Input: For example, some samples exposed these filenames: fdisk32.sys, A0009547.sys, or Ultra3.sys.


Input: The filename of the dropper could be rknginst.exe or fdiskmon.exe.


Input: Once executed, the driver first makes sure it is registered under a pre-defined name, such as Ultra3.


Input: Other samples may have a different registration name, such as ~ROOT.


Input: The registration is ensured with creation of the following registry entries: The driver then flags the following events with the notification purposes: The rootkit then places a number of the hooks.

The registration

creation of the following registry entries

The driver

the following events

the notification purposes

The rootkit

a number of the hooks

is ensured

flags

places

with

with


Input: The first API it hooks is IoCreateDevice ().

it

IoCreateDevice ()

hooks


Input: The installed hook handler calls the original API and then checks if the name of the device is netbt or afd.

The installed hook handler

the original API

if the name of the device is netbt or afd

calls

checks


Input: If so, it will install a TDI filter driver.

it

a TDI filter driver

install


Input: If the device name is Null, Beep, tcpip or Nsiproxy, it will activate itself by enabling its hooks designed to hide the presence of Snake on a system, set up its access control lists and the messaging system.

its hooks

the presence of Snake on a system

hide


Input: In order to hide its components, the driver hooks the following APIs: For example, the hook handlers of the registry-related APIs will block access to the registry entries that contain the name of the driver.

hide

hooks

block

its components

the driver

the following APIs

the hook handlers of the registry-related APIs

access to the registry entries that contain the name of the driver


Input: In one example, the rootkit blocks access to registry entries that contain the strings'' Ultra3'' and'' ~ROOT''.

the rootkit

access to registry entries that contain the strings'' Ultra3'' and'' ~ROOT''

blocks


Input: The ZwReadFile () hook handler will block access to the home directory where the rootkit keeps its file.

The ZwReadFile () hook handler

access to the home directory where the rootkit keeps its file

block


Input: In one of the analysed kernel-centric Snake samples the home directory was hard-coded as% windows%\$NtUninstallQ817473 $, so it blocked file read access from that directory.

it

file read access from that directory

blocked


Input: The ZwClose () hook handler is used to inject the DLL module into the userland processes.

The ZwClose () hook handler

the DLL module

the userland processes

inject

into


Input: The hook handler for ZwTerminateProcess () checks if the process being shut down is svchost.exe.

The hook handler for ZwTerminateProcess ()

if the process being shut down is svchost.exe

checks


Input: If so, it considers it to be a system shutdown, so it unloads its usermode DLL and deactivates its own network drivers, just like it does when its ZwShutdownSystem () hook handler gets invoked.

it

its usermode DLL

its own network drivers

unloads

deactivates


Input: The ObOpenObjectByName () hook is designed to hide the presence of its virtual partitions (described later).

The ObOpenObjectByName () hook

the presence of its virtual partitions

hide


Input: To encrypt data stored on its virtual partitions, the driver sets a hook for another API: To re-infect the usermode process svchost.exe and to re-enable its network drivers, the rootkit hooks these APIs: Snake then proceeds to the task of deep packet inspection and modification.

encrypt

sets

re-infect

re-enable

hooks

data stored on its virtual partitions

the driver

a hook for another API

the usermode process svchost.exe

its network drivers

the rootkit

these APIs


Input: In order to accomplish it, it registers a callout driver for Windows Filtering Platform (WFP), an architecture first introduced with Windows Vista and nowadays normally used by antivirus and/or intrusion detection systems to inspect/block malicious traffic.

it

a callout driver for Windows Filtering Platform (WFP)

registers


Input: Snake sets filters at the layers FWPMLAYERSTREAMV4 and FWPMLAYERALEFLOWESTABLISHEDV4 in the TCP/ IP stack, so that its callout driver is notified whenever a TCP connection is established by a browser.

its callout driver

a TCP connection is established by a browser

is notified

whenever


Input: When that happens, the rootkit triggers an event named \BaseNamedObjects\wininetactivate.

the rootkit

an event named \BaseNamedObjects\wininetactivate

triggers


Input: When the data arrives, it is intercepted with the FwpsCopyStreamDataToBuffer0 () API, and then scanned for the presence of the hidden commands from C & C.

When

with

for

the data arrives

it

the FwpsCopyStreamDataToBuffer0 () API

the presence of the hidden commands from C & C

is intercepted

scanned


Input: The driver inspects bidirectional network data on a per stream basis, as it's located right on the stream data path.

The driver

bidirectional network data

a per stream basis

inspects

on


Input: An ability to manipulate data streams is provided with the packet injection logic below, allowing Snake to covertly insert traffic destined to its C & C servers: In order to qualify as a browser, the usermode process must have any of the following names: In addition to WFP, Snake also hooks the Transport Driver Interface (TDI) network routines by setting itself up as a TDI filter driver.

manipulate

insert

hooks

data streams

Snake

traffic destined to its C & C servers

Snake

the Transport Driver Interface (TDI) network routines

setting itself up as a TDI filter driver

by


Input: TDI is considered deprecated and will be removed in future versions of Microsoft Windows, but it's still supported on Windows 7.


Input: Being registered as a TDI driver on the device stack, Snake hooks TCP calls.

registered

hooks

as

on

a TDI driver

the device stack

Snake

TCP calls


Input: This way it intercepts all requests along with their parameters via IRP (IO request package) hooks.

it

all requests along with their parameters

IRP (IO request package) hooks

intercepts

via


Input: By'sniffing' all the requests, it can now inspect the traffic, looking for and then parsing GET/POST HTTP requests and also SMTP communications, in order to distinguish commands addressed to itself.

it

the traffic

GET/POST HTTP requests and also SMTP communications

commands addressed to itself

inspect

looking for and then parsing

distinguish


Input: If the rootkit detects that the OS version is pre-Vista (e.g. Windows XP) or Windows Server 2008 (e.g. Windows Server 2003), it will invoke FwpsStreamInjectAsync0 () API in order to generate outbound requests.

the rootkit

the OS version is pre-Vista (e.g. Windows XP) or Windows Server 2008 (e.g. Windows Server 2003)

it

FwpsStreamInjectAsync0 () API

outbound requests

detects

invoke

generate

that


Input: Whenever the client establishes connections, the TDI driver will also'pulse' the \BaseNamedObjects\wininetactivate event, just like the WPF driver's component of it, in order to notify the userland service about the event.

Whenever

the client establishes connections

the TDI driver

the \BaseNamedObjects\wininetactivate event

'pulse'


Input: The data that the driver intercepts, along with the important notifications, is passed to the userland DLL to be processed.

The data

the driver

intercepts


Input: If the data contains commands from C & C, the DLL module is expected to execute them and report results back to the driver to be delivered back to C & C.

If

back to

the data contains commands from C & C

the DLL module

them

the driver

C & C

execute

be delivered


Input: For NDIS versions 5.X, Snake rootkit contains code that installs NDIS filter intermediate driver.

code

NDIS filter intermediate driver

installs


Input: This driver is set up above a miniport driver (a driver that communicates with the physical device) and below a protocol driver (a driver that implements a protocol, e.g.

This driver

a miniport driver

a protocol driver

is set up

above

below


Input: TCP/IP).


Input: The driver is registered with NdisIMRegisterLayeredMiniport () API.

The driver

NdisIMRegisterLayeredMiniport () API

is registered

with


Input: After that, the drivers hooks the following exports within ndis.sys: The rootkit contains code that installs NDIS filter driver for NDIS 6.0 and above: NDIS filter driver configuration is stored in the registry entry: The driver is registered with NdisFRegisterFilterDriver () API.

the drivers

the following exports

ndis.sys

code

NDIS filter driver for NDIS 6.0 and above

NDIS filter driver configuration

the registry entry

The driver

NdisFRegisterFilterDriver () API

hooks

installs

is stored

is registered

within

in

with


Input: After that, the drivers hooks the following exports within ndis.sys (for NDIS 6.0): Another set of exports it attempts to hook in ndis.sys (for NDIS 6.0) is: With the hooks installed, whenever the network adapter driver attempts to register to NDIS, or whenever there is an attempt to install NDIS intermediate driver or NDIS filter driver, the hook handlers will register Snake's own MiniportXxx functions with the NDIS library.

the drivers

the following exports

ndis.sys (for NDIS 6.0)

Another set of exports

it

ndis.sys (for NDIS 6.0)

the hooks

the hook handlers

Snake's own MiniportXxx functions

the NDIS library

hooks

hook

installed

register

within

in

with


Input: With its own miniport handler functions, it can send/receive data by using a private TCP/IP stack, bypassing all firewall hooks, and making its open ports invisible to scanners.

it

data

using a private TCP/IP stack

all firewall hooks

its open ports

invisible to scanners

send

receive

bypassing

making

by


Input: The Snake rootkit registers itself as Network Driver Interface Specification (NDIS) protocol driver.

The Snake rootkit

itself

Network Driver Interface Specification (NDIS) protocol driver

registers

as


Input: Whenever the underlying miniport driver receives data from the network, it calls NDIS by invoking a data receive indication function NdisMIndicateReceiveNetBufferLists ().

the underlying miniport driver

data

the network

it

a data receive indication function NdisMIndicateReceiveNetBufferLists ()

receives

invoking

from


Input: When that happens, NDIS invokes Snake's hook function (ProtocolReceiveNetBufferLists) to process the received data.

NDIS

Snake's hook function

invokes


Input: To send the data back, the protocol driver defines the data in a list of NETBUFFERLIST structures, and then passes them to NDIS by calling NdisSendNetBufferLists ().

send

defines

calling

the data

the protocol driver

the data

a list of NETBUFFERLIST structures

NdisSendNetBufferLists ()

in


Input: NDIS, in turn, calls the miniport driver's MiniportSendNetBufferLists () function to forward the data to an underlying miniport driver.

NDIS

the miniport driver's MiniportSendNetBufferLists () function

calls


Input: Being able to fully manipulate traffic at 3 different levels (NDIS protocol driver, TDI Driver, and WPF callout driver), Snake is able to'inject' the traffic into existing communications to reach out to external components, and at the same time parse all incoming traffic to detect traffic addressed to itself: As the driver intercepts all connections (e.g.

manipulate

'inject'

reach out

parse

detect

intercepts

traffic

3 different levels (NDIS protocol driver, TDI Driver, and WPF callout driver)

Snake

the traffic

existing communications

external components

all incoming traffic

traffic addressed to itself

the driver

all connections

at

into

to


Input: on TDIRECEIVE TDI event or ClientEventReceive () event notification triggered through its TDI Filter Driver), it parses all incoming HTTP and SMTP traffic to see if it can be authenticated as Snake traffic.

it

all incoming HTTP and SMTP traffic

it

Snake traffic

parses

be authenticated

as


Input: The authentication is implemented by decrypting the data and making sure it starts with the markers 0xDEADBEAF and 0xC001BA5E (which appear to derive from'DEAD BEEF' and'COOL BASE').

The authentication

the data

it starts with the markers 0xDEADBEAF and 0xC001BA5E (which appear to derive from'DEAD BEEF' and'COOL BASE')

is implemented

decrypting

making sure


Input: Here are specific steps: By observing such behaviour, one might wonder why the driver is expecting HTTP or SMTP clients? Why does it act like HTTP/SMTP server processing client traffic, and serving back normal responses as per the protocol? For example, in HTTP the driver will respond with messages like'' HTTP/1.1 200 OK'' or'' HTTP/1.1 500 Server Error''.

the driver

messages like'' HTTP/1.1 200 OK'' or'' HTTP/1.1 500 Server Error''

respond

with


Input: For SMTP traffic, it communicates back normal SMTP server responses, such as'' 250 Sender OK'','' 503 Bad sequence of commands'', etc.


Input: The reason behind such behaviour is that the driver is acting in this mode like a proxy, routing requests from other infected hosts to a remote C & C server.

the driver

this mode

a proxy

requests from other infected hosts

a remote C & C server

is acting

routing

in

like

to


Input: Another opportunity this mode unlocks is a peer-to-peer network mode with no centralised C & C.


Input: The infected hosts are capable of transferring the following peer-2-peer commands defining fragment size, reliability parameters, new peer information, peer impersonation flags, etc.


Input: : Once the incoming data is authenticated and decrypted, the driver passes it to the DLL by using memory pipes.

the incoming data

is authenticated and decrypted


Input: For example, on HTTP traffic arrival it may send traffic data into a memory pipe \Device\NamedPipe\isapihttp, and then, send a received peer-2-peer command message writepeernfo= [IPADDRESS: PORT] 0fragnoscrambling=Y0 into another memory pipe called \Device\NamedPipe\isapidg.

it

traffic data

a memory pipe \Device\NamedPipe\isapihttp

a received peer-2-peer command message writepeernfo= [IPADDRESS: PORT] 0fragnoscrambling=Y0

another memory pipe called \Device\NamedPipe\isapidg

send

send

into

into


Input: In order to log its activity, the driver writes log data into the pipe \Device\NamedPipe\isapilog, so that the DLL could log the data into the log files.

log

writes

log

its activity

the driver

log data

the pipe \Device\NamedPipe\isapilog

the DLL

the data

the log files

into

into


Input: Full list of the named pipes used for communications is provided below: Messages submitted into the pipes are wrapped into the structures.

the named pipes

communications

Messages

the pipes

used

submitted

for

into


Input: The structures appear to contain headers to allow the pipe server, that runs within an infected userland module, to identify the messages first and then unwrap the structures accordingly.

the pipe server

the messages

identify


Input: For example, the message headers could be: Once received from the pipes and unwrapped/decoded, the data is then handled by the usermode DLL as per the data intention-whether it's a traffic sniffing task, a peer-2-peer client logic, a logging task, or a task of saving received files into the virtual volumes.

received

from

the pipes

the data


Input: The driver creates virtual file volumes for encrypted storage of its files and configuration data: The volumes are mounted from the virtual file systems RawDisk1 and RawDisk2.

The driver

virtual file volumes

encrypted storage of its files and configuration data

The volumes

the virtual file systems RawDisk1 and RawDisk2

creates

are mounted

for

from


Input: The first partition is created with the following steps: The hook installed by the rootkit on IofCallDriver () API provides on-the-fly data encryption/decryption whenever that data is written to or read from the volume.

The first partition

the following steps

The hook

the rootkit

IofCallDriver () API

on-the-fly data encryption/decryption

that data

the volume

is created

installed

provides

is written

read

with

on

to

from


Input: The encryption algorithm is based on CAST-128, with the hard-coded key stored in the rootkit body.

The encryption algorithm

the hard-coded key stored in the rootkit body

is based

on

with


Input: As a result, whenever the data is saved into the volume Hd1, it will be scrambled on-the-fly, and reflected in the persistent storage file hotfix.dat, which is physically located within the rootkit's'home' directory: Analysis of the hotfix.dat file contents reveals it's a fully encrypted file with flat entropy.

the data

the volume Hd1

it

on-the-fly

in the persistent storage file hotfix.dat

it

a fully encrypted file with flat entropy

is saved

be scrambled

reflected

's

into


Input: Thus, it is not possible to reveal the contents of the Snake's volume by accessing the contents of this file (unless the encryption is broken, that is).


Input: Enlisting the contents of the created volume is possible, along with creating files on it: However, as soon as IofCallDriver () hook is removed, the same'dir' command will fail, as with no hook the rootkit can not decrypt the scrambled volume: The second volume \\.\Hd2 is not mapped to a file, so when a computer is switched off, its contents is lost.


Input: Thus, it could be used as a temporary or a cache storage.


Input: The data stored in \\.\Hd2 is encrypted the same way the first volume's data.

The data stored in \\.\Hd2

the same way the first volume's data

is encrypted


Input: Both volumes appear to be set up as FAT volumes.

Both volumes

FAT volumes

be set up

as


Input: An attempt to read the data from these volumes with the code below: This will produce the following results: For \\.\Hd1: For \\.\Hd2: The ability to keep its data on TrueCrypt-like volumes provides Snake with a powerful ability to exchange data with the usermode DLL, as these volumes are accessible both from usermode and kernel mode.

keep

its data

TrueCrypt-like volumes

Snake

on


Input: Static analysis of the code reveals that the Snake driver uses virtual volumes to store its data and additional files on it.

the Snake driver

virtual volumes

its data and additional files

it

uses

store

on


Input: For example, it stores its message queue in a file called: The message queue indicates an asynchronous communication model between kernel mode driver and a usermode DLL, e.g.

it

its message queue

a file called

stores

in


Input: to pass commands, configuration parameters, binary images of additional Snake components.


Input: Other files that may also be found on the virtual volume are: klog, conlog, dump, rknginst.exe, where rknginst.exe could be the name of the original dropper, and other log files could potentially contain executed command outputs, intercepted keystrokes, and other output logs.

other log files

executed command outputs

keystrokes

contain

intercepted


Input: The 64-bit version of Snake must deal with a number of additional security protections implemented in 64-bit editions of Microsoft Windows, the most significant of which are kernel driver signature validation and Kernel Patch Protection (more commonly known as PatchGuard).


Input: PatchGuard is a feature of 64-bit Windows which aims to prevent modification of the Windows kernel, something that is often performed by malware attempting to hide itself on an infected system.


Input: Although PatchGuard is successful at preventing kernel patching once initialised, several published bypass approaches exist,.


Input: The technique used by Snake appears to be similar to these approaches.


Input: The driver signing policy enforced by all 64-bit versions of Windows from Vista onwards requires all kernel-mode drivers to be signed with a valid digital signature.


Input: The Snake dropper contains both 32-bit and 64-bit unsigned drivers, and it can successfully load its unsigned 64-bit driver on a 64-bit version of Windows XP–as driver signing is not enforced it does not have to resort to any tricks under this OS version.

it

its unsigned 64-bit driver

a 64-bit version of Windows XP

load

on


Input: In this case, in order to ensure the driver is loaded automatically at startup, the dropper can install the 64-bit driver on 64-bit Windows XP in the same way it installs a 32-bit driver on a 32-bit version of Windows XP.

ensure

install

installs

the driver is loaded automatically at startup

the dropper

the 64-bit driver

64-bit Windows XP

it

a 32-bit driver

a 32-bit version of Windows XP

on

on


Input: On 64-bit versions of Windows Vista and above it behaves differently.

On

64-bit versions of Windows Vista and above

it

differently

behaves


Input: Firstly, the 64-bit unsigned driver file is created as usual: However, the driver is not registered; what is registered instead is the dropper itself.

the 64-bit unsigned driver file

the dropper itself

is created

is registered


Input: To do that, the dropper first copies itself as: The dropper then registers itself as a service to ensure it starts every time Windows is booted, by creating the values: Now comes the most interesting part: does the dropper manage to load its 64-bit unsigned driver under 64-bit versions of Windows Vista and later versions, such as 64-bit Windows 7/8? The answer: Yes, it does.

the dropper

itself

The dropper

itself

a service

it starts every time Windows is booted

copies

registers

ensure

as


Input: Does it resort to using bootkit technology, which has been used in the past to bypass protections to load unsigned 64-bit drivers? The answer: No.


Input: Bootkits must overwrite the Master Boot Record (MBR) and antivirus products are well trained to catch that kind of bad behavior.


Input: The masterminds behind Snake rootkit seem to be well aware of this so what they resorted to instead is leveraging a vulnerability in a well-known virtualization product called VirtualBox, a product made by Oracle which is widely used by researchers to analyse malware.


Input: VirtualBox driver version 1.6.2 was released in June 2, 2008.


Input: Two months later, in August 2008, security researchers reported that its main driver component, which is signed under the entity'' innotek Gmbh'', contained a privilege escalation vulnerability.


Input: In a nutshell, the VirtualBox software installs a driver called VBoxDrv.


Input: The driver is controlled with the Input/Ouput Control Codes (32-bit values called IOCTL) passed along DeviceIoControl () API.


Input: One of the documented transfer methods that the system uses to pass data between the caller of DeviceIoControl () API and the driver itself is called METHODNEITHER.


Input: As per MSDN documentation, METHODNEITHER is a special transfer type when Input/Output Request Packet (IRP) supplies the user-mode virtual addresses of the input and output buffers, without validating or mapping them.


Input: It is the responsibility of the driver to validate the addresses sent from user mode in order to make sure those addresses are valid usermode addresses.


Input: The source code of the vulnerable driver (shown below) demonstrates how the integer value of the rc variable is first derived from the input parameters pDevObj (device object) and pIrp (request packet).


Input: Next, that integer value is written into the UserBuffer-an arbitrary address, pointed by the input parameter pIrp (request packet).


Input: As there are no validations made for the UserBuffer an attacker can craft such input parameters that will define address within kernel memory to patch and the data to patch it with: Now that the vulnerable driver can be used as a weapon to patch kernel memory, all the malware needs to do is to patch the content of the variable nt! gCiEnabled, a boolean variable'' Code Integrity Enabled'' that marks whether the system was booted in WinPE mode.

an attacker

such input parameters that will define address within kernel memory to patch and the data to patch it

the vulnerable driver

a weapon to patch kernel memory

craft

be used

as


Input: When running in WinPE mode there is no Code Integrity control, therefore by enabling this mode by patching only one bit, Code Integrity verification is disabled so that the unsigned 64-bit driver can be loaded.

Code Integrity verification

the unsigned 64-bit driver

is disabled

be loaded


Input: This variable is used within the function SepInitializeCodeIntegrity (), implemented within CI.dll's function CiInitialize () and imported by the NT core (ntoskrnl.exe).


Input: In order to find the variable in kernel memory, the Snake dropper loads a copy of the NT core image (ntoskrnl.exe), locates the import of CI.dll's function CiInitialize (), and then SepInitializeCodeIntegrity () within it.

the Snake dropper

a copy of the NT core image (ntoskrnl.exe)

the import of CI.dll's function CiInitialize ()

SepInitializeCodeIntegrity () within it

loads

locates


Input: Then it parses the function's code to locate the offset of the variable.

it

the function's code

locate the offset of the variable

parses

to


Input: Once located, the content of the variable nt! gCiEnabled is patched in kernel memory and the 64-bit unsigned driver is loaded.

the 64-bit unsigned driver

is loaded


Input: This explains why Snake dropper registers itself as a service to start each time Windows starts: in order to install the vulnerable VBox driver first, then pass it a malformed structure to disable Code Integrity control with a DeviceIoControl () API call, and finally, load the driver.

Snake dropper

itself

a service

each time Windows starts

the vulnerable VBox driver

Code Integrity control

a DeviceIoControl () API call

the driver

registers

start

install

disable

load

as

with


Input: In order to be able to perform the steps above, the dropper must first obtain Administrator privileges.

the dropper

Administrator privileges

obtain


Input: It attempts to do this by running MS09-025 and MS10-015 exploits on the target system.

It

MS09-025 and MS10-015 exploits

the target system

running

on


Input: These exploits are bundled within the dropper in its resource section as executable files.


Input: Other resources embedded within the dropper are the 32-bit and 64-bit builds of its driver, a tool for creating NTFS file systems, and the initial message queue file which is written into the virtual volume.

a tool

NTFS file systems

the initial message queue file

the virtual volume

creating

is written

into


Input: The message queue file contains configuration data and the libraries that will be injected into usermode processes.

libraries

usermode processes

be injected

into


Input: The usermode DLLs injected by the kernel-mode driver into the userland system process (e.g.

The usermode DLLs

the kernel-mode driver

the userland system process

injected

into


Input: explorer.exe) are: The rkctlWin32.dll/rkctlx64.dll module uses the following hard-coded named pipe for communications: The remote commands it receives appear to be designed to control other components of Snake: The injsnakeWin32.dll/injsnakex64.dll module exports 61 functions.

The rkctlWin32.dll/rkctlx64.dll module

the following hard-coded named pipe

communications

The remote commands

it

other components of Snake

uses

receives

control

for


Input: It is designed to perform the high-level tasks such as: When the DLL activates, it reads configuration parameters from the configuration queue, that the driver creates on a virtual volume.

the DLL

it

configuration parameters

the configuration queue

the driver

a virtual volume

activates

reads

creates

from

on


Input: One of the parameters defines the pipe name (s) that the DLL should use for its communications.

the pipe name (s)

the DLL

its communications

use

for


Input: The remote commands received by this Snake DLL module are designed to set up various communication parameters: To post the data, the DLL can use the following User-Agent string'' Mozilla/4.0 (compatible; MSIE 6.0)''.

The remote commands

this Snake DLL module

the data

the DLL

received

post


Input: It may rely on the following Internet Media types (MIME types) for data exfiltration: Request type it uses can either be POST of GET, and C & C server resource name is /default.asp.

It

the following Internet Media types (MIME types)

data exfiltration

Request type

it

POST

GET

C & C server resource name

/default.asp

rely on

uses

be

is

for


Input: One of the Snake components that could have been downloaded from a remote C & C server, was identified as a network reconnaissance tool.

One of the Snake components

a remote C & C server

a network reconnaissance tool

been downloaded

was identified

from

as


Input: When run as a command line tool, with its logic defined with the command line switches, this tool enumerates other network hosts and detects what Windows RPC services are enabled at the endpoints.

When

run as a command line tool

this tool

other network hosts

what Windows RPC services are enabled at the endpoints

enumerates

detects


Input: It carries a list of interface identifiers associated with the named pipes.

a list of interface identifiers

the named pipes

associated

with


Input: It then uses these identifiers to write a message to and read a message from the associated named pipes.

It

a message

a message

the associated named pipes

write

read

to

from


Input: By knowing what RPC services are running, it can successfully fingerprint all network hosts by mimicking the Metasploit's logic of OS fingerprinting via SMB.

it

all network hosts

mimicking the Metasploit's logic of OS fingerprinting via SMB

fingerprint

by


Input: The fingerprinting allows it to reveal the following characteristics for each host found in the network: The data it retrieves is encrypted and saved into a configuration file% system% \vtmon.bin.

it

the following characteristics

each host found in the network

The data

a configuration file% system% \vtmon.bin

reveal

is encrypted

saved

for

into


Input: This file is then further encrypted with an NTL-based (Number Theory Library) algorithm and is uploaded by the usermode-centric Snake rootkit to the C & C server, along with other configuration files, such as mtmon.sdb, mtmon32.sdb, gstatsnd.bin, gstat.bin, gstat32.bin, and other log files found in the% windows%\$NtUninstallQ [random] $directory.

This file

an NTL-based (Number Theory Library) algorithm

the usermode-centric Snake rootkit

the C & C server

other configuration files, such as mtmon.sdb, mtmon32.sdb, gstatsnd.bin, gstat.bin, gstat32.bin, and other log files found in the% windows%\$NtUninstallQ [random] $directory

is then further encrypted

is uploaded

with

by

to

along with


Input: By using this function the remote attacker can identify any potentially exploitable hosts located in the same network as the victim.

the remote attacker

any potentially exploitable hosts located in the same network as the victim

identify


Input: The attacker may then craft an exploit against those hosts, possibly by using the Metasploit framework, and then deliver the generated shellcode back to the reconnaissance tool to be applied against the identified hosts by running the tool with the'expos' switch.

The attacker

the generated shellcode

the reconnaissance tool

be applied against the identified hosts by running the tool with the'expos' switch

deliver

back to

to


Input: If the tool successfully delivers the payload and exploits the remote host (s), it will replicate the infection across the network, taking control over new hosts, thus repeating the infection cycle all over again and spreading the infection further.

the tool

the payload

the remote host (s)

it

the infection

the network

new hosts

the infection cycle

all over again

the infection

further

delivers

exploits

replicate

taking control

repeating

spreading

across

over


Input: Unlike traditional worm techniques, this process is rather manual, but its danger is in the fact that the attacker can flexibly craft new attack methods, adjusting them to the hosts present within the network, thus preying on the weakest (least updated, most vulnerable) victims along its path.

the attacker

them

the hosts present within the network

adjusting

to


Input: As seen from the check-in logs found within one of the recent samples, the time span covers almost 6 years from January 2007 till December 2012, which is aligned with the first reports of Agent.BTZ.


Input: It's worth noting that Agent.BTZ used the same XOR key for its logs as the most recent variants: Log files created by the latest samples of Snake, compiled in 2013 and 2014, were successfully decrypted with the same XOR key.

Agent.BTZ

the same XOR key

its logs

Log files

the latest samples of Snake

used

created

for


Input: Other similarities include the usage of the virtual partition \\.\Vd1, the temporary file named FA.tmp, usage of files named mswmpdat.tlb, wmcache.nld, winview.ocx.


Input: The cyber-espionage operation behind the Snake rootkit is well established, a sample comiled in January 2006 indicates that the activity would have begun in at least 2005.


Input: It is also sophisticated, using complex techniques for evading host defences and providing the attackers covert communication channels.

It

complex techniques

evading host defences

the attackers

covert communication channels

using

providing

for


Input: Toolmarks left behind by the authors'vlad' &'gilg', leave tantalizing clues as to the personas behind this.


Input: From a technical perspective, Snake demonstrates two very different approaches to the task of building a cyber-espionage toolkit.


Input: One approach is to delegate the network communication engine to usermode code, backed up by a usermode rootkit.

delegate

the network communication engine

usermode code

to


Input: Another approach is to carry out all of the communications from the kernel-mode driver, which is a very challenging task by itself.

carry out

all of the communications

the kernel-mode driver

from


Input: The complexity of the usermode-centric approach is on par with Rustock rootkit-it uses similar techniques.


Input: It's an old well-polished technology that evolved over the years and demonstrated its resilience and survivability under the stress of security counter- measures.


Input: The complexity of the kernel-centric architecture of Snake is quite unique.


Input: This architecture is designed to grant Snake as much flexibility as possible.


Input: When most of the infected hosts are cut off from the outside world, it only needs one host to be connected online.

When

most of the infected hosts are cut off from the outside world

it

one host to be connected online

only needs


Input: The traffic is then routed through that host to make external control and data exfiltration still possible.

The traffic

that host

external control

data exfiltration

still possible

is then routed

make

through


Input: The presence of the reconnaissance tool in the Snake operators' framework suggests the existence of an arsenal of infiltration tools, designed to compromise a system, then find a way to replicate into other hosts, infect them, and spread the infection even further.

The presence of the reconnaissance tool in the Snake operators' framework

the existence of an arsenal of infiltration tools

a system

other hosts

them

the infection

even further

suggests

compromise

replicate

infect

spread

into


Input: As demonstrated, the backdoor commands allow Snake to provide remote attackers with full remote access to the compromised system.

the backdoor commands

Snake

remote attackers

full remote access to the compromised system

allow

provide

with


Input: Its ability to hibernate, staying fully inactive for a number of days, makes its detection during that time very difficult.

hibernate

staying

makes

fully inactive

a number of days

its detection during that time

very difficult

for


Input: The analysed code suggests that even file system and registry operations can be delegated by an infected module to another module in order to stay unnoticed by behaviour analysis engines of the antivirus products, and to overcome account restrictions of the browser processes so that the injected module could still write into files and into the sensitive registry hives.

stay

overcome

write

unnoticed

behaviour analysis engines of the antivirus products

account restrictions of the browser processes

the injected module

files

the sensitive registry hives

by

into

into


Input: The logs and dumps it creates on the hidden virtual volumes contributes to its stealthiness too.

The logs and dumps

it

the hidden virtual volumes

creates

on


Input: A great deal of attention has also been given to keep its network communications as quiet as possible.

keep

its network communications

as quiet as possible


Input: Its ability to generate malicious traffic whenever the user goes online and start loading the web pages allows it to'blend in' with the legitimate communications.

generate

'blend in'

malicious traffic

the user goes online and start loading the web pages

it

the legitimate communications

whenever

with


Input: We expect much more will be uncovered by researchers in the coming weeks as the capabilities of this operation are further fleshed out.


Input: However, as we implied in the opening section, we view this threat to be a permanent feature of the landscape.


Input: Whether they dismantle this toolset and start from scratch, or continue using tools which have been exposed, remains to be seen.


Input: For their targets though the considerable challenge of keeping secrets safe on sensitive networks will certainly continue for years to come.


Input: Recently, research was published identifying a Tor exit node, located in Russia, that was consistently and maliciously modifying any uncompressed Windows executables downloaded through it.

a Tor exit node

any uncompressed Windows executables downloaded through it

was consistently and maliciously modifying


Input: Naturally this piqued our interest, so we decided to peer down the rabbit hole.


Input: Suffice to say, the hole was a lot deeper than we expected! In fact, it went all the way back to the notorious Russian APT family MiniDuke, known to have been used in targeted attacks against NATO and European government agencies.


Input: The malware used in this case is, however, not a version of MiniDuke.


Input: It is instead a separate, distinct family of malware that we have since taken to calling OnionDuke.


Input: But lets start from the beginning.


Input: When a user attempts to download an executable via the malicious Tor exit node, what they actually receive is an executable'' wrapper'' that embeds both the original executable and a second, malicious executable.


Input: By using a separate wrapper, the malicious actors are able to bypass any integrity checks the original binary might contain.

By

using a separate wrapper

the malicious actors

any integrity checks the original binary might contain

bypass


Input: Upon execution, the wrapper will proceed to write to disk and execute the original executable, thereby tricking the user into believing that everything went fine.


Input: However, the wrapper will also write to disk and execute the second executable.


Input: In all the cases we have observed, this malicious executable has been the same binary (SHA1: a75995f94854dea8799650a2f4a97980b71199d2, detected as Trojan-Dropper: W32/OnionDuke.A).


Input: This executable is a dropper containing a PE resource that pretends to be an embedded GIF image file.

This executable

a dropper

a PE resource

be an embedded GIF image file

is

pretends

to


Input: In reality, the resource is actually an encrypted dynamically linked library (DLL) file.


Input: The dropper will proceed to decrypt this DLL, write it to disk and execute it.

The dropper

decrypt this DLL, write it to disk and execute it

proceed

to


Input: Once executed, the DLL file (SHA1: b491c14d8cfb48636f6095b7b16555e9a575d57f, detected as Backdoor: W32/OnionDuke.B) will decrypt an embedded configuration (shown below) and attempt to connect to hardcoded C & C URLs specified in the configuration data.

the DLL file

hardcoded C & C URLs specified in the configuration data

connect

to


Input: From these C & Cs the malware may receive instructions to download and execute additional malicious components.

the malware

instructions

additional malicious components

receive

download and execute


Input: It should be noted, that we believe all five domains contacted by the malware are innocent websites compromised by the malware operators, not dedicated malicious servers.


Input: Through our research, we have also been able to identify multiple other components of the OnionDuke malware family.


Input: We have, for instance, observed components dedicated to stealing login credentials from the victim machine and components dedicated to gathering further information on the compromised system like the presence of antivirus software or a firewall.

components

login credentials

the victim machine

components

further information on the compromised system like the presence of antivirus software or a firewall

stealing

gathering

from


Input: Some of these components have been observed being downloaded and executed by the original backdoor process but for other components, we have yet to identify the infection vector.

Some of these components

the original backdoor process

being downloaded and executed


Input: Most of these components don't embed their own C & C information but rather communicate with their controllers through the original backdoor process.

Most of these components

their controllers

the original backdoor process

communicate

with

through


Input: One component, however, is an interesting exception.


Input: This DLL file (SHA1 d433f281cf56015941a1c2cb87066ca62ea1db37, detected as Backdoor: W32/OnionDuke.A) contains among its configuration data a different hardcoded C & C domain, overpict.com and also evidence suggesting that this component may abuse Twitter as an additional C & C channel.

This DLL file

its configuration data

a different hardcoded C & C domain, overpict.com

this component

Twitter

an additional C & C channel

contains

abuse

among

as


Input: What makes the overpict.com domain interesting, is it was originally registered in 2011 with the alias of'' John Kasai''.


Input: Within a two-week window,'' John Kasai'' also registered the following domains: airtravelabroad.com, beijingnewsblog.net, grouptumbler.com, leveldelta.com, nasdaqblog.net, natureinhome.com, nestedmail.com, nostressjob.com, nytunion.com, oilnewsblog.com, sixsquare.net and ustradecomp.com.


Input: This is significant because the domains leveldelta.com and grouptumbler.com have previously been identified as C & C domains used by MiniDuke.

the domains leveldelta.com and grouptumbler.com

C & C domains used by MiniDuke

been identified

as


Input: This strongly suggests that although OnionDuke and MiniDuke are two separate families of malware, the actors behind them are connected through the use of shared infrastructure.


Input: Based on compilation timestamps and discovery dates of samples we have observed, we believe the OnionDuke operators have been infecting downloaded executables at least since the end of October 2013.

the OnionDuke operators

downloaded executables

the end of October 2013

been infecting

since


Input: We also have evidence suggesting that, at least since February of 2014, OnionDuke has not only been spread by modifying downloaded executables but also by infecting executables in .torrent files containing pirated software.

OnionDuke

modifying downloaded executables

infecting executables in .torrent files containing pirated software

been spread

by

by


Input: However, it would seem that the OnionDuke family is much older, both based on older compilation timestamps and also on the fact that some of the embedded configuration data make reference to an apparent version number of 4 suggesting that at least three earlier versions of the family exist.


Input: During our research, we have also uncovered strong evidence suggesting that OnionDuke has been used in targeted attacks against European government agencies, although we have so far been unable to identify the infection vector (s).


Input: Interestingly, this would suggest two very different targeting strategies.


Input: On one hand is the'' shooting a fly with a cannon'' mass-infection strategy through modified binaries and, on the other, the more surgical targeting traditionally associated with APT operations.


Input: In any case, although much is still shrouded in mystery and speculation, one thing is certain.


Input: While using Tor may help you stay anonymous, it does at the same time paint a huge target on your back.


Input: It's never a good idea to download binaries via Tor (or anything else) without encryption.


Input: The problem with Tor is that you have no idea who is maintaining the exit node you are using and what their motives are.


Input: VPNs (such as our Freedome VPN) will encrypt your connection all the way through the Tor network, so the maintainers of Tor exit nodes will not see your traffic and can't tamper with it.


Input: Samples:


Input: On February 11, FireEye identified a zero-day exploit (CVE-2014-0322) being served up from the U.S. Veterans of Foreign Wars' website (vfw [.] org).

a zero-day exploit (CVE-2014-0322)

the U.S. Veterans of Foreign Wars' website (vfw [.] org)

being served up

from


Input: We believe the attack is a strategic Web compromise targeting American military personnel amid a paralyzing snowstorm at the U.S. Capitol in the days leading up to the Presidents Day holiday weekend.


Input: Based on infrastructure overlaps and tradecraft similarities, we believe the actors behind this campaign are associated with two previously identified campaigns (Operation DeputyDog and Operation Ephemeral Hydra).


Input: This blog post examines the vulnerability and associated attacks, which we have dubbed'' Operation SnowMan.


Input: '' After compromising the VFW website, the attackers added an iframe into the beginning of the website's HTML code that loads the attacker's page in the background.


Input: The attacker's HTML/JavaScript page runs a Flash object, which orchestrates the remainder of the exploit.


Input: The exploit includes calling back to the IE 10 vulnerability trigger, which is embedded in the JavaScript.


Input: Specifically, visitors to the VFW website were silently redirected through an iframe to the exploit at www. [REDACTED] .com/Data/img/img.html.

visitors to the VFW website

an iframe

the exploit at www. [REDACTED] .com/Data/img/img.html

were silently redirected

through

to


Input: The exploit targets IE 10 with Adobe Flash.


Input: It aborts exploitation if the user is browsing with a different version of IE or has installed Microsoft's Experience Mitigation Toolkit (EMET).

It

exploitation

the user is browsing with a different version of IE or has installed Microsoft's Experience Mitigation Toolkit (EMET)

aborts

if


Input: So installing EMET or updating to IE 11 prevents this exploit from functioning.


Input: The vulnerability is a previously unknown use-after-free bug in Microsoft Internet Explorer 10.


Input: The vulnerability allows the attacker to modify one byte of memory at an arbitrary address.

the attacker

one byte of memory

an arbitrary address

modify

at


Input: The attacker uses the vulnerability to do the following: The attacker uses the Microsoft.XMLDOM ActiveX control to load a one-line XML string containing a file path to the EMET DLL.

The attacker

the Microsoft.XMLDOM ActiveX control

load a one-line XML string containing a file path to the EMET DLL

uses

to


Input: Then the exploit code parses the error resulting from the XML load order to determine whether the load failed because the EMET DLL is not present.


Input: The exploit proceeds only if this check determines that the EMET DLL is not present.


Input: Because the vulnerability allows attackers to modify memory to an arbitrary address, the attacker can use it to bypass ASLR.

attackers

memory

an arbitrary address

the attacker

it

bypass ASLR

modify

use

to

to


Input: For example, the attacker corrupts a Flash Vector object and then accesses the corrupted object from within Flash to access memory.


Input: We have discussed this technique and other ASLR bypass approaches in our blog.


Input: One minor difference between the previous approaches and this attack is the heap spray address, which was changed to 0x1a1b2000 in this exploit.


Input: Once the attacker's code has full memory access through the corrupted Flash Vector object, the code searches through loaded libraries gadgets by machine code.

Once

through

by

the attacker's code has full memory access through the corrupted Flash Vector object

the code

loaded libraries gadgets

machine code

searches


Input: The attacker then overwrites the vftable pointer of a flash.Media.Sound () object in memory to point to the pivot and begin ROP.

The attacker

the vftable pointer of a flash.Media.Sound () object

memory

point to the pivot

ROP

overwrites

begin

in

to


Input: After successful exploitation, the code repairs the corrupted Flash Vector and flash.Media.Sound to continue execution.


Input: Subsequently, the malicious Flash code downloads a file containing the dropped malware payload.

the malicious Flash code

a file containing the dropped malware payload

downloads


Input: The beginning of the file is a JPG image; the end of the file (offset 36321) is the payload, encoded with an XOR key of 0×95.


Input: The attacker appends the payload to the shellcode before pivoting to code control.


Input: Then, when the shellcode is executed, the malware creates files'' sqlrenew.txt'' and'' stream.exe''.

when

the shellcode is executed

the malware

files'' sqlrenew.txt'' and'' stream.exe''

creates


Input: The tail of the image file is decoded, and written to these files.

The tail of the image file

these files

is decoded, and written

to


Input: '' sqlrenew.txt'' is then executed with the LoadLibraryA Windows API call.

'' sqlrenew.txt''

the LoadLibraryA Windows API call

is then executed

with


Input: As documented above, this exploit dropped an XOR (0×95) payload that executed a ZxShell backdoor (MD5: 8455bbb9a210ce603a1b646b0d951bce).

this exploit

an XOR (0×95) payload

a ZxShell backdoor (MD5: 8455bbb9a210ce603a1b646b0d951bce)

dropped

executed


Input: The compile date of the payload was 2014-02-11, and the last modified date of the exploit code was also 2014-02-11.


Input: This suggests that this instantiation of the exploit was very recent and was deployed for this specific strategic Web compromise of the Veterans of Foreign Wars website.


Input: A possible objective in the SnowMan attack is targeting military service members to steal military intelligence.


Input: In addition to retirees, active military personnel use the VFW website.


Input: It is probably no coincidence that Monday, Feb. 17, is a U.S. holiday, and much of the U.S. Capitol shut down Thursday amid a severe winter storm.


Input: The ZxShell backdoor is a widely used and publicly available tool used by multiple threat actors linked to cyber espionage operations.

The ZxShell backdoor

multiple threat actors linked to cyber espionage operations

used


Input: This particular variant called back to a command and control server located at newss [.] effers [.] com.

This particular variant

a command and control server located at newss [.] effers [.] com

called

back to


Input: This domain currently resolves to 118.99.60.142.


Input: The domain info [.


Input: ] flnet [.


Input: ] org also resolved to this IP address on 2014-02-12.


Input: The info [.


Input: ] flnet [.


Input: ] org domain overlaps with icybin [.


Input: ] flnet [.


Input: ] org and book [.


Input: ] flnet [.


Input: ] org via the previous resolutions to the following IP addresses: We previously observed Gh0stRat samples with the custom packet flag'' HTTPS'' calling back to book [.] flnet [.] org and icybin [.] flnet [.] org.

Gh0stRat samples with the custom packet flag'' HTTPS''

book [.] flnet [.] org and icybin [.] flnet [.] org

calling

back to


Input: The threat actor responsible for Operation DeputyDog also used the'' HTTPS'' version of the Gh0st.


Input: We also observed another'' HTTPS'' Gh0st variant connecting to a related command and control server at me [.] scieron [.] com.

another'' HTTPS'' Gh0st variant

a related command and control server at me [.] scieron [.] com

connecting

to


Input: The me [.


Input: ] scieron [.


Input: ] com domain previously resolved to 58.64.199.22.


Input: The book [.


Input: ] flnet [.


Input: ] org domain also resolved to another IP in the same subnet 58.64.199.0/24.


Input: Specifically, book [.


Input: ] flnet [.


Input: ] org previously resolved to 58.64.199.27.


Input: Others domain seen resolving to this same /24 subnet were dll [.


Input: ] freshdns [.


Input: ] org, ali [.


Input: ] blankchair [.


Input: ] com, and cht [.


Input: ] blankchair [.


Input: ] com.


Input: The domain dll [.


Input: ] freshdns [.


Input: ] org resolved to 58.64.199.25.


Input: Both ali [.


Input: ] blankchair [.


Input: ] com and cht [.


Input: ] blankchair [.


Input: ] com resolved to 58.64.199.22.


Input: A number of other related domains resolve to these IPs and other IPs also in this /24 subnet.


Input: For the purposes of this blog, we've chosen to focus on those domains and IP that relate to the previously discussed DeputyDog and Ephemeral Hydra campaigns.


Input: You may recall that dll [.] freshdns [.] org, ali [.] blankchair [.] com and cht [.] blankchair [.] com were all linked to both Operation DeputyDog and Operation Ephemeral Hydra.

dll [.] freshdns [.] org, ali [.] blankchair [.] com and cht [.] blankchair [.] com

both Operation DeputyDog and Operation Ephemeral Hydra

were all linked

to


Input: Figure 1 illustrates the infrastructure overlaps and connections we observed between the strategic Web compromise campaign leveraging the VFW's website, the DeputyDog, and the Ephemeral Hydra operations.


Input: Other tradecraft similarities between the actor (s) responsible for this campaign and the actor (s) responsible for the DeputyDog/Ephemeral Hydra campaigns include: We observed many similarities from the exploitation side as well.


Input: At a high level, this attack and the CVE- 2013-3163 attack both leveraged a Flash file that orchestrated the exploit, and would call back into IE JavaScript to trigger an IE flaw.


Input: The code within the Flash files from each attack are extremely similar.


Input: They build ROP chains and shellcode the same way, both choose to corrupt a Flash Vector object, have some identical functions with common typos, and even share the same name.

They

ROP chains

build


Input: These actors have previously targeted a number of different industries, including: The proven ability to successfully deploy a number of different private and public RATs using zero-day exploits against high-profile targets likely indicates that this actor (s) will continue to operate in the mid to long-term.

deploy

a number of different private and public RATs

zero-day exploits

high-profile targets

this actor (s)

using

against


Input: This entry was posted in Advanced Malware, Exploits, Targeted Attack, Threat Research, Vulnerabilities and tagged 0day, zero-day by Darien Kindlund, Dan Caselden, Xiaobo Chen, Ned Moran and Mike Scott.


Input: Bookmark the permalink.