Catching Phish with PhishMe Intelligence and ThreatQ

PhishMe IntelligenceTM Integrates with ThreatQuotient’s ThreatQ Platform

Swimming in a sea of threat intelligence indicators and services, security teams have been working towards effective ways to centralize, de-duplicate, and correlate massive amounts of threat data. The challenge, once this is done, is acting on what matters most. This requires intelligence, not just data.

NanoCore Variant Delivered Through UUE Files

Over the past few weeks, our Phishing Defense Center has observed several emails with malicious PDF attachments that prompt the user to download a .UUE file from Dropbox. UUE files (Unix to Unix Encoding) are files encoded with uuencode, a program that converts binary files to text format for easy transfer while still allowing for the files to be easily opened using Winzip or similar un-archiving applications. When file extensions are not displayed in Windows, the downloaded file looks like any other compressed file (as shown in Figure 1), which makes it harder to spot that this file is indeed malicious.

Figure 1 – Ordy Compressed File Icon

All emails contain the same message body shown in Figure 2, asking users to confirm the payment and customer details as outlined in the attached copy of the Swift advice.

Figure 2 – Email body

The messages had a PDF attachment named “MensajeSWIFTMT103.pdf” (MD5: 8b9a5e36cd1e1ec7dfd7801bfa5afa86, SHA256: 743c9ffe67a80ac84385efc8dc78c84f7b38805285dda49ac6459d17008daa17). The PDF only contains one page, characteristic of malicious PDF documents, and the PDF does not contain any text but only a link to “View File” (as shown in Figure 3).

Figure 3 – PDF Document – View File

The link takes the user to the Dropbox site hxxps://www[.][.]uue?dl=1 to download Ordy.uue (MD5: 673d3a374900a23ecec3acc092fe8dba, SHA256: d476a35f392a1c616f045418ce9c3c6645ac6886a6195ef1ec578e6bbe15a48b). After downloading the file, it appears that a compressed file has been downloaded, as previously discussed. Unpacking the file extracts the executable Ordy.exe (MD5: 1A9E533E870C4B0B5D6126A3E7609601, SHA256: F76A8BED84ED4177626A4B7B3ECED4AEABE93BE8CB500A1B2D5F3A662539C98D), with an Acrobat PDF icon (as shown in Figure 4), which tricks the user in thinking that this is a genuine PDF file.

After executing Ordy.exe, it creates a copy of itself in \AppData\Roaming\taskprocess.exe while Ordy.exe hides itself, and it adds taskprocess.exe to the scheduled tasks (as shown in Figure 5).

Figure 5 – Scheduled Tasks

Additionally, it creates a Registry entry to start itself automatically when Windows starts (as shown in Figure 6).

Figure 6 – Registry Key Entry

The malware reads the machine GUUID and creates a directory in \AppData\Roaming with the GUUID as well as two subfolders: \DPI Subsystem and \Logs. The directory \DPI Subsystem contains a copy of Ordy.exe called dpiss.exe which gets executed after reboot.

The logs directory contains a .dat file with the naming convention of KB_XXXXXXX.dat. Opening the .dat file reveals some hexadecimal values (as shown in Figure 7).

Figure 7 – Hex contents in .dat file

After converting the hexadecimal values from the .dat file to ASCII, it becomes apparent that the malware captures keystrokes and stores them in the .dat file (as shown in Figure 8).

Figure 8 – Ascii decoded hex from .dat file

Analysing the malicious network traffic reveals active communication with IP over TCP port 6777 (as shown in Figure 9). After a three-way handshake is completed, the host and server exchange a PSH, ACK, ACK communication sequence a few times per second. Often, keylogger and remote access trojan malware will communicate using HTTP requests sent to a webserver. However, this TCP communication indicates a different, perhaps more difficult to stop, means for exfiltration.

Figure 9 – Wireshark Capture

Figure 10 – TCPView Outbound Connection to malicious IP

After reboot, dpiss.exe is executed instead of Ordy.exe and a new .dat file is created in \AppData\Roaming\{machineID}\Logs.

This malware application also reveals analysis and sandbox evasion characteristics in which a functional Internet connection is verified and will not attempt to make any outbound connections when executed in a sandboxed environment with restricted Internet access. It still copies itself and adds itself to the registry and scheduled tasks as well as capturing keystrokes, but it only tries to communicate to the server once a valid Internet connection has been established.

This malware contains a keylogger that actively captures keystrokes and transfers them to the server in the hope of capturing login details and other valuable information. While delivery using .UUE files has been around for a while, it is not commonly used at this point, and, to end users, these files appear as genuine compressed files. Most firewalls and endpoint security solutions only alert on or block .zip or .rar file extensions, ignoring .UUE and making it easier for attackers to bypass security solutions.

During analysis, we have observed this malware behaving like NanoCore. NanoCore is a remote access trojan (RAT) that is used to steal sensitive information such as passwords from victim computers.

However, Ordy.exe doesn’t contain any hardcoded “NanoCore” strings which is the reason why current NanoCore Yara rules will not detect this variant of NanoCore. Figure 11 shows the strings typically found in NanoCore samples, while Figure 11 shows the ones found in Ordy.exe.

Figure 11 – Identifiable NanoCore strings

Figure 12 – Ordy.exe strings

NanoCore first appeared in 2013 and has since gained popularity due to its modularity, which allows attackers to expand its functionality and performance. Several cracked versions of NanoCore exist in the wild, allowing attackers to use and modify the core functions to create new variants, and Ordy.exe is no exception. As our research suggests, Ordy closely resembles NanoCore, but the delivery through .UUE files is still very rare and can be seen as an attempt to bypass malware defences. Attackers will continue to create new malware as well as modify existing malware to pass through security perimeters; so, always act on the side of caution and only open links and attachments you trust.

Don’t miss another threat – stay on top of emerging phishing and malware threats and attacks, all delivered straight to your inbox completely free. Subscribe to PhishMe® Threat Alerts today.

Want to Get In Front of Breaches? Be Like the Marines.

Part 1 in our series on being “Left of Breach” in the Phishing Kill Chain.

Too often in the information/cyber security industry, we focus our efforts on mitigation of breaches after they occur, relying on incident response teams to find the needles in the haystack.

According to “Left of Bang: How the Marine Corps’ Combat Hunter Program Can Save Your Life,” (by Patrick Van Horne and Jason A. Riley; Foreword by Steven Pressfield) The Marine’s Combat Hunter training program works on this premise: by understanding what “normal” looks like, we are much more likely to recognize activities and behaviors that are out of place. That recognition, even if based on “gut feel,” becomes the trigger for acting. This approach relies heavily on front-line human assets, not just automation or artificial intelligence, to detect attacks in progress. Most important, it lets you get in front of breaches before they blow up in your face.

Get “Left of Breach.”

In the Marine’s case, it’s acting to get “Left of Bang,” as in bombs and bullets. In anti-phishing programs, it’s getting Left of Breach—taking proactive steps instead of accepting that hackers and other malicious actors will succeed no matter what. In the figure below, it’s everything left of the bullseye.

With a few modifications, the standard security industry kill chain can resemble the Marine Combat Hunter approach.

As you can see in the Phishing Kill Chain above, we focus on baselining an organization and developing human threat reporters throughout the first four steps. This provides 2 things: a starting point for risk analysis and development of targeted simulations (Enumeration, Design, Delivery); and the development of HUMINT (human intelligence), data collection and reporting of suspicious material to incident response teams.

As your anti-phishing program matures, you’ll combine the data your employees report with human-vetted phishing intelligence feeds in Triage. The net: actionable intelligence enabling you to mitigate threats before they happen.

5 steps to getting there:

  1. Be transparent and educate users on standard phishing clues and the purpose of the program.
    • NOTE: Program transparency is key to your success. It builds enthusiasm for the program and a sense of ownership and positive engagement with the organization’s security process.
  2. Baseline your organization’s technical and business process weaknesses for targeting during initial simulations.
  3. Execute diverse simulations and analyze for risk level (e.g. – high susceptibility to active threats)
  4. Design follow-up simulations based on known deficiencies and analysis of initial results.
  5. Stress the importance of reporting in all simulations and awareness activities.

Taking these simple steps is the quickest, most effective way to protect against phishing. Ready to get Left of Breach? Booyah!

Next: part 2 of our “Left of Breach” series examines the first step in the Phishing Kill Chain, Self-Enumeration.

Stay on top of recent phishing and malware threats and attacks trends, delivered straight to your inbox completely free. Subscribe to PhishMe® Threat Alerts today.

10 Ways to Defend Against Business Email Compromise / CEO Email Fraud Scams

Cybercriminals continue to successfully hack and spoof emails to impersonate supervisors, CEOs, and suppliers and then request seemingly legitimate business payments. Because the emails look authentic and seem to come from known authority figures, many employees comply. But later they discover they’ve been tricked into wiring money or depositing checks into criminals’ bank accounts.

The Newest Delivery Method for the Locky Ransomware

Since its introduction in early 2016 and throughout this year, the distribution of the Locky ransomware has been overwhelmingly facilitated by attached script applications written in JScript or Visual Basic. These script applications have been delivered as the content of an attached archive such as a Zip or RAR file delivered as part of the email messages.