Connecting the Dots: Syrian Malware Team Uses BlackWorm for AttacksThe Syrian Electronic Army has made news for its href="/content/fireeye-www/en_US/blog/threat-research/2013/07/syrian-electronic-army-hacks-major-communications-websites.html">recent
attacks on major communications websites, href="http://www.forbes.com/sites/andygreenberg/2014/02/20/how-the-syrian-electronic-army-hacked-us-a-detailed-timeline/">Forbes,
and an alleged attack on href="http://blogs.computerworld.com/cybercrime-and-hacking/23668/syrian-electronic-army-attacks-centcom-us-central-command-denies-it-was-hacked">CENTCOM.
While these attacks garnered public attention, the activities of
another group - The Syrian Malware Team - have gone largely unnoticed.
The group’s activities prompted us to take a closer look. We
discovered this group using a .NET based RAT called BlackWorm to
infiltrate their targets.
The Syrian Malware Team is largely pro-Syrian government, as seen in
one of their banners featuring Syrian President Bashar al-Assad. Based
on the sentiments publicly expressed by this group it is likely that
they are either directly or indirectly involved with the Syrian
government. Further certain members of the Syrian Malware Team have
ties to the Syrian Electronic army (SEA) known to be href="http://en.wikipedia.org/wiki/Syrian_Electronic_Army">linked to
the Syrian government. This indicates that the Syrian Malware
Team may also be possibly an offshoot or part of the SEA.
Banner used by the Syrian Malware Team
BlackWorm Authorship
We found at least two distinct versions of the BlackWorm tool,
including an original/private version (v0.3.0) and the Dark Edition
(v2.1). The original href="http://blogs.technet.com/b/mmpc/archive/2014/06/30/microsoft-digital-crimes-unit-disrupts-jenxcus-and-bladabindi-malware-families.aspx">BlackWorm
builder was co-authored by Naser Al Mutairi from Kuwait, better
known by his online moniker 'njq8'. He is also href="/content/fireeye-www/en_US/blog/threat-research/2013/08/njw0rm-brother-from-the-same-mother.html">known
to have coded njw0rm, href="/content/fireeye-www/en_US/blog/threat-research/2012/09/the-story-behind-backdoorlv.html">njRAT/LV,
and earlier versions of href="/content/fireeye-www/en_US/blog/threat-research/2013/09/now-you-see-me-h-worm-by-houdini.html">H-worm/Houdini.
We found his code being used in a slew of other RATs such as Fallaga
and Spygate. BlackWorm v0.3.0 was also co-authored by another actor,
Black Mafia.
class="aligncenter wp-image-6336 landscape-sm" alt="syria2"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria2.png"
width="214" height="167" />
About section within the original
version of BlackWorm builder
Within the underground development forums, it’s common for threat
actors to collaborate on toolsets. Some write the base tools that
other attackers can use; others modify and enhance existing tools.
The BlackWorm builder v2.1 is a prime example of actors modifying
and enhancing current RATs. After njq8 and Black Mafia created the
original builder, another author, Black.Hacker, enhanced its feature set.
class="aligncenter wp-image-6335 landscape-sm" alt="syria3"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria3.png"
width="169" height="149" />
About section within BlackWorm Dark
Edition builder
class="aligncenter wp-image-6334 landscape-sm" alt="syria4"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria4.png"
width="439" height="92" />
Black.Hacker's banner on social media
class="aligncenter wp-image-6333 landscape-sm" alt="syria5"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria5.png"
width="371" height="91" />
As an interesting side note, 'njq8' took down his blog in recent
months and announced a cease in all malware development activity on
his Twitter and Facebook account, urging others to stop as well. This
is likely a direct result of the href="http://garwarner.blogspot.com/2014/06/microsoft-njrat-and-no-ip.html">lawsuit
filed against him by Microsoft.
BlackWorm RAT Features
The builder for BlackWorm v0.3.0 is fairly simple and allows for
very quick payload, but doesn’t allow any configuration other than the
IP address for command and control (C2).
class="aligncenter wp-image-6332 landscape-sm" alt="syria6"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria6.png"
width="250" height="118" />
Building binary through BlackWorm v0.3.0
class="aligncenter wp-image-6331 landscape-med" alt="syria7"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria7.png"
width="540" height="169" />
BlackWorm v0.3.0 controller
BlackWorm v0.3.0 supports the following commands between the
controller and the implant:
ping | | valign="top">Checks if victim is online
closeserver | | valign="top">Exits the implant
restartserver | | valign="top">Restarts the implant
sendfile | | valign="top">Transfer and run file from server
download | | valign="top">Download and run file from URL
ddos | | valign="top">Ping flood target
msgbox | | valign="top">Message interaction with victim
down | | valign="top">Kill critical windows processes
blocker | | valign="top">Block specified website by pointing resolution to
127.0.0.1
logoff | | valign="top">Logout out of windows
restart | | valign="top">Restart system
shutdown | | valign="top">Shutdown system
more | | valign="top">Disable task manager, registry tools, system
restore. Also blocks keyboard and mouse input
hror | | valign="top">Displays a startling flash video
In addition to the features supported by the command structure, the
payload can:
- Seek and kill no-ip processes DUC30 and DUC20
- Disable
Task Manager to kill process dialog - Copy itself to USB
drives and create autorun entries - Copy itself to common
peer-to-peer (P2P) share locations - Collect system
information such as OS, username, hostname, presence of camera,
active window name, etc., to display in the controller - Kill
the following analysis processes (if found): - procexp
- SbieCtrl
- SpyTheSpy
- SpeedGear
- Wireshark
- MBAM
- ApateDNS
- IPBlocker
- cPorts
- ProcessHacker
- AntiLogger
The Syrian Malware Team primarily uses another version of BlackWorm
called the Dark Edition (v2.1). BlackWorm v2.1 was released on a
prolific underground forum where information and code is often shared,
traded and sold.
class="aligncenter wp-image-6330 landscape-med" alt="syria8"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria8.png"
width="542" height="362" />
BlackWorm v2.1 has the same abilities as the original version and
additional functionality, including bypassing UAC, disabling host
firewalls and spreading over network shares. Unlike its predecessor,
it also allows for granular control of the features available within
the RAT. These additional controls allow the RAT user to enable and
disable features as needed. Binary output can be also be generated in
multiple formats, such as .exe, .src and .dll.
class="aligncenter wp-image-6329 portrait-sm" alt="syria9"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria9.png"
width="214" height="334" />
BlackWorm Dark Edition builder
Syrian Malware Team
We observed activity from the Syrian Malware Team going as far back
as Jan. 1, 2011. Based on Facebook posts, they are allegedly directly
or indirectly involved with the Syrian government. Their Facebook page
shows they are still very active, with a post as recent as July
16th, 2014.
class="aligncenter wp-image-6328 landscape-med" alt="syria10"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria10.png"
width="542" height="380" />
Syrian Malware Team’s Facebook page
The Syrian Malware Team has been involved in everything from
profiling targets to orchestrating attacks themselves. There are
seemingly multiple members, including:
href="https://www.facebook.com/hawk.syrian.9">https://www.facebook.com/hawk.syrian.9
href="https://www.facebook.com/kays.syr">https://www.facebook.com/kays.syr
Partial list of self-proclaimed Syrian
Malware Team members
Some of these people have posted malware-related items on Facebook.
class="aligncenter wp-image-6327 landscape-sm" alt="syria11"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria11.png"
width="281" height="245" />
Facebook posting of virus scanning of files
While looking for Dark Edition samples, we discovered a binary named
svchost.exe (MD5: 015c51e11e314ff99b1487d92a1ba09b). We
quickly saw indicators that it was created by BlackWorm Dark Edition.
class="aligncenter wp-image-6326 landscape-sm" alt="syria12"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria12.png"
width="261" height="163" />
Configuration options within code
The malware communicated out to 178.44.115.196, over port 5050, with
a command structure of:
style="text-align: center;">!0/j|n\12121212_64F3BF1F/j|n\{Hostname}/j|n\{Username}/j|n\USA/j|n\Win
7 Professional SP1 x86/j|n\No/j|n\2.4.0 [ Dark Edition]/j|n\/j|n\{ActiveWindowName}/j|n\[endof]
When looking at samples of Dark Edition BlackWorm being used by the
Syrian Malware Team, the strings “Syrian Malware,” or “ href="http://syrianmalware.com/files/Attack.m.exe%20-%20Report.pdf">Syrian
Malware Team” are often used in the C2 communications or within
the binary strings.
Additional pivoting off of svchost.exe brought us to three
additional samples apparently built with BlackWorm Dark Edition.
E.exe, (MD5: a8cf815c3800202d448d035300985dc7) a binary that drew our
attention, looked to be a backdoor with the Syrian Malware strings
within it.
class="aligncenter wp-image-6325 landscape-sm" alt="syria13"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria13.png"
width="160" height="147" />
When executed, the binary beacons to aliallosh.sytes.net on port
1177. This C2 has been seen in multiple malware runs often associated
with Syria. The command structure of the binary is:
!0/j|n\Syrian
Malware/j|n\{Hostname}/j|n\{Username}/j|n\USA/j|n\Win 7 Professional
SP1 x86/j|n\No/j|n
\0.1/j|n\/j|n\{ActiveWindowName}/j|n\[endof]
Finally, pivoting to another sample, 1gpj.srcRania
(MD5:f99c15c62a5d981ffac5fdb611e13095), the same strings were present.
The string "Rania" used as a lure was in Arabic and likely
refers to the prolific href="http://en.wikipedia.org/wiki/Queen_Rania_of_Jordan">Queen
Rania of Jordan.
class="aligncenter wp-image-6324 landscape-sm" alt="syria14"
src="https://www.fireeye.com/content/dam/legacy/blog/2014/08/syria14.png"
width="197" height="149" />
The traffic is nearly identical to the other samples we identified
and tied to the Syrian Malware Team.
!1/j|n\C:\Documents and
Settings\{Username}\Local Settings\Application DataldoDrZdpkK.jpg -
Windows Internet Explorer[endof]!0/j|n\Syrian
Malware/j|n\{Hostname}/j|n\{Username}/j|n\USA/j|n\Win XP
ProfessionalSP2 x86/j|n\No/j|n\0.1/j|n\/j|n\C:\Documents and
Settings\{Username}\Local Settings\Application DataldoDrZdpkK.jpg - {ActiveWindowName}/j|n\[endof]
Conclusion
Determining which groups use which malware is often very difficult.
Connecting the dots between actors and malware typically involves
looking at binary code, identifying related malware examples
associated with those binaries, and reviewing infection vectors, among
other things.
This blog presents a prime example of the process of attribution. We
connected a builder with malware samples and the actors/developers
behind these attacks. This type of attribution is key to creating
actionable threat intelligence to help proactively protect organizations.
Source:
Connecting the Dots: Syrian Malware Team Uses BlackWorm for Attacks
