Input: To locate victims effectively, an attacker needs to monitor large-scale network traffic containing such private information.


Input: Unfortunately, several well-known attacks can be used to achieve large-scale monitoring, including DNS hijacking, BGP hijacking, and ARP hijacking in IDC.

several well-known attacks

large-scale monitoring

achieve


Input: In this context, DNS hijacking is done to subvert the resolution of Domain Name System (DNS) queries through modifying the behavior of DNS servers so that they serve fake DNS information.

DNS hijacking

the resolution of Domain Name System (DNS) queries

modifying the behavior of DNS servers so that they serve fake DNS information

subvert

through


Input: DNS hijacking is legally and maliciously used in many situations including traffic management, phishing and censorship.


Input: Attackers successfully compromised many DNS servers, including the ones from Google and Godaddy.

Attackers

many DNS servers, including the ones from Google and Godaddy

compromised


Input: By DNS hijacking, attackers can effectively access all the traffic to ad servers.

By

DNS hijacking

attackers

all the traffic to ad servers

access


Input: BGP hijacking takes over groups of IP addresses, corrupting Internet routing tables by breaking BGP sessions or injecting fake BGP information.

BGP hijacking

groups of IP addresses

Internet routing tables

breaking BGP sessions or injecting fake BGP information

takes over

corrupting

by


Input: This enables attackers to monitor all traffic to specific IPs.

attackers

all traffic to specific IPs

monitor


Input: Historically, there were many BGP hijacking attacks that affected YouTube, DNS root servers, Yahoo, and many other important Internet services.


Input: ARP hijacking (or spoofing) in IDC is done to hijack the traffic to the ad server in the IDC where the ad server locates through fake ARP packets.

ARP hijacking (or spoofing) in IDC

the traffic to the ad server in the IDC where the ad server locates through fake ARP packets

hijack


Input: Attackers may rent servers close to the target servers, and use fake ARP packets to direct all the traffic to go through the hijacking servers first for monitoring and hijacking.

Attackers

fake ARP packets

direct all the traffic to go through the hijacking servers first for monitoring and hijacking

use

to


Input: ARP hijacking is a well-known approach used in network attacks.

ARP hijacking

a well-known approach used in network attacks

is


Input: Using the large-scale traffic intercepted from the above methods, attackers can iden- tify potential victims based on information leakage such as GPS location described in Sec- tion 4.2.

Using

based on

the large-scale traffic intercepted from the above methods

attackers

potential victims

information leakage such as GPS location described in Sec- tion 4.2

iden- tify


Input: After that, they can inject exploits only into the targeted traffic to launch further attacks.

they

exploits

the targeted traffic

launch further attacks

inject

only into

to


Input: Attackers keep a low profile by allowing all other irrelevant network traffic to pass without being modified.

Attackers

a low profile

allowing all other irrelevant network traffic to pass without being modified

keep

by


Input: We used the FireEye Mobile Threat Prevention (MTP) engine to analyze all of the ~73,000 popular apps from Google Play with more than 50,000 downloads, and identified 93 ad libraries.


Input: The detailed ad library inclusion statistics are shown in Figure 4.


Input: Seventy-one% of the apps contain at least one ad library, 35% have at least two ad libraries, and 22.25% include at least three ad libraries.


Input: The largest ad inclusion number is 35.


Input: Since Google is cautious about the security of the products it directly controls, we exclude Google Ad from the following discussion.


Input: For security considerations, in this paper we anonymize the names of the other 92 ad libraries, using Ad1, Ad2, ...


Input: , Ad92 to refer to them, where the subscripts represent the rankings of how many apps include the ad libraries.


Input: The top five popular ad libraries' inclusion and download statistics are listed in Table 2.


Input: We analyzed the 92 ad libraries found in the popular Google Play apps, and summa- rized the communication channel vulnerabilities in Table 3.


Input: Combined with the uploaded information column we can learn about the data the attackers can obtain.


Input: Fifty-seven of the 92 ad libraries in the popular Google Play apps have the JBOH issue.


Input: Specifically, four of the top five ad libraries are subject to this problem (shown in Table 2).


Input: Seven of the 92 ad libraries are prone to DLOH attacks.


Input: Particularly, some versions of Ad5 in Table 3 have this problem.


Input: The affected Google Play apps number and the accumulated download counts are listed in Table 4.


Input: In the current golden age of Android ad libraries, Sidewinder Targeted Attacks can target victims using info leakage and other vulnerabilities of ad libraries to get valuable, sensitive information.

Sidewinder Targeted Attacks

victims

info leakage and other vulnerabilities of ad libraries

get valuable, sensitive information

target

using

to


Input: Millions of users are still under the threat of Sidewinder Targeted Attacks.


Input: First we need to improve the security and privacy protection of ad libraries.


Input: For example, we encourage ad libraries' publishers to use HTTPS with proper SSL certificate validation, and to properly encrypt network traffic.


Input: They also need to be cautious about which privileged interfaces are exposed to the ad providers, in case of malicious ads or attackers hijacking the communication channels.

malicious ads or attackers

the communication channels

hijacking


Input: Meanwhile, Google itself needs to further harden the security framework.


Input: This may prove difficult because: 1.


Input: Android is a complex system.


Input: Any sub- component's vulnerability may impact the security of the whole system.


Input: Fragmentation makes the situation even more challenging.


Input: The trade-off between usability, performance and security always matters, and market demand frequently dictates that security comes last.


Input: Many Android developers do not even understand how to program securely (as shown in the JBOH issue).


Input: Many security patches are not back-ported to old versions of Android (like the launcher settings problem described earlier), even though older versions are widely used.


Input: There is always information asymmetry in the development chain.


Input: For example, it usually takes several months for vendors to apply security patches after Google releases them.


Input: Albeit challenging, we hope that this work can kickstart a conversation, both on improved security and privacy protection in third-party libraries and on a hardened Android security framework.


Input: FireEye has invented a purpose-built, virtual machine-based security platform that provides real-time threat protection to enterprises and governments worldwide against the next generation of cyber attacks.


Input: These highly sophisticated cyber attacks easily circumvent traditional signature-based defenses, such as next-generation firewalls, IPS, anti-virus, and gateways.


Input: The FireEye Threat Prevention Platform provides real-time, dynamic threat protection without the use of signatures to protect an organization across the primary threat vectors and across the different stages of an attack life cycle.


Input: The core of the FireEye platform is a virtual execution engine, complemented by dynamic threat intelligence, to identify and block cyber attacks in real time.


Input: FireEye has over 1,900 customers across more than 60 countries, including over 130 of the Fortune 500.


Input: A few days ago we detected a watering hole campaign in a website owned by one big industrial company.


Input: The website is related to software used for simulation and system engineering in a wide range of industries, including automotive, aerospace, and manufacturing.


Input: The attackers were able to compromise the website and include code that loaded a malicious Javascript file from a remote server.

The attackers

the website

code

a malicious Javascript file

a remote server

compromise

loaded

from


Input: This Javascript file is a framework for reconnaissance that the attackers call'' Scanbox'' and includes some of the techniques we described in a previous blog post: The Scanbox framework first configures the remote C & C server that it will use and collects a small amount of information about the victim that is visiting the compromised website including: Resulting in something like this: Before sending the information to the C & C server, Scanbox encodes and encrypts the data with the following function: Producing the following request: If we decrypt the data it translates to: After the first request, the framework contains several plugins to extract different information from the victim.

This Javascript file

a framework for reconnaissance

The Scanbox framework

the remote C & C server that it will use

a small amount of information

the victim that is visiting the compromised website

the information

the C & C server

Scanbox

the data

the following function

the framework

different information

the victim

is

configures

collects

sending

encodes

encrypts

extract

about

to

with

from


Input: While the user is browsing the compromised website, all keystrokes are being recorded and sent to the C & C periodically.

all keystrokes

the C & C

periodically

being recorded

sent

to


Input: It will also send keystrokes when the user submits web forms that can potentially include passwords and other sensitive data.

It

keystrokes

the user submits web forms that can potentially include passwords and other sensitive data

send

when


Input: As we have seen, this is a very powerful framework that gives attackers a lot of insight into the potential targets that will help them launching future attacks against them.


Input: We have also seen several Metasploit-produced exploits that target different versions of Java in the same IP address that hosts the Scanbox framework (122.10.9 [.


Input: ] 109).


Input: We recommend you look for this type of activity against the following machines in your network:


Input: In late December 2011, CrowdStrike, Inc. received three binary executable files that were suspected of having been involved in a sophisticted attack against a large Fortune 500 company.


Input: The files were analyzed to understand first if they were in fact malicious, and the level of sophistication of the samples.


Input: The samples were clearly malicious and varied in sophistication.


Input: All three samples provided remote access to the attacker, via two Command and Control (C2) servers.

All three samples

remote access

the attacker

two Command and Control (C2) servers

provided

to

via


Input: One sample is typical of what is commonly referred to as a'dropper' because its primary purpose is to write a malicious component to disk and connect it to the targeted hosts operating system.

One sample

a malicious component

disk

write

to


Input: The malicious component in this case is what is commonly referred to as a Remote Access Tool (RAT), this RAT is manifested as a Dynamic Link Library (DLL) installed as a service.

a Dynamic Link Library (DLL)

a service

installed

as


Input: The second sample analyzed is a dual use tool that can function both as a post exploitation tool used to infect other systems, download additional tools, remove log data, and itself be used as a backdoor.

a post exploitation tool

other systems

additional tools

log data

itself

a backdoor

infect

download

remove

be used

as


Input: The third sample was a sophisticated implant that in addition to having multiple communication capabilities, and the ability to act as a relay for other infected hosts, utilized a kernel mode driver that can hide aspects of the tool from user-mode tools.

The third sample

multiple communication capabilities

a relay for other infected hosts

a kernel mode driver

aspects of the tool

user-mode tools

having

act

utilized

hide

as

from


Input: This third component is likely used for long-term implantation and intelligence gathering.

This third component

intelligence gathering

is likely used

for


Input: Some AV engines occasionally identify this sample as Derusbi Trojan.


Input: CrowdStrike Intelligence Team has seen Trojans from 8 different builder variants of this RAT, including 64-bit versions, used in targeted attacks in 2011 against Defense, Energy/Power, and Chemical Industries in US and Japan.


Input: All of these samples reflect common toolmarks and tradecraft consistent with Chinese based actors who target various strategic interests of the United States including High Tech/Heavy Industry, Non-Governmental Organizations (NGOs), State/Federal Government, Defense Industrial Base (DIB), and organizations with vast economic interests.


Input: This report contains an in-depth technical analysis of the samples, detection/remediation/mitigation information, attribution intelligence, and a conclusion aimed at providing the reader with a synopsis of the report.


Input: The executable 14c04f88dc97aef3e9b516ef208a2bf5 is commonly referred to as a'dropper', which is designed with the purpose of extracting from itself a malicious payload and to initialize and install it into a targeted system.

The executable 14c04f88dc97aef3e9b516ef208a2bf5

itself

a malicious payload

it

a targeted system

extracting

initialize and install

from

into


Input: In this case, the malicious payload is a Dynamic-Link Library (DLL), which enables an attacker to have full control of the system.

the malicious payload

an attacker

have full control of the system

enables

to


Input: This code appears to have been compiled on Wednesday May 4th, 2011 at 11:04:24 A.M. UTC (equivalent to early evening time in China).


Input: Note that the timestamp is in UTC, however the relative time of day in China is provided for the benefit of the reader.


Input: The sample first resolves several library functions provided by Microsoft using the LoadLibrary () and GetProcAddress () Application Programming Interfaces (APIs).

The sample

several library functions provided by Microsoft

the LoadLibrary () and GetProcAddress () Application Programming Interfaces (APIs)

resolves

using


Input: The imported function names are not encrypted; however, the function name is minutely obfuscated by a simple single character substitution: The dropper invokes the SHGetSpecialFolderPath () API supplying a Constant Special Item ID List (CSIDL) of'CSIDLCOMMONDOCUMENTS' to identify the destination folder for the malicious DLL payload.

The dropper

the SHGetSpecialFolderPath () API

invokes


Input: The CSIDL in this case pints to:'' The file system directory that contains documents that are common to all users.


Input: A typical path is C: \Documents and Settings\All Users\Documents.


Input: '' The dropper attempts to write the malicious payload to one of the following names, using the first available name in this set: The dropper sets the creation and last written timestamp of the newly created file to the date 2007-03-07 00:00:00; this allows the newly created malicious DLL to blend in with other system files.

The dropper

the malicious payload

one of the following names

the first available name in this set

The dropper

the creation and last written timestamp of the newly created file

the date 2007-03-07 00:00:00

the newly created malicious DLL

other system files

write

sets

blend in

to

using

to

with


Input: This is meant to prevent identification during disk forensics using a common investigative technique called a forensic analysis timeline.

This

identification

disk forensics

prevent

during


Input: This date is specified in the dropper code and does not change across multiple infections.


Input: The malicious DLL file that is dropped is hidden in a resource of the dropper binary.

The malicious DLL file that is dropped

a resource of the dropper binary

is hidden

in


Input: This is a relatively common technique used by malware dropper files to optimize the number of files required to infect a machine.


Input: The resource language of the malicious DLL is set to'' Chinese (Simplified)'', this is a compiler artifact which indicates the language setting on the compiler used by the person who built the binary was set to'' Chinese (Simplified)'' at the time the dropper was compiled.


Input: The'MZ' header which denotes a binary executable file of the dropped DLL is initially obfuscated.


Input: When the dropper writes the file to disk, the first byte of the file is'Z' which prevents the file from executing or being detected as an executable by many defensive tools.

the dropper

the file

disk

the first byte of the file is'Z'

the file

being detected as an executable by many defensive tools

writes

prevents

to

from


Input: The dropper subsequently opens the dropped file and corrects the header by writing the'M' over the first byte, allowing the file to be executed.

The dropper

the dropped file

the header

writing the'M' over the first byte

opens

corrects

by


Input: A subroutine to decompress the dropped file is present as'dead code' (code that is not used) in the binary.


Input: This subroutine will be invoked on the already closed file handle of the dropped file in the present code version.


Input: Since the dropped resource is not compressed, the routine fails.


Input: This indicates a low sophistication modification to the original dropper code to make it work with an uncompressed source.


Input: The final step the dropper performs is to load the dropped DLL into its own process space; it then resolves the export'OpenINFOPerformanceData' from the DLL and invokes it with the dropped DLL's filename as parameter.

the dropper

the dropped DLL

its own process space

load

into


Input: This export then implements the actual install logic to maintain persistence and invoke the main routine.

This export

the actual install logic

maintain persistence

implements

to


Input: The dropper binary contains an icon resource that resembles the'Google Chrome' browser icon, the re- source language is set to'' Chinese (Simplified)'', which is consistent with the builder of the tool systems language set to Chinese.


Input: The use of the Chrome icon may indicate a possible attempt to socially engineer the intended victim into thinking the dropper was a legitimate file associated with Google.

The use of the Chrome icon

the intended victim

thinking the dropper was a legitimate file associated with Google

socially engineer

into


Input: This sample is a'backdoor' which is the DLL dropped by the dropper sample file with an MD5 of 14c04f88dc97aef3e9b516ef208a2bf5.

This sample

a'backdoor'

the DLL

the dropper sample file

is

dropped


Input: This code appears to have been compiled on Wednesday May 4th, 2011 at 10:48:19 A.M. UTC (equivalent to early evening time in China).


Input: It is instantiated when it is mapped into the process space of its dropped file, and its' export named'OpenINFOPerformanceData' is called.

it

the process space of its dropped file

is mapped

into


Input: This export first attempts to stop a service called'' msupdate'', which is not a known Microsoft Windows service despite the appearance.


Input: If the service is present, the malware replaces its previous instances or versions of this backdoor.

the malware

its previous instances or versions of this backdoor

replaces


Input: After attempting to disable the existing service, the malware tries to install itself as a service with that same name.

the malware

itself

a service with that same name

install

as


Input: During installation, the sample attempts to use documented APIs such as OpenSCManager () and CreateService () to initialize itself as a persistent Windows service.

the sample

documented APIs such as OpenSCManager () and CreateService ()

initialize itself as a persistent Windows service

use

to


Input: As a precaution, the sample writes settings directly to the Windows Registry to accomplish the same goal if installing the service with the documented APIs fails.

the sample

settings

the Windows Registry

writes

directly to


Input: The registry change creates the following key: Following this, the subroutine will set the value of the'ServiceDLL' to the module handle of the DLL.

The registry change

the following key

the subroutine

the value of the'ServiceDLL'

the module handle of the DLL

creates

set

to


Input: The next key to be changed is: HKEYLOCALMACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost, which will have the'msupdate' key set to'msupdate'.

The next key

the'msupdate' key

'msupdate'

be changed

set

to


Input: The export'CollectW3PerfData' is registered as the main function of the DLL.

The export'CollectW3PerfData'

the main function of the DLL

is registered

as


Input: If the installation of the new service is successful, the sample then starts the new service and exits.

the sample

the new service

starts


Input: If the installation fails, the sample spawns a new process using rundll32.exe, this executable will instantiate the DLL and can call a specific exported function.

the sample

a new process

spawns

using


Input: In the case of installation failure, rundll32.exe calls the main functions export'CollectW3PerfData'.


Input: The rundll32.exe is instantiated with a new NULL Security Identifier (SID) (S-1-0-0) with permissions set to grant all access to the file.

permissions

grant all access to the file

set

to


Input: This allows any user to have complete control over the machine, as rundll32.exe is frequently launched by tasks such as changing the time, wallpaper, or other system settings.

This

any user

have complete control over the machine

allows

to


Input: This means that after cleaning up the components dropped by the malware, the system remains vulnerable to local attacks by simply overwriting the legitimate rundll32.exe executable with a malicious version and await it's automatic execution by the Operating System.

cleaning up

remains

the components dropped by the malware

the system

vulnerable to local attacks


Input: The main entry point to the DLL is named'CollectW3PerfData', as it first creates and displays a fake Window with class'' NOD32% d'' where% d is replaced with a pseudo-random number.


Input: This may be an attempt to fool some automated dynamic analysis or anti-malware software into believing this is the legitimate ESET AV software.

fool

some automated dynamic analysis or anti-malware software

believing this is the legitimate ESET AV software

into


Input: The window is however not visible and implements no specific functionality.


Input: After creating this window, the routine starts the main thread that eventually initiates calling out to the Command and Control (C2).

the routine

calling out to the Command and Control (C2)

initiates


Input: In order to accomplish this task, the newly created thread initializes networking APIs using WSAStartup () and resolves some other APIs dynamically using LoadLibrary () and GetProcAddress ().


Input: Once the proper API's have been resolved, the sample then assigns a NULL SID to the rundll32.exe executable and sets the current process' Window Station to'' winsta0'', which enables the sample to access the real user's desktop if started as service.

the sample

the real user's desktop

started as service

access

if


Input: The communication to the C2 is handled by a while () loop, with each successive connection attempt causing the loop to invoke the Windows Sleep () API for a time interval of 2 seconds, exponentially increasing in length up to 1024 seconds (17 minutes) and then restarting back to 2 seconds.

The communication to the C2

a while () loop

is handled

by


Input: The C2 location in this sample is statically defined as 1.9.5.38:443 (Malaysia: Tmnet, Telekom Malaysia Bhd).


Input: While ther is'dead code' that will download the C2 location from an HTTP URL that could be defined in the binary, using the User-Agent string'' Google'', this code is not activated due to the format of the stat- ically defined C2 location using an IP address.


Input: Thus the sample will only attempt to connect directly using a raw socket to the C2 located at 1.9.5.38:443.

the sample

a raw socket

the C2 located at 1.9.5.38:443

connect

using

to


Input: This indicates the use of a'boiler plate code' or a builder software package that automates the creation of the malicious sample.


Input: The malicious sample sends an initial beacon to the C2 that includes the following information: The beacon is encrypted using an XOR/ADD loop using the statically defined key 0x1C and sent to the C2.

The malicious sample

an initial beacon

the C2

The beacon

an XOR/ADD loop using the statically defined key 0x1C

the C2

sends

is encrypted

sent

to

using

to


Input: The following python function can be used to decode the beacon stings: After sending the initial beacon, the routine loops receiving incoming commands and executes them in sequence.

sending

receiving

executes

the initial beacon

the routine

incoming commands

them


Input: When a connection can successfully be established to the C2 server, the sleep timer is reset to two seconds for the next attempt.


Input: The network protocol used by this sample resembles a'Type-Length-Value' layout in both directions.


Input: Each 16 byte request header consists of: Zero or more of specified bytes of additional payload then follows the header.


Input: This inbound payload is received unconditionally and regardless of command type into a fixed-size stack buffer of 408 bytes size.

This inbound payload

is received


Input: Providing additional payload of any larger size will result in a trivial exploitable stack buffer overflow that allows arbitrary code execution due to the absence of any security features.


Input: However, exploitation of this vulnerability is unnecessary due to the already available unauthenticated command execution capabilities of this backdoor.


Input: Certain commands initiate a second connection to the C2 in a separate thread using the same network protocol but providing a different request command identifier than for the initial beacon.


Input: The primary aim of this backdoor is remote desktop control functionality comparable to VNC or Remote Desktop over a custom protocol.

The primary aim of this backdoor

remote desktop control functionality comparable to VNC or Remote Desktop over a custom protocol

is


Input: It allows the adversary to view the main desktop graphically and control the keyboard and mouse.

the adversary

the main desktop

graphically

the keyboard

mouse

view

control


Input: This remote control functionality is implemented as separate messages for mouse clicks, pressed keys, etc.

This remote control functionality

separate messages for mouse clicks, pressed keys, etc.

is implemented

as


Input: using command identifiers 0x20000002 to 0x20000019.

using

command identifiers 0x20000002 to 0x20000019


Input: The command 0x22000001 initiates continuous transmission of screen captures to the C2.

The command 0x22000001

continuous transmission of screen captures to the C2

initiates


Input: The screen captures are created using a series of Microsoft Windows Graphic Device Interface (GDI) API calls culminating in a call to GetDIBits ().

The screen captures

a series of Microsoft Windows Graphic Device Interface (GDI) API calls culminating in a call to GetDIBits ()

are created

using


Input: Command 0x20000001 exits the backdoor and 0x20000000 is issued to completely remove the backdoor from the system.

the backdoor

the system

remove

from


Input: When command 0x23000004 is received, a temporary new user'' DomainUser'' with password'' Dom4! nU- serP4ss'' is created and added to the local Administrators group.

a temporary new user'' DomainUser'' with password'' Dom4! nU- serP4ss''

the local Administrators group

is created

added

to


Input: The backdoor is then started under that account and the user is deleted.

The backdoor

that account

the user

is then started

is deleted

under


Input: It would appear this technique is meant to obfuscate the activities of the malicious sample by masking the process creator's user name to appear to be a generic domain user.

this technique

the activities of the malicious sample

masking the process creator's user name to appear to be a generic domain user

obfuscate

by


Input: Note that such an account does not normally exist in an Active Directory environment.


Input: Additionally, the primary C2 connection allows for requests to start additional connections to the C2 imple- menting the following functionality: This sample is typical of a post exploitation tool; it is written in .NET


Input: This code appears to have been compiled on Thursday May 26th, 2011 at 10:21:44 A.M. UTC (early evening time in China).


Input: The backdoor functionality can be instantiated either directly from the command line or through commands issued over a network based protocol via the C2.

commands

a network based protocol

the C2

issued

over

via


Input: If no arguments are given, a connection to the C2 is initiated to the stati- cally defined IP address.

a connection to the C2

the stati- cally defined IP address

is initiated

to


Input: The command line options support post exploitation capabilities such as changing file timestamps, forensic mitigation, privilege escalation, launching the executable, and specifying a specific C2.

The command line options

changing file timestamps

forensic mitigation

privilege escalation

launching the executable

specifying a specific C2

support


Input: One interesting command line option allows the backdoor to filter the contents of specified files to remove content using a regular expression (regex).

the backdoor

the contents of specified files

content

a regular expression (regex)

filter

remove

using


Input: This command then modifies the creation, modification, and last access timestamps of the modified file to conceal the content modifications.

This command

the creation, modification, and last access timestamps of the modified file

conceal the content modifications

modifies

to


Input: A detailed listing of command line arguments can be viewed in Appendix A.


Input: This activity is generally associated with log cleaning to com- plicate a forensic investigation.

This activity

log cleaning to com- plicate a forensic investigation

is generally associated

with


Input: The sample contains an embedded IP address for C2 that is stored in an encrypted format as a string re- source: The first two bytes of this string represent the base 16 length of the encrypted string, in this case,'' 0x14''.


Input: Following this is a base64 encoded string of the specified length.


Input: Once this string has been decoded using base64, the result is then XOR'd with the fixed value of 0xAA yielding the decoded IP address 202.86.190.3:80 (Hong Kong: TeleOne (HK) Limited).


Input: There are three components to the protocol: Authentication is accomplished using a 32 byte packet, this packet consists of: An example authentication packet sent to the C2 is located in Appendix E. After sending the initial authentication packet, the sample verifies that the first four bytes of the response is equal to a statically defined value, in this sample the value is: 0x16030100.

Authentication

a 32 byte packet

An example authentication packet

the C2

the initial authentication packet

the sample

the first four bytes of the response is equal to a statically defined value

is accomplished

sent

sending

verifies

using

to

that


Input: In addition, an 8 byte key is sent to the client which is then RC4 encrypted using the random number generated in step 2 from above as the password.

an 8 byte key

the client

is sent

to


Input: This value is then transformed using a simple algorithm in Appendix F into a 32 byte array.


Input: The first 16 bytes of this array are then used as the KEY and the second 16 bytes are used as the IV for setting up AES encryption which is then used to encrypt and decrypt any further communications.

AES encryption

any further communications

encrypt and decrypt


Input: Beacon, this is typical of this type of malicious sample, it allows the operator to separate various infected hosts in a targeted campaign.


Input: The beacon for this sample is formatted as XML and consists of: An example of an unencrypted beacon: Command handling loop, this is a loop structure that will process and execute commands sent by the C2.

Command handling loop

commands sent by the C2

process and execute


Input: The malware sends and receives a heartbeat/keepalive packet every 2 minutes.

The malware

a heartbeat/keepalive packet

2 minutes

sends

receives

every


Input: The command format is derived from a structure consisting of: These fields are received as a sequence of serialized .NET


Input: objects in the order specified.


Input: A detailed description of the possible values for commands is in Appendix D. It is important to note that the order in which the application defines them is not the same order as they appear to be coming over the network.


Input: Examples of implemented commands include download and upload files, installing new .NET assemblies, calling methods on those assemblies, connecting to new C2 servers and executing processes.

download

upload

installing

calling

connecting

executing

files

new .NET assemblies

methods

those assemblies

new C2 servers

processes

on

to


Input: This sample is a sophisticated backdoor which implements several communications protocols and was developed in C++.

This sample

a sophisticated backdoor

several communications protocols

is

implements


Input: This binary is compiled with the /GS flag using Visual Studio 2010, enabling stack buffer overflow detection.


Input: This code appears to have been compiled on Sunday October 30, 2011 at 12:43:33 P.M. UTC (late evening time in China).


Input: The code contains several Run Time Type Information (RTTI) artifacts that indicate most of the C++ class names were prefixed with the string'' PCC'' in the original source code.


Input: Variants of this Trojan are sometimes detected under the name'Derusbi' by Microsoft, Trend, Sophos and Symantec AV engines.


Input: This sample is a DLL which can be registered as a service and is used to drop a kernel driver and provide an interactive command line shell to the C2.

This sample

a DLL

a service

a kernel driver

an interactive command line shell

the C2

be registered

drop

provide

as

to


Input: It also is able to bypass User Account Control (UAC) to install itself by using the'sysprep.exe' Microsoft Windows executable provided by the targeted system.

It

User Account Control (UAC)

install itself by using the'sysprep.exe' Microsoft Windows executable provided by the targeted system

bypass

to


Input: The steps it takes to install itself onto a system are as follows: 2.


Input: After it copies itself, it will modify the creation time, last access time and last modification time to the current system time when the copy was made but with the year changed to 2005.

it

itself

it

the creation time, last access time and last modification time

the current system time when the copy was made but with the year changed to 2005

copies

modify

to


Input: Adds itself as a service name from the backdoor's configuration under HKEYLOCAL MACHINE\\SYSTEM\\CurrentControlSet\\Services\\ < service >'' This defaults to'' wuauserv'', the legitimate Windows Update service, in the given binary's default configuration.

Adds

itself

a service name

the backdoor's configuration

HKEYLOCAL MACHINE\\SYSTEM\\CurrentControlSet\\Services\\ < service >''

as

from

under


Input: Adds itself to list of services started by'netsvc' using the service name'helpsvc'.

Adds

itself

list of services started by'netsvc'

the service name'helpsvc'

to

using


Input: If McAfee AV is installed, creates a copy of regsvr32.exe named Update.exe and then schedules the copy to be deleted on reboot using the well documented MoveFileExA API.

creates

schedules

a copy of regsvr32.exe named Update.exe

the copy

be deleted on reboot

the well documented MoveFileExA API

to

using


Input: It then calls either the original or copy of regsvr32.exe with the parameters /s /u and the path to the copy of itself it made in Step 1.


Input: The /u parameter means'' uninstall'', which calls DllUnregisterServer, this is an unsophisticated method of DLL entry point obfuscation.


Input: DllUnregisterServer installs the driver and initiates the backdoor component.


Input: The sample is capable of'dropping' an embedded/encrypted kernel driver.

The sample

an embedded/encrypted kernel driver

'dropping'


Input: If the process'' ZhuDongFangYu.


Input: exe'' is running (AntiVirus360 program from the Chinese'Quihoo 360 Technology Co., LTD' 360), or the username of the DLL's host process context is not'SYSTEM', the driver is not written to disk.


Input: Barring the two aforementioned conditions, the sample decrypts the kernel driver to: Following the decryption and writing of the driver to disk, it is loaded using the ZwLoadDriver () API.

writing

is loaded

the driver

disk

it

the ZwLoadDriver () API

to

using


Input: The driv- er is encrypted with a simple four byte XOR key value of 0x2E885Df3; after decryption the file has the MD5 hash of dae6b9b3b8e39b08b10a51a6457444d8.

The driv- er

a simple four byte XOR key value of 0x2E885Df3

is encrypted

with


Input: The malware contains a dynamic configuration stored in the Registry under and loads a default configuration embedded into the binary if such a configuration is not found.


Input: The way this default configuration is loaded and parsed indicates that this malware has been built with a'builder' that takes a template sample and lets an unsophisticated user specify a configuration without recompiling any code.


Input: If the current service name matches a set of pre-defined service names that legitimately exist in Windows, the backdoor then loads the original service's DLL into the address space with LoadLibrary and invokes the ServiceMain export.

the backdoor

the original service's DLL

the address space

LoadLibrary

loads

into

with


Input: This effectively hijacks the original service's entry while retaining its functionality.


Input: While there is code in the binary that allows downloading a list of C2 servers from an HTTP URL, the default configuration present specifies 202.86.190.3:80 as a C2 to use, this is the same Hong Kong C2 server as the one used by the post exploitation .NET

downloading

specifies

a list of C2 servers

an HTTP URL

the default configuration present

a C2

use

from

as

to


Input: tool.


Input: The malware has three distinct C2 protocols two of which can be transmitted over HTTP proxies and one can be bundled in two different'dual' modes (see 3.

The malware

three distinct C2 protocols

has


Input: ), totaling 7 distinct supported C2 mechanisms.


Input: The con- figuration contains the C2 protocol to be used or optionally a self-configuration mode in which the malware attempts the different C2 protocols in a pre-defined order.

The con- figuration

the C2 protocol to be used

the malware

the different C2 protocols

a pre-defined order

contains

attempts

in


Input: In self-configuration, a connection via a proxy is attempted if the system wide Internet Explorer settings specify such a proxy.


Input: The configuration found in this sample is set to automatic self-configuration, resulting in the following mechanisms being tried in this order: 1.


Input: Proprietary binary header (optionally over an HTTP Proxy using CONNECT mechanism); this protocol consists of 64 random bytes being sent to the C2.

64 random bytes

the C2

being sent

to


Input: The C2 then responds with 64 bytes where the first four bytes must match the first four sent bytes to establish a connection successfully.


Input: The remaining bytes are discarded.


Input: Interestingly, the malware stores the first four bytes rotated right by seven bits and compares that value to the seven bits rotated right version of the server's response, effectively neutralizing the rotation's effect; the purpose of this is unclear.


Input: A long-running HTTP POST request to the path'' /forum/login.cgi'' with a statically defined HTTP request string including HTTP headers (optionally over a HTTP Proxy using CONNECT).


Input: The malware requires the response to start with'' HTTP/1.0 200'' or'' HTTP/1.1 200'' and an absence of a'' Connection: close'' header.


Input: This one HTTP connection will be used for bi-directional communications, sending chunks of POST payload and receiving chunks of the response, interleaved.

sending

receiving

chunks of POST payload

chunks of the response


Input: Two long-running HTTP requests to the same C2 (optionally over an HTTP Proxy with original request verb), one GET request to'' /Photos/Query.cgi? loginid='' followed by a random number and one POST request to'' /Catelog/login1.cgi''.


Input: The GET request serves as a down-stream channel while the POST request serves as a upstream channel.

The GET request

a down-stream channel

the POST request

a upstream channel

serves

serves

as

as


Input: This demonstrates an attempt to use the most efficient communication channel first, falling back to more legitimate appearing channels as required in order to appear Request For Comment (RFC) compliant with the HTTP protocol.


Input: Additionally, the malware contains a custom DNS client implementation that will use the system's configured DNS server to tunnel C2 traffic over legitimate DNS.

the malware

a custom DNS client implementation

the system's configured DNS server

C2 traffic

legitimate DNS

contains

use

tunnel

over


Input: Since this C2 mechanism is not attempted in self-configuration and was not configured for this binary, analysis was left out due to time constraints.


Input: After establishing any of the aforementioned channels for arbitrary binary data exchange, the malware will start sending and receiving compressed binary blobs via the channel of choice.

the malware

compressed binary blobs

the channel of choice

sending

receiving

via


Input: The C2's binary data blobs are compressed.


Input: No further encryption of the data takes place.


Input: All C2 transport implementations contain code for accepting and handling server-side connections of the respective protocols.


Input: However, this code does not appear to be invoked.


Input: It appears that the author of this code shares the library that implements these transports for the client with the C2 server.


Input: The main backdoor thread then reads commands from the chosen C2 protocol and passes them on to any of the following registered handler classes based upon a command ID.

The main backdoor thread

commands

the chosen C2 protocol

reads

from


Input: The handler class is responsible for parsing the remainder of the command.


Input: This handler class for command ID 8 implements generic directory and file browsing using FindFirstFileW () and FindNextFileW () APIs, as well as reading and writing arbitrary files via C2 commands, thus enabling upload and download of arbitrary files.

This handler class for command ID 8

generic directory and file browsing

FindFirstFileW () and FindNextFileW () APIs

arbitrary files

C2 commands

arbitrary files

implements

reading

writing

upload

download

using

via


Input: This is typically seen in RATs for searching specific files to exfiltrate.

RATs

specific files

searching

exfiltrate


Input: Additionally, this class implements launching of specified executable files via the CreateProcess () API.

this class

specified executable files

the CreateProcess () API

launching

via


Input: This handler class implements a generic TCP proxy.

This handler class

a generic TCP proxy

implements


Input: It supports establishing TCP connections to other hosts and also listening for incoming connections.

It

TCP connections

other hosts

incoming connections

establishing

listening

to

for


Input: The incoming connection contents are forwarded to the C2 and data from the C2 is passed on to connections.

The incoming connection contents

the C2

data from the C2

connections

are forwarded

is passed

to

on to


Input: It supports up to 1024 parallel connections.


Input: The malware is capable of gathering various pieces of information from the system, triggered by a command ID 10.

The malware

various pieces of information

the system

gathering

from


Input: The capabilities include recovering authentication credentials from various system and client storage such as Mozilla Firefox, Internet Explorer, and Remote Access Service (RAS).

recovering

authentication credentials

various system and client storage such as Mozilla Firefox, Internet Explorer, and Remote Access Service (RAS)

from


Input: This class also supports gathering intelligence on the infected system including identifying security tools by their process name, proxy accounts, and version numbers for the Operating System (OS) and Internet Explorer.

This class

intelligence on the infected system

security tools

their process name

proxy accounts

version numbers for the Operating System (OS)

Internet Explorer

gathering

identifying

by


Input: This handler class provides the attacker with the ability to manage system components including start/stop/delete system services, enumerate/alter registry keys, and manage running processes.

This handler class

system components

system services

registry keys

running processes

manage

start

stop

delete

enumerate

alter

manage


Input: This class also provides the ability for the attacker to take a screen shot of the users desktop.

This class

a screen shot of the users desktop

take


Input: This handler class uses the command ID 5 and implements an interactive command line shell accessible from the C2 server, containing a series of built-in commands.

This handler class

an interactive command line shell accessible from the C2 server

implements


Input: If the input is not in this list of built-in commands, the malware attempts to invoke cmd.exe in the background, launching a command or command line utility already present on the system.

the malware

cmd.exe

the background

a command or command line utility already present on the system

invoke

launching

in


Input: The standard output channel of that command is provided back to the C2.

The standard output channel of that command

the C2

is provided

back to


Input: The supported built-in commands are: The only command that is implemented directly in the main backdoor thread as a subprocedure call and not via a generic command handler class is command ID 256.


Input: This command results in the DLL deleting itself and terminating the backdoor process.

the DLL

itself

the backdoor process

deleting

terminating


Input: This sample is a packed 32-bit kernel driver extracted by the aforementioned DLL with an MD5 hash of: de7500fc1065a081180841f32f06a537, this sample will only function on a Windows 32-bit kernel.


Input: This code appears to have been compiled on Sunday October 9, 2011 at 4:50:31 P.M. UTC (very early morning time of Monday, October 10 in China).


Input: This section describes how the driver performs its initialization routine.


Input: The driver begins by opening a named event in the BaseNamedObjects object directory with the name {8CB2ff21-0166-4cf1-BD8F-E190BC7902DC} using the Windows API ZwOpenEvent ().

The driver

a named event

the BaseNamedObjects object directory

the name {8CB2ff21-0166-4cf1-BD8F-E190BC7902DC}

the Windows API ZwOpenEvent ()

opening

in

with

using


Input: If the event already exists, the driver fails to load, presumably to avoid a multiple instances of itself.

the driver

multiple instances of itself

avoid


Input: If the event does not exist, the driver then creates it using the Windows API ZwCreateEvent ().

the driver

it

the Windows API ZwCreateEvent ()

creates

using


Input: The Windows API for creating events (ZwCreateEvent (), or CreateEvent () in user mode) already provides the ability to'' create-or-open'' an event, so the use of an initial ZwOpenEvent is superfluous and indicative of relatively limited Windows API knowledge of the author of that part of the code.


Input: It is interesting to note that some of the hex digits in the object name are mixed case which is potentially indicative of the code being re-appropriated from another source.


Input: The second component of the entry point performs an anti-debugging technique, calling the function KdDisableDebugger (), which allows the driver to disable usage of the built-in Windows kernel debugging facility that is used by popular kernel debuggers KD and WinDbg.

The second component of the entry point

an anti-debugging technique

the function KdDisableDebugger ()

the driver

usage of the built-in Windows kernel debugging facility that is used by popular kernel debuggers KD and WinDbg

performs

calling

disable


Input: Tools such as Syser Debugger, or debugging through a virtual machine are unaffected by this technique.


Input: The sample, rather than importing the KdDisableDebugger () API using conventional methods, looks up the API through MmGetSystemRoutineAddress () instead.


Input: All of the other APIs used by the driver are imported normally, so this is not a technique to hide import APIs used throughout the driver.


Input: Searching Google for'' MmGetSystemRoutineAddress'' and'' KdDisableDebugger'' results in dozens of Chinese language blogs which explain how to use this technique to'' Disable WinDbg''.


Input: The final step of the entry point is to begin hooking the system, which is done by two helper functions-one is designed to hook the system call table, while the other hooks the network stack.

The final step of the entry point

the system

one

the system call table

the other

the network stack

hooking

hook

hooks


Input: The network stack hooking first queries the OS version using RtlGetVersion () or PsGetVersion ().

The network stack hooking

the OS version

RtlGetVersion () or PsGetVersion ()

queries

using


Input: Checking the version is necessary because Windows versions beginning with Vista utilize a redesigned TCP/IP net- work stack, most hooking operations will require a different implementation for these versions.


Input: On versions prior to Windows Vista, the TCP/IP driver creates a \Device\Tcp device object through which most network requests are piped through.


Input: On Vista and later, TCP/IP has been split up into multiple components, and IP connection enumeration, which this driver is targeting, is managed by \Device\nsiproxy instead.


Input: In either case, the driver obtains the device object by using IoGetDeviceObjectPointer () and hooks Major Function 14 the IRPMJDEVICECONTROL, as this is the function through which all Input Output ConTroLls (IOCTLs) are sent, such as the IOCTL for querying active IP connections.

the driver

Major Function 14 the IRPMJDEVICECONTROL

hooks


Input: The NSI hook, targets IOCTL 0x12001B, which is used by NsiGetObjectAllParameters () in nsi.dll when users typically run commands such as netstat.exe or use any of the IP Helper APIs in iphlpapi.dll.


Input: The purpose of the hook is to scan the list of active connections returned to the user, and hide any such connection currently bound to a local TCP port in the range between 40000 and 45000.

the hook

the list of active connections returned to the user

any such connection currently bound to a local TCP port in the range between 40000 and 45000

scan

hide


Input: The hooking is performed by creating a new completion routine associated with any IRPMJDEVICECONTROL IRP that matches the IOCTL, attaching to the target process, performing several memory copies to hide the entry, and detaching.

The hooking

creating a new completion routine associated with any IRPMJDEVICECONTROL IRP that matches the IOCTL, attaching to the target process, performing several memory copies to hide the entry, and detaching

is performed

by


Input: This functionality is nearly identical to the code posted by Edward Sun (aka cardmagic, sunmy1 @sina.com, onlyonejazz @hotmail.com, cardcian @mail.ustc.edu.cn, QQ #28025945) from Hefei, Anhui province (Nanjing Military District) on July 8, 2007, then a China-based researcher at Trend Micro (now working at Kingsoft Chinese AV Company; LinkedIn profile page: http: //www.linkedin.com/profile/view? id=84082731) at http: //forum.eviloctal.com/viewthread.php? action=printable & tid=29604 (See Appendix G).


Input: CrowdStrike has no information connecting Mr. Sun to this intrusion activity, his code appears to have been appropriated by the actor to add similar functionality to their code.


Input: The TCP hook works almost identically to the NSI hook, though instead hooking IOCTL 0x120003 (IOCTL TCPQUERYINFORMATIONEX).

The TCP hook

IOCTL 0x120003 (IOCTL TCPQUERYINFORMATIONEX)

hooking


Input: This IOCTL has the exact same functionality as the NSI specific IOCTL.


Input: This IOCTL was the mechanism used on Windows versions prior to Windows Vista.


Input: This hook also filters any connections listening on TCP ports in the range between 40000 and 45000.

This hook

any connections listening on TCP ports in the range between 40000 and 45000

filters


Input: The system call hooking targets three functions: ZwSaveKey (), ZwQueryValueKey (), and ZwEnumerateValueKey ().


Input: The unpacked kernel driver sample hooks these functions by reading the second DWORD at each of these exported functions.

The unpacked kernel driver sample

these functions

reading the second DWORD at each of these exported functions

hooks

by


Input: Because the system call stub uses the EAX register as an index for the system call ID, and a'' mov eax, imm32'' instruction'' instruction is used, this second DWORD will match the system call ID.


Input: It then adds this index to the value of KeServiceDescriptorTable.Base, which is the exported kernel variable (on 32-bit Windows only) which directly points to the system call table.


Input: This is one of the simplest ways to do a system call hook, but will not work on 64-bit Windows as this variable is not exported in addition to the protection provided by Microsoft PatchGuard.


Input: The system call hook is then performed by first allocating a Memory Descriptor List (MDL) using the Windows API IoAllocateMdl (), and associating the MDL to a non-paged buffer using MmBuildMdlForNonPagedPool ().

The system call hook

first allocating a Memory Descriptor List (MDL) using the Windows API IoAllocateMdl (), and associating the MDL to a non-paged buffer using MmBuildMdlForNonPagedPool ()

is then performed

by


Input: Once the MDL is associated to the non-paged buffer, the sample locks the underlying pages using the Windows API MmProbeAndLockPages ().


Input: Instead of hooking the entry in the table directly, which is easily detectable, the driver uses the LDASM open-source disassembly engine to analyze the function that is being pointed to by the table, and applying a Detours-style hook directly in the code.

the driver

a Detours-style hook

the code

applying

directly in


Input: It uses the standard'' mov cr0, eax'' technique, turning off the Write Protect (WP) bit as it does this.


Input: When the hook is installed, it writes a special DWORD value,'KDTR', which allows it to prevent double-hooking or badly-hooking the system call, during unhooking, this value is also checked.


Input: In the ZwSaveKey () hook, access to \\REGISTRY\\MACHINE\\SYSTEM is blocked.


Input: RegSaveKey () which is the user-mode implementation of the kernel ZwSaveKey () API, is typically used when performing an offline backup of a particular registry key.


Input: hook is the ZwQueryValueValue () hook, which looks for'' Parameters'' key of a service within the registry at \\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\.


Input: It then checks for the values of the'' ServiceDll'' and'' Security'' keys, in the latter case it applies an XOR on the data with the value 127.

It

the values of the'' ServiceDll'' and'' Security'' keys

it

an XOR

the data

the value 127

checks

applies

for

on

with


Input: The user-mode component of this malware is a service called'' msupdate'', this driver is attempting to hide the service.

this driver

the service

hide


Input: The user-mode service stores configuration data in the'' Security'' subkey of the RPC registry key, this component will obfuscate the user-mode configuration data.


Input: The driver does not make any efforts to hide its own key, nor does it specifically check for'' RPC'' before'' Security'', which can lead to random data being obfuscated.


Input: The final hook, ZwEnumerateValueKey (), is similar in structure to the ZwQueryValueHook key, due to the fact that these APIs provide almost identical functionality when it comes to reading registry values.


Input: In the registry hooking code of the driver, a call is made to ObReferenceObjectByHandle ().

In

to

the registry hooking code of the driver

a call

ObReferenceObjectByHandle ()

is made


Input: This allows the driver to receive the'CMKEYOBJECT' which is then used with ObQueryNameString () to get the key/value path.


Input: However, no call to ObDereferenceObject () is ever made, which means that all registry objects being sent to these APIs are eventually leaked.


Input: In the registry hook, it was noticed that'' CurrentControlSet001'' was used as the target, if the target machine was using a'' last known good'' configuration, or a roaming hardware profile, the registry hook would not function as intended.


Input: This is the reason the Microsoft implemented a symbolic link to \\CurrentControlSet which ensures that regardless of the machines configuration any request will access the correct registry key.


Input: This threat actor leaves several key fingerprints which can be used to identify compromised systems.


Input: These digital fingerprints are unique to this adversary for this campaign.


Input: The following network signatures are designed for the popular Open Source IDS called Snort.


Input: These signature can be ported to other formats upon request.


Input: The following file system artifacts are indicative of a compromised host: The following Windows Registry artifacts are indicative of a compromised host: The backdoor may be detected by several different Anti-Virus products under a signature with the name: Attribution in the cyber domain is always a tricky subject when relying solely on malicious samples.


Input: Compiler artifacts and language settings can of course be deliberately masked or spoofed.


Input: CrowdStrike uses a unique approach of comprehensive threat analysis in order to decipher attributable components.


Input: Based on the corroborating evidence discovered in the course of this analysis, it appears there are numerous indications that this is a Chinese-speaking actor.


Input: ZhuDongFangYu.exe is a component of 360 360􀆔􀆔􀆔􀆔, a Chinese security product available from http: //www.360.cn/.


Input: This is particularly relevant in this case because the backdoor DLL sample with an MD5 of de7500fc1065a081180841f32f06a537 specifically avoids installing the kernel driver on a system running this tool.

the backdoor DLL sample with an MD5 of de7500fc1065a081180841f32f06a537

installing the kernel driver on a system running this tool

avoids


Input: Speculatively this may be because this security product detects this rootkit, or the author was attempting to prevent accidental infection on systems running this Anti-Virus product.


Input: The obfuscation of the KdDisableDebugger () function call is seen on several Chinese language forums, and can be seen being reused in several code samples on those forums.


Input: As previously mentioned there is no advantage associated with using this call obfuscation, and appears to be reused for no apparent reason other than the attackers have copied code directly from forum code.


Input: While the various network hooking techniques used in the kernel driver may appear novel or well researched, upon close inspection it is actually a line-for-line copy of an existing post from the now-offline'rootkit.com' by a Chinese language developer.

the various network hooking techniques

the kernel driver

used

in


Input: This post is currently mirrored on dozens of Chinese hacking websites.


Input: Similarly the system call hooking is less impressive after searching for'' IoAllocateMdl'' and'' cr0'' (bbs.pediy.


Input: com/showthread.php? t=77467 perform system call hooking through MDLs.

perform

system call hooking

MDLs

through


Input: The ldasm inline hooking is also repeated in numerous postings to Chinese forums.


Input: One particular website (http: //read.pudn.com/downloads197/sourcecode/windows/sys- tem/927802/CCRootkit/RootkitSys/HookSSDT.c.htm) had an almost identical ldasm loop that tried to identify the exact same code sequences.


Input: Open source research of the 4 innocuous kernel APIs'' ZwSaveKey ZwQueryValueKey ZwEnumerateValueKey IoAllocateMdl'', in concert leads directly to a Chinese website that has a cached rootkit performing similar hooks on the same 3 registry related APIs.

a cached rootkit

similar hooks

the same 3 registry related APIs

performing

on


Input: While the driver does not use pool tags for most of its allocations, it does utilize them in the networking hooking code, much like the examples found on the Chinese language forums.


Input: This sample uses pool tags:'tnet,' and'KDTR'.


Input: Although the meaning of the KDTR tag is not obvious, we assess with high confidence that this is a shortened version of:'' Kernel DeTouR'', which coincides with the matching functionality of the detour-style inline hook.


Input: The driver code (MD5: dae6b9b3b8e39b08b10a51a6457444d8) appears to be a combination of various code that is easily searchable on the Internet, and almost always attributed to Chinese language forums and websites.


Input: The system call hooking parts of the code appear to be identical to the HookSSDT.c code authored by Steven Lai'embedlinux' and utilized in what the author titled'CC Rootkit' on on August 4, 2008 who's email address is hqulyc @126.com.


Input: This user has a QQ identity of: 5054-3533, QQ is a popular instant messaging chat client used almost exclusively in China.


Input: His real name according to his QQ profile (http: //user.qzone.qq.com/50543533) appears to be Steven Lai.


Input: He was is 28 years old (born September 5, 1983) and lives in Xiamen, Fujian province (Nanjing Military Region).


Input: According to his profile, he has worked at Xiamen XOCECO New Technic Co., Ltd. (http: //www.likego.com/en/about.asp), a company that builds audio/video systems for transportation systems.


Input: Mr. Lai is not being identified as the actor, his code however was used by whomever built the kernel driver utilized by the backdoor and for this reason we are providing the background on this individual.


Input: The samples involved in this incident are typical of attacks commonly associated with the People's Republic of China (PRC).


Input: These code samples have a variety of Tools, Techniques, and Procedures (TTPs) that are used to track and identify specific adversary groups.


Input: The sophistication of the actor responsible this incident is difficult to quantify without visibility into the activities that transpired on the victims network.


Input: The ability to conduct Incident Response (IR) including forensics, and log analysis, greatly augments this visibility into these aspects of the incident.


Input: Some indications as to the adversaries' capabilities can be derived from the captured samples alone.


Input: The dropper code (MD5: 14c04f88dc97aef3e9b516ef208a2bf5) does not utilize any techniques that are unique or unusual, and is consistent with tools, techniques, and procedures of attacks targeting proprietary information and generally attributed to the PRC.


Input: The presence of dead code and its replacement by a more simple obfuscation method to hide the to-be-dropped dll binary file indicates code reuse on the attacker side.


Input: The'dead code' utilizes a more sophisticated compression algorithm provided by a third party which was rendered useless for some reason.


Input: This may have been a result of the attacker modifying an existing tool, or unknowingly using a re-purposed tool.


Input: The dropper resources indicate the compiler used to build the tool was running on a system that utilized the Chinese'' Simple'' language pack and was built on Wednesday May 4th, 2011 at 11:04:24 A.M. UTC (early evening time in China).


Input: While this can be deliberately spoofed as a'false flag' other indicators including the C2 are consistent with this having been the work of a Chinese speaking actor.


Input: The dropped DLL (MD5: 47619fca20895abc83807321cbb80a3d) itself contains functionality that is typical of a Remote Access Tool (RAT) which are commonly used by PRC based actors in data exfiltration attacks.

The dropped DLL (MD5: 47619fca20895abc83807321cbb80a3d) itself

functionality that is typical of a Remote Access Tool (RAT)

PRC based actors

data exfiltration attacks

contains

used

in


Input: The code quality is not impressive, and contains a trivial stack buffer overflow vulnerability.


Input: Despite the buf- fer overflow, the C2 channel lacks any command authenication or encryption, apart from the initial beacon encryption/obfuscation using a statically compiled XOR key.


Input: The sample uses TCP port 443 for commu- nication, but makes no attempt to mimic the SSL protocol typically used on that port number, which would provide enhanced Operational Security (OPSEC).


Input: This code appears to have been compiled on Wednes- day May 4th, 2011 at 10:48:19 A.M. UTC (early evening time in China).


Input: The post exploitation tool (MD5: 2dce7fc3f52a692d8a84a0c182519133) is a dual-use tool, it can be dropped and executed by a client-side exploit, or the adversary can launch it using a variety of command line options.

it

a client-side exploit

the adversary

it

a variety of command line options

be dropped

executed

launch

using


Input: This tool is built in Microsoft .NET


Input: framework, which is typically an indication of a less sophis- ticated attacker, because .NET


Input: is easier to develop in but requires the .NET


Input: framework be present on the victim machine.


Input: The tool appears to have been compiled on Thursday May 26th, 2011 at 10:21:44 A.M. UTC (early evening time in China).


Input: The sample utilizes the AES cryptographic algorithm to protect its C2 communications.

The sample

the AES cryptographic algorithm

protect its C2 communications

utilizes

to


Input: This DLL is a moderately sophisticated backdoor with several well designed communication mechanisms not typically seen in these types of implants.

This DLL

a moderately sophisticated backdoor

is


Input: The code base for the sample was developed in C++.


Input: The code appears to have been compiled on Sunday October 30, 2011 at 12:43:33 P.M. UTC (late evening time in China).


Input: This sample has multiple communication capabilities available that makes it far more versatile and stealthy.

This sample

multiple communication capabilities available

has


Input: It implements relatively well thought out protocols including HTTP and DNS.

It

relatively well thought out protocols including HTTP and DNS

implements


Input: The tool has the ability to automatically down select the most effective communication channel once it has been instantiated, which can help avoid detection from solutions like DNS blacklisting and RFC protocol enforcement.

The tool

the most effective communication channel

it has been instantiated

detection from solutions like DNS blacklisting and RFC protocol enforcement

select

avoid

once


Input: The DLL itself contains traces of the original C++ class names that were utilized in the source code, which in general were prefixed with'PCC'.


Input: The sample supports the ability to act as a generic proxy, this may be intended to proxy C2 traffic for other infected machines in order to minimize the number of systems communicating to the C2, thus enhancing OPSEC.

The sample

a generic proxy

C2 traffic

other infected machines

minimize the number of systems communicating to the C2

act

proxy

as

for

in order to


Input: The sample contains'dead code' which appears to be command and control server classes, this is likely an indicator that the C2 client which would communicate with this sample shares the same communications library which was compiled into this sample.

the C2 client which would communicate with this sample

the same communications library which was compiled into this sample

shares


Input: The kernel driver component dropped by the Backdoor DLL bears many tool marks associating it with the CCRootkit package publicly by Steven Lai (a/k/a embedlinux).

The kernel driver component

the Backdoor DLL

dropped


Input: This kernel mode rootkit implements several hooking techniques that are aimed at preventing a system administrator from detecting the backdoor DLL.

This kernel mode rootkit

several hooking techniques

a system administrator

detecting the backdoor DLL

implements

preventing

from


Input: The implementation of these techniques has some unique idiosyncrasies that permit direct attribution to the source code Steven Lai posted.


Input: This driver attempts to hide a wide swath of TCP ports (40000-45000) for an unknown reason, however it is suspected that this may relate to the potential network relaying capability alluded to for the backdoor dll.

This driver

a wide swath of TCP ports (40000-45000)

an unknown reason

hide

for


Input: The kernel driver component dropped by the Backdoor DLL bears many tool marks associating it with the CCRootkit package publicly by Steven Lai (a/k/a embedlinux).

The kernel driver component

the Backdoor DLL

dropped


Input: This kernel mode rootkit implements several hooking techniques that are aimed at preventing a system administrator from detecting the backdoor DLL.

This kernel mode rootkit

several hooking techniques

a system administrator

detecting the backdoor DLL

implements

preventing

from


Input: The implementation of these techniques has some unique idiosyncrasies that permit direct attribution to the source code Steven Lai posted.


Input: This driver attempts to hide a wide swath of TCP ports (40000-45000) for an unknown reason, however it is suspected that this may relate to the potential network relaying capability alluded to for the backdoor dll.

This driver

a wide swath of TCP ports (40000-45000)

an unknown reason

hide

for


Input: Implemented values for cmdID are as follows: cmdType can be one of the following (Interesting commands explained in detail): string0 can have one of the following values dependant upon command id and type.


Input: cardmagic writes: Windows Vista has changed alot on network module, many old port hiding materials are no longer usable.


Input: In this post, I will share with you a simple code to hide port under Vista, hope it is useful for some guys.


Input: Actually under Windows Vista, netstat.exe will call InternalGetTcpTable2 which is exported by Iphlpapi.dll to list all open ports, then InternalGetTcpTable2 will transfer control to NsiAllocateAndGetTable which is exported by nsi.dll, and finally nsi.dll involve NsiEnumerateObjectsAllParametersEx to interact with kernel mode module of NSI -- nsiproxy.sys.


Input: nsiproxy.sys is almost like a wrapper of netio.sys, it will then call internal subroutines of netio.sys.


Input: Here, we will use a relatively easy way --'' NSI Kernel Module Dispatch Routine Hook'' to demonstrate the specified port hiding uner Vista.


Input: Dispatch routine hook is an old topic, this time, we will apply this method to nsiproxy.sys.


Input: Please focus on how to handle the content filtering of NSI:) Check the following code (Notice: I only tested it under Windows Vista RTM 32bit):


Input: One of the questions which comes up in the months after big security whitepaper disclosures is: where are they now? In other words, what happened to the operators, tools, and infrastructure which was revealed in the reports, blog-posts, and press interviews.


Input: Did they continue on as before, did they re-build the disclosed infrastructure and tools, did they go away and get jobs in another line of work? In some cases, the disclosure had little, if any impact on the operation.


Input: For example, after the McAfee ShadyRAT report in 2011, there was absolutely no change in the attacks from the group behind this.


Input: However, when Mandiant released their APT1 report in 2013, there was a noticeable reduction in activity from the group–and much of the tools and infrastructure has not been seen since.


Input: In the September 2010 issue of Foreign Affairs magazine, former US Deputy Secretary of Defense William J. Lynn discussed a cyber-attack which happened two years previously on the DoD's classified computer networks.


Input: Lynn described how a foreign intelligence agency planted malicious code on the networks with the aim of transferring data to servers under their control.


Input: The article included the now oft-quoted phrase'digital beachhead' to describe what was undoubtedly a significant compromise of US military systems.


Input: Further reports in the press kept the story alive in 2011, but since then this threat has received remarkably little attention.


Input: However, the operation behind the attacks has continued with little modification to the tools and techniques, in spite of the widespread attention a few years ago.


Input: They use highly sophisticated malware tools to maintain persistent access to their targets.

They

persistent access to their targets

maintain


Input: These tools can be used for covert communications in a number of different modes, some of which present significant challenges for traditional security technologies to detect.

These tools

covert communications

a number of different modes

some of which

significant challenges for traditional security technologies to detect

be used

present

for

in


Input: There are some threats which come and go, whilst there are others which are permanent features of the landscape.


Input: In this paper, we describe the tools and techniques of one of the most sophisticated and persistent threats we track.


Input: We hope this will help victims identify intrusions and understand their need to improve defences.


Input: Cyber security is a collaborative effort–the operation described in this paper again raises the bar for the security community in their efforts to keep up with the attackers in cyber-space.


Input: When antivirus back-end classification platforms can not identify a malware family for an analysed malicious sample, they assign generic names, such as'' Trojan Horse'' or'' Agent''.


Input: The variant letters are also assigned automatically, by using hexavigesimal (or Base26) notation.


Input: That is, the variant letters are auto-assigned starting from'' A'', followed with'' B'', and so on until'' Z''.


Input: Next comes'' AA'','' AB'' and so on, until'' ZZ''.


Input: After that, the variant letters start from'' AAA'','' AAB'' and so on, until'' ZZZ''.


Input: Back in 2008 an unknown malicious file was discovered and auto-classified as'' Agent.BTZ'', meaning it was registered as unknown malicious sample #1,898 in an anti-virus classification system.


Input: It wasn't given an actual name, only a generic one.


Input: Meanwhile, internally the authors behind this malware were using their own naming systems-with specific titles for their file components and projects such as'' snake'','' uroburos'','' sengoku'', and'' snark'' used to denote variants of their framework.


Input: A recent report from German security company GData described a sample from the'' uroburos'' variant of this framework.


Input: Their report revealed the complex nature of this malware family, and showed that the operation behind'' Agent.BTZ'' has continued.


Input: As a result of this disclosure, we are also releasing our own technical analysis of the threat, including a timeline of known samples, known Command-and-Control (C & C) servers, and other indicators to aid investigators in discovering attacks.


Input: Reverse engineering of recent malware samples shows these to be much more advanced variants of Agent.BTZ, though still sharing many similarities and encryption methods with the original.


Input: Further investigation allowed us to locate related samples compiled between 2006 and 2014, and spanning across several distinctive generations.


Input: The first section of this report gives an overview of the samples collected, where they were reported and the timelines derived from their analysis.


Input: Snake's architecture turned out to be quite interesting.


Input: We have identified two distinct variants, both highly flexible but with two different techniques for establishing and maintaining a presence on the target system.

two distinct variants

a presence

the target system

establishing and maintaining

on


Input: In general, its operation relies on kernel mode drivers, making it a rootkit.


Input: It is designed to covertly install a backdoor on a compromised system, hide the presence of its components, provide a communication mechanism with its C & C servers, and enable an effective data exfiltration mechanism.

It

a backdoor

a compromised system

the presence of its components

a communication mechanism with its C & C servers

an effective data exfiltration mechanism

covertly install

hide

provide

enable

on


Input: At the same time, Snake exposed a flexibility to conduct its operations by engaging these noticeably different architectures.


Input: In the first model, the network communications are carried out from the userland-i.e.

the network communications

the userland

are carried out

from


Input: the area of the computer system where application software executes.


Input: In another model, the network communications are handled by a kernel mode driver-i.e.

the network communications

a kernel mode driver

are handled


Input: the area where lower level system code such as device drivers run.


Input: The choice of what architecture should be used may depend on a specific target's environment, allowing the Snake operators to choose the most suitable architecture to be deployed.

The choice of what architecture should be used

a specific target's environment

depend on


Input: In both architectures there is a kernel mode driver installed and a usermode DLL injected by the driver into the system processes.

a kernel mode driver

a usermode DLL

the driver

the system processes

installed

injected

into


Input: In both architectures, there is both 32-bit and 64-bit code involved.


Input: In order to distinguish between these architectures, we will call them the usermode-centric and the kernel-centric architectures respectively.


Input: The remainder of this report gives a detailed explanation of how the two Snake architectures embed themselves in the target system and communicate with the outside world.


Input: We have also provided a set of technical indicators in the Appendix to enable organisations and the security research community to identify compromises.


Input: In total we have collected over 100 unique files related to this espionage toolkit.


Input: Many of these were submitted to online malware analysis websites by victims and investigators over several years.


Input: In many cases the source country information of the submission is available.


Input: These allow us to visualise the distribution of countries where this malware has been seen: Whilst this view is likely to only be the tip of the iceberg, it does give us an initial insight into the profile of targets for the Snake operations.


Input: Other useful visualisations of the operations come from the compile timestamps.


Input: Below is shown a table with a count of the number of files in our sample set from recent years.


Input: Two samples compiled in late January 2014 show that this activity is ongoing.


Input: Plotting the day of the week in which the samples were compiled shows a now familiar pattern for analysts of modern cyber-attacks.


Input: The creators of the malware operate a working week, just like any other professional.


Input: The single sample in our set which was compiled on a Saturday is an outlier, but doesn't alter the conclusion.


Input: Similarly, plotting the hour of the day in which the samples were compiled reveals another human pattern–the working day.


Input: This has been adjusted to UTC+4 to show a possible fit to the operators' local time.


Input: The usermode-centric architecture of Snake is known to have been used from 2011 till 2014, with the most recent sample compiled on January 28, 2014.


Input: With this architecture, the Snake driver is mainly used to load the DLL module into the usermode processes, and then use that module for the communications.

the Snake driver

the DLL module

the usermode processes

that module

the communications

load

use

into

for


Input: One of the analysed samples exposed multiple debug messages and source control check-in logs.


Input: It is not clear why those messages were allowed in the deployed driver-possibly an operational security lapse.


Input: However, they give some insight into the internal structure of the source code.


Input: For example, the analysed driver gave away the following source file names: The source control check-in log examples, showing the names of the developers to be'vlad' and'gilg': It also exposed the project name of this particular variant as'sengoku': Now it's time to execute the driver and see what it does.


Input: When first executed, the driver creates device named \Device\vstor32 with a symbolic link \DosDevices\vstor32.

the driver

device named \Device\vstor32

a symbolic link \DosDevices\vstor32

creates

with


Input: This device is used for userland/kernel communications.

This device

userland/kernel communications

is used

for


Input: Next, it drops a DLL into the% windows% directory-the DLL is carried in the body of the driver as a binary chunk with XOR 0xAA applied on top of it, so the driver decrypts it first.

it

a DLL

the% windows% directory

XOR 0xAA

it

drops

applied

into

on top of


Input: Depending on the variant, the DLL is dropped either under a random name or a hard-coded name, such as mscpx32n.dll.

the DLL

a random name or a hard-coded name

is dropped

under


Input: The purpose of this DLL is to be injected into the user-mode processes.

this DLL

the user-mode processes

be injected

into


Input: Some variants of Snake carry the DLL modules that can be installed as a service, to be run within taskhost.exe or services.exe processes.

DLL modules

a service

taskhost.exe or services.exe processes

be installed

be run

as

within


Input: Next, the driver sets up the hooks for the following kernel-mode APIs: After that, it calls PsSetCreateProcessNotifyRoutine () in order to be notified whenever a new process is started.

the driver

the hooks

the following kernel-mode APIs

it

PsSetCreateProcessNotifyRoutine ()

a new process is started

sets up

calls

be notified

for

whenever


Input: The handlers of the hooks above along with the notification callback allow Snake to stay persistent on a system, being able to infect any newly created processes, and restore its driver file in case it gets deleted.

Snake

persistent on a system

any newly created processes

its driver file

it gets deleted

stay

infect

restore

in case


Input: Another set of hooks it sets is designed to hide the presence of the Snake components on the system: The driver then watches for all userland processes to see if they load any web pages.

Another set of hooks

it

the presence of the Snake components on the system

The driver

all userland processes

see if they load any web pages

sets

hide

watches

for

to


Input: As long as the user is not using the Internet, Snake stays dormant too, as there is no process that communicates with the web servers.

As long as

the user is not using the Internet

Snake

dormant

stays


Input: However, as soon as the user goes online, the driver intercepts that event and then immediately injects the malicious DLL module into the process that initiated connection (the browser).

as soon as

into

the user goes online

the driver

that event

the malicious DLL module

the process that initiated connection

intercepts

injects


Input: Once injected, the module initiates polling from one of the hard-coded C & C servers.

the module

polling

one of the hard-coded C & C servers

initiates

from


Input: The purpose of this behaviour is to blend Snake's traffic with the browser traffic, bypassing the firewalls, and keeping a low profile at the same time.

this behaviour

Snake's traffic

the browser traffic

the firewalls

a low profile

blend

bypassing

keeping

with


Input: By communicating from within a process that also communicates, even a technically savvy user will find it challenging to detect Snake traffic among legitimate traffic.


Input: The reason behind such difficulty is because modern web pages often fetch pages from the different web servers, including such data as additional scripts, CSS templates, advertising contents, analytics data, blogs, social networking data, etc.


Input: When intercepted with the purpose of analysis, such traffic may literally represent itself hundreds of DNS and HTTP requests made when a popular website, such as a news website is open.


Input: Hiding a few DNS/HTTP requests among busy network traffic allows Snake rootkit to stay unnoticed.

Hiding

stay

a few DNS/HTTP requests

busy network traffic

Snake rootkit

unnoticed

among


Input: In order to test Snake's communications with the C & C servers, and still being able to clearly distinguish its traffic, a small tool was built to generate GET request to a web server running on the analysed system.


Input: The tool was named as chrome.exe in order to trigger the malware communications.


Input: As long as the test tool named chrome.exe did not make any requests, its memory stayed pristine.


Input: There were no injections made by the driver.


Input: As soon as the tool made its first GET requests, the driver immediately injected a malicious DLL module in it, and that module started producing the following traffic: ↓ The domain names of the C & C servers it relies on are hard-coded in the body of the malware.

the driver

a malicious DLL module

it

that module

producing the following traffic

The domain names of the C & C servers

it

injected

started

relies on

in


Input: Some examples are given below, and a full list of known domains is given in the Appendix D: As seen in the traffic dump above, the malware first resolves the domain name of its C & C.

the malware

the domain name of its C & C

resolves


Input: Next, it fetches a file /D/pub.txt, and expects the server to respond with a string'' 1'', acknowledging it's active: Once acknowledged, it asks the server for a command, and the server returns a new command to execute: The command it receives from C & C above (swim.onlinewebshop.net) is encrypted.

it

a file /D/pub.txt

the server to respond with a string'' 1'', acknowledging it's active

it

the server

a command

the server

a new command to execute

The command

it

C & C

fetches

expects

asks

returns

receives

is encrypted

for

from


Input: In order to decrypt it, the malware first applies the XOR mask to the bytes that start from offset 0x40: An identical XOR mask was also used by Agent.BTZ.

decrypt

applies

it

the malware

the XOR mask

the bytes that start from offset 0x40

to


Input: Next, it calculates and confirms a CRC32 checksum within the command, further decrypts the data by using the Number Theory Library (NTL), and makes sure the command is destined to the current host by matching the ID field in it.

it

a CRC32 checksum

the command

the data

using the Number Theory Library (NTL)

the command is destined to the current host

matching the ID field in it

calculates and confirms

decrypts

makes sure

within

by

by


Input: Once decrypted, the malware interprets the received command, as reflected in the malware log below (the new C & C server address is highlighted in it): After that, the malware connects to the new C & C, asking it for another command: The command it receives is called UpLoad, so it uploads all the collected logs to the server, and then cleans out those logs: The files it uploads are stored inside its home directory% windows%\$NtUninstallQ [random] $, where [random] is a random number.

the malware

the received command

the malware

the new C & C

it

another command

The command

it

it

all the collected logs

the server

those logs

The files

it

interprets

connects

asking

receives

uploads

cleans out

uploads

to

for

to


Input: For example, Snake's home directory could be C: \WINDOWS\ $NtUninstallQ812589 $.


Input: The files within that directory are used by the rootkit to store configuration and log data.

The files within that directory

rootkit

configuration and log data

are used

store


Input: When decrypted with the same XOR key that was used by Agent.BTZ, these files expose the following contents: Analysis of the sample reveals that it supports 3 modes of fetching C & C commands.

it

3 modes of fetching C & C commands

supports


Input: • In the first mode, it relies on Windows Internet (WinINet) APIs, such as HttpOpenRequest (), HttpSendRequest (), InternetReadFile (), etc.

it

Windows Internet (WinINet) APIs, such as HttpOpenRequest (), HttpSendRequest (), InternetReadFile (), etc

relies on


Input: • In the second mode, it uses Windows Sockets 2 (Winsock) APIs, such as WSAStartup (), socket (), connect (), send (), etc.

it

Windows Sockets 2 (Winsock) APIs, such as WSAStartup (), socket (), connect (), send (), etc

uses


Input: • In the third mode, it works in the'pipe server' mode, when it passes the web requests it is interested in (as a client) to the pipe server that runs within Windows Explorer (explorer.exe) and/or Internet Explorer (iexplore.exe) processes.

it

the'pipe server' mode

it

the web requests it is interested in (as a client)

the pipe server that runs within Windows Explorer (explorer.exe) and/or Internet Explorer (iexplore.exe) processes

works

passes

in

to


Input: Memory pipes is a common mechanism for Inter-Process Communications (IPC).


Input: When the pipe server reads such requests from the pipes, it performs the web request on behalf of a client by using WinINet APIs, so it effectively serves as a proxy.


Input: The diagram below demonstrates the last,'pipe server' mode of Snake operation: The diagram illustrates the operation steps 1-4: 1 First, the malicious driver with the embedded DLL module injects that DLL into a system process, such as services.exe; once loaded, the DLL will function in the'pipe server' mode.

the malicious driver with the embedded DLL module

that DLL

a system process, such as services.exe

the DLL

the'pipe server' mode

injects

function

into

in


Input: 2 As soon as the driver detects a usermode process that goes online (e.g. a browser), it will inject malicious DLL module into it; depending on the operational mode, the DLL may start communicating with C & C directly.

the driver

a usermode process that goes online (e.g. a browser)

it

malicious DLL module

it

the DLL

communicating with C & C directly

detects

inject

start

into


Input: 3 In the'pipe mode' of operation, the injected DLL will start communicating with the pipe server by sending messages into the established inter-process communication pipes.

the injected DLL

communicating with the pipe server

messages

the established inter-process communication pipes

start

sending

into


Input: 4 Once the task of communication with C & C is delegated to the pipe server, it will start communicating with the C & C, bypassing the host-based firewalls that keep an infected system process in a white-list.

the task of communication with C & C

the pipe server

it

communicating with the C & C

the host-based firewalls that keep an infected system process in a white-list

is delegated

start

bypassing

to


Input: The reason behind the pipes usage is to'legitimise' the outbound web requests, forcing them to originate from the host firewall- friendly system services.

the pipes usage

the outbound web requests

'legitimise'


Input: Pipe server is a special mode of the injected DLL.


Input: In order to switch into that mode, a dedicated thread is spawned to listen for IPC messages received through the pipes.

a dedicated thread

IPC messages received through the pipes

is spawned

listen

for


Input: The memory pipes used by Snake are named as: Apart from GET/POST requests, the pipe clients (infected usermode processes) may also ask the pipe server to perform other operations on their behalf, such as saving data into a temporary file, copy/delete files, save configuration data into the registry under the aforementioned ShellCore value.

GET

POST requests

the pipe clients (infected usermode processes)

the pipe server

data

a temporary file

files

configuration data

the registry

the aforementioned ShellCore value

ask

perform

saving

copy

delete

save

into

into

under


Input: This delegation of tasks is designed to keep infected processes under the radar of the behavioural analysis tools for as long as possible.

This delegation of tasks

infected processes

the radar of the behavioural analysis tools

as long as possible

keep

under

for


Input: Another reason is to overcome account restrictions imposed on a browser process in order to be able to write into files/registry.

overcome

write

account restrictions imposed on a browser process

files

registry

into


Input: To delegate different types of tasks, the clients send messages to the pipe server using the following task identification headers: The usermode component of Snake communicates with its kernel-mode driver via a device called \\.\vstor32 (created under kernel as \Device\vstor32).

the clients

messages

the pipe server

the following task identification headers

The usermode component of Snake

its kernel-mode driver

a device called \\.\vstor32 (created under kernel as \Device\vstor32)

send

communicates

to

using

with

via


Input: In its communication protocol with the driver it uses the IOCTL code of 0x222038.


Input: To write data, it opens the device with CreateFile ('' \\.\vstor32''), then calls DeviceIoControl () API on its handle with IOCTL code of 0x222038.

write

opens

calls

data

it

the device

CreateFile ('' \\.\vstor32'')

DeviceIoControl () API

its handle

IOCTL code of 0x222038

with

on

with


Input: Configuration parameters along with the initial set of domain names are hard-coded within the body of the DLL.

the initial set of domain names

the body of the DLL

are hard-coded

within


Input: However, the data appears to be defined in the structures, so it is very likely the DLL could be generated by a stand-alone builder that'patches' the DLL with the new/updated list of C & C.


Input: Analysis of the commands performed by the malware suggests the following capabilities: Together, these commands provide complete backdoor functionality, allowing remote attacker full control over the compromised system.

the commands

the malware

these commands

complete backdoor functionality

remote attacker

full control over the compromised system

performed

provide

allowing


Input: The ability to update the driver and then rely on its communication capabilities means that the components of Snake are flexible, making possible the existence of the hybrid (kernel-centric and usermode-centric) architectures.

update

rely on

the driver

its communication capabilities


Input: For example, the virtual partitions are used by kernel-centric Snake variants, where the kernel-mode driver is responsible for the communications.

the kernel-mode driver

responsible for the communications

is


Input: If such a driver is installed via an update, the usermode component can be instructed to delegate the file upload task to the driver by copying all the necessary logs into the shared virtual partition, physically located on the compromised host and thus, accessible from kernel.

such a driver

an update

the usermode component

all the necessary logs

the shared virtual partition

is installed

be instructed

copying

via

into


Input: This particular architecture relies on a kernel-mode driver to carry out the network communications.

a kernel-mode driver

the network communications

carry out


Input: The usermode DLLs are still injected into the system processes to perform high-level tasks.

The usermode DLLs

the system processes

perform high-level tasks

are still injected

into

to


Input: The delivery mechanism is not known: it may be distributed via a thumb-drive, a phishing email attachment, or be delivered via an exploit across the network (e.g.

it

a phishing email attachment

an exploit across the network

be distributed

be delivered

via

via


Input: by using the reconnaissance tool that is explained later).


Input: Infection starts from a dropper penetrating into the compromised system where it is allowed to run.

Infection

a dropper penetrating into the compromised system where it is allowed to run

starts

from


Input: Once executed, the dropper installs the kernel mode driver in a pre-defined location.

executed

installs

the dropper

the kernel mode driver

a pre-defined location

in


Input: The dropper itself is 32-bit, so it will run both on 32-bit and 64-bit Windows OS (in WoW64 mode).


Input: On a 32-bit OS, it will install a 32-bit driver.

On

a 32-bit OS

it

a 32-bit driver

install


Input: On a 64-bit OS, it will install a 64-bit driver.

On

a 64-bit OS

it

a 64-bit driver

install


Input: The analysed 32-bit dropper creates a driver in the following location: However, different samples may use a different path and driver file name.

The analysed 32-bit dropper

a driver

the following location

creates

in