Category: #IT/CYBER/TECHNOLOGY

This post is the first in a series by Unit 42 covering the cybercrime underground. Cybercrime persists as an epidemic that continues to worsen every year, with associated impacts and losses steadily growing. In this series, we’ll explore actors, motivations, and the current threat landscape.

Some of what contributes to the growth of the cybercrime underground is the convenience, speed, and anonymity the Internet provides to enable online crimes. Advances in the sophistication of cyberattacks over the past decade closely correlate with two major evolutions:

• Lowered Cost of Entry: The ease and availability of tools and training to conduct such attacks, allowing individuals with lower skillsets to successfully thrive in the cybercrime industry.
• Increased Business Acumen: The refinement of full attack lifecycle processes and support structures that rival some of the most innovative legitimate business models, enabling more efficient and effective operations coupled with robust commodity markets.

With the ever-changing cybercrime threat landscape, it is important to understand its current state, observe trends, and anticipate likely paths of evolution. Before we go any further, let’s establish some definitions related to the cybercrime underground.

Definitions

Cybercrime: Any crime that involves the use of computers to victimize an individual or organization for financial gain.

Indexed Web: All Internet search engine accessible and indexed sites. This is the web that most of the world knows and uses every day, and includes commercial / retail, social media, news, consumer service, and other publicly known sites.

Deep Web: Sites that make indexing by Internet search engines problematic, due to access control, dynamic content, or other prerequisite mechanisms (e.g., encryption or specialized software). In general, these sites are not accessible to standard web search engine crawlers that perform indexing. This class of sites is also sometimes referred to as the Invisible Web, Hidden Web, or Deepnet.

Dark Web: A subset of Deep Web sites that requires special software (e.g., TOR) to reach. Related infrastructure hosts criminal content such as stolen information and access to premium malware and exploits, and supports other categories of activity, such as illegal pornography, drug trade, prostitution, human trafficking, and terrorist operations. A number of these sites are transient, only up for a short

time or constantly changing addresses in an attempt to minimize the risk of exposure to government agencies, law enforcement and security researchers.

Cybercrime underground: Online forums where information, tools (malware, exploits), and services are bought and sold in support of cybercrime objectives. Composite sites exist on the Indexed Web, Deep Web, and Dark Web in varying contexts.

Figure 1 High level chart connecting the different attributes of cybercrime

Impacts

Cybercrime has broad impacts to both organizations and individuals. The losses from cybercrime can range from theft of intellectual property to costs incurred due to a result of a breach. A high level overview of the impacts can be broken down into direct and indirect losses:

Direct Losses

• Loss of control over owned or entrusted:
  • PII data
  • Financial information
  • Electronic Health Records (EHRs)
  • Intellectual property
  • Trade secrets
• Direct financial fraud
• Service disruptions or restriction of access to data (e.g., ransomware).

Indirect Losses

• Costs supporting recovery from a breach, such as incident response, investigation services, and remediation
• Reputational damage
• Legal and regulatory penalties related to the loss of records (e.g., PII, health, financial, etc.)
• Near term business revenue loss
• Longer term financial and economic consequences

Products, Services and Actor Roles

The cybercrime underground maintains its own economy of commoditized products and services. Related financial transactions have boomed with the broad adoption and accessibility of anonymous cryptocurrencies such as Bitcoin, which is commonly used by malicious actors amongst themselves as well as for accepting payments from victims (e.g., ransomware).

Products can be broken down into two main categories: information and resources. Sellers of these products benefit from the quick payouts of discrete (and sometimes one-time) transactions. Buyers benefit from what is often a professional level product that can be applied immediately to malicious actor operations “out of the box.” Information products include commodities such as:

• Stolen personally identifiable information (PII): Including everything from mass email lists used by spammers to full identity theft packages to commit financial fraud
• Exfiltrated organizational information: Including intellectual capital / property, non-public internal data, and internal operational details
• Harvested authentication credentials: Stolen username and password combinations continue to present a significant risk these days, especially when those credentials are re-used across multiple sites
• Pilfered financial / payment data: Unauthorized withdrawals from accounts or charges against credit lines continue to plague account holders

Resource products include elements such as:

• Access to feature-rich malware: Malware across varying capabilities (e.g., information stealers, remote administration tools – RATs, ransomware, purpose built utilities) that demonstrate consistent results and avoid source code leakage can generate significant revenue for associated authors and distributors
• Purchase of system or software exploits: While many white hats elect to support bug bounty initiatives by vendors, there remains a lucrative underground market for reliable, un-patched exploits
• Transfer of control for previously compromised machines: This usually applies to always-on servers that can then be used as attack platforms or sold for the information they store, although the service model for this element is more popular these days
• Malicious actor training: Guidebooks or tutorials on effective tool usage or specific Tactics, Techniques, and Procedures (TTPs)

Services can be thought of as “lease” versions of the resource-based – and even some of the information-based – products described above, where access to a product is promised at a set rate for an agreed upon period of time. Providing services appeals to many actors due to the recurrent cost model and opportunity to collect higher profits over a longer period of service. Malicious actors using these services benefit from assurances on availability and performance (e.g., timely feature, exploitation, and evasion updates). Such services include the following:

• Distributed Denial of Service (DDoS): Botnet powered attacks that affect the availability of targeted servers and capabilities
• Exploit Kits (EKs): Typically, monthly rate for access to the exploit toolkit allowing for customized end payloads
• Infrastructure rental: Hosting services for attack platforms; malware update, configuration, and command and control (C2); and other attack lifecycle functions. Of special note: BulletProof Hosting Services (BPHSs) providers play a critical role in the cybercrime world as they allow cyber criminals to thrive and operate their malicious services without the risk of easily being taken down by law enforcement. Some of the key reasons that BPHS providers have been successful in their operations include: the appearance of legitimate businesses, strategic geographic distribution of servers in countries with accommodating cyber laws, high redundancy to minimize the risk of operational disruption, and professional level support services
• Money laundering: Transfer (“money muling”) of illegally obtained funds through accounts and mechanisms in money haven countries remains a key service

As a high-level, malicious actor motivation, cybercrime is simply an extension of traditional criminal activity, focused on the theft of personal and account information and/or establishment of leverage over a target to achieve illicit monetary gain. The cybercrime ecosystem relies on a number of key roles that are also shared across other top-level motivations. A description of these roles can be found in Part 2 of a prior Unit 42 blog series: Adversaries and Their Motivations.

Coming Up…

Subsequent posts in this blog series will focus on different aspects of the cybercrime underground, including associated tools, services, techniques, and actors.

Rob Downs and Vicky Ray

[Palo Alto Networks Research Center]

(This blog post is also available in Japanese.)

Palo Alto Networks has identified a malware family known as ‘Aveo’ that is being used to target Japanese speaking users. The ‘Aveo’ malware name comes from an embedded debug string within the binary file. The Aveo malware family has close ties to the previously discussed FormerFirstRAT malware family, which was also witnessed being used against Japanese targets. Aveo is disguised as a Microsoft Excel document, and drops a decoy document upon execution. The decoy document in question is related to a research initiative led by the Ido Laboratory at the Saitama Institute of Technology. Upon execution, the Aveo malware accepts a number of commands, allowing attackers to take full control over the victim machine.

Deployment

The Aveo malware sample disguises itself as a Microsoft Excel document, as the icon below demonstrates. Note that the filename of ‘malware.exe’ is simply a placeholder, as the original filename is unknown.

Figure 1 Microsoft Excel icon used by Aveo malware

The executable is in fact a WinRAR self-extracting executable file, which will drop the decoy document and Aveo Trojan upon execution. The following decoy document is dropped and subsequently opened when run.

Figure 2 Decoy document used with Aveo malware

This decoy document is hosted on the Ido Laboratory and contains information about a 2016 research initiative. The document lists participants in the 16^th CAVE workshop, including names, affiliations, and email addresses of those involved. The document, written in Japanese, as well as the filename of this document, “CAVE研究会参加者.xls”, indicates that this malware was used to target one or more Japanese speaking individuals. Additionally, the similarities between the Aveo and FormerFirstRAT malware families, which will be discussed later in the post, further add evidence that Japanese speakers are being targeted.

Infrastructure

The Aveo Trojan is configured to communicate with the following domain name over HTTP.

• snoozetime[.]info

This domain was first registered in May 2015 to ‘jack.ondo@mail.com’. Since that time, it has since been associated with the following three IP addresses:

• 104.202.173[.]82
• 107.180.36[.]179
• 50.63.202[.]38

All IP addresses in question are located within the United States.

Figure 3 PassiveTotal screenshot showing associated IP addresses with snoozetime[.]info

The WHOIS information for snoozetime[.]info lists a registrant email address of ‘jack.ondo@mail[.]com’ and a name of ‘aygt5ruhrj aygt5ruhrj gerhjrt’. Pivoting off of these two pieces of information to domains that share the same yields the following additional domains and email addresses.

• bluepaint[.]info
• coinpack[.]info
• 7b7p[.]info
• donkeyhaws[.]info
• europcubit[.]com
• jhmiyh.ny@gmail[.]com
• 844148030@qq[.]com

Malware Analysis

After running the self-extracting executable, a number of files are dropped to the file system and the following execution flow is witnessed:

Figure 4 Malware execution flow

When the mshelp32.exe executable runs, it begins by reading in the setting32.ini file, which contains the name of the decoy document. This information is used to build a batch script, such as the following.

This batch script is executed within a new process, and acts as a simple cleanup script that runs after Aveo and the decoy document are executed.

Aveo Malware Family

The Aveo malware initially runs an install routine, which will copy itself to the following location:

• %APPDATA%\MMC\MMC.exe

If for any reason the %APPDATA%\MMC directory is unable to be created, Aveo will use %TEMP% instead of %APPDATA%.

After the malware copies itself, it will execute MMC.exe in a new process with an argument of the original filename. When executed, if this single argument is provided, the malware will delete the file path provided.

After the installation routine completes, Aveo will exfiltrate the following victim information to a remote server via HTTP.

• Unique victim hash
• IP Address
• Microsoft Windows version
• Username
• ANSI code page identifier

This information is exfiltrated to the ‘snoozetime[.]info’ domain, as seen in the following example HTTP request:

To encrypt the provided data, the malware makes use of the RC4 algorithm, using a key of ‘hello’. As shown in the following image, the encryption routines between Aveo and FormerFirstRAT are almost identical, with only the algorithms and keys being changed.

Figure 5 Comparison of encryption function between Aveo and FormerFirstRAT

In order to decrypt the data provided via HTTP, the following code may be used:

Running the code above yields the following results:

After the initial victim information is exfiltrated, the malware expects a response of ‘OK’. Afterwards, Aveo will spawn a new thread that is responsible for handling interactive command requests received by the command and control (C2) server, as well as requests to spawn an interactive shell.

Aveo proceeds to set the following registry key to point towards the malware’s path, thus ensuring persistence across reboots:

HKCU\software\microsoft\windows\currentversion\run\msnetbridge

A command handler loop is then entered, where Aveo will accept commands from the remote C2. While the Aveo malware family awaits a response, it will perform sleep delays of randomly chosen intervals between 0 and 3276 milliseconds. Should the C2 server respond with ‘toyota’, it will set that interval to 60 seconds. Aveo accepts the following commands, shown with their associated function.

• 1 : Execute command in interactive shell
• 2 : Get file attributes
• 3 : Write file
• 4 : Read file
• 5 : List drives
• 6 : Execute DIR command against path

The following example request demonstrates the C2 server sending the ‘ipconfig’ command to the Aveo malware.

C2 Request

Aveo Response

Conclusion

Aveo shares a number of characteristics with FormerFirstRAT, including encryption routines, code reuse, and similarities in C2 functionality. Aveo is far from the most sophisticated malware family around. As witnessed in the previously discussed FormerFirstRAT sample, this related malware family also looks to be targeting Japanese speaking users. Using a self-extracting WinRAR file, the malware drops a decoy document, a copy of the Aveo malware, and a cleanup script.

Palo Alto Networks customers are protected from this threat in the following ways:

• An AutoFocus tag has been created to track and monitor this threat
• WildFire classifies Aveo samples as malicious
• C2 domains listed in this report are blocked through Threat Prevention.

Indicators of Compromise

SHA256 Hashes

9dccfdd2a503ef8614189225bbbac11ee6027590c577afcaada7e042e18625e2
8101c298a33d91a985a5150d0254cf426601e4632250f5a03ddac39375e7fb4d

C2 Domains

snoozetime[.]info

Registry Keys

HKCU\software\microsoft\windows\currentversion\run\msnetbridge

File Paths

%APPDATA%\MMC\MMC.exe
%TEMP%\MMC\MMC.exe

Josh Grunzweig and Robert Falcone

[Palo Alto Networks Research Center]