CSIS News: The Rovnix reincarnation
Back in June 2014, we discovered a new malware campaign that was using a new DGA. This sparked our interest.
After unpacking, some of the samples that we retrieved contained an interesting debug string “ISFB” inside the binary code.
We assumed that this was related to Gozi2, as several other sources had already reported the same observations. However, after our investigations we discovered that the ISFB debug string is indeed rather the private name for Rovnix.
A description of Rovnix was already done by our friends over at ESET and can be found here: http://www.welivesecurity.com/2012/02/22/rovnix-reloaded-new-step-of-evolution/
The current version of Rovnix bootkit component has been removed and now only supports a user mode component.
Protocol
In the latest Rovnix variant, the author changed the protocol in order to avoid traffic detection by patterns. So now, it is generating a random file name, of which only the first letter is of importance. It can be one of the following three: “c” for config.php , “t” – for task.php and “d” – for data:
Data is sent with a random generated value encoded by base64:
Campaigns:
We have observed three campaigns, all of which are targeting countries in the EU.
Campaign 1: Poland
Sample 1:
MD5 3435c8ef4a12426347b2c92b35eada4a
Version 2.12.220
C&C:
Rovnix communicates back to its C&C using a POST request like the one provided below:
http://kingthand[removed by CSIS].biz/task.php?version=212220&user=[user ID]&server=12&id=1000&crc=9daa74
As you can see, the request is not encrypted. However, it is compressed as a CAB using “cabinet.dll”.
DGA (Domain Generation Algorithm)
Rovnix implements a DGA, which fits the description from the US Constitution on malware generating domains: http://constitution.org/usdeclar.txt
Sample domains:
accordinglytathdivine.com
operationlegislative.eu
brethavepeotaking.com
abolitbegunknown.eu
prerightlacoursewh.cn
governmentformsact.eu
overmartimeconstrains.cn
Sample 2:
MD5: 3a012ed8a0b5324b4d4a6decd4ba864d
Version of rovnix : 2.12.309
VT first submission 2014-06-13
This variant implements a secure protocol when communicating with C&C. Below, a small snippet for illustration:
https://accordinglytath[removed by CSIS].com/tvbirkod.php?jacwsn=
Y3B3ZWM9ZWFxeXgmdmVyc2lvbj0yMTIzMD
kmdXNlcj0xNzZmZjhiMDc3NTc2YWNlYzEyYzliM2U4MjJiNzg3NiZzZ
XJ2ZXI9MTImaWQ9NzEyODg5JmNyYz1lMmFmJndkYXRhPTIwMTQwNzIy
Instead of encrypting the communication, it encodes the parameter value using base64.
Decrypted string:
lewev=kkmaybjia&version=212309&user=[user ID]&server=12&id=712889&crc=157cf&wdata=20140722
Sinkhole heat map for campaign 1:
Campaign 2: Fast Flux
MD5: 1b3ccd2b97c0544ecc1c4929bcdb2ef1
746e93b066c968572c415e2d19be95b0
C&C musicvideo[removed by CSIS].ru which is the old C&C, now subsided by goliath[removed by CSIS].com
As compared to the previous campaigns, in the recent ones, the criminals added encryption to protect the communication with the C&Cs.
BOT version changed to “version=2.12.356”.
Campaign 3: Norway
Currently, we are undergoing an investigation, in which the target of the attacks is Norway. This specific campaign is related to Rovnix Version 2.11.295 and 2.11.319.
This campaign differs from the above in the following ways:
– added key for encryption
– removed CAB compression
We assume this version is mainly used for debugging and testing webinjects.
C&C Panel
In the current campaign targeting Norway, a new version of the control panel, dubbed “IAP”, is used. The C&C panel was probably rewritten and renamed after a bug affecting the previous version was publicly reported. We managed to obtain a manual for setting up the panel, which is written in Russia.
Translated to English:
Project IAP, version 1.0 beta
Introduction
IAP project is a web-control panel for managing and controlling the product ISFB (hereinafter – the client). More information about the project can be found in the user manual. This document only describes the installation process of the panel on the server.
Note: this document does not cover issues of optimization and server settings for maximum performance. These settings should be made separately.
And that concludes it for now. Rovnix has rebooted!
We have added detection for this malware to Heimdal PRO and corporate and are blocking the malicious domains in the CSIS Secure DNS solution.
Research credit: Yurii Khvyl, CSIS eCrime Unit 2014.
