WARNING: Do Not Feed the Bears

WARNING:WARNING:
Do Not Feed the BearsDo Not Feed the Bears
Miroslav Štampar
(mstampar@zsis.hr; miroslav@sqlmap.org)
WARNING:WARNING:
Do Not Feed the BearsDo Not Feed the Bears
Miroslav Štampar
(mstampar@zsis.hr; miroslav@sqlmap.org)

BSidesLjubljana 0x7E1, Ljubljana (Slovenia) March 10th, 2017 2
ContextContext
Croatian Government CERT
Dealing with vast diversity of different
incidents (e.g. ransomware, defacements, DoS
attacks, etc.)
Most interesting (by far) are APT attacks
“Have you noticed anything strange with your
computer lately? -Nope. Though, IE with Twitter
is popping out here and there… and I don’t use
Twitter” (recent APT incident)
We are part of NATO and EU – hence, natural
target of “advanced persistent threats”

IntroductionIntroduction
In January got two (forwarded) suspicious
emails with question “was this an attack?”
August (Bulletin.doc - bigger) and November
(Operation_in_Mosul.doc - smaller) of 2016
Originally addressed to one “sensitive”
government institution, hence, we expected
the “unexpected”
Attachments were Microsoft Office documents
(.doc), regular attacking vector in this kind of
(spear) phishing attacks
In majority of cases, malicious Macros are
used, while in this case, there were no Macros

Emails (content)Emails (content)

Emails (headers)Emails (headers)

Emails (reverse DNS)Emails (reverse DNS)

Attachments (.doc / RTF)Attachments (.doc / RTF)

Initial findings (long hex strings)Initial findings (long hex strings)

Initial findings (CLSID)Initial findings (CLSID)

Initial findings (ShockwaveFlash)Initial findings (ShockwaveFlash)

Initial findings (hash/VirusTotal)Initial findings (hash/VirusTotal)

Dummy run (VM)Dummy run (VM)

Extracting OLE objects (OfficeMalScanner)Extracting OLE objects (OfficeMalScanner)

Decompiling SWF files (ffdec)Decompiling SWF files (ffdec)

Encrypted payloads (exploit + dropper)Encrypted payloads (exploit + dropper)

Decryption (LFSR) routine (Bulletin.doc)Decryption (LFSR) routine (Bulletin.doc)

Decryption/Loader routine (Operation_in_Mosul.doc)Decryption/Loader routine (Operation_in_Mosul.doc)

Payload “choice” (Bulletin.doc)Payload “choice” (Bulletin.doc)
Flash Player Version Embedded Binary Vulnerability
20.0.0.306 - 21.0.0.242 (Ver_)ExtSwf2 CVE-2016-4117
20.0.0.228 - 20.0.0.306 (Ver_)ExtSwf CVE-2016-1019
11.5.502.146 - 19.0.0.207 (Ver_)ExtSwf1 CVE-2015-7645

Vulnerabilities exploited (Bulletin.doc)Vulnerabilities exploited (Bulletin.doc)

Payload decryptionPayload decryption

Payload decompression (CWS/FWS)Payload decompression (CWS/FWS)

Payload (dbg) strings (Bulletin.doc)Payload (dbg) strings (Bulletin.doc)

CVE-2016-4117 (Bulletin.doc)CVE-2016-4117 (Bulletin.doc)

Payload “fetch” (Operation_in_Mosul.doc)Payload “fetch” (Operation_in_Mosul.doc)

Infection phase (Bulletin.doc)Infection phase (Bulletin.doc)

nshwmpfs.dll (runtime check)nshwmpfs.dll (runtime check)

nshwmpfs.dll (Carberp source)nshwmpfs.dll (Carberp source)

nshwmpfs.dll (string (de)obfuscation)nshwmpfs.dll (string (de)obfuscation)

nshwmpfs.dll (what it is all about?)nshwmpfs.dll (what it is all about?)
Reconnaissance (first stage) malware (aka.
JHUHUGIT)
Downloading, execution and deletion of
arbitrary files
Collects basic data about the infected system
and sends it (in encrypted form) to C&C
In case that C&C server and/or operator finds
the system “interesting” leaves command for
downloading of second stage malware
Second stage malware: SPLM (aka Xagent, aka
CHOPSTICK) and AZZY (aka. ADVSTORESHELL,
NETUI, EVILTOSS)

Appendix A: Servers (C&C)Appendix A: Servers (C&C)
accgmail.com (mail server)
213.202.214.148
servicecdp.com (C&C - Bulletin.doc)
87.236.211.182
uniquecorpind.com (C&C / exploits -
Operation_in_Mosul.doc)
62.113.232.196

Appendix B: Passive DNS / WHOISAppendix B: Passive DNS / WHOIS

Related workRelated work
Palo Alto Networks, “‘DealersChoice’ is Sofacy’s
Flash Player Exploit Platform”, Oct. 2016.
Palo Alto Networks, “Let It Ride: The Sofacy
Group’s DealersChoice Attacks Continue”, Dec.
2016.
FireEye, “CVE-2016-4117: Flash Zero-Day
Exploited in the Wild”, May. 2016.
SonicWall, “Adobe Type Confusion Vulnerability
CVE-2015-7645 Exploits in the Wild”, 2016.
Trend Micro, “A Look Into Adobe Flash Player
CVE-2016-1019 Zero-Day Attack”, Apr. 2016.

Questions?Questions?

WARNING: Do Not Feed the Bears

Recommended

Recommended

More Related Content

More from Miroslav Stampar

More from Miroslav Stampar (15)

Recently uploaded

Recently uploaded (12)

WARNING: Do Not Feed the Bears