Bluvector Threat Report Q1 2018

Home , NRG (file format), SamSam, Vector (malware)

BluVector Threat Report Q1 2018

While 2018 began with the massive revelation of Meltdown and Spectre, news about any malware threats that specifically target these CPU vulnerabilities has not yet been reported or confirmed. However, the first quarter has shown that while malware prevention solutions are improving for known threats, adversaries continue to evolve their craft to create attacks that circumvent these solutions. As the financial reward for attackers increases, we expect money to remain the primary driving force throughout the year. Which leads directly into Threat Report’s new category… TABLE OF CONTENTS

3 Threat Report Q1 2018 Threat Chart RANSOMWARE Q1 2018 4 Summary 16 RANSOMWARE: AVCrypt APTs Q1 2018 17 RANSOMWARE: BitPaymer/FriedEx APT: HackingTeam RANSOMWARE: GlobeImposter & 5 18 GandCrab 6 APT: OceanLotus 19 RANSOMWARE: SamSam 7 APT: PZChao 8 APT: Slingshot NOTABLE Q4 2017 THREATS TROJANS Q1 2018 TROJANS Q4 2017 9 TROJAN: AndroRAT 21 TROJAN: ExpensiveWall & Hancitor 10 TROJAN: Dridex 22 TROJAN: Iced Id 11 TROJAN: GhostTeam 23 TROJAN: Marcher 12 TROJAN: LockPOS 24 TROJAN: Orcus Rat 13 TROJAN: OylmpicDestroyer 25 TROJAN: Scarab 14 TROJAN: Snojan RANSOMWARE Q4 2017 MINERS Q1 2018 26 RANSOMWARE: Bad Rabbit RANSOMWARE: DoubleLocker 15 MINER: Smominru 27 Android Threat Report Q1 2018

APTs BitPaymer/ GlobeImposter PZChao 51 Months FriedEx in advance 19 Months 29 Months HackingTeam in advance in advance 21 Months in advance Slingshot Double 34 Months SamSam Locker in advance 12 Months 10 Months in advance in advance OceanLotus 10 Months Scarab in advance 11 Months GandCrab in advance 15 Months in advance AVCrypt RANSOMWARE 50 40 30 20 10 5 Months MONTHS MONTHS MONTHS MONTHS MONTHS in advance Bad Rabbit THREAT FIRST 10 Months PUBLICLY in advance Expensive Wall IDENTIFIED 11 Months AndroRat in advance 7 Months in advance Snojan TROJANS 14 Months in advance Marcher GhostTeam 11 Months 9 Months in advance in advance

Orcus Rat OlympicDestroyer 11 Months 14 Months in advance in advance MINERS Smominru 32 Months in advance IcedID 36 Months in advance Hancitor 35 Months Dridex in advance 32 Months in advance

LockPOS 48 Months in advance BluVector runs all discovered malware samples through historical classifiers to identify when our machine learning engine would have first detected the named threat. BluVector currently supports over 35 file-specific machine learning classifiers.

Mining for Malware of Atlanta was also hit by a highly publicized SamSam ransomware attack in March, which As predicted, Q1 2018 saw the continued rise was still not completely resolved a month later, in prominence of crypto-mining, as the topic of costing $2.7 million to that point. The Baltimore cryptocurrencies remains the focus of the media 9-1-1 Computer Aided Dispatch system was also and the general public. Huge financial incentives knocked offline for approximately 17 hours in late and a lack of regulation continue to draw the March by unnamed ransomware. attention of attackers. Due to the volatility in the values of differing cryptocurrencies, miners have APTs and Trojans: Still Kicking moved away from Bitcoin toward Monero. The most damaging threat comes from the However, crypto-mining is far from the greatest two categories that allow attackers to stealthily threat facing organizations, as reflected by the compromise a network and extract credentials fact that only one Threat Report blog in Q1 dealt and other data: trojans and their stealthier with miner malware, and it was only the use of the cousins, Advanced Persistent Threats (APTs). EternalBlue exploit that made the Smominru miner Cumulatively, they accounted for over 63% of noteworthy. We have added a Miner category to Threat Reports in Q1. Trojans and APTs are highly our Threat Report chart as we expect that there likely to be responsible for – or a large component will be further miner threats in the coming year. of – successful breaches. In January 2018, the Japanese-based cryptocurrency exchange Ransomware Hit List Coincheck was breached, resulting in the theft of a colossal $534 million in the relatively unknown As stated in one of our Q1 Threat Report blogs, NEM coin cryptocurrency. In March, Under Armour the death of ransomware in the face of the announced that data was compromised from 150 popularity of cryptominers has been greatly million accounts related to its MyFitnessPal app. exaggerated. Ransomware continues to pose a significant threat to organizations, with victims Conclusion facing both high monetary and reputational costs as the result of a successful attack. There were To put the relentlessness of attacks and the several high-profile attacks during Q1 which attackers perpetrating them into perspective, it amply demonstrate these impacts. has been reported that the global cybercrime economy generates an annual profit of $1.5 trillion The threat ransomware continues to pose is or roughly the same as Russia’s GDP. To use an demonstrated by ransomware accounting for old cybersecurity adage, attackers only need over 30% of Threat Report blogs in Q1. In February, to succeed once to compromise your network, SamSam ransomware infected 2,000 Colorado defenders need to succeed every time. These Department of Transport (CDOT) systems. A facts and the events of Q1 2018 reinforce the reality week later, once CDOT had 20% of systems back that threat actors have no intention of scaling back online, another SamSam variant reinfected those their attacks. It is important not to be distracted systems, resulting in the staff’s return to pen and by coverage given to one attack vector or class paper. Six weeks after the initial infection, CDOT of attack – distraction has been a powerful tool in reported it had only returned to 80% of its pre- the arsenals of attackers for centuries… just think infection functionality. It stated that recovery costs about why malware trojans are so named. may reach US$1.5 million, which includes the cost of temporarily expanding its core IT team from 25 to 150 “during the peak of the incident.” The City

What Is It? to spoof an executable file as a PDF.

HackingTeam is an Italian-based purveyor of So far these new variants have been detected in spyware which became notorious for selling its 14 unnamed countries. There is no valid reason main surveillance tool, Remote Control System for these samples to be present on a corporate (RCS), to nation states with a dubious record network, and their presence may indicate of human rights issues, as well as various industrial espionage or other compromise. intelligence and law enforcement agencies. In July 2015, HackingTeam itself was hacked, How Does It Propagate? resulting in the release of over 400GB of internal The malware does not self-propagate. It has been data, including emails, customer lists and RCS’s observed attached to spear phishing emails as source code. The hackers also gained access to an executable file, attempting to appear as a the official HackingTeam Twitter account, which PDF file. This again highlights the importance of they used to publicly announce the hack and user education and awareness programs as a provide links to the data. The data revealed that component of overall security protections. HackingTeam’s employees used poor passwords including “P4ssword”. When/How Did BluVector Detect It?

In the wake of the data breach, HackingTeam Nine samples are publicly available and was forced to request its customers discontinue BluVector’s patented Machine Learning Engine using the RCS product, which cast doubt on the (MLE) detected all of them. Regression testing has continuing viability of the company. Research shown all samples would have been detected by done by Slovakia-based security company ESET all previous MLE models. Owing to differing times describes samples of RCS that were created the samples have been available in the wild, they between September 2015 and October 2017 would have been detected between 21 and 50 and run on Microsoft Windows. Similarities in months prior to their release. coding style and other factors, which they have chosen not to make public, led ESET to be “fully convinced” that these new variants are from HackingTeam and not created by other actors utilizing the previously released source code. The samples make use of VMProtect, which describes itself as “software protection against reversing and cracking.” ESET found no major advances in functionality when compared to earlier variants, which include capabilities for extracting files, intercepting emails and instant messages and covertly activating webcams and microphones. In at least two cases, they found the samples attached to emails where the filename utilized multiple file extensions in order to attempt

What Is It? file. This well-established malicious technique is known as DLL side-loading. It works by placing Since 2014, the OceanLotus Advanced Persistent the malicious DLL file in the same directory Threat (APT) group, also referred to as APT32 as the legitimate, signed DLL and then having and APT-C-00, has been targeting governments the legitimate DLL load the malicious DLL into and corporations in various industries located memory. This appears less suspicious as the in Southeast Asia, especially Vietnam, Laos, loading is performed by a signed, trusted Cambodia and the Philippines. The group is application. believed to be Vietnamese. The backdoor then encrypts its Command and The group’s goal is to install a backdoor allowing Control (C2) traffic. However, if detected and for full access to a system and the data it contains. captured, this traffic can be decrypted, owing to Recently, Slovakian-based security company the fact the encryption key is actually part of the ESET described the latest malware from traffic. OceanLotus. Though previously OceanLotus has utilized backdoor malware running on Macs, How Does It Propagate? these samples run on Microsoft Windows. The malware does not self-propagate. It is OceanLotus utilizes two main attack vectors believed to be attached to spearphishing in order to install the backdoor. The first is emails as an executable file, using the icon the tried and true method of spear phishing of a Microsoft Word or Excel document or emails containing malicious attachments. These convincing users to download and execute attachments are executables but use icons of what they believe to be the installer or updater Microsoft Word and Excel documents in order to for common software such as Firefox. Again, this convince targeted users to execute them. Once highlights the importance of user education and executed, they display a password protected awareness programs as a component of overall document to distract the user while the backdoor security protections. installs itself. When/How Did BluVector Detect It? The second vector is the use of watering hole attacks in order to get targeted users to install Six samples are publicly available and BluVector’s fake installers or updaters for common software, patented Machine Learning Engine detected such as Firefox. A watering hole attack is where all of them. Regression testing has shown four threat actors compromise legitimate websites samples would have been detected 41 months they either know or strongly suspect targeted prior to their release, with the two remaining users will visit. samples being detected 26 and 10 months prior. Once executed, the malware creates a Windows service and deletes the document used as a distraction. The malware then drops a legitimate, digitally-signed DLL (Dynamic Link Library) file from a well-known application and uses it to load the code from a second, malicious dropped DLL

What Is It? How Does It Propagate?

Recently, researchers at Bitdefender have As is common with APTs, PZChao attacks begin released the results of their analysis of a with highly targeted spam emails containing a sophisticated piece of custom written malware. malicious Visual Basic Script (VBS) attachment, They have named this malware PZChao, based which then downloads further malicious on the domains it uses for its infrastructure. components. Each domain is used for a specific purpose, such as downloading or controlling malware When/How Did BluVector Detect It? components. BluVector’s patented Machine Learning Engine The attackers have targeted government sector, detects PZChao components as malicious. education and technology/telecommunications Regression testing on various samples has organizations in the U.S., Canada, Australia and shown they would have been detected by throughout Asia since July 2017. BluVector between 19 and 25 months prior to their release, with one sample detected 45 It has been observed that once compromised, months prior. three payloads are installed on an infected system. The first is a bitcoin miner. Secondly, both the 32-bit and 64-bit versions of the Mimikatz tool are installed, uploading harvested passwords to a command and control (C2) server later. Finally, a close variant of the Gh0st RAT remote access trojan (RAT) is installed. The RAT component effectively gives the attackers full control over an infected machine including keystroke logging, eavesdropping utilizing the webcam or microphone, full access to the file system and remote shell. When analyzed, the RAT samples were found to be very similar to those used by the Iron Tiger Advanced Persistent Threat group. Believed to have been active since 2010, the group is thought to be based in China and previously considered to have initiated successful attacks on U.S. contractors, resulting in significant theft of data.

What Is It? additional malware capable of taking screenshots, logging keystrokes, acquiring network data While working on a malware incident in February and capturing passwords, the contents of USB 2018, controversial Russian anti-virus firmdevices and clipboard contents. However, as the Kaspersky Labs discovered a sophisticated malware has full access to the kernel (also known piece of malware, which led them to identify as ring-0), which is extremely difficult to achieve additional samples that are the very definition of without causing the dreaded “blue screen of an Advanced Persistent Threat. death,” Slingshot could potentially access other The APT malware, named Slingshot based on sensitive data such as stored password hashes strings found in the code, uses a unique and highly- and credit card details. targeted attack vector in order to compromise As demonstrated by the amount of time this systems belonging to highly privileged users. An APT has gone unnoticed, the malware uses indication of the sophistication and success of sophisticated techniques to remain undetected, this APT is that it has remained undetected in the including shutting down its components when it wild for a period believed to be at least 6 years. detects tools or techniques suggesting forensic Kaspersky observed nearly one hundred or malware analysis. Similar to previous APTs, infections in Kenya, Yemen, Libya, Afghanistan, Slingshot utilizes its own custom, encrypted Iraq, Tanzania, Jordan, Mauritius, Somalia, Congo, filesystem located in unused space on the hard Turkey, Sudan and the United Arab Emirates, with drive. the majority in Kenya and Yemen. Based on text How Does It Propagate? found within the code, Kaspersky believes that the creators are native English speakers, though The initial infection vector is not currently known, this is often difficult to ascertain. They also though it is not believed the malware self- believe the APTs overall sophistication points in propagates. the direction of nation state actors. The malware infects the systems of administrators The malware is installed into routers specifically logging into infected Mikrotik routers. made by a Latvian company named Mikrotik. It isn’t currently known how the malware is initially When/How Did BluVector Detect It? placed on the router, however it could be due Not all samples referenced in the report are to an unknown (zero-day) vulnerability in the currently publically available, however, four router’s firmware or potentially the use of default samples were retrieved and BluVector’s patented credentials. Machine Learning Engine detected all of them. When a system or network administrator Though the samples have only just become responsible for administering the router logs into available after being discovered in February it, they become infected. In this way, the malware 2018, they are believed to have been hidden infects an attacker’s ideal user, one with access to in the wild for at least 6 years, predating public numerous key systems and infrastructure within release of BluVector. However, regression testing a corporate environment. Once installed on an on the four samples has shown they would have administrator’s system, the APT downloads been detected up to 34 months ago.

What Is It? How Does It Propagate?

Researchers recently released analysis of a new AndroRAT does not self-propagate. variant of AndroRAT, a remote access trojan for Android devices. The malware is contained in a malicious app on third party app stores, and users are enticed to Of note, this variant exploits the CVE-2015- download it based on its apparent usefulness. 1805 vulnerability in order to gain root access Google has confirmed this app was never to the device to allow it to perform privileged present in the official Google Play store and actions. This vulnerability was patched by that detection for CVE-2015-1805 was already Google in March 2016, however, devices part of their compatibility tests. This reinforces running older versions of Android, which no the dangers posed to users by third party app longer receive patches, leave a large number of stores. users potentially exposed. This user base could include those making use of a corporate bring When/How Did BluVector Detect It? your own device (BYOD) program which could BluVector’s patented Machine Learning Engine provide attackers with sensitive information or detects this malware. Regression testing on other information that could be used to socially three samples has shown the malware would engineer an infected user or other employee. have been detected by BluVector 30, 27 and This AndroRAT variant’s capabilities include 7 months prior to its release. Note: BluVector key logging, recording audio and calls, taking would only detect the malware if the mobile photos and stealing various data, including WiFi device was connected to a corporate network passwords, call logs, GPS location, contacts, files, monitored by a BluVector appliance. SMS messages, calendar events, screenshots and web browsing history. It can also be used to upload files to the device.

What Is It? How Does It Propagate?

Researchers recently discovered a malicious The Dridex trojan does not self-propagate. spam run spreading a new variant of the Dridex banking trojan. Dridex was first seen in late 2014 As has been the case since it was first released, and continues to be very successful at stealing Dridex relies on a malicious spam email and a online banking credentials. malicious Microsoft Office document in order for the actual trojan to be downloaded and In an uncommon move, the links in the spam installed on a user’s system. Both of these steps emails, which result in the downloading of require the user to be socially engineered into malicious Microsoft Office documents, are FTP performing an action for them to be successful, sites. It is far more common for these links to e.g., clicking a link or allowing a macro to run. point to web pages. The FTP links in the emails Dridex actors continue to use this approach as contain the compromised credentials for it continues to work. This again illustrates the accessing the FTP site. importance of user education as a component of your overall cyber defense strategy. The use of FTP links may be due to the attackers attempting to bypass email security products/ When/How Did BluVector Detect It? policies. However, it highlights the importance of keeping FTP server software up-to-date and BluVector’s patented machine learning malware ensuring policies are in place to change all FTP detection engine detected the Dridex trojan as passwords on a regular basis, as this limits the malicious. Regression testing on samples has time-to-live for any misuse of compromised shown the Dridex trojan itself would have been credentials. detected by BluVector 32 months prior to its release and the malicious document files would have been detected 13 months prior.

What Is It? How Does It Propagate?

A recent blog entry from Trend Micro describes The infected apps do not self-propagate. malware they found in a total of 53 apps on the Google Play Store. The malware, named The malware is contained in various apps on GhostTeam based on the presence of this string the Google Play Store and users are enticed in early versions of the malware code, is primarily to download them based on their apparent Adware, however, it also targets Facebook usefulness. credentials, uploading them to a command and When/How Did BluVector Detect It? control (C2) server in the .com.vn domain. BluVector’s patented machine learning malware The malware will only fully install after it confirms detection engine detects the GhostTeam it is running on an actual Android device and not -infected apps as malicious. Regression testing an emulator or a virtual machine. on several infected samples has shown the files The infected apps claim to be useful utility would have been detected by BluVector an apps, such as a flashlight, device performance average of 9 months prior to their release. Note: improvement apps and social media video BluVector would only detect the malware if the downloader apps, which are particularly mobile device was connected to a corporate appealing to users in areas where mobile network monitored by a BluVector appliance. internet speeds are relatively low. These apps are also illustrative of the risks associated with Adware and other potentially unwanted programs/applications. These categories can sometimes be considered essentially safe by administrators, however, as evidenced here, Adware is often more than merely annoying and can contain malicious elements or can download other malicious content.

What Is It? How Does It Propagate?

Recently, researchers have discovered a new The LockPOS malware does not self-propagate. and sophisticated variant of the LockPOS point- of-sale (POS) malware. The purpose of this The malware is being spread by the same malware is to extract payment card data from botnet that previously delivered the Flokibot the memory of an infected point-of-sale system POS malware, which could be any device on and send that data back to the attackers. the corporate network that has visibility in to the POS devices. The most concerning aspect of LockPOS is that it improves upon a method that an earlier When/How Did BluVector Detect It? POS malware, Flokibot, used to avoid detection BluVector’s patented machine learning malware by endpoint anti-virus products. Aside from detection engine detects the LockPOS malware multiple stages of unpacking and decrypting as malicious. Regression testing on the sample itself, LockPOS first obtains a copy of a core has shown the file would have been detected Windows file (ntdll.dll) by mapping it from the by BluVector 48 months prior to its release. system’s disk. This process ensures the malware is calling a “clean copy” of the file, therefore bypassing hooks used by anti-virus products to monitor system activity. LockPOS then injects the malicious payload into the kernel, again bypassing anti-virus products. Researchers note that this malware required significant resources and technical skill to develop. This reflects the potential high monetary returns from a successful POS breach. POS malware is a great concern for any business, as the reputational losses and potential settlement and regulatory costs stemming from a major POS breach can have a large impact, as we have seen in several breaches including Target and Home Depot.

What Is It? How Does It Propagate?

Following the opening ceremony of the The initial infection vector in this attack is PyeongChang Winter Olympics there were currently not publicly known. reports of a cyberattack targeting systems associated with the games, including the official The malware uses the legitimate PSExec utility website. A spokesperson for PyeongChang 2018 and Windows Management Instrumentation later confirmed this. Along with the International (WMI) to move laterally. This is the same Olympic Committee, they had decided not mechanism employed by both BadRabbit and to name the source, though there were two NotPetya malware. obvious candidates. The malware also includes 44 sets of hard Researchers at Cisco TALOS believe with coded credentials for systems within the “moderate confidence” that they have identified Pyeongchang2018.com domain, which are also and analyzed the malware samples responsible used for lateral movement. The passwords, for this attack. The malware is destructive though redacted in the TALOS article, are very in nature and includes components to steal poor and would have been easily guessed credentials to allow it to spread laterally through or brute-forced, presumably during prior a network. TALOS found similarities in the lateral reconnaissance by the attackers. movement and destructive parts of the code When/How Did BluVector Detect It? with BadRabbit and NotPetya malware. BluVector’s patented Machine Learning Engine Though the initial infection vector is currently detects the malware utilized by this attack. unknown, the first piece of malware drops several Regression testing on samples has shown other malicious files and handles propagation. the malware would have been detected by Other components include a browser credential BluVector 14 months prior to its release. stealer, a system credential stealer (similar to Mimikatz) and a destructive component. The destructive component deletes the shadow copies and the WBAdmin backups, clears the system and security event logs, disables all the services on the system and overwrites all writable files on all shared drives attached to the infected system.

What Is It? Once again, these attacks rely on socially engineering users to not only open an attachment As is inevitable at this time of year, there have but then allow macros to run. The reason these been recent reports of large scale malicious attacks continue to use this vector is that it spam campaigns based around tax-related continues to work in sufficient numbers to make lures. One such campaign has been reported it unnecessary for less skilled attackers to invest to involve tens of millions of malicious emails, time and effort into using more sophisticated containing an attachment named taxletter.doc. attacks. The attackers have been observed regularly How Does It Propagate? altering the text of the emails in an attempt to avoid detection by spam filters and other None of the malware discussed here self- security products. However, the email subject propagates. and body text generally claims to be advising the recipient of an issue with their tax return or Once again these attacks utilize social informing them of an unexpected tax windfall. engineering to be successful. Particularly at this The object of course is to get the recipient to time of year, it is important for users to be vigilant open the attached malicious Word document and aware of the likelihood of malicious emails and override their default warnings to allow the using tax-related lures. embedded macro to run. When/How Did BluVector Detect It?

In this case, once allowed to run by the user, BluVector’s patented Machine Learning Engine the macro issues a Powershell command detects this malware. Regression testing on two to download and execute a file from the malicious Word document samples has shown bigrussiandomains[.]win site. The downloaded they would have been detected by BluVector file, tax.exe, is then saved to the user’s Temporary 48 months prior to their release. The password directory as mixak.exe and executed. stealer malware sample would have been The tax.exe malware is a password stealer, detected 14 months prior to its release. targeting, among others, passwords stored in browsers. Though convenient, storing of passwords in browsers makes it easier for attackers to obtain passwords such as banking and other financial credentials, social media credentials and credentials used for internal systems on the corporate network. These credentials can easily be monetized by attackers either using them to perform financial fraud directly or selling them. Internal credentials greatly assist attackers with reconnaissance and lateral movement within a corporate network.

What Is It? How Does It Propagate?

Recently, several articles have described As mentioned, the Smominru miner uses the how the massive increase in value of various EternalBlue exploit to spread. This highlights cryptocurrencies has seen attackers switching the need to have a robust patching policy and focus from ransomware to cryptocurrency ensure that internet-facing systems have all mining as it becomes the most lucrative form of unnecessary services turned off, in this case malware. Windows network file sharing. The rise in miner malware is such that SANS When/How Did BluVector Detect It? Internet Storm Center handler Kevin Liston opined that he should add an infrared camera BluVector’s patented Machine Learning to his incident response toolkit, given that a Engine (MLE) detects Smominru as malicious. computer infected with a miner would be using Regression testing on samples of four different all available computing power and therefore be versions of Smominru has shown they would running hotter than other computers in the same have been detected by BluVector 32, 49 and 50 office. months prior to their release. One such miner is Smominru, recently analyzed by Proofpoint researchers, which targets the Monero cryptocurrency. They state the attackers have already mined approximately 8,900 Monero which, due to the volatility of cryptocurrency valuations, equates to somewhere between $2.8 and $3.6 million, and they are currently mining Monero worth around $8,500 every day. The Smominru miner spreads to vulnerable Microsoft Windows systems by utilizing the leaked NSA EternalBlue exploit (CVE-2017- 0144), even though Microsoft released a patch for this in March 2017 (MS17-010).

What Is It? strings within it are not packed or obfuscated in any way, as is commonplace with most malware in the Attribution of malicious code, that is, attempting to wild. identify which group, individual or nation state is behind a given sample, is a controversial and often The sample also makes a number of changes divisive issue. This is due to the fact that attribution is to the Windows registry aimed at reducing the very difficult to prove conclusively, and it is relatively overall security posture of the system. Once it has easy for a threat actor to obfuscate the true author. completed encrypting files, it then deletes the TOR Sometimes the issue at hand is simply, what is the client files it dropped, clears the Windows event logs primary purpose of a piece of malware? and terminates its own process. These steps are in addition to a number of Windows Services it attempts Such is the case with a piece of malware recently to delete at startup. Taken together, these actions described by BleepingComputer. The malware, could be considered quite destructive – if successful. which they have named AVCrypt based on the file name of av2018.exe, exhibits some behaviors On balance, the above would suggest this malware consistent with a potentially incomplete piece of is ransomware in development. However, the original ransomware and some related to destructive wiper BleepingComputer article has a very interesting malware. comment added by user “hitler67”. The author of the comment, which appears not to be written by a native The AVCrypt malware attempts to specifically English speaker, states he is the author of the sample, uninstall and remove both Windows Defender and which was intended to be used for a presentation at Malwarebytes by issuing commands to stop and an unnamed security conference, and he is unaware delete the relevant Windows Services. There have how the sample became public. He also states he is been reports that AVCrypt queries Windows Security concerned the sample and the analysis in the article Center and tries to remove the registered anti-virus could be used by “bad actors.” product. The keyword here is “tries” as AVCrypt issues a WMIC (Windows Management Instrumentation How Does It Propagate? Command-line) command to attempt to uninstall the product. This is highly unlikely to be successful The malware does not contain the necessary code with the vast majority of AV products, which contain to self-propagate. countermeasures against unauthorized removal. The most common attack vector for most ransomware Lending credence to the hypothesis that AVCrypt is is social engineering, either as malicious attachments a sample of in-development ransomware is the fact or downloads performed by malicious documents. that when it encrypts files and creates the +HOW_ When/How Did BluVector Detect It? TO_UNLOCK.txt file, this file only contains the string “lol n.” Additionally, the sample contains numerous Two samples are publicly available and BluVector’s uses of the Windows API call OutputDebugString. patented Machine Learning Engine detected both. Also, when AVCrypt uses its included TOR client to Regression testing has shown both samples would send the encryption key to a hardcoded command have been detected 5 months prior to their release. and control server address, it appears to append invalid data to the key. The sample itself and the

What Is It? How Does It Propagate?

Researchers at legacy anti-virus vendor ESET Similar to the SamSam ransomware, BitPaymer/ have published findings that show strong FriedEx spreads by attackers manually brute evidence that the authors of the Dridex banking forcing Remote Desktop Protocol (RDP) servers, trojan are also responsible for writing the code which then gives them access to devices within for the BitPaymer ransomware. Owing to the the networks. Again, best practice dictates that connections they found with Dridex, ESET refers RDP servers should not be accessible from the to this malware as FriedEx. internet. The Dridex banking trojan has been seen in When/How Did BluVector Detect It? the wild since 2014 and since its initial release has been significantly updated and improved, BluVector’s patented machine learning malware becoming one of the most sophisticated and detection engine detects the BitPaymer/FriedEx successful banking trojans. ransomware as malicious. Regression testing on samples has shown the ransomware would The BitPaymer/FriedEx ransomware was first have been detected by BluVector 29 months seen in July 2017 and received significant media prior to its release. coverage when it was responsible for infecting several National Health Service hospitals in Scotland during August 2017. Much like the recently discussed SamSam ransomware, BitPaymer/FriedEx tends to target higher-profile companies and entities, rather than home users, and usually uses brute force Remote Desktop attacks to initially infect systems. Researchers showed screenshots that appear to come from the Hex-Rays decompiler tool, showing almost identical code in key areas of Dridex and BitPaymer/FriedEx functions. There were also commonalities in the compiler information and compiler timestamps. Their findings make a strong case for the same authors being behind both families of malware. It appears the authors saw an opportunity to take their existing Dridex codebase and modify it as necessary to create a ransomware revenue stream for themselves.

What Is It? site. All of the attachments were named “Resume.doc” (with a space as the first character), With all the focus cryptocurrency mining is however, each sample had a unique file hash. The currently receiving, both from the press and attackers also varied the email’s from address, attackers looking for a more lucrative revenue email subject, email headers and email body text stream, it is prudent not to underestimate the in an attempt to avoid detection. The resulting threat that ransomware still poses. ransomware were determined to be variants of Take the case of the Colorado Department of GlobeImposter and GandCrab. Transport (DOT). On February 21, 2018, the Ransomware may not currently be the cause du staff discovered that all employee machines jour of IT Security, however, as these two examples running Windows were infected with what was demonstrate, this does not mean that the threat later determined to be SamSam ransomware. ransomware poses to corporate environments This forced Colorado DOT to take over 2,000 has diminished. machines offline, literally sending employees back to pen and paper for their work activities. How Does It Propagate? While the DOT had backups of the encrypted None of the malware discussed here self- data, restoring the data is a time-consuming propagates. process. So much so that it had to work out how to pay employees without fully restored systems. Once again, these attacks utilize social engineering By March 1, approximately 20% of machines to be successful on an infected end user’s machine. were back online, consisting mainly of HR and When/How Did BluVector Detect It? payroll machines that were given recovery priority. They were promptly taken back offline BluVector’s patented Machine Learning Engine after another variant of SamSam infected these detects both the malicious Word documents systems. and ransomware described in the ISC article. Regression testing on the 23 malicious Word A SANS Internet Storm Center (ISC) Diary document samples showed that they would post by handler Brad Duncan described a have all been detected by BluVector 49 months large malicious spam campaign resulting in prior to their release. One of the three samples of ransomware infection. He found this of note, ransomware would have been detected 15 months as it was one of the few major ransomware prior to its release, with the other two detected 51 malicious spam campaigns he had seen so far months prior. in 2018. The majority of campaigns related to cryptocurrency mining and trojans. The specifics So far, no specifics on the SamSam variants that of this campaign aren’t particularly novel: an infected Colorado DOT machines are available, attached Word document contained a malicious therefore they cannot be tested against BluVector. macro. If the recipient is successfully socially However, previous testing on other SamSam engineered to allow the macro to run, it results in variants has shown strong detection results, with a Powershell script that retrieves and executes an average detection of 12 months prior to their the ransomware from an external release into the wild.

What Is It? How Does It Propagate?

Researchers from Cisco TALOS recently Unlike many other strains of ransomware, released details of a new variant of the SamSam SamSam does not self-propagate. ransomware, which has affected organizations in several industry verticals, including government, Researchers have not yet determined with healthcare and ICS. certainty the initial infection vector which then allowed the attackers to install the SamSam Media reports have advised various healthcare ransomware. However, they believe it may be organizations have been affected in recent compromised RDP and VNC servers that gave days, including MedStar, a non-profit group the attackers their first foothold into entering that manages 10 hospitals in the Baltimore and corporate networks. This is another reminder that Washington, DC area, Chicago-based AllScripts a determined attacker will find any weakness in and Hancock Health Hospital, as well as Adams your perimeter defense. Best practice dictates Memorial Hospital in Indiana. The government that RDP and VNC servers should not be municipality of Farmington, New Mexico has accessible from the internet. also been impacted. When/How Did BluVector Detect It? The initial infection vector has not yet been determined, though it is believed to be consistent BluVector’s patented machine learning malware with previous SamSam variants, where the detection engine detects SamSam ransomware attackers manually install the ransomware as malicious. Regression testing on several after compromising the corporate network samples has shown they would have been and moving laterally to identify which business detected by BluVector an average of 12 months critical servers would make the best targets. prior to their release. The ransomware consists of two components, a loader and an encrypted payload, both delivered as .NET executables. By design, the attackers must manually activate the ransomware using a randomly generated encryption key. SamSam is not a mass market ransomware such as WannaCry, but it is designed to be deployed on high-value targets. Researchers have determined at least one Bitcoin wallet is being used to collect ransom payments. Currently this wallet has collected 30.4 Bitcoin, which at the time of writing is worth approximately US$270K.

What Is It? What Is It?

Another strain of Android malware, dubbed The Hancitor botnet has previously targeted ExpensiveWall, was discovered in over 50 apps corporations in the tech, bio-tech and on the Google Play Store. These infected apps infrastructure industry verticals. were down-loaded at least 1 million times and possibly as high as 4.4 million times with the In this case, a malicious spam email claiming potential for up to 21.1 million infections. to be an invoice from Ad-vanced Maintenance contains links which, if clicked, result in the The malware makes use of packing, a common download of a Word document containing technique in Windows malware which encrypts malicious macros. If the end-user allows these the malicious code, in order to defeat Google macros to run, a malicious executable is Play Store’s own malware detection. extracted and executed. Once installed and granted the requested This malicious executable is capable of privileges, it silently registers the infected users downloading other malware, includ-ing for premium services and sends premium SMS ransomware and data-stealing malware. messages, charging their accounts. How Does It Propagate? How Does It Propagate? The malware is spread using a spam campaign More than 50 apps in the Google Play Store which needs to convince the user to click on a were infected with Expensive-Wall malware. link in order to download the malicious Word While Google Play Store quickly removed the document, open the document and allow macros apps from availability, Android users with those to execute. As always, end-user edu-cation is apps may still risk infection. a critical component of securing a corporate environment. When/How Did BluVector Detect It? When/How Did BluVector Detect It? A number of Android apps infected with ExpensiveWall were tested and all were Both the malicious Word document and the identified as malicious by BluVector’s machine extracted executable are identified as malicious learning malware detection engine. Regression by BluVector’s machine learning malware testing has shown this trojan would have been detection engine. Regression testing has shown detected by BluVector since November 2016. the Word document would have been detected Note: BluVector would only detect the malware if by BluVector 43 months in advance and the the mobile device was connected to a corporate executable 35 months in advance. net-work monitored by a BluVector appliance.

What Is It? How Does It Propagate?

Recently security researchers released the The IcedID malware has been found to have results of their research into a new banking been downloaded and installed on systems trojan dubbed IcedID, first seen in the wild in as a secondary infection, by the Emotet trojan. September 2017. This allows the attackers to only install IcedID on systems located in the US, Canada and the The current versions of IcedID are able to UK, and recov-ered configuration files show target banks, payment card and mobile service financial institutions in these countries are the providers, payroll portals, as well as webmail ones currently being targeted. and e-commerce sites. This malware also has the ability to propagate In order to steal financial data and user credentials, via the internal network, and re-searchers have the malware performs both redirection attacks also observed it infecting a terminal server. – where it creates a local proxy in order to silently redirect users to fake, cloned versions When/How Did BluVector Detect It? of their legitimate financial provider’s websites – and web injection attacks – where it adds BluVector’s patented machine learning engine extra fields into legitimate webpages in order to detects the IcedID malware as ma-licious. obtain additional user data. Previously, only the Regression testing on four samples has shown Dridex banking trojan utilized both techniques; the files would have been detected by BluVector generally one or the other is used. between 36 and 46 months prior to their release. The research found that the IcedID trojan does not appear to reuse code from other banking trojans, indicating the attackers are potentially a new group.

What Is It? How Does It Propagate?

The Marcher malware is part of a three-way Previous variants of Marcher malware have attack aimed at customers of Austrian banks. been distributed via text messages. In this case, propagation occurs by successfully socially The first component of this attack is a phishing engineering a user to install the malware, email containing a link, utilizing the bit.ly URL believing it to be an app required by his or redirection service. The link takes the user to a her bank. This will only occur if the user has phishing site that duplicates a bank’s legitimate previously been socially engineered to click on online banking login page in an attempt to steal the link in a phishing email and enter his or her the user’s credentials. After the user enters his or credentials into a fake online banking site. her credentials, the fake site then also requests the user’s email address and phone number. Attackers continue to use social engineering to exploit the most vulnerable component of At this point, the second phase of the attack any computer system: the user. They do so begins. The user is presented with a webpage because this attack vector is reliably successful. advising that he or she does not have the bank’s User education is a critical part of securing required “Security App” and providing another any corporate network. With Android devices bit.ly link and a QR code in order to download the becoming more commonplace in enterprise app. There are even instructions on ac-cepting networks due to BYOD policies, they can create the Android system permissions requested by a new threat vector for malware infections if not the app. The app is, of course, a variant of the monitored and managed correctly. Marcher banking trojan. When/How Did BluVector Detect It? The third aspect of the attack is that, in addition to stealing the user’s online banking credentials, BluVector’s patented machine learning malware the Marcher trojan will also request credit card detection engine detects the Marcher Android information be entered when certain apps are app as malicious. Regression testing has shown opened, such as the Google Play Store. The the file would have been detected by BluVector trojan also attempts to obtain other supporting 11 months prior to its release. Note: BluVector information, such as the user’s date of birth, would only detect the malware if the mobile address, billing phone number and password by device was connected to a corporate network presenting fake Verified by Visa and MasterCard monitored by a BluVector appliance. SecureCode screens.

What Is It? How Does It Propagate?

In the days leading up to the U.S. Thanksgiving The Scarab ransomware does not self- break, a significant malicious spam campaign propagate, nor does it spread via an internal was launched to spread a new piece of network. ransomware known as Scarab. The timing was clearly deliberate in its social engineering It spreads via malicious spam, requiring users approach as many people had already started to be socially engineered to open the attached their Thanksgiving break. It was designed to hit 7-Zip file and execute the Visual Basic Script in the inboxes of people in a rush to finish their work order to be infected. Once again, this highlights and start their holiday break, thus exercising less the importance of user education in securing care and attention to what they were clicking. the corporate IT environment. It is reported that in the first four hours of this When/How Did BluVector Detect It? campaign, over 12.5 million spam emails were BluVector’s patented machine learning malware sent. The subject of the emails used a common detection engine detects the Scarab malware lure of “Scanned from [printer name],” where as malicious. Regression testing on the sample “printer name” was Epson, HP, Lexmark or has shown the ransomware would have been Canon. The campaign utilized the large Necurs detected by BluVector 11 months prior to its botnet to send the spam emails from infected release. hosts. Attached to the email was a Visual Basic Script compressed inside a 7-Zip file. Executing the Visual Basic Script resulted in downloading and executing the Scarab ransomware. Scarab adds the extension “[suupport@ protonmail.com].scarab” to all files it encrypts, including data files as well as document and image file types.

What Is It? .dib, .disk, .djvu, .doc, .docx, .dwg, .eml, .fdb, .gz, .h, .hdd, .hpp, .hxx, .iso, .java, .jfif, .jpe, .jpeg, .jpg, On Oct. 24, 2017, a new strain of ransomware, .js, .kdbx, .key, .mail, .mdb, .msg, .nrg, .odc, .odf, referred to as Bad Rabbit, was used in a .odg, .odi, .odm, .odp, .ods, .odt, .ora, .ost, .ova, widespread campaign that reportedly caused .ovf, .p12, .p7b, .p7c, .pdf, .pem, .pfx, .php, .pmf, issues for enterprises and infrastructure such .png, .ppt, .pptx, .ps1, .pst, .pvi, .py, .pyc, .pyw, as airports and train stations across Eastern .qcow, .qcow2, .rar, .rb, .rtf, .scm, .sln, .sql, .tar, .tib, Europe, Turkey and Germany. .tif, .tiff, .vb, .vbox, .vbs, .vcb, .vdi, .vfd, .vhd, .vhdx, Analysis of the malware code found similarities .vmc, .vmdk, .vmsd, .vmtm, .vmx, .vsdx, .vsv, .work, with previous large-scale ransomware attacks .xls, .xlsx, .xml, .xvd, .zip such as NotPetya and Petya. However, this How Does It Propagate? malware does not use the EternalBlue exploit to propagate. Additionally, this malware appears Bad Rabbit spreads via compromised websites not to be destructive as NotPetya was; it is purely redirecting to a drive-by download of the ransomware. malware, which claims to be an Adobe Flash Player update. A number of websites were compromised in Eastern Europe and Turkey and redirected This malware also contains a list of weak users to a site serving a drive-by download of passwords which it can utilize to propagate over a fake Adobe Flash Player update. The drive- the network. It does not utilize any exploits. by download server was taken offline after approximately 6 hours. As this attack initially requires a user to execute the fake Adobe Flash Player update, end-user The ransomware requested an initial ransom of education is always a critical component of 0.05 Bitcoin (US$274.86, as of the writing of this securing a corporate environment. report) which increases the longer the ransom goes unpaid. When/How Did BluVector Detect It?

As is common with recent ransomware, it BluVector’s machine learning malware detection encrypts the Master Boot Record on the victim’s engine detects the fake Adobe Flash Player hard drive, rendering it unusable until the update as malicious. Regression testing has ransom is paid, after first encrypting files with shown the file would have been detected by the extensions of: BluVector 10 months prior to the malware’s release. .3ds, .7z, .accdb, .ai, .asm, .asp, .aspx, .avhd, .back, .bak, .bmp, .brw, .c, .cab, .cc, .cer, .cfg, .conf, .cpp, .crt, .cs, .ctl, .cxx, .dbf, .der, .dib, .disk, .djvu, .doc, .docx, .3ds, .7z, .accdb, .ai, .asm, .asp, .aspx, .avhd, .back, .bak, .bmp, .brw, .c, .cab, .cc, .cer, .cfg, .conf, .cpp, .crt, .cs, .ctl, .cxx, .dbf, .der,

What Is It?

Various news articles have described a new strain of Android ransomware known as DoubleLocker. The malware is so named as it not only encrypts data files on an infected smartphone, it also alters the PIN of the device. Files are encrypted using a correct implementation of the AES algorithm and have the file extension “.cryeye” added to encrypted filenames.

If the ransom of 0.013 Bitcoin is paid within the permitted two-hour time frame, the malicious actors can reset the device’s PIN and decryptthe files.

How Does It Propagate?

The malware is said to be spreading mostly via compromised websites offering a fake Adobe Flash Player download.

When/How Did BluVector Detect It?

The Android APK file is identified as malicious by BluVector’s machine learning malware detection engine. Regression testing has shown this file would have been detected by BluVector 10 months prior to it being released. Note: BluVector would only detect the malware if the Android device was connected to a corporate network monitored by a BluVector appliance.

BluVector is revolutionizing network security with state-of-the-art AI, sensing and responding to the world's most sophisticated threats in real time. With the unmatched advantage of 8 years of work with the US Intel Community and their threat data, only BluVector has the proven ability to protect against emerging threats on average 13 months in advance. Stop waiting for breaches to happen. GET AHEAD OF THE THREAT.

BLUVECTOR MLE BLUVECTOR SCE BluVector MLE is a patented supervised BluVector SCE is the security market’s first analytic Machine Learning Engine that was developed specifically designed to detect fileless malware within the defense and intelligence community as it traverses the network. By emulating how to accurately detect zero-day and polymorphic the malware will behave when it is executed, the malware in real time. Unlike unsupervised Speculative Code Execution engine determines, machine learning, which is leveraged by at line speed, what an input can do if executed most security vendors today, BluVector MLE and to what extent these behaviors might initiate algorithms were pre-trained to immediately a security breach. By covering all potential identify malicious content embedded within execution chains and focusing on malicious common file formats like Office documents, capacity rather than malicious behavior, the archives, executables, .pdf, and system updates. analytic technology vastly reduces the number The result: 99.1%+ detection accuracy upon of execution environments and the quantity of installation. analytic results that must be investigated. The result: 99%+ detection accuracy of this otherwise “invisible” threat.

GET AHEAD OF THE THREAT www.bluvector.io 571.565.2100