Flash Update: Emotet Gang Distributes First Japanese Campaign

Cofense Intelligence™ has identified yet another change in Emotet’s behavior, this time distributing a campaign targeting Japanese-speaking recipients. The messages, which reference potentially overdue invoices and the payments thereof, deliver a macro-laden document, as per Emotet’s modus operandi. Figure one shows an example email from this campaign.

Diversifying their target-base is the latest link in an ever-lengthening chain of updates and refinements being pushed by the actors behind Emotet. The targets in this campaign include Japanese academic institutions, demonstrating a keen interest in Emotet securing a presence in such networks worldwide.

Appendix

Subject Lines

特別請求書
三月發票
確認して承認してください。
請查看和 批准。 謝謝。
請求書

 Attachment Names

878345912 99590954.doc
953830038_784779.doc
125469441531_79909831.doc
1379110773-877347.doc
1994740003_23358762.doc
24239118_62193073.doc
31021154 71136771.doc
35404060839-51945433.doc
517044779-87996292.doc
64123575263 958618.doc
72239600 553010.doc
75446103-4089070.doc
7690905434_609835.doc
823522415 83838965.doc
86726152984 4077671.doc
97016848095 4035273.doc
00209430800-791240.doc
01341161_9221765.doc
04546449854 46414589.doc
10433741_1976807.doc
1105119866-989027.doc
12129058435 35307309.doc
1375335111_2342554.doc
13826610090_89267548.doc
18009110 429772.doc
18965548-228698.doc
19529643 07207376.doc
20080657431-132300.doc
2094899952-633559.doc
22789621095 667097.doc
28025325_9781072.doc
31555902_50732534.doc
329298339962-7428084.doc
3405249239-0494889.doc
3696903556_82472490.doc
369955609499_6558583.doc
39032869312-95552314.doc
424078934718-386196.doc
4302447799_071604.doc
44498431-49581333.doc
445993000_8728570.doc
459894237 3920280.doc
48513288 3409281.doc
51036407549_224907.doc
514855331 4861472.doc
5256872379_032431.doc
52981800501_34239839.doc
59622012497-3273399.doc
60475231104 37366668.doc
6325401702 834277.doc

Attachment Hashes

27605401f9d2948e6a86c98457485dd7
4694bfed342c109a9bc54319a93a40bf
51177c2465eec69dc1a7c3cecaafd541
0fedcdc0d340a47555676f25ee12e8a2
691b1890521138b049edbf0e6cb09e7b
6f96482f2d2a78b02686efbcfae8138b
48f66f4b02fbe277282bac5467aba344
9b3aa6c52c788d356ab032d342270eed
1090395626b52579023a1cfd87a48dd9
3ad0040b48e62e9ca22d52a68de0966e
4dc61c605083d3fd32d69529ea14d0db
5c5d24b49c33b147a0344229a127b1cd
249dd3be9d101354015460ead19f0fa3
929116540242d88367af42f66e1a0336
ccfec8b2f804b553deb2193772e03785

Payload URLS

hxxp://garammatka[.]com/cgi-bin/o569U/
hxxp://rinconadarolandovera[.]com/calendar/5n5WY/
hxxp://gamvrellis[.]com/MEDIA/heuMx/
hxxp://hadrianjonathan[.]com/floorplans/vOec/
hxxp://warwickvalleyliving[.]com/images/wmGN/

Payload Hashes

69a5838744d6aa7b8f1d08b6e36d6844

C2s

187.188.166.192:80
88.215.2.29:80
187.137.162.145:443
65.49.60.163:443
45.33.35.103:8080
43.229.62.186:8080
165.227.213.173:8080
210.2.86.72:8080
192.155.90.90:7080
88.97.26.73:50000
190.117.206.153:443
185.86.148.222:8080
187.189.210.143:80
67.241.81.253:8443
200.114.142.40:8080
107.159.94.183:8080
190.147.116.32:21
138.68.139.199:443
219.94.254.93:8080
77.44.16.54:465
200.90.201.77:80
71.11.157.249:80
192.163.199.254:8080
144.76.117.247:8080
69.163.33.82:8080
109.73.52.242:8080
5.9.128.163:8080
189.225.119.52:990
62.75.143.100:7080
109.104.79.48:8080
181.29.186.65:80
200.28.131.215:443
190.192.113.159:21
89.211.193.18:80
189.205.185.71:465
181.29.101.13:80
176.58.93.123:8080
82.226.163.9:80
196.6.112.70:443
92.48.118.27:8080
72.47.248.48:8080
200.107.105.16:465
23.254.203.51:8080
154.120.228.126:8080
213.172.88.13:80
51.255.50.164:8080
201.217.108.155:21
197.248.67.226:8080
139.59.19.157:80
66.209.69.165:443
91.205.215.57:7080
99.243.127.236:80
136.49.87.106:80
186.139.160.193:8080

Filename Regex

\d{6,12}[-_\s]\d{6,12}\.doc

Cofense continues to closely track Emotet’s evolution. Watch this space for further updates. To stay ahead of emerging phishing and malware trends, sign up for free Cofense™ Threat Alerts.

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.

Emotet Update: New C2 Communication Followed by New Infection Chain

CISO Summary

On March 15, CofenseTM Research reported that the Emotet botnet is changing the way it communicates, in a likely attempt to evade malware detection. Since then, Cofense IntelligenceTM has seen the same trend: Geodo-Emotet isn’t relying on cookies to make certain requests, instead performing HTTP POSTs to what seems to be the C2. Baking requests into cookies is a time-honored and easily detected pattern of  behavior. Switching this up makes it harder to see when the malware is calling home.

Moreover, Geodo-Emotet is now using a new infection chain, utilizing JavaScript files as droppers instead of macro-packed Office documents. These changes in behavior and delivery methods are the threat actors’ latest attempts to keep ahead of network defenders. They will very likely require security teams to adjust—once more.

Full Details

Cofense Intelligence has observed a change in the way that the Emotet botnet communicates, along with  the use of a new infection chain. In past versions, a compromised client would typically perform a GET request with data contained in the cookie value. As of approximately 11pm UTC on March 14th, this changed. The clients have begun to perform HTTP POST’s to what appear to be their C2’s. An educated guess: the primary driver behind this transition appears to be an attempt to bypass established detection methods. In tandem with this update, Geodo has begun experimenting with delivering its binaries with JavaScript files acting as droppers, and not via Office documents laden with macros as has been most common.

Historically, Geodo has passed data to its C2 using the Cookie field of the HTTP header. Information about the system, as well as identifiers, would be encrypted, wrapped in Base64 and added to the HTTP header before transport. This was a consistent and easily identifiable pattern of behavior, which led to near universal enterprise detection. Figure 1 shows an example of this exfiltration method.

Figure 1: An example of classic Geodo C2 comms using the Cookie field. Source: app.any.run

Despite being a valid and oft-used header field, there are several other tells – such as direct communication with an IP address for which no DNS resolution was performed. This, when combined with the cookie, is an easy way to identify a Geodo infection calling home.

The latest iteration of Geodo, however, has transitioned away from this legacy method to submitting data to its C2 via HTTP POST as a form. Figure 2 shows an example of this updated communication method.

Figure 2: The new method of C2 comms

Experimenting with JavaScript

Geodo operates various tiers of payload distribution by using payload-agnostic droppers and relying on the Windows file-type handlers to correctly execute what is downloaded. This means that payloads can be hot-swapped at any point during a campaign. This behavior was observed late in 2018 when a payload location, for a short period of time, swapped a Geodo executable for that of QakBot. By making the payload system agnostic, the actors behind Geodo can experiment with varying payloads without affecting the overall integrity of the infection chain. Despite the sophistication and robustness of the Geodo delivery infrastructure, the JavaScript payload observed by Cofense Intelligence was minimally obfuscated and immediately legible to an experienced eye. If one traces the execution, though, things begin to become a little bit murky. Figure 3 shows a snippet of the obfuscated dropper, verbatim.

Figure 3: The obfuscated payload showcasing cleartext strings

After deobfuscation, the flow of the code is somewhat easier to interpret. The code is broken out into 5 distinct functions, with two anonymous functions—one at the head and one at the tail—responsible for execution. Figure 4 shows the first two functions and an array.

Figure 4: Two functions responsible for shuffling an array and retrieving an element by index, respectively.

The shuffling function is likely there to slow down manual analysis of the file. It could also be used to defeat unsophisticated emulation techniques. The second function simply returns an item from an array by its index.

The next two functions, seen in figures 5 and 6, are responsible for downloading and response code verification, and looping through available URLs, respectively.

Figure 5: The code responsible for downloading payloads and verifying the response code

Figure 6: Looping through five URLs, and attempting to execute the retrieved payload

Although the dataset is entirely too small to accept as correlation, the use of 5 payload locations is in line with the standard Geodo modus operandi. During analysis, it was noticed that one of the payloads was not like the others, however. Figure 7 shows the rather interesting subject matter returned during analysis of the payload locations.

Figure 7: A blog page returned in lieu of a binary payload.

Figure 8 shows the code responsible for finding the path of, and writing files to, the %temp% directory.

Figure 8:  The dropper generates a pseudo-random filename as which to write the file

Figure 9 is the code responsible for kicking off the main functions of the script.

Figure 9: The code responsible for starting the download and execute operations. Comments added for clarity

With routine changes in behavior and delivery methods, Geodo’s operators consistently find ways to evolve how the botnet behaves—always attempting to stay ahead of the cat-and-mouse game they play with network defenders. The change in how form data is passed will almost certainly allow Geodo to overcome certain detection technologies, requiring immediate retooling. Identifying a highly dynamic family, such as Geodo, requires highly agile security infrastructure coupled with responsive threat intelligence.

To stay ahead of emerging phishing and malware trends, sign up for free Cofense Threat Alerts.

 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.

This Phishing Campaign Spoofed a CDC Warning to Deliver the Latest GandCrab Ransomware

CISO Summary

Cofense IntelligenceTM reports that threat actors have spoofed a CDC email—this one warns of a flu epidemic—to deliver an updated variant of GandCrab ransomware. Besides competing for a new low in predatory cyber-crime, the phishing campaign follows the public release of a decryptor tool for infections of recent GandCrab versions, through version 5.1. The fake CDC email contained version 5.2, which renders the decryptor tool ineffective.

Though ransomware has dropped off over the past year, the authors of GandCrab are still pushing out frequent, powerful updates.  GandCrab is the last of the infamous “ransomware as a service” threats. The extent to which its creators make upgrades, parrying and thrusting with security researchers, shows it’s still a very real weapon for revenue-hungry criminals.

Full Details

Recent updates to GandCrab Ransomware demonstrate that its operators remain committed to the malware’s effectiveness and are prepared to make urgent changes to overcome disruptions. Shortly after a coordinated public release of a decryptor tool for infections of GandCrab versions 5.0.4 through 5.1, Cofense Intelligence observed GandCrab v5.2 campaigns that rendered the tool ineffective.  In a recent phishing email delivering GandCrab, a fabricated flu epidemic alert from the Center for Disease Control (CDC) was crafted to terrify recipients into opening an attached document. Far from receiving potentially life-saving instructions, the Office document was laden with macros, coded to download and execute a copy of—you guessed it— GandCrab v5.2.

Natural disasters, global geopolitical events, and pandemics are perfect narrative drivers for threat actors seemingly devoid of conscience, tact, or taste. Self-preservation is a human imperative, and such narratives that evoke fear and urgency are potentially more effective than those exploiting greed, empathy, or curiosity, other typical phishing narratives.

Coughs and Splutters

Despite leveraging a powerful concept, the execution of the observed campaign leaves much to be desired. Figure 1 shows the body of a typical message from this campaign.

Figure 1: a typical message observed during this campaign

Ostensibly, the message is well-structured, somewhat professional and believable. However, a closer read would note the grammatical errors and unusual statements. The content of the attached document continues this trend, with such preposterously low effort as compared to the effort put into the phishing email. Figure 2 shows the content of the document, displayed to the user while the macros are busy downloading and executing GandCrab.

Figure 2: the content of the document, typically deployed as a decoy.

In scenarios that leverage weaponized documents as the attack vector, threat actors often disseminate believable content to distract the user while whatever required background processes run.

Where’s Trik?

A noticeable deviation from the recent standard GandCrab protocol is the absence of an intermediate loader. Since Feb 2019, all phishing campaigns that ultimately served GandCrab did so via Trik, a spambot with pretentions of data-stealer. Certainly not a wholly unique occurrence, it does reverse a trend that had been forming.

Despite ransomware becoming less and less lucrative, the actors behind GandCrab continue to push out extremely frequent and pertinent updates. On February 19th 2019, Bitdefender released a decryption tool for GandCrab V5.1. Later that same day, it came to light v5.2 – a version for which no available decryption utility would work – had already been released, seemingly in direct response to the decryption utility.

GandCrab is the last great bastion of the ransomware-as-a-service world. Its frequent updates, active engagement with security researchers, and novel abuse of vulnerabilities and weaknesses makes it a very real, and potentially very devastating, threat. By appealing to fear and self-preservation, this campaign highlights to what lengths threat actors will go to generate revenue.

To stay ahead of emerging phishing and malware trends, sign up for free Cofense Threat Alerts.

IoCs

Flu pandemic warning.doc        054607600b11e09fa74aa39c790357d6

perdaliche.exe                         b47b281a8d1f227d6a7f48f73192e7ed

hxxp://gandcrabmfe6mnef[.]onion/

hxxps://www[.]kakaocorp[.]link/data/images/kadeheme[.]jpg

hxxp://www[.]kakaocorp[.]link/news/image/kazuzu[.]bmp

hxxp://210[.]16[.]102[.]43/perdaliche[.]exe

 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.

 

The Malware Holiday Ends—Welcome Back Geodo and Chanitor

CISO Summary

Even cybercriminals knock off for the holidays. Then in January, it’s back to work. We all have bills to pay.

This past holiday season, including the Russian Orthodox Christmas which fell on January 7, threat actors cooled their heels and malware campaigns dipped. But with the holidays over, threat actors are back in action. Chanitor malware campaigns are spiking, at even higher levels than a year ago, and Geodo/Emotet campaigns have been surging too.

In 2018, Cheap and Easy Malware Flooded Corporate Inboxes

CISO Summary

Sometimes it’s the simple things that make life hard. In 2018, over 2/3 of unique malware campaigns Cofense IntelligenceTM observed were simple, inexpensive “stealers” or remote access trojans (RATs). With exceptionally low barrier-to-entry—an email account or website can handle distribution and communication—these malware types make data theft a viable career choice for threat actors without the skills to use more advanced varieties.

A Staggering Amount of Stolen Data is Heading to Zoho Domains

After last month’s brief domain suspension of Zoho—which resulted from an insufficient response to reported phishing abuse— Cofense Intelligence™ has uncovered Zoho’s connection to an extremely high number of keylogger phishing campaigns designed to harvest data from infected machines. Of all Keyloggers analysed by Cofense, 40% used a zoho.com or zoho.eu email address to exfiltrate data from victim machines.

Recent Geodo Malware Campaigns Feature Heavily Obfuscated Macros

Part 3 of 3

As we mentioned in our previous overview of Geodo, the documents used to deliver Geodo are all quite similar. Each document comes weaponised with a hostile macro. The macros are always heavily obfuscated, with junk functions and string substitutions prevalent throughout the code. The obfuscation uses three languages or dialects as part of the obfuscation process: Visual Basic, PowerShell, and Batch.

Twin Trouble: Geodo Malware URL-Based Campaigns Use Two URL Classes

Part 2 of 3

As discussed in our prior blog post, URL-based campaigns – that is, campaigns that deliver messages which contain URLs to download weaponised Office documents – are by far the most prevalent payload mechanism employed by Geodo. Indeed, analysis of ~612K messages shows just 7300 have attachments; a trifling 1.2% of the total. The structure of the URLs falls into two distinct classes. Cofense Intelligence™ analysed a corpus of 90,000 URLs and identified 165 unique URL paths. There are two distinct classes of URLs employed by Geodo. A detailed breakdown of these URL structures follows. 

Into a Dark Realm: The Shifting Ways of Geodo Malware

The Geodo malware is a banking trojan that presents significant challenges. For starters, it conducts financial theft on a vast scale and enables other financially driven trojans. Also known as Emotet, Geodo has a rich history, with five distinct variants, three of which are currently active according to Feodo Tracker. Geodo’s lineage is incredibly convoluted and intertwined with malware such as Cridex as well as the later iterations known as Dridex.

This blog is the first of a CofenseTM three-part series on Geodo. Our analysis of Geodo focuses not on code analysis, rather on observed behaviours, infrastructure choices and proliferation. We note there has been an upward trend of education and government-based mail account credentials being compromised and used to further distribute Geodo. Further, we investigate message content and its focus on financial themes and narratives.

Future blogs will dive into the technical details of the URL structures prevalent in Geodo campaigns and will feature an in-depth analysis and deobfuscation techniques for the multi-layered macro code found within these documents.

Trends

Geodo has been steadily building momentum during 2018; after a quiet first quarter, campaigns involving Geodo have increased significantly both in frequency and density. Cofense Intelligence™ is seeing more consecutive days of campaigns, as well as more campaigns per day. Chart 1 details the year-to-date trends of Geodo as tracked by Cofense Intelligence.

Chart 1: The yearly trends of campaigns involving Geodo or its derivatives.

 A very recent change in Geodo’s behavior has seen the banking Trojan move away from its stealer roots and move towards the loader space. Recent campaigns have seen Geodo conditionally deliver either TrickBot or Zeus Panda, both of which would be considered competitors to Geodo’s banking functionality. The actors behind Geodo had been testing the water of competitor delivery as far back as March 26th, 2018, where a campaign delivering Geodo via weaponised Microsoft Office documents led to a further infection of Zeus Panda (See TID 11199). The authors of banking trojans are continually pushed to combat and overcome evolving financial security measures, such as Multi-Factor Authentication (MFA) and software-based security solutions. This arms-race could well be a motivator for the actors behind Geodo’s distribution having moved to the long-term revenue strategy of leasing out their botnet as a loader platform.

Geodo overwhelmingly favours an infection chain of:

Malicious URL → Downloaded Office Document → Macro → Geodo.

Geodo heavily favours both package delivery notices and financial institution-themed campaigns. Figure 1 is a world cloud based upon all Geodo campaigns observed by Cofense IntelligenceTM since tracking began. Figure 2 details campaigns observed strictly in 2018.

Figure 1: A word cloud generated from subject lines captured since tracking began.

Figure 2: Geodo campaign subject lines identified via tracking and botnet injection

Over time, Geodo has expanded from a propensity towards delivery-themed campaigns (spoofing companies like DHL, FedEx, and UPS), to Banking and financial narratives. However, this new focus does not preclude the tendency to spoof legitimate institutions, such as Bank of America and Chase bank. Chart 2 details the breakdown of campaigns throughout 2018, by [imitated] brand.

Chart 2: A breakdown of brands being spoofed by Geodo in 2018. Note: Generic Malware Threat is assigned to campaigns that do not imitate a legitimate entity or organisation. Note: the redacted entry is a large banking entity.

Delivery

Geodo is a self-perpetuating bot. Once running on a machine, it actively begins to spam copies of itself to a victim list retrieved during one of its many check-ins to a plethora of C2 nodes, as well as addresses harvested directly from local contact lists. Typically, the messages sent by an infected host will contain either a URL from which a potential victim can download a weaponised Office document, or it will have that type of document attached directly to the message.

Message Structure

Geodo uses a subtle marker to track which bots are delivering messages on behalf of the actor(s) behind the campaigns. The Message-ID field of each message contains an identifier which can potentially be used to identify which bot sent a particular message. At this moment, the structure of the message ID is:

Identifier.hash@domain

<20 numeric characters>.<16 hex characters>@<recipient domain>

A more literal example could be:

11223344556677889900.0123456789ABCDEF@recipient-domain.com

The identifier is a unique number assigned to each message as it is generated and sent by a bot. We have observed the identifier change as a bot progresses through its assigned list of recipients, then subsequent campaigns, as the bot becomes active again. Despite not changing linearly or sequentially, the general trend of these identifiers has seen the character count increase from 15 to 19-20.

There are several key pieces of data that can guide us toward some likely reasons for this behavior:

  1. The identifier ranges are not unique to each bot – multiple bots can have overlap within the same range.
  2. Identifiers do not always increment sequentially. This is true across multiple bots.
  3. Since tracking began, the identifier size has risen consistently from 15 bytes, up to 19-20 bytes.
  4. There are never any identifier collisions, even across different infections.

These four points lend credence to the supposition that these identifiers not only serve the functional purpose of a Message-ID (to act as a globally unique identifier of a message), but also allow the actors behind Geodo to track which bot is sending which message. By seeding recipient lists with attacker-controlled email addresses, it is possible to programmatically identify which bots are not sending messages as expected, and could be compromised, offline or otherwise in an undesirable state. With this information, attackers may be able to figure out which bots are legitimate infections, and which are researcher-controlled, thus giving them the capability to selectively send bogus templates or data to these compromised nodes.

The second part of the Message-ID structure is a 16 character hex string. As with the identifier, each hex string is unique to the message, meaning it is most likely a hash of some kind.

The final part of the Message-ID is simply the recipient’s own domain.

URLs

URL-based campaigns – that is, campaigns that deliver messages which contain URLs to download weaponised Office documents – are by far the most prevalent payload mechanism employed by Geodo. Indeed, analysis of ~612K messages shows just 7300 have attachments; a trifling 1.2% of the total. The structure of the URLs falls into two distinct classes. Cofense Intelligence analysed a corpus of 90,000 URLs and identified 165 unique URL paths.

There are two distinct classes of URLs employed by Geodo. A detailed breakdown of these URL structures will be discussed in an upcoming blog.

Chart 3: A breakdown of the top 10 URL tokens extracted from the 1000 most recently observed URLs.

A typical email from a URL-based campaign can be seen in Figure 3. Heavily contrasting TrickBot’s focus on social engineering, Geodo campaigns are fairly often lacking in any genuine attempt at brand imitation, beyond merely stating a name and perhaps a disclaimer.

Figure 3: An example of a Geodo email delivering a URL.

Figure 4 details the type of network activity that might occur, should a victim click on a link in one of these messages. When clicked, the user’s default browser is opened, and the download occurs directly. In the case of Google Chrome, the user typically will receive multiple warnings that the file being downloaded is hostile and requires multiple steps to allow the download to finish. Figures 5 and 6 details this process.

Figure 4: A Wireshark capture of the HTTP conversation after a live link is clicked.

Figure 5: A warning bar at the base of the Google Chrome browser warns the user the file is dangerous.

Figure 6: The user is required to click “Keep Dangerous File” followed by “Keep anyway” before Chrome will release the quarantined file.

Despite Chrome doing an admirable job of identifying some of the malicious documents, the permutations employed by the Geodo actors allows a significant number of documents to pass by unnoticed. Further stymying the malicious actors’ efforts: the downloaded documents are tagged with a “MotW” — or “Mark of the Web” – which, as seen in Figure 7, can potentially require further engagement by the recipient to finally get the file opened. A ZoneID of 3 indicates that the file is from the Internet Zone.

Figure 7: The downloaded documents are tagged with a Mark of the Web.

Attachments

Although comparatively rare, Geodo campaigns occasionally deliver attachments instead of malicious URLs, but the narratives and themes used for these campaigns do not noticeably differ. Figure 8 shows an example of a message from an attachment-based campaign. This campaign used a generic theme with no identifiable company or entity being imitated.

Figure 8: An example message from an attachment-based, Geodo campaign.

Digging into a corpus of ~7500 filenames (examples of which are presented in Table 1) shows a very distinct set of naming conventions. These can mostly be described by a regular expression, with a few caveats.

Table 1: Example filenames used during very recent Geodo campaigns.

The naming structure bears very close resemblance to certain segments of URLs, described in detail in the next blog in this series. Although drawing any conclusions from this would be fallacious, it could potentially be used to predict the structure of a successor campaign.

Weaponised Office Documents

Regardless of which vehicle was used as the transport medium, the documents are invariably, intuitively similar. Each document comes weaponised with a hostile macro. The macros are always heavily obfuscated, with junk functions and string substitutions prevalent throughout the code. The obfuscation uses three languages or dialects as part of the obfuscation process: Visual Basic, PowerShell, and Batch.

An upcoming blog will provide an in-depth analysis of the deobfuscation techniques for the multi-layered macro code found within these documents.

Self-Propagation

The general behaviour of Geodo has been covered in extreme depth both by Cofense and the greater InfoSec community, so we will not rehash those analyses here. Rather, we will focus on Geodo’s ubiquitous spamming capabilities and the methods it uses to facilitate such behaviour.

Geodo is a modular trojan, which means most of its functionality is abstracted away from the core code and placed in external files that can be selectively imported and executed. One such example is the “spam” module. This module facilitates not only the distribution of spam, but also the validation of stolen credentials.

Geodo has two primary means of obtaining credentials. One way is retrieving a list along with the spam module. The other harvests accounts from the local machine, using a variety of external utilities. When new accounts are discovered, their credentials are validated before any attempt is made to communicate them. Figure 9 shows the credential validation phase of the spam process.

Figure 9: The credential validation phase. Each set of credentials is validated before it is used to send spam messages.

If a set of credentials is validated, spam messaging begins in earnest. Figures 10 and 11 show a Wireshark capture of a bot testing credentials before delivering messages to multiple recipients. These recipients are chosen from a large pool of email addresses containing hundreds of thousands, perhaps millions of addresses. It is unlikely that any bot ever receives a complete list of recipient addresses, meaning the sheer number available to Geodo is staggering.

Figure 10: A Wireshark capture of Geodo testing a set of credentials, before using them to authenticate and begin sending the current template.

Figure 11: Geodo iterates through its recipient list and continues to send phishing messages, using the same session.

Geodo is in constant contact with its C2 hosts. Geodo comes hardcoded with anywhere from 30-45 IP addresses, each pointing to a compromised (or, in some cases, outright malicious) web server. Most of these use Nginx as a reverse proxy to forward connections onto the actual command and control hosts. Figure 12 shows an approximate interpretation of this infrastructure.

Figure 12: An approximate representation of the Geodo infrastructure. It should be noted that there’s a high chance the proxies are tiered or layered; this representation defines a single-layer proxy configuration.

As part of its communications with the C2 infrastructure, Geodo is constantly polling for updates, commands, or instructions. Threat actors behind Geodo frequently deploy new email templates, updated C2 lists, and other module specific instructions or data. In the case of the spam module, we have actively observed Geodo launching spam campaigns against yet unseen victims in addition to new, stolen credentials. This type of information exchange is very unlikely to be unidirectional. To keep the recipient and credential lists fresh and relevant, Geodo must communicate dead recipients, bad credentials, or bad hosts.  Geodo has also been directly observed updating passwords for usernames as they become available. This type of information exchange allows the Geodo actors to automatically adjust their lists in as near real-time as is feasible, but it does open the botnet up to vulnerabilities.

It is plausible that researchers could poison the entire botnet from just a few hosts. Researchers could monitor the credentials being used by each bot, then create an account on the infected device that matches the username but contains a bad password. When the bot attempts to verify the authenticity of the new password and connects to a researcher-controlled SMTP host to accomplish this, the researcher’s host responds that authentication has been successful. Geodo will not only go ahead and begin spamming out phishing emails (as demonstrated in Figures 10 and 11), but it will also report the updated credentials to the C2 infrastructure. These bad credentials will propagate throughout the botnet and, potentially, cause large scale interruptions to its activity.

At the time of analysis, Cofense has tracked ~31,000 credential sets in a very short time. Charts 4 through 6 show multiple interpretations and permutations of this data.

Chart 4: Compromised credentials by Top-Level-Domain (TLD).

Chart 5: Compromised Credentials by Second-Level-Domain (SLD).

Chart 6: Compromised credentials by domain.

Beyond being interesting purely as data points, tracking the domains to which the compromised credentials belong allows us to actively see where outbreaks are succeeding. Spikes for certain TLDs (such as .edu) might indicate the actors are targeting students and educators. A rise in occurrences of .gov.uk SLDs (Second-Level Domains) could indicate the targeting of UK-based government agencies.

For many reasons, Geodo is a hugely problematic trojan. Its primary distribution method contributes an enormous amount of daily spam and phishing volumes. Not only does it engage in financial theft, but also enables additional finance-driven trojans. It can spread laterally across a network and steal credentials from a large array of software – further perpetuating the spam problem. Staying on top of these threats means employing timely, pertinent, and high-fidelity training to help users become familiar with this prolific threat. Security in depth means the ability to know not only “what”, but also “who.”

For a look behind and a look ahead at major malware trends, view the 2018 Cofense Malware Review.

 

All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks.