's how you can enable file extensions: https://www.howtogeek.com/205086/beginner-how-to-make-windows-show-file-extensions/

  5. Create unique passwords where possible; if feasible; use a password manager;

  6. Enable MFA (or 2FA if MFA is not available) on all your sensitive accounts; this will add an additional layer which is typically very hard for the attacker to guess or crack. Google "your service/ account + MFA" for specific instructions;

  7. If you receive a new commission or request to create art, stop and think first - ask yourself these questions:
    1. Is this coming from a reputable account or from a totally new account?
      1. If reputable, can I verify their claim or request somehow?
      2. If from a new account: be extra wary!
      3. If from an account with very low followers/following: be extra wary!
    2. How will they pay me? 
      1. Are they using a verified cryptowallet, or trying to set me up for something shady?
      2. Do they have any reviews on their (public) profile, if any?
    3. What are they asking of me exactly?
      1. Are they indeed sending just images, or is there an executable file or "special software" I am supposed to download/open?
    4. Where are their links or attachments leading to?
      1. Are these leading to another service, e.g. imgur.com, or something different altogether?
    5. I have downloaded the file(s), but I do not trust the source;
      1. Delete it or ask for more information;
      2. Block the sender if you are suspect and report their account, delete any files;
      3. You can double-check by scanning the files with your antivirus, or uploading it to VirusTotal. The same nuance as above applies however.
    6. You can also Google any information they send through to further verify their claims.

  8. Finally and where possible;
    1. Use a hardware instead of software wallet;
    2. Secure your seed phrase; store it offline, for example, on an external drive or use pen and paper;
    3. Verify the security settings in your wallet or crypto provider: perform a check of which other security features you can enable, and enable them. 

 

Manifold, a company that creates blockchain products for NFT communities, has also written an excellent post-mortem of this attack which includes additional advice - I highly recommend you to read it: https://manifoldxyz.substack.com/p/the-fvckrender-hack-post-mortem

 

Conclusion and afterthoughts

It's not the first time a highly targeted or specific attack occurs on communities that use crypto in some form or another, for example, at the end of 2019, Monero's download site and binaries were compromised for a brief time.

If you have been targeted by this attack, and you have been compromised, follow the advice in this blog as soon as possible to clean it up and to prevent any future attack.

This attack was quite specific and targeted - there is really no need to feel bad if you have been affected, as it can happen to anyone. Explain to your crypto provider what happened, and they should be able to help you out.

I'd like to thank all the vigilant users on Twitter out there for creating awareness, and I hope this blog has provided further insight. If you were affected, and you'd like me to analyse any suspicious file, or would just like to comment, use the comment section below or contact me on Twitter. Refer to my About me page for even more contact details.

Posted by at 1 comment:
Labels: , , ,

Sunday, September 21, 2014

A word on CosmicDuke


On Thursday F-Secure released a blog post on CosmicDuke. But what is CosmicDuke exactly?

CosmicDuke - the first malware seen to include code from both the notorious MiniDuke APT Trojan and another longstanding threat, the information-stealing Cosmu family. When active on an infected machine, CosmicDuke will search for and harvest login details from a range of programs and forward the data to remote servers.
Source: COSMICDUKE: Cosmu with a twist of MiniDuke (PDF)

In other words, it will (attempt to) steal your login credentials from browsers and any other programs you may or may not use. I was interested to take a look, queue how Twitter comes in handy:



In this post we'll be focusing on sample 82448eb23ea9eb3939b6f24df46789bf7f2d43e3 - which supposedly handles about the EU sanctions against Russia.


When opening the document:

(Source)


















When you open the document with macros disabled:














Seems they got prepared in case anyone disabled macros. Think this is a legit Word document?
Nope.

When you open the document, there's actually a child process spawned (tmp4D.tmp) which also loads a file called input.dll:


Don't be fooled by the company name or description,
this isn't IIS Express Worker Process nor has it anything to do with Microsoft.









We'll soon see what all this does. First, I'd like to provide some background information. The file's a .docx file, which means it is a combination of XML architecture and ZIP compression for size reduction and was implemented when Office 2007 was introduced. Why is that relevant?

Because you can unzip (with 7-zip for example) any Office file with the new extension:
(.docx, .xlsx, .pptx, ...)


Unzipped content of a .docx file











Thus, you can have a peek inside the document without actually opening it. If we look inside the "word" folder from our document, we can see the following (note the highlighted entries):
Unzipped content of  our .docx file


As you can see, there are 3 extra files there, 2 DLL files and a BIN file. Those files are embedded into the Word document. The BIN file loads an OLE , which then loads either the input.dll or input64.dll file, depending on your Operating System architecture. (in other words, the Office macro loads a malicious binary file.)

If you're interested in what the OLE artifact contained, here's a Pastebin link:
CosmicDuke VBA macro

Afterwards, the malware tries to kill the following processes:
cmd.exe
savadminservice.exe
scfservice.exe
savservice.exe
ekrn.exe
msseces.exe
MsMpEng.exe
dwengine.exe
ekern.exe
nod32.exe
nod32krn.exe
AvastUi.exe
AvastSvc.exe
kav.exe
navapsvc.exe
mcods.exe
mcvsescn.exe
outpost.exe
acs.exe
avp.exe

It will then try to gather as much data as possible, from cookies to files containing *psw*;*pass*;*login*;*admin*;*sifr*;*sifer* or *vpn. Soon after your data will be uploaded to an FTP server... Which wasn't too hard to find.

Anyways, here's some additional information on the Word file by automated tools:
MalwareTracker Result
VirusTotal Result



Prevention



Conclusion

It seems obvious that malware authors are keeping up-to-date with the latest news and as such adapting their campaigns as well. Better be safe than sorry and don't trust anything sent via email. ;-)

If you're in an organisation, you might want to consider blocking the execution of all macros (or only allow the ones that are digitally signed if there's no other option) by using GPO.

You can find those templates here:
2007 Office system (SP2) Administrative Template files (ADM, ADMX, ADML) and Office Customization Tool
Office 2010 Administrative Template files (ADM, ADMX/ADML) and Office Customization Tool download
Office 2013 Administrative Template files (ADMX/ADML) and Office Customization Tool



Resources

Analyzing Malicious Documents Cheat Sheet
COSMICDUKE: Cosmu with a twist of MiniDuke (PDF)
Where is the documentation for Office's docx/xlsx/pptx formats? Part 1: Office 2007
Where is the documentation for Office's docx/xlsx/pptx formats? Part 2: Office 2010
Posted by at 1 comment:
Labels: , , , , , ,

Friday, October 25, 2013

PHP.net compromised


Unless you didn't have any internet access today, you must have heard about the compromise of PHP.net today. An excerpt:

One of the first confirmations that PHP.net is was in fact compromised






Google Safe Browsing warning













You can read the full discussion on whether PHP was compromised or not here:

Statements by PHP.net itself:
I think it's pretty clear by now how it (could have) happened: insertion of a malicious - or change of- a Javascript file on their website.

Let's start with the first entry of infection, most likely userprefs.js on the main page. Some heavily obfuscated Javascript is present, which redirects to either:
Redirects







Here's a Pastebin link containing the modified userprefs.js: http://pastebin.com/yZWxxk2h

After either of those redirects, PluginDetect (which is a legit Javascript library to detect browser plugins) determines your version of Adobe & Java. If you have any of those vulnerable versions installed, you'll get served with several flavors of malware. Your browser will either crash or "hang" for a while.

Interestingly enough, another PluginDetect was also trying to check for vulnerable versions of VLC, SilverLight and Flash.

If you don't have any of these installed, you're possibly being redirected to a website with the text "He took over Russia with a wooden plough, but left it equipped with atomic weapons" (seems to be a letter about Stalin, see here) which contains the following fancy YouTube video:
http://www.youtube.com/watch?v=9Mnmhtr4ThE


Let's move on to the actual payload. Thanks to a blogpost by Barracuda Labs, I was able to download the PCAP file they gathered. 


The PCAP file proved to be very interesting. Besides being able to pull the usual malicious Javascript files, I was able to gather some payloads as well, which aren't very friendly to your machine.

The following malware was seen to be downloaded: Fareit, ZeroAccess (GoogleUpdate/Google Desktop variant), Zeus and even ransomware (unknown) in one instance!

Fareit and Zeus/Zbot have been known for going hand in hand for some time now, see here for an earlier blogpost. When executed, you'll either have to pay up a fine (ransomware), get a rootkit (ZeroAccess) or get your information stolen (Fareit & Zeus). An overview of the information that will be stolen:

Your data being stolen





















I don't need to mention that this is quite bad. Have you visited PHP.net yesterday or today and saw your browser crash? Did you notice any strange behavior? Yes? No? Either way, perform a scan of your machine right away. We'll get back to that though.

MD5s of samples gathered:
c73134f67fd261dedbc1b685b49d1fa4
406d6001e16e76622d85a92ae3453588
dc0dbf82e756fe110c5fbdd771fe67f5
78a5f0bc44fa387310d6571ed752e217
18f4d13f7670866f96822e4683137dd6

Callbacks:
85.114.128.127



Prevention

  • Patch your Java & Adobe or uninstall it if you don't need it.
    Same goes for their browser plugins or add-ons!
  • Keep your browser of choice up-to-date.
  • Install an antivirus and antimalware product and keep it up-to-date & running.
  • Use NoScript in Firefox or NotScripts in Chrome.
  • Block the above IP. (either in your firewall or host file)


Disinfection 


  • Perform a full scan with your installed antivirus and a scan with another antivirus or antimalware product. You can check on VirusTotal which antivirus applications already detect this malware.


Conclusion

  • Every website can be injected with malicious Javascript, even well-known websites!
  • Received a Google Safe Browsing warning? Don't simply ignore it, either look up if anything's known about that website being hacked or if you're not sure, stay away from it for a while. (best case is to contact the site owner as well.)


Posted by at 4 comments:
Labels: , , , , , , , , , ,

Tuesday, June 11, 2013

WellsFargo spam serving infostealing malware


Not that new, but still noteworthy the spammers seem to be abusing WelssFargo (an American bank) as trusted sender. This is simple mail spoofing.


Mail from "Georgina Franks"















Some example senders (where it seems to come from):
Evelyn_Piper@wellsfargo.com
Georgina_Franks@wellsfargo.com
Noe_Zavala@wellsfargo.com

As far as I could find, these email addresses do not even exist.

The mail itself is actually coming from the Pushdo botnet. Example IPs:

173.167.205.149 - IPVoid Result
209.181.66.178 - IPVoid Result

All the links in the mail are legit, this to convince you that the attachment will be legit as well. When opening the ZIP file (which is named WellsFargo.yourmailprefix) , you're presented with a what-looks-like a PDF file, but is in fact an EXE file:







MD5: 47e739106c24fbf52ed3b8fd01dc3668
VirusTotal Report
Anubis Report
Malwr Report


This malware is known as Fareit (or Tepfer). According to Microsoft:
 Win32/Fareit is a multiple component malware family that consists of a password stealing component, PWS:Win32/Fareit, that steals sensitive information from the affected user's computer and sends it to a remote attacker, and a Distributed Denial of Service (DDoS) component, DDoS:Win32/Fareit.gen!A, that may be commanded to perform flooding attacks against other servers.

When executing the file it looks for quite a lot of data to steal, as well to phone home to update its configuration files and download additional malware (Zeus).Below you can find an image on the data (information) it tries to steal:

List of programs it tries to extract username/password from




















So besides all this, it additionally downloads Zeus (the payload), which tries to steal banking credentials and others... If you'd think Fareit is enough, guess again! There's a good image made by the FBI how the Zeus 'scheme' or malware works:

Cyber Theft Ring details















































The downloaded Zeus files are all having a very low detection rate on VirusTotal. Hint:
check out the VirusTotal report from the sample above and click on the tab "Behavioural Information". Note the links are live!



Conclusion
  • Don't open any attachment(s) of unknown senders. In fact, don't even open mail from unknown senders.
  • Don't be fooled by mail spoofing, you can view the real source by right-clicking your mail and choosing "View Source". (This depends on your mailclient though.)
  • Don't be fooled by the fancy icons, they are actually EXE files. You can enable an option in Windows so you're always sure of the filetype being used:
    Enable Viewing of Filename Extensions for Known File Types
  • Install an antivirus and antimalware product and keep it up-to-date & running.
  • If you're in an organisation, you might want to block the following IPs (quite a long list):

    173.255.213.171
    5.199.171.133
    50.141.158.229
    62.149.131.162
    62.149.131.162
    69.115.119.227
    69.128.126.198
    76.226.112.216
    76.226.112.216
    78.140.131.151
    82.211.180.109
    89.122.155.200
    90.156.118.144
    95.241.244.184
    107.193.222.108
    107.211.213.205
    108.233.198.131
    108.240.232.212
    116.202.222.102
    142.136.161.103
    173.255.213.171
    188.217.207.224
    198.118.112.110
    211.209.241.213
    212.182.121.226
    108.254.22.166
    108.74.172.39
    112.78.142.66
    122.178.149.88
    173.194.67.105
    173.194.67.94
    173.201.59.32
    173.201.59.32
    173.254.68.134
    173.254.68.134
    178.40.101.100
    181.67.50.91
    182.68.130.230
    184.80.8.18
    187.153.52.160
    189.254.111.2
    190.153.51.122
    190.21.64.25
    199.30.90.80
    199.7.177.218
    2.180.24.120
    2.230.133.66
    200.180.176.65
    201.122.96.80
    201.245.14.237
    201.245.14.237
    207.204.5.170
    207.204.5.170
    216.227.73.207
    24.115.24.89
    24.120.165.58
    41.34.11.17
    65.131.15.62
    66.63.204.26
    68.162.220.34
    69.26.171.181
    69.77.132.197
    69.92.6.139
    71.43.167.82
    74.120.9.245
    74.125.24.105
    74.125.24.94
    74.240.17.144
    78.100.36.98
    78.152.96.70
    79.29.227.158
    79.52.113.31
    81.111.62.181
    83.172.126.39
    84.59.129.23
    84.59.138.75
    85.100.41.9
    87.29.153.193
    87.66.14.62
    87.66.14.62
    90.189.54.253
    91.236.245.22
    94.67.83.244
    94.67.83.244
    95.101.0.104
    95.249.114.32
    98.103.34.226
    98.67.162.178
    99.159.193.22
    99.36.163.147
    99.48.126.246
    99.5.234.38
    99.98.209.3
Note that these are IPs the malware communicates to. In most cases, they are harmful, but keep in mind some IPs might be legit, as the malware authors want to test for connectivity by connecting to Google for example. So, if you plan to block on IP, be sure to cross-check on IPvoid or DomainTools.

Stay safe.
Posted by at 2 comments:
Labels: , , , , , , , , ,
Subscribe to: Posts (Atom)