Category Archives: Italy

Kronos Banking Trojan and Geo-targeted attacks to Australia, Italy, United Kingdom and United States by Kelihos

I’m happy to welcome back guest-blogger Arsh Arora for another blog about the Kelihos botnet. This research is being conducted in our malware research lab at UAB by Arsh (PhD student) and Max Gannon, a malware researcher at UAB, who is about to graduate at the end of this semester and is looking for a job (hint to employers!)

Let’s start the story of the things happening with Kelihos botnet over the past couple of days. After laying low for past couple of weeks, it strikes back with authority. As observed previously http://garwarner.blogspot.com/2016/08/kelihos-botnet-sending-geo-targeted.html, Kelihos continue to geo-target different locations. First and foremost, it started by sending Money Mule spam to users in Italy, Australia, and the United Kingdom, if their email addresses ended with .it, .au, or .uk.  Second, it targeted users in the United States to download a social media management tool “Kuku.io.”  Because this was based on country-code targeted of “.us” it is more likely to impact people in education and local government, who are the main users of .us email addresses.  As all these things were happening, it sneaked a malicious word document from a website and uploaded it on the desktop without any indication to the user of the download. The malicious document eventually delivers Kronos malware which is considered to be same as Zeus malware which was sent by Kelihos in August http://garwarner.blogspot.com/2016/08/kelihos-botnet-sending-panda-zeus-to.html. This behavior was bizarre and never observed before this event.

Money Mule Spam

1. Australia – Spam for email addresses ending with “.au” 

Subject: Available Position
Hi,

cargoinvestmentmiltonlogistics@gmail[dot]com
.

2. Italy – Spam for email addresses ending with “.it”

<== Italian Money Mule spam || Google Translate ==>

Subject: Assunzione – collocamento al lavoro
Subject: Assunzione al lavoro
Subject: Cerchiamo collaboratori in vostra area
Subject: Cerchiamo collaboratori in vostra citta
Subject: Cerchiamo collaboratori in vostra provincia
Subject: Cerchiamo collaboratori in vostra regione
Subject: Lavoro part-time
Subject: Ricerchiamo collaboratori in gruppo operante a livello globale

3. UK – Spam for email addresses ending with”.uk”

Subject: Wow amazing girl..Read that article

Hey, what’s up? Actually, for that long time we haven’t been reaching each other, I’ve discovered a brilliant 
reading stuff. By now, 5 days I am stuck to it have already brought about 2,350 pound for me! I am talking about 
the soft trading market – it doesn’t require any specific skills at it, all is automated.
Flick the article through and write me something as you are in. By the way, get a chance to know how the stuff 
works with a demo!
Take the best out of it!
P.s. The article itself: hxxp://newsdep3-telegraph[dot]co/

.

Interesting observation here is the fake url for The Telegraph newspaper. The spammers are trying to trick the user to visit the following link in disguise of telegraph newspaper.

Following Domain name is hosted on 162[.]255[.]119[.]249 and has been dominantly hosting various phishing websites https://www.virustotal.com/en/ip-address/162.255.119.249/information/. Information found on Domain Tools is mentioned below.

Information from Domain Tools

Information about the registrant.

Domain Name:                              NEWSDEP3-TELEGRAPH.CO
Domain ID:                                   D153329223-CO
Sponsoring Registrar:                   NAMECHEAP, INC.
Sponsoring Registrar IANA ID:   1068
Registrar URL (registration services):  http://www.namecheap.com
Domain Status:                             clientTransferProhibited
Registrant ID:                               70G0X0PHDOIUNYLZ
Registrant Name:                          WhoisGuard Protected
Registrant Organization:               WhoisGuard, Inc.
Registrant Address1:                     P.O. Box 0823-03411
Registrant City:                             Panama
Registrant State/Province:             Panama
Registrant Postal Code:                 0
Registrant Country:                       Panama
Registrant Country Code:              PA
Registrant Phone Number:            +507.8365503
Registrant Facsimile Number:       +51.17057182
Registrant Email:                           76fb43b32d694e49a7cf070f148b6aae.protect@whoisguard.com

Some of the email subjects being used include

Subject – Look what i found
Subject – Why work for your money when your money can work for you?
Subject – Wow amazing girl.. Read that article

When visited the URL it redirected to
hxxp://www[dot]talegraph[dot]co[dot]uk/investor/ideas/from-zero-to-hero-mom-vanessa-makes-8000-per-month
As it can be observed it redirects to talegraph[dot]co[dot]uk, not telegraph, which is hosted in Netherlands.

Whois & Quick Stats
Dates Created on 2016-09-27 – Expires on 2017-09-27 – Updated on 2016-09-27  
IP Address 185.110.173.76 is hosted on a dedicated server  
IP Location Netherlands – Zuid-holland – Papendrecht – It-ernity Internet Services Bv
ASN         Netherlands AS21155 ASN-PROSERVE Amsterdam,, NL (registered Sep 11, 2001)
Whois History 4 records have been archived since 2016-10-01  
Whois Server whois.nic.uk

Webpage of talegraph As it can be viewed, following is a fake website portraying telegraph newspaper.

Social Media Management Tool

Kuku.io It is well-known that people of United States are crazy about social media and get super excited whenever a new app or a tool gets launched. Recently, everyone went crazy after the launch of Pokemon Go. This reaction forced the threat actors to change their way of attacks by focusing on the social media market. There were different malware being developed to exploit this weakness of the users. in a recent blog post, I mentioned how scammers were fooling people to buy cheat codes that never existed http://garwarner.blogspot.com/2016/07/pokemon-go-invitation-to-spammers.html. In continuation to these attacks, the Kelihos spammers are now inviting users to download Kuku.io, a social media management tool. The following spam is explicitly targeting email addresses ending with “.us,” because of the popularity and use of social media in the United States.

Email being spammed is as follows:
Subject: Need your opinion

Regards,
Michael
hello@kuku.company
.

Subject: Need your opinion
Subject: Need your feeback
Subject: Please let me know if this is of any interest

When visited the webpage mentioned.

Webpage of Kuku[.]io

Kronos Banking Trojan

Now let’s get to the sneaky part performed by Kelihos, which is dropping a malicious word document on the desktop. While doing his daily chores of running Kelihos malware and collecting the spam sent, Max  found that a document named ‘oldversion’ was placed on the desktop. It was strange and we have never seen this behavior previously.

Pictorial view of the document icon on the Desktop

On further scrutiny, we found that during the capture, Kelihos did a GET request to download the document.

hxxp://topswingusa[dot]top/qivi/oldversion[dot]doc – Get request https://www.virustotal.com/en/file/e6071f9205ed8540df9612d3f1a001f497931fc76dee43fee1e77750d00df256/analysis/

IP address of topwingsusa[dot]top – 167.88.160.146 https://www.virustotal.com/en/ip-address/167.88.160.146/information/
 
Virus total result of topswingusa[dot]top https://www.virustotal.com/en/url/56f79838c296ac58ab81cd6571187bc1abcb33f6cb395bcebfd9db966224d4dc/analysis/


An interesting string found in the process hacker was ”  UPLD save to: C:\Users\malware\Desktop\oldversion.doc”

Out of curiosity and to do more in-depth research, I decided to click the document. The document did not disappoint and asked for two of my favorite things when viewing a word document.

Enable Editing

 The document was opened in Protected view and after clicking ‘Enable Editing,’ it asked to “Enable Content.

Enable Content

After clicking ‘Enable Content,’ It spawns a child process with the name ‘24580.exe’ and then another child process was launched with the name of “svchost.exe”. The process killed itself and did not run properly.

Hence, I have to put it into OLLYDBG to get the malware working. On further observations in the debugger, I found that it was checking for virtual machine. Hence, it was vmware aware and killed itself instantaneously. But before it killed itself, I found the following string in the “svchost.exe” in the debugger, which mentioned the malware to be Kronos.

Hence, it can inferred that the following malware is Kronos. In order to be double sure, I repeated the process by downloading the malicious document and running it again.

This time I was able to gather more information, once the document is activated by ‘Enable Content,’ it grabs the downloader from the following url:
hxxp://topswingusa[dot]top/qivi/mswords2k8[dot]exe, 
which is hosted on the same IP 167[.]88[.]160[.]146. Once the file “mswords2k8[dot]exe was obtained, it spawned a third process named as “MSOSQM”, which was Kronos malware. 

On further scrutiny, I found that both the downloaders “24580.exe” and “mswords2k8[dot]exe” have the same MD5 hash, 547890EA5FD8374383E0663223B5A26F.

Downloader and Kronos malware

 Another interesting observation found in the debugger is presence of a string named “BOTID”

BOTID found in OLLYDBG

Researchers are still working on trying to find more about the significance of BOTID. Hopefully, everyone will be updated soon with the findings.

Continue reading Kronos Banking Trojan and Geo-Targeting from Kelihos→