Short background
Just recently, CSIS carried out a forensic analysis involving a Microsoft Windows client that was compromised in an attempt to conduct fraudulent online banking transactions. As part of the forensic task, we managed to isolate a signed binary, which we later identified as a new Carbanak sample.
The $1bn heist
Carbanak (aka Anunak) has been around for several years and it was highlighted in a report released by researchers at Kaspersky in February 2015 with the headline “The Great Bank Robbery: Carbanak cybergang steals $1bn from 100 financial institutions worldwide” (ref 1). As expected, such a colorful title would quickly draw the attention of international press and a few days later the story was headlining the media.
At the time when the Carbanak story broke into the media, several researchers from CSIS were attending the Kaspersky Security Analyst Summit (TheSAS2015) hosted in Mexico. We soon got very busy answering questions from concerned customers. As our investigation at that time progressed, it turned out, that none of our customers was affected by Carbanak. Unfortunately, this would not last forever. As stated earlier, during the last week, we uncovered a new variant of Carbanak. From our analysis, it comes clear that Carbanak has returned and has been confirmed targeting large corporations in Europe and in the USA. Attack methods are spear phishing.
The first new variant
As already mentioned, the new variant of Carbanak is digitally signed (more details on that follow later in the blog post). It was found on the compromised Windows 7 host at this location: C://Program//DataMozilla//svchost.exe. On Windows XP, the location would be: C://Documents and Settings//All Users//Application Data//Mozilla//svchost.exe. At the same time, it adds a runkey to registry, so that the code would be executed upon reboot of the system.
After having reversed the code, we are now able to confirm that the folder and the filename are both static and thus can be used as an IoC (Indicator of Compromise).
Carbanak injects itself into the svchost.exe process. In this way, it manages to hide its presence in memory.
As several other advanced data stealing threats, Carbanak utilizes plugins. The plugins are installed using Carbanak’s own protocol and communicating with a hardcoded IP address over TCP port 443. The two plugins downloaded during our analysis were “wi.exe” and “klgconfig.plug”. Both of them have already been mentioned in the Kaspersky report (ref. 2).
When communicating with the C&C, the sample in question registers the BOT with a predefined string: yamota0 – followed by a 16 bytes randomly generated string used as BOTID e.g.: “yamota0832ebfe80090bd64”. See screenshot below:
There are several differences between these new variants and the previously observed Carbanak specimen (ref 2). These include:
– new geographical targets
– a new proprietary protocol
– the use of random files (i. e. main component is static) and mutexes
– predefined IP address (previous variants were using domains)
Besides these, the binaries are almost identical with the previous Carbanak samples.
For one of the new samples, the C&C server can be tied to a well-known bulletproof hosting company.
Signed Carbanak malware
As shown below, this new variant of Carbanak was digitally signed using Comodo:
CN = Blik
O = Blik
STREET = Berzarina, 7, 1
L = Moscow
S = Moscow
PostalCode = 123298
C = RU
Certificate valid from 02-Oct-2014 till 03-Oct-2015
After some investigations, we located additional information related to the company “Blik”.
Company registration date: April 3, 2014.
Director: Chunyaeva Svetlana Alexandrova.
Company address: 123298, Moscow, street. Berzarina, 7, 1.
The registration information of the company states “Other wholesale” as the primary business activity of “Blik”. The organization also operates the following non-core activities:
– wholesale trade of timber and building materials
– wholesale trade of food, beverages and tobacco
– wholesale of fruit and vegetables
– wholesale of meat, poultry, products and canned meat and poultry meat
– wholesale of dairy products, eggs and edible oils and fats
– wholesale of alcoholic and other beverages
When searching further, we only managed to find the following domain related to this company: bliksco.com
Updated Date: 2015-04-01 17:55:18.274469
Creation Date: 2014-10-01
Registrant Name: Svetlana Chunyaeva
Registrant Organization: Blik
Registrant Street: Berzarina, 7, 1
Registrant City: Moscow
Registrant Postal Code: 123298
Registrant Country: Russian Federation
Registrant Phone: +7.4997030345
Registrant Email: admin@bliksco.com
One interesting question arises, as it sometimes does in cases like this: “why would a company working within this kind of business area ever need a code-signing certificate?”.
This brings us to several observations:
– The timeline between the dates of company registration and certificate issue could indicate that criminals have probably registered their own company using fake identity or a stolen passport
– This time, the criminals have obviously registered a real company instead of using a stolen certificate for code signing as they did previously as report by Kaspersky.
– We speculate that the main purpose of this company is to receive money from fraudulent transactions. As stated in the Kaspersky report, Carbanak-related transfers are rather huge. Possibly, they have registered a company and opened bank accounts in order to receive their stolen money while having full control of the transferring process.
Conclusions:
Carbanak is what we define as a financial APT. In its nature, it is very targeted and it is being deployed in small numbers. In this way, it tends to slide under the radar. We have observed at least four different new variants of Carbanak targeting key financial personal in large international corporations.
It is our intention to release a technical write-up on our analysis of Carbanak. Meanwhile samples have been shared with trusted entities to ensure that detection is deployed in order to eradicate the threat through various security solutions.
References
Ref 1:
http://www.kaspersky.com/about/news/virus/2015/Carbanak-cybergang-steals-1-bn-USD-from-100-financial-institutions-worldwide
Ref 2:
https://securelist.com/files/2015/02/Carbanak_APT_eng.pdf
// Yurii Khvyl and Peter Kruse, CSIS
Continue reading CSIS Blog: Carbanak returns→
