File MD5: c2db982fccf8d4ce960a3727a53128f7
Virus Total 15/47 Detected as Generic Trojan
Not all malicious samples are after your data. Some simply want to redirect your browser. Often this is less about stealing your data, and more about getting ‘hits’ on their website. Sometimes it’s an easy fix, change your home page, and its fine. Other times it warrants a bit deeper of an investigation.
When I first want to analyze a sample I prefer to do a behavioral analysis. Obviously a static analysis can take time, and if management is beating down the door to get something fixed, or you just don’t have hours to kill, a behavioral analysis can be quick, and either provides enough information for a fix or to help direct your static analysis to save time.
One of the real benefits of the MAG2 is to shorten the behavioral analysis time. Even though a behavioral analysis is shorter than a static analysis, collecting the tools, running each tool through its own snapshot, and other things still take time. The MAG2 allows me to get a lot of that data in about a minute.
One of the drawbacks of most automated behavioral analysis tools, is the inability to simulate human interaction…
Click to enlarge
In this sample, the file itself wants to extract. Without some way to interact with the sample, we won’t be able to get a complete analysis. We could extract it ourselves and submit each file, but what if it does something during extraction we want to know about? Enter the Ghost plugin.
The MAG2 has a restful API that’s documented on a private repository in Github. One of the reasons we are using Github for our documentation is we can provide additional plugins, as well as allow our customers to share plugins they find useful. Ghost User is a MAG2 IntelliVM-plugin for interacting with Windows dialogue boxes and installers. The plugin will attempt to mimic a real user to close dialogue-boxes that may be preventing further execution of an application, and step through installers to install applications.
Of course, as expected, when running the sample, with the Ghost Plugin the data I got back was much more useful.
The information I am focused on is under the pattern matching results, and Other Resources. The reason that this sample comes back as a 6 is that it adds an autorun entry. This in itself is not necessarily that malicious, plenty of programs do that. But it is an interesting note.
Also under other resources, you will see a list of files. The main file I am focused on is the executable that was extracted, but I am always curious as to what network activity is occurring. So I proceed to take a look at the network activity.
Interestingly enough, for an extractor it reaches safeshared.com :80. When I did a whois it returned privacyprotect.org. Both are run out of Australia. Safeshared.com appears to be a file sharing service similar to rapidshare etc., but it does not appear to be working – basically returning a 404 error.
Then I took the executable that was saved off (47-0-thirdPartiesTemp.exe) and submitted it via MAG2 as well. It also came back as a 6 for the same reason, but it provided a lot more activity to go through.
The screenshot appears to be a Vietnamese website. Interestingly enough this executable also drops an executable. Taking a look at it the MD5 doesn’t match. There could be several reasons for this so I decided to see if the strings differed. I used BinText on the extractor, first extracted file and the executable that one drops to see where the changes were. First I noted that nothing was packed (always makes it easier), then Looking through the file with WinDiff It’s fairly obvious the file was extracted from the extractor, and the file the extracted file dropped is identical (string-wise) from the original extracted file.
So far the files don’t look that dangerous. Yet, there were some interesting things going on with network activity. Essentially it reaches out to safeshared.com(123.30.135.77) but if you go to safeshared.com it throws an nginx error. If you do an nslookup on the IP however, you don’t get a safeshared.com result you get
Digging into the pcap file I can see that it reaches out to safeshared.com and gets a 404 error:
So the first file is a simple extractor that tries to reach out to a dead site. It’s interesting that the site resolves to an IP belonging to a site in Vietnam, but going to the website, as is (Safeshared.com) doesn’t result in much… Ok that’s not interesting… but the file that gets extracted, also has a risk score of 6, yet there is a lot more going on, especially on the network. In fact 87% of the data extracted during running of this file is network activity.
The 120.138.69.x domain is the most interesting one because that’s stc.laban.vn which is the same one that safeshared.com refers to. And of course it’s the nosiest on the pcap file. After Name resolution the first attempt to communicate is to 120.138.69.21 (2.stc.laban.vn).Digging into the TCP Stream that appears to bring up the website. (GET statement)
The next interesting step is that the default laban.vn comes up (.77)
But again the website communication seems fairly straightforward.
After continuing along this path, it appears there is little dangerous activity inherent in the website.
(laban.vn is a popular site, at first I was checking it out in case there was some kind of redirects or hidden agenda, but I couldn’t find it on the site itself through the pcap files)
I thought the activity might change if I used a different browser, so I installed Chrome and set it as the default browser. However, it showed the same basic activity as in Internet Explorer. Essentially all this file appears to do is create a file in the same location as a shortcut to laban.bn and change the default browser home page to
http://www.laban.vn/?utm_source=ssh&u=405f94a5eaf3cfdec34fbf47fbcd65921c09
Which is the laban.vn with the u = file name. It also adds an autorun entry so that if you change the home page, when you reboot, all your browser’s home pages have been changed back to the laban site.
So it might seem that all this work just to learn that the file was a browser redirect with an autorun entry is a bit excessive. Essentially we got the information we needed in about a minute using the ghost plugin (Rating 6, Autorun entry). Beyond that, most of the research was conducted to confirm that there was nothing more dangerous in the file. When I was in IT, we would often get calls from users complaining about their browser home page changing, or the browser not going where they expected it to. Having information that indicated what I needed to fix in a minute or two would have been nice. In addition, combining the Malware Analyzer G2 with the Network Threat Discovery tool would provide a report before receiving a call from the user. This would allow me to restrict others from getting the file from the internet, containing the outbreak and allowing me to focus my time on more interesting network issues.
