By Vanja Svajcer.
- As protection techniques develop, attackers are finding it harder to successfully attack their targets and must find creative ways to succeed.
- Cisco Talos recently discovered a campaign utilizing a variant of the Masslogger trojan designed to retrieve and exfiltrate user credentials from multiple sources such as Microsoft Outlook, Google Chrome and instant messengers.
- Apart from the initial email attachment, all the stages of the attacks are fileless and they only occur in volatile memory.
- These threats demonstrate several techniques of the MITRE ATT&CK framework, most notably T1566 — Phishing, T1059.001 and T1059.007 — Command and Scripting Interpreters, T1140 — Deobfuscate/Decode Files or Information, T1497 — Virtualization/Sandbox Evasion, T1555.003 — Credentials from Web Browsers, T1115 — Clipboard Data, T1056.001 — Keylogging and T1048.003 — Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol.
Attackers are constantly reinventing ways to monetize their tools. Cisco Talos recently discovered an interesting campaign affecting Windows systems and targeting users in Turkey, Latvia and Italy, although similar campaigns by the same actor have also been targeting users in Bulgaria, Lithuania, Hungary, Estonia, Romania and Spain in September, October and November 2020.
The actor employs a multi-modular approach that starts with the initial phishing email and carries through to the final payload. The adversaries behind this campaign likely do this to evade detection. But it can also be a weakness, as there are plenty of opportunities for defenders to break the killchain.
How did it work?
The infection starts with an email message containing a legitimate-looking subject line that seems to relate to a business. The email contains a RAR attachment with a slightly unusual filename extension.
The usual filename extension for RAR files is .rar. However, RAR-compressed archives can also be split into multi-volume archives. In this case, the filename creates files with the RAR extension named "r00" and onwards with the .chm file extension. This naming scheme is used by the Masslogger campaign, presumably to bypass any programs that would block the email attachment based on its file extension.
The second stage is a PowerShell script that eventually deobfuscates into a downloader and downloads and loads the main PowerShell loader. The Masslogger loaders seem to be hosted on compromised legitimate hosts with a filename containing one letter and one number concatenated with the filename extension .jpg. For example, "D9.jpg".
The main payload is a variant of the Masslogger trojan designed to retrieve and exfiltrate user credentials from a variety of sources, targeting home and business users. Masslogger can be configured as a keylogger, but in this case, the actor has disabled this functionality.
While most of the public attention seems to be focused on ransomware attacks, big game hunting and APTs, it is important to keep in mind that crimeware actors are still active and can inflict significant damage to organizations by stealing users' credentials. The credentials themselves have value on the dark web and actors sell them for money or use them in other attacks.
Technical case overview
Masslogger is a spyware program written in .NET with a focus on stealing user credentials, mostly from the browsers but also from several popular messaging applications and email clients. It was released in April 2020 and sold on underground forums for a moderate price with a few licensing options.
The exfiltration of data takes place over one or more of these channels:
- FTP (plain text over default port 21), the configuration contains user credentials.
- HTTP — Using a PHP-based control panel.
- SMTP — The user has to specify email address, server and credentials to use it.
We won't dig deep into the functionality of the final Masslogger payload, as this was previously well-described by other researchers. Instead, we'll focus on the infection vector and the memory-only delivery chain before the final stage is loaded. In case of commodity spyware such as Masslogger, it is the infection chain and contextual information that distinguish the individual actors behind each campaign.
Email as an infection vector
The latest campaign began in mid-January. Based on the combination of discovered emails and file names, we believe it was targeting organizations in Turkey, Latvia and Italy. We have observed similar campaigns happening in several instances before, starting no later than September 2020. In previous campaigns, the actor was targeting users in Bulgaria, Lithuania, Hungary, Estonia, Romania and Spain.
European countries targeted by the observed Masslogger campaigns from September 2020.
The email is written in the language of the targeted recipient's top-level domain. The first example is an email targeted at users in Turkey with the subject "Domestic customer inquiry" and the body "At the request of our customer, please send your attached best quotes."
Email campaign example targeting users in Turkey.
Some earlier campaigns were purported to be a request to open and sign a memorandum of understanding. The actor attempted to make emails more credible by adding a link to the legitimate scanning application to the email footer "Shipped with Genius Scan for iOS."
For the campaigns in September, October and November, the adversaries sent emails containing a subject line that translates to "MOU Information" with the text "Please return it signed and stamped. Best regards," in the body.
An example of an earlier email targeting users in Spain.
An example of an earlier email targeting users in Bulgaria.
The attachment file name for the latest campaign is chosen according to the email subject, with possible random strings prepended, for example, "70727_YK90054_Teknik_Cizimler." The attachment filename extension is chosen to bypass simple blockers that attempt to block RAR attachments using its default filename extension ".rar". The actor changes the filename extension to RAR multi-volume filename extensions, starting from ".r00". WinRAR and other RAR-capable unarchivers will still open the file without problems.
The attached RAR archive contains a single file with the ".chm" filename extension. CHM stands for "compiled HTML files," and it is one of the default formats for Windows Help files. Compiled HTML files can be easily created using the Windows HTML Help executable program hh.exe. The same program can be used with the command line option "-decompile" to extract the embedded and compressed HTML files.
When the user opens the attachment with the default application, a simple HTML page is displayed, containing the text "Customer service, Please Wait…"
The HTML page displayed when the .CHM attachment is opened.
HTML page with an ActiveX object embedded and PowerShell code.
When deobfuscated, we can observe a PowerShell downloader stage, which simply connects to the download server, usually a compromised legitimate host. The download server hosts the next stage of the infection.
PowerShell downloader stage.
The URL to download the next stage ends in the path with the format [1Letter][1 to 2-digit number].jpg, for example, hxxp://sinetcol[.]co/D7.jpg. This stage is encoded with a simple hexadecimal encoding scheme and is converted to code by first splitting the downloaded content using the character "^" as the delimiter and then adding ASCII representation of each number to a string variable. Eventually, the string containing PowerShell code is piped into the Invoke-Expression (IEX) cmdlet. This is the PowerShell loader.
Encoded PowerShell loader
The PowerShell loader contains two encoded .NET assemblies. The first one is a DLL and the other an executable.
Loader DLL and final Masslogger payload
Start of the PowerShell loader.
The PowerShell loader first decodes the .NET DLL and then deobfuscates the string "System.AppDomain" to get the reference to its method "GetCurrentDomain." The loader then creates a byte array where it stores the Masslogger loader before it invokes the GetCurrentDomain function to get the context of execution and the process where the script is executing.
The acquired domain is then used to load the .NET DLL assembly into the powershell.exe process space with the assembly name "Waves.dll." Waves employs a Costura loader, an open-source reflective assembly loader alternative to ILMerge and is obfuscated with DotNetGuard obfuscator, all to make analysis and detection more difficult.
Once the DLL is loaded as a .NET assembly, the PowerShell loader calls the method tasked with creating a msbuild.exe process, injecting the final payload into its process space and launching it.
After decoding, the DLL loader assembly is created and loaded.
The Masslogger payload is stored in memory as a buffer compressed with gzip. The buffer is decompressed by the DLL loader. The internal assembly name of the payload is "service-med-star.gr", which is a concatenation of the username and the server used for FTP credentials exfiltration.
Masslogger is a credential stealer and keylogger with the ability to exfiltrate data through SMTP, FTP or HTTP protocols. For the first two, no additional server-side components are required, while the exfiltration over HTTP is done through the Masslogger control panel web application.
This version of Masslogger contains the functionality to target and retrieve credentials from the following applications:
- Pidgin messenger client
- FileZilla FTP client
- QQ Browser
- Chromium based browsers (Chrome, Chromium, Edge, Opera, Brave)
The configuration for a payload is stored as an encrypted array of strings within the payload itself. Although the configuration is encrypted and the payload obfuscated with an unknown obfuscator it is still possible to find code used to decrypt the configuration as previously documented by Mario Henkel.
The configuration is decrypted using the standard .NET framework functionality. This allows us to place a breakpoint to the beginning of the method System.Security.Cryptography.AesCryptoServiceProvider and step back to the configuration decryption function within the payload body and trace the value returned to the caller after each configuration string is decrypted.
Breakpoints placed to decrypt the payload configuration.
The decrypted configuration is parsed by Masslogger to configure the trojan to target a specific set of applications and exhibit functionality. In our case, the Masslogger version we are dealing with is 3.0.7563.31381 and the exfiltration is conducted over FTP, with med-star.gr as the FTP exfiltration server.
Although the payload is configured to use FTP, the actor has installed a version of Masslogger control panel on the same server with the URL hxxps://www[.]med-star[.]gr/panel/?/login.
Masslogger control panel login screen.
Decrypted Masslogger configuration strings.
Once the credentials from targeted applications are retrieved, they are uploaded to the exfiltration server with a filename containing the username, two-letter country ID, unique machine ID and the timestamp for when the file was created.
Uploaded credential files begin with the information about the user and the infected system, configuration options and processes running, followed by the retrieved credentials delimited by lines containing targeted application names.
The beginning of an uploaded exfiltrated credentials file.
This recently discovered Masslogger campaign — which we attribute to an actor launching similar credential-stealing campaigns — back to at least September 2020. There is moderate confidence the author has previously used AgentTesla with similar goals in April 2020. The campaigns are targeted to several European countries, shifting its focus monthly. In our research, we detected email messages targeting Turkey, Latvia, Lithuania, Bulgaria, Hungary, Estonia, Romania, Italy and Spain, as well as messages written in English.
Masslogger campaign modules.
The observed campaign is almost entirely executed and present only in memory, which emphasizes the importance of conducting regular and background memory scans. The only component present on disk is the attachment and the compiled HTML help file.
Users are advised to configure their systems for logging PowerShell events such as module loading and executed script blocks as they will show executed code in its deobfuscated format. Talos will continue to track similar campaigns to make sure adequate protection is included in Cisco Secure products.
Ways our customers can detect and block this threat are listed below.
Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors. Exploit Prevention present within AMP is designed to protect customers from unknown attacks such as this automatically.
Email Security can block malicious emails sent by threat actors as part of their campaign.
Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS),Cisco ISR andMeraki MX can detect malicious activity associated with this threat.
AMP Threat Grid helps identify malicious binaries and builds protection into all Cisco Security products.
Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs and URLs, whether users are on or off the corporate network.
Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase onSnort.org.
Cisco AMP users can use Orbital Advanced Search to run complex OSqueries to see if their endpoints are infected with this specific threat. For specific OSqueries on this threat, click here https://github.com/Cisco-Talos/osquery_queries/blob/master/win_forensics/potential_compiled_HTML_abuse.yaml
hxxp://sinetcol[.]co/A7.jpg - January
hxxp://sinetcol[.]co/D7.jpg - January
hxxp://becasmedikal[.]com.tr/A5.jpg - January
hxxp://risu[.]fi/D9.jpg - November
hxxp://topometria[.]com.cy/A12.jpg - September
hxxp://bouinteriorismo[.]com/R9.jpg - November
hxxp://optovision[.]gr/4B.jpg - October
hxxp://hotelaretes[.]gr/V8.jpg - October
hxxp://jetfleet24[.]com/T5.jpg - October
hxxps://www.med-star[.]gr/panel/?/login - C2 panel
fxp://med-star[.]gr - exfiltration FTP
742b9912f329c05296e2f837555dceea0ae3e06e80aa178a9127692d25e21479 - September 2020, Windows batch file
04910322c2e91d58e9ed3c5bcc3a18be1ba1b5582153184d1f5da3d9c42bac15 - January 2021, CHM file
aac62b80b790d96882b4b747a8ed592f45b39ceadd9864948bb391f3f41d7f9f - January 2021, CHM file
f946e1c690fc2125af4ad7d3d1b93c6af218a82d55a11a5a6ee5a9b04a763e7f - January 2021, CHM file
9cd7622ade7408c03e0c966738f51f74f884fbafdf3fe97edf4be374a7fb1d77 - November 2020, CHM file
5415bcc4bffa5191a1fac3ce3b11c46335d19f053f5d9d51a10f4ed77393ed82 - October 2020, CHM file
Downloaded obfuscated PowerShell loaders