International Security Conference "ZeroNights 2011" - http://www.zeronights.org/

1. Modern malware techniques for attacking
RBS systems in Russia
Aleksandr Matrosov
Eugene Rodionov

2. Who we are?
Malware researchers at ESET
- complex threats analysis
- development of cleaning tools
- tracking new malware techniques
- investigation of cybercrime groups
http://www.joineset.com/

3. Agenda
o Cybercrime trends in RBS
o Most prevalent threats and incidents
Win32/Shiz
 Win32/Hodprot
 Win32/Sheldor
 Win32/RDPdoor
 Win32/Carberp
o Carberp cybercrime group revenue

4. Overview
2010/11: years of attacks on Russian banks
• number of incidents has more than doubled compared to 2010*
Over 92%* of incidents involve banking trojans
Malware tailored to Russian banks and payment
systems
However!
• Can (and IS) used in other countries as well
*research report "The Russian cybercrime market in 2010: status and trends”
http://www.group-ib.ru/wp-content/uploads/2011/04/Group-IB_Report_Russian-cybercrime-market_2010_eng.pdf

6. Interesting facts about Russian bank fraud
These guys are still free!

8. Evolution of RBS trojans
o RBS Trojans 2009-2010: o RBS Trojans 2011:
 Win32/Shiz (2009)  Multiple updates
 Win32/Carberp  Growing incidents numbers
 Win32/Hodprot  ….
 Win32/Sheldor  Win32/Carberp with Bootkit
 Win32/RDPdoor

9. Cybercrime landscape (2010)

10. Cybercrime landscape (2011)

11. Cybercrime landscape (2011)

13. Win32/Spy.Shiz

14. Win32/Spy.Shiz detection statistics by month
Cloud data from Live Grid
August 2009 – November 2011

15. Win32/Spy.Shiz detection statistics by country
Cloud data from Live Grid

16. Win32/Spy.Shiz: stealing money

18. Win32/Hodprot

19. Win32/Hodprot detection statistics by month
Cloud data from Live Grid
July 2010 – November 2011

20. Win32/Hodprot detection statistics by country
Cloud data from Live Grid

21. Win32/Hodprot: antiforensics
Main module
Original sfcfiles.dll
Kernel - driver image
Loader code
C&C URLs

22. Win32/Hodprot: injecting payload
Winlogon Address Browser Address
Space Space
Setupapi.dll
Assemble Payload
Inject Payload
Update
Payload
sfcfiles.dll Payload
System Registry
User-mode
Kernel-mode
Inject Payload
Install & Load Assemble Payload
Driver
sfc.sys

23. Win32/Hodprot: C&C protocol
Win32/Hodprot C&C Server
Send request
(bot ID, integer)
Reply with updated Handle
modules and image to Request
execute
Update the bot’s
modules, run
downloaded Send Status
exeutable Information

24. Win32/Sheldor & Win32/RDPdoor

25. Win32/Sheldor and TeamViewer in action
1. Request cloud ID
2. Set cloud ID
3. Send ID to C&C TeamViewer
4. Malicious connection cloud
1 2
infected
4
computer
Win32/Sheldor
3
GET C&C
/getinfo.php?id=414%20034%20883&pwd
=6655&stat=1

26. Under the hood: DLL hooking
TeamViewer.exe
TV.dll
(proxy DLL)
TS.dll
(original TS.dll)

27. Malicious DLL call graph

28. Malicious DLL decompilation
Functions for calling
from original TS.dll
Load original TS.dll
Hook functions
C&C URL

29. Sheldor C&C panel

30. Win32/RDPdoor installation
infected Win32/RDPdoor
computer C&C
run dropper and send system information
1
authentication on C&C and provide Thinsoft BeTwin for installation
2
send status information
3

31. Stealing authentication data
1. Install GINA extension DLL
2. Display fake logon screen
3. Capture user name &
password
4. Send to C&C

32. Win32/Carberp

33. Win32/Carberp detections over time in Russia
Cloud data from Live Grid
January 2010 – November 2011

34. Win32/Carberp detection statistics by country
Cloud data from Live Grid

35. Self-protecting Functionality
Bypassing AV-emulators many calls of rare WinAPI functions
Code injection method ZwQueueApcThread()
ZwResumeThread()
Unhooking method checking first bytes of API function
body and deleting hooks
Command and string encryption custom encryption algorithm
Bot authentication on C&C file with authentication data stored on
infected PC
Network communication encryption base64( RC2(data) )
API function calls obfuscation custom hash algorithm
Detection of AV hooks comparison of the first original bytes
Bypassing static AV signatures appending random junk bytes to
dropped files
Hiding in the system hooking system functions
bootkit infector (September 2011)

36. Carberp going deeper since September 2011

38. Carberp going deeper since September 2011
real mode
Load MBR
real mode
Load VBR
real mode/
Load protected mode
bootstrap
code
real mode/
protected mode
Load
bootmgr
Target of
Rovnix & Carberp
real mode/
Load protected mode
winload.exe or
winresume.exe
Load kernel
and boot
start drivers

39. Carberp: Infected Partition Layout
o Carberp overwrites bootstrap code of the active
partition
o The malicious driver is written either:
 before active partition, in case there is enough space
 in the end of the hard drive, otherwise
MBR VBR Bootstrap Code File System Data
Before Infecting
Compressed After Infecting
Data
Malicious
Malicious Bootstrap
MBR VBR File System Data Unsigned
Code Code
Driver
NTFS bootstrap code
(15 sectors)

41. Interesting strings and investigation

43. Win32/Carberp: money stealing methods
Stealing techniques Functionality
Web-injects/Autoloads inserting the specified JS-code into HTML
(IE, FF, Chrome, Opera) returned by the online banking site
Backconnect backdoor loading on request special binary module
(RDP/VNC) (RDPdoor, custom VNC client)
Keylogger (based on WinAPI) recording keyboard events into logfile
ScreenSpy (based on WinAPI) saving screenshots into logfile
Grabbers (Form, FTP, Pass) loading on request special binary module
Custom plugins for RBS binary modules for specified RBS (sber.plug)

44. Win32/Carberp botnet control panel

45. C&C with stolen data

46. Cab-files with stolen data

47. Stolen data: BS-Client IB system

48. Stolen data: CyberPlat payment system

49. Stolen data: iBank IB system

50. Stolen data: SberBank IB

51. Stolen data: UkrSibBank IB

52. References
 “Cybercrime in Russia: Trends and issues”
http://go.eset.com/us/resources/white-papers/CARO_2011.pdf
 “Evolution of Win32/Carberp: going deeper”
http://blog.eset.com/2011/11/21/evolution-of-win32carberp-going-deeper
 “Hodprot: Hot to Bot”
http://go.eset.com/us/resources/white-papers/Hodprot-Report.pdf
 Follow ESET Threat Blog
http://blog.eset.com

53. Questions

54. Thank you for your attention ;)
Aleksandr Matrosov
matrosov@eset.sk
@matrosov
Eugene Rodionov
rodionov@eset.sk
@vxradius