Evasive Tactics: Terminator RAT
FireEye Labs has
been tracking a variety of advanced persistent threat (APT) actors
that have been slightly changing their tools, techniques, and
procedures (TTPs) in order to evade network defenses. Earlier, we
documented changes to href="/content/fireeye-www/en_US/blog/threat-research/2013/09/evasive-tactics-taidoor-3.html">Taidoor,
a malware family that is being used in ongoing cyber-espionage
campaigns particularly against entities in Taiwan. In this post we
will explore changes made to Terminator RAT (Remote Access Tool) by
examining a recent attack against entities in Taiwan.
We recently analyzed a sample that we suspect was sent via
spear-phishing emails to targets in Taiwan. As shown in Figure 1, the
adversary sends a malicious Word document, “103.doc” (md5:
a130b2e578d82409021b3c9ceda657b7), that exploits CVE-2012-0158, which
subsequently drops a malware installer named “DW20.exe”. This
particular malware is interesting because of the following:
- It evades sandbox by terminating and removing itself
(DW20.exe) after installing. Malicious behavior will only appear
after reboot. - It deters single-object based sandbox by
segregation of roles between collaborating malwares. The RAT
(svchost_.exe) will collaborate with its relay (sss.exe) to
communicate with the command and control server. - It deters
forensics investigation by changing the startup location.
- It deters file-based scanning that implements a maximum file
size filter, by expanding the size of svchost_.exe to 40MB.
The ultimate payload of the attack is href="http://www.malware.lu/assets/files/articles/RAP002_APT1_Technical_backstage.1.0.pdf"
target="_blank">Terminator RAT, which is also known as href="http://www.trendmicro.com/cloud-content/us/pdfs/security-intelligence/white-papers/wp-fakem-rat.pdf">FakeM
RAT. This RAT does not appear to be exclusively used by a single
APT actor, but is most likely being used in a variety (of possibly
otherwise unrelated) campaigns. In the past, this RAT has been used
against Tibetan and Uyghur activists, and we are seeing an increasing
number of attacks targeting Taiwan as well.
However, these attacks use some evasive tactics that demonstrate the
evolution of Terminator RAT. First, the attackers have included a
component that relays traffic between the malware and a proxy server.
Second, they have modified the 32-byte magic header that in previous
versions attempted to disguise itself to look like either MSN
Messenger, Yahoo! Messenger, or HTML code.
These modifications appear to be an attempt to evade network
defenses, perhaps in response to defender’s increasing knowledge of
the indicators of compromise associated with this malware. We will
discuss the individual components of this attack in more detail.
[caption id="attachment_3596" align="alignnone"
width="585"] href="/content/dam/legacy/blog/2013/10/01.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/01.png"
alt="Figure 1" class=" wp-image-3596 landscape-med" width="585"
height="352" /> Figure 1[/caption]
1. DW20.exe (MD5: 7B18E1F0CE0CB7EEA990859EF6DB810C)
DW20.exe was found to be the installation executable file. It will
first create its working folders located at “%UserProfile%\Microsoft”
and “%AppData%\2019”. The former is used to store the configurations
and executable files (svchost_.exe and sss.exe) and the latter is used
to store the shortcut link files. This folder “2019” was then
configured to be the new start up folder location by changing the
registry
“HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell
Folders\Startup" with the location of its path (see Figure 2).
[caption id="attachment_3597" align="alignnone"
width="575"] href="/content/dam/legacy/blog/2013/10/02.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/02.png"
alt="Figure 2" class="size-full wp-image-3597 landscape-med"
width="575" height="352" /> Figure 2[/caption]
The executable file “sss.exe” was found to be the decrypted form of
the resource named 140 with type “ACCELORATOR” (likely misspelling of
Accelerator - see Figure 3). This resource was decrypted using
customized XTEA algorithm and appended with an encrypted configuration
for the domains and ports.
[caption id="attachment_3598" align="alignnone"
width="307"] href="/content/dam/legacy/blog/2013/10/03.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/03.png"
alt="Figure 3" class="size-full wp-image-3598 landscape-sm"
width="307" height="94" /> Figure 3[/caption]
After installation, DW20.exe deletes and terminates itself. The
malwares will only run after reboot. This is one effective way to
evade sandbox automatic analysis, as malicious activity will only
reveal after a reboot.
2. sss.exe (MD5: 93F51B957DA86BDE1B82934E73B10D9D)
sss.exe is an interesting malware component. As a researcher would
analyze it independently, it is not considered a malicious program.
This component plays the role as a network relay between the malware
and the proxy server, by listening over port 8000. To achieve this, it
first tries to identify the list of proxy servers that are used within
the system using “WinHttpGetIEProxyConfigForCurrentUser”, and the
discovered proxy servers and related ports are stored in the same
directory in a file named “PROXY” (see Figure 4).
[caption id="attachment_3599" align="alignnone"
width="425"] href="/content/dam/legacy/blog/2013/10/04.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/04.png"
alt="Figure 4" class="size-full wp-image-3599 landscape-sm"
width="425" height="222" /> Figure 4[/caption]
When there is a new incoming TCP connection over port 8000, it will
attempt to create a local to proxy socket connection. With that, it
will check connectivity with the CnC server. If the response is 200,
it will then start to create a “relay link” between the malware and
the CnC server (see Figure 5). The “relay link” was created using two
threads, where one thread will transfer data from socket 1 to socket 2
(see Figure 6) and the other will do vice versa.
[caption id="attachment_3600" align="alignnone"
width="654"] href="/content/dam/legacy/blog/2013/10/05.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/05.png"
alt="Figure 5" class="size-full wp-image-3600 landscape-med"
width="654" height="497" /> Figure 5[/caption]
[caption id="attachment_3601" align="alignnone"
width="497"] href="/content/dam/legacy/blog/2013/10/06.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/06.png"
alt="Figure 6" class="size-full wp-image-3601 landscape-sm"
width="497" height="299" /> Figure 6[/caption]
As depicted in Figure 7, the user agent
is hard coded. It is a possible means to identify potentially
malicious traffic, as Internet Explorer 6 is significantly outdated
and “MSIE 6.0.1.3” is not a valid version token.
The configurations for the malicious
domains and ports to use are located at the last 188 bytes of the
executable file (see Figure 8). The first 16 bytes is the key (boxed
in red) to decrypt the remaining content using modified XTEA algorithm
(see Figure 9). The two malicious domains found were
“liumingzhen.zapto.org” and “liumingzhen.myftp.org”
[caption id="attachment_3603" align="alignnone"
width="645"] href="/content/dam/legacy/blog/2013/10/08.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/08.png"
alt="Figure 8" class="size-full wp-image-3603 landscape-med"
width="645" height="434" /> Figure 8[/caption]
[caption id="attachment_3604" align="alignnone"
width="639"] href="/content/dam/legacy/blog/2013/10/09.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/09.png"
alt="Figure 9" class="size-full wp-image-3604 landscape-med"
width="639" height="365" /> Figure 9[/caption]
3. Network Traffic
The Terminator sample we analyzed, “103.doc” (md5:
a130b2e578d82409021b3c9ceda657b7) was not configured with fake HTML,
Yahoo Messenger, or Windows Messenger traffic header as it had in past
variants. However, the content is encrypted in exactly the same way as
previous versions of Terminator RAT.
[caption id="attachment_3605" align="alignnone"
width="648"] href="/content/dam/legacy/blog/2013/10/10.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/10.png"
alt="Figure 10" class=" wp-image-3605 landscape-med" width="648"
height="157" /> Figure 10[/caption]
The decrypted content reveals that the malware is sending back the
user name, the computer name and a campaign mark of “zjz1020”.
[caption id="attachment_3606" align="alignnone"
width="683"] href="/content/dam/legacy/blog/2013/10/11.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/11.png"
alt="Figure 11" class=" wp-image-3606 landscape-med" width="683"
height="154" /> Figure 11[/caption]
This particular sample is configured to one of two command and
control servers:
- liumingzhen.zapto.org /
123.51.208.69 - liumingzhen.myftp.org / 123.51.208.69
We have located another malicious
document that has a Taiwan-related decoy document that drops this same
version of Terminator RAT.
[caption id="attachment_3607" align="alignnone"
width="583"] href="/content/dam/legacy/blog/2013/10/12.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/12.png"
alt="Figure 12" class=" wp-image-3607 landscape-med"
width="583" height="413" /> Figure 12[/caption]
The sample we analyzed (md5: 50d5e73ff8a0693ed2ee2d320af3b304)
exploits CVE-2012-0158 and has the following command and control server:
- catlovers.25u.com / 123.51.208.142
The command and control servers for both samples resolved to IP
addresses in the same class C network.
4. Campaign Connections
In June 2013, we investigated an attack against entities in Taiwan
that used spear-phishing emails to deliver a malicious attachment.
[caption id="attachment_3608" align="alignnone"
width="455"] href="/content/dam/legacy/blog/2013/10/13.png"> src="https://www.fireeye.com/content/dam/legacy/blog/2013/10/13.png"
alt="Figure 13" class=" wp-image-3608 portrait-sm" width="455"
height="522" /> Figure 13[/caption]
The malicious attachment "標案資料.doc" (md5:
bfc96694731f3cf39bcad6e0716c5746) exploited a vulnerability in
Microsoft Office (CVE-2012-0158), however, the payload in this case
was a different malware family known as WinData. The malware connected
to the same command and control server, liumingzhen.zapto.org, but the
callback is quite different:
XYZ /WinData.DLL?HELO-STX-1*1[IP Address]*[Computer
Name]*0605[MAC:[Mac Address]]$
In a separate case where liumingzhen.zapto.org has been used as the
command and control server, the payload was neither WinData nor
Terminator RAT, but another type of malware known as Protux. The
sample we analyzed in August 2012 for this case was “幹!.doc” (md5: 01da7213940a74c292d09ebe17f1bd01).
This particular threat actor has access to a variety of malware
families and has been using them to target entities in Taiwan for more
than a year.
Conclusion
Terminator RAT is an example of how malware are increasingly
becoming more sophisticated and harder to detect. There is a need for
continual research to understand various techniques, tactics, and
procedures used by the adversaries. Detection of exploitation and
identification of anomalous callbacks are becoming extremely critical
in preventing the malware from installing into the system or phoning
back to the command control servers.
Source:
Evasive Tactics: Terminator RAT
