The Fidelis Threat Research team is comprised of expert security researchers whose sole focus is generating accurate and actionable intelligence to better secure customers. Together, they represent over... Read More
Comments
Downloaders and droppers (aka malware that delivers other malware) have been forced to live in the shadow of more famous stages of the exploit kit chain, like landing pages or the malware that’s eventually dropped. One reason they are often overlooked and not analyzed as often is because they typically (and conveniently) wipe themselves from compromised hosts once they completely deliver their malicious payload.
But don’t mistake the lack of attention for lack of importance. Downloaders and droppers play a vital role in the web exploitation ecosystem. They’re often used across multiple exploit kits and they are effective at delivering a broad menu of malware including ransomware, banking trojans, credential stealers etc.
SmokeLoader is an older downloader that continues to be actively developed and utilized to deliver other malware. Fidelis Threat Research observed a SmokeLoader sample delivered through the Sundown Exploit Kit. We’re sharing our findings with the security community to keep them updated on this evolving threat.
This blog post covers four key points:
This SmokeLoader sample was delivered from the Sundown Exploit Kit. This sample has been consistently delivered by this exploit kit as noted by researchers at Malwarebytes in late 2016.
A number of chains related to the Sundown Exploit Kit have been analyzed after it began including CVE-2016-0189, coupled with either their own or an affiliate’s consistent usage of SmokeLoader. Then in January 2017 we began tracking what appeared to be two distinct instances of Sundown traffic similar to what we saw in the Malwarebytes post.
One exploit kit thread using minimal obfuscation was delivered through malvertising campaigns and pretended to be affiliated with EmpowerNetwork, a popular blogging and webhosting platform. While the EmpowerNetwork thread was largely in the clear with minimal obfuscation, the second exploit kit thread had an obfuscated landing page and favored .mobi registered domains for a period of time during our observation. Both threads delivered SmokeLoader, which in turn downloaded a diverse range of malware.
The crypter is one that has been showing up recently using NSIS with an encrypted payload. The crypter normally works in three stages.
After decoding the function names and allocating memory with VirtualAlloc, the crypter decodes a small section of bytecode that basically performs a sleep by looping 0x18f06 * 0x1644a times. As analysis continued, we found many instances of useless code such as this one. After decoding out the payload, the malware is injected into a new process of itself. Then the current thread is hijacked using GetThreadContext/SetThreadContext before finally resuming the program. There are a variety of methods for breaking into a child process. In this example, the entry pointer was overwritten with custom code to gain control of execution.
After breaking in with the debugger, the bytes can be easily changed back to their original version.
After the new unpacked code is run, the bot begins XORing sections of its code, leading to a few debugger checks almost immediately after. The bot takes the isbeingdebugged flag and uses it to XOR a byte of its next code section — so if it is being debugged then the bot will break.
The same check is then performed using the NtGlobalFlag:
Upon successfully passing these checks, the bot decodes a large section of itself, which is then decompressed using APLIB. Once this section is decompressed, the final stage of the bot is revealed.
The final stage has two noticeable sections of encoded data. Both RC4 encrypted sections are decrypted using a hardcoded 4 byte key that is passed to the routines (“zVsO”).
This next stage, ultimately, has two paths that it can take. The first performs a bunch of system checks looking to see if it’s being analyzed or running in a virtual environment before injecting itself into a new explorer.exe process. The second is intended to be run after it has been injected into Explorer. This is where the malware performs the following tasks:
As previously mentioned, the strings are obfuscating using a 4 byte key. They are then split using a separator value, which in this case was ‘x01’. The bot has a routine designed to pass any number in the block of decoded strings that it wants to be used for decoding.
This routine is only called twice, and does so with different blocks of data. This means there are two blocks of strings to be decoded.
Here is the address and size being passed in to the string decryption routine.
At first glance, it seems this information is used to write a string decoder, but after checking the results, the URLs are not decoded. A little digging and pivoting off referenced addresses (found near the two blocks of data) result in the discovery of another decoding routine.
A quick overview of this additional routine shows that each block of encoded data is prepended with a crc32 hash that is checked against the decoded data.
The decoding routine looks confusing at first, but by taking small pieces and verifying that the decoded data is the same as the data in the bot, the decoding function can be understood quickly:
We know that the first 4 bytes are the CRC32 hash, but glancing at the code shows that the beginning of the data block addressis used to XOR each byte pulled out of the other register. We can see that the first byte of the CRC32 hash is used as an XOR key against every two bytes independently, followed by a subtraction of the output of that calculation.
A python script for use in IDA to decode out the URLs in the sample is included in this report.
This variant of SmokeLoader performs a POST containing RC4 encrypted data to one of its C2 URLs that it keeps onboard.
As long as a response is received after the POST (even a 404), then the data will attempt to be read. As can be seen in the figure above, the 4 byte RC4 key is generated using the rdtsc command. After encrypting the data, the 4 byte key is loaded onto the front of the encrypted data. Decryption then becomes straightforward:
key = posted_data[:4]
rc4 = ARC4.new(key)
decoded_data = rc4.decrypt(posted_data[4:])
Downloaders and other delivery systems seek to obscure their payloads using a variety of techniques. This post explored techniques used by SmokeLoader, a downloader currently deployed via Sundown Exploit Kit, to confuse analysts and deter detection. In our estimation, these techniques will be observed with greater frequency in the coming years, which calls out the need for more thorough detection capabilities across the entire chain of events at multiple levels.
Fidelis customers are protected from SmokeLoader and Sundown Exploit Kit by a variety of mechanisms designed to detect malware throughout the infection chain. Learn more at <a href="https://fidelissecurity.com/.
Sundown EK:
zs.2490.mobi/index.php?zXbjY2v-mNAA=53q3YzvzhaNRTCnZ2qNJ9VnS0Jph-Rg8_VX6nFY3IlmjksmxkOMlRTlJ
zs.2490.mobi/4325/5421.swf
zs.2490.mobi/4325/542.swf
zs.2490.mobi/4325/235.swf
glh.2104.mobi/43526876827345687356872456.php?id=235
zs.2490.mobi/4325/iguhfskrf.xap
website.empowernetworkaffiliate1.us/jiorei34/index.php
website1.empowernetworksolutions.biz/jiorei34/index.php
website1090.empowernetworkview.us/jiorei34/index.php
website1320.empowernetworkview.us/jiorei34/index.php
website1376.empowernetworkpackage.biz/jiorei34/index.php
website1477.empowernetworkview.us/jiorei34/index.php
website1482.empowernetworkpackage.biz/jiorei34/index.php
website1509.empowernetworkview.us/jiorei34/index.php
website1608.empowernetworkview.us/jiorei34/index.php
website1677.empowernetworkpackage.biz/jiorei34/index.php
website1701.empowernetworkview.us/jiorei34/index.php
website177.empowernetworkpackage.biz/jiorei34/index.php
website1860.empowernetworkpackage.biz/jiorei34/index.php
website1944.empowernetworkview.us/jiorei34/index.php
website2.empowernetworksolutions.biz/jiorei34/index.php
website3.empowernetworksolutions.biz/jiorei34/index.php
website300.empowernetworkview.us/jiorei34/index.php
website310.empowernetworkview.us/jiorei34/index.php
website382.empowernetworkpackage.biz/jiorei34/index.php
website4.empowernetworksolutions.biz/jiorei34/index.php
website479.empowernetworkview.us/jiorei34/index.php
website480.empowernetworkpackage.biz/jiorei34/index.php
website5.empowernetworkpackage.biz/jiorei34/index.php
website5.empowernetworksolutions.biz/jiorei34/index.php
website50.empowernetworkpackage.biz/jiorei34/index.php
website556.empowernetworkpackage.biz/jiorei34/index.php
website6.empowernetworksolutions.biz/jiorei34/index.php
website613.empowernetworkview.us/jiorei34/index.php
website639.empowernetworkview.us/jiorei34/index.php
website7.empowernetworksolutions.biz/jiorei34/index.php
website791.empowernetworkpackage.biz/jiorei34/index.php
website8.empowernetworksolutions.biz/jiorei34/index.php
website84.empowernetworkpackage.biz/jiorei34/index.php
website841.empowernetworkview.us/jiorei34/index.php
website941.empowernetworkview.us/jiorei34/index.php
www.empowernetwork1.biz/jiorei34/index.php
www.empowernetwork2.biz/jiorei34/index.php
www.empowernetwork3.biz/jiorei34/index.php
www.empowernetwork4.biz/jiorei34/index.php
www.empowernetworkaffiliate2.us/jiorei34/index.php
www.empowernetworkbook.us/jiorei34/index.php
www.empowernetworkproject.us/jiorei34/index.php
SmokeLoader:
buildsae.org
bulentisik.com
buildsae.us
31.148.219.232
185.183.96.137
118acc3577e163ced7bcc0811b7ee324
-Fidelis Threat Team Researcher Jason Reaves
