Insolence beyond belief. Threat actors target information security developers on GitHub
Real-time threat news | Hot news | All the news
Infection source
The first infected repositories emerged two years ago. The early uploads targeted crypto wallet users—back then attackers uses repositories containing Visual Studio projects related to blockchain games, game bots and cheating.
Example of a compromised repository for the Telegram-based platform Catizen
The contents of such repositories included:
- The .csproj file containing the PreBuildEvent routine that runs malicious code before the project gets compiled,
- .suo files containing a PowerShell command.
The attackers even went as far as to cater for users who might lack sufficient IT background and provided instructions on installing Visual Studio and cloning the repository.
The file .csproj incorporating malicious code
However, at this point the perpetrators have switched their attention to another large target group—information security professionals. The malware now lurks in projects related to scanning automation, security system testing, and log analysis, and the malicious payload also includes .go and .py files where malicious code concealed behind a large number of whitespaces. Several addresses associated with the attackers have also been discovered in the bogus repositories. They include:
- muckanthropic[.]com
- muckduck.duckdns[.]org
- muckcoding[.]com
- muckdeveloper[.]com
- 130.12.182[.]172
A bogus repository containing a data parsing, cleaning, and formatting script for Fscan
A Python file containing malicious code
Malicious code in a Golang file
Infection process
PowerShell.Packed.270
Once infected files are downloaded, a PowerShell script is run in the user's system. Path examples:
- C:\Users\Public\Pictures\t.ps1,
- C:\Users\Public\Pictures\L.ps1.
PowerShell.Packed.270
The script can send queries to both attackers' servers and legitimate platforms, including YouTube, Telegram, GoogleDocs, GitCode and Pastebin.
Encrypted string obtained from Pastebin
The trojan retrieves an encrypted string from a remote host. Decrypting it provides the malware with a download link for the Quixo.7z archive. The archive is downloaded from attackers' servers or GitHub and unpacked to C:\ProgramData\Windows.Microsoft.Photos.
Microsoft.exe (Trojan.Loader.3261)
The archived content includes an application built with the Electron framework—this malicious program does most of the damage in the system. This trojan has a complex modular design. As of this writing, version 1.4.5.was its latest version. Trojan.Loader.3261 performs a variety of tasks:
- Downloads the file Nexara.7z, which contains encrypted payload, configuration information and some auxiliary files;
- Collects system information and relays it to the intruders via a Telegram bot;
- Makes sure it gets restarted automatically;
- Employs various techniques to elevate its privileges;
- Disables Windows Defender, UAC, notifications, System Restore and VSS;
- Adds custom Windows Defender exclusions;
- Injects malicious cod into legitimate processes (BackDoor.AsyncRAT.115, Trojan.InjectNET.14);
- Extracts an additional module from the archive Nexara/Nvdia.7z (JS.Stealer.191) and launches it;
- Removes McAfee, ESET, and Malwarebytes antivirus software from the device;
- Modifies the hosts file C:\windows\system32\drivers\etc\hosts.
The virus makers refer to their malware deployment methods as modes, which include mode3, mode2, mode3non and handler. Let's examine them one by one.
Mode3
This mode is designed to bypass system protection. To accomplish this, several techniques are used.
- PPID (Parent Process ID) spoofing – explorer.exe is assigned as the parent to a malicious process.
- Smart App Control bypass – circumvents Smart App Control, which prevents untrusted or potentially dangerous programs from being launched. To disable this feature, the trojan changes the VerifiedAndReputablePolicyState value in the Windows registry.
- Ntdll.dll unhooking – removes hooks that may have been introduced, for example, by Endpoint Detection and Response (EDR) software into the ntdll file. The trojan reads the original system library ntdll.dll from the disk and matches it against the process’s code section. If discrepancies that resemble hook functions are discovered, it will replace them with the original data from the file.
- Halo's Gate – executes Windows syscalls directly, which complicates their interception by EDR. The trojan retrieves functions’ SSNs (System Service Numbers) to use the routines in for malware deployment.
- ETW(Event Tracing for Windws) patch – disables Event Tracing for Windows’s diagnostics telemetry logging by altering ntdll.dll!EtwEventWrite in the memory of the respective process.
- AMSI patch – modifies AmsiScanBuffer’s function amsi.dll to ensure that a process can run scripts without being detected by an antivirus.
If successful, the trojan chooses a process to inject its code into: RegAsm.exe, dwwin.exe, dwm.exe. Malicious modules are contained in the files extracted from the Nexara.7z archive. They include boot_f, kernel_f, thread_f. These files are encrypted, and the encryption keys are stored in Nexara /manifest/config.json as b_f, k_f and t_f.
Once malicious code has been injected, the trojan uses a PowerShell script and Netstat to test its connection to a C2 server. If at least one malicious module failed to deploy, the script can send an error message to the Telegram bot.
Mode2
The trojan uses this mode if it fails to launch the malicious modules. Mode2 operates as follows:
- The file thumbcache_{11..20}.dll gets extracted from the archive Nexara.7z and then decrypted—it contains certain payload deployment routines.
- Then the trojan adds regasm.exe and dwm.exe as Windows Defender exclusions;
- A PowerShell script (PowerShell.Inject.245) is extracted from the configuration data and saved to the temp folder as a file with a random name. After that, the trojan runs the script, which, in turn, decrypts boot_f, kernel_f and thread_f and injects their content into the RegAsm.exe process;
- It then locates the file cryptwizard, decrypts it, and injects its content into the dwwin.exe process. As of this writing, this file doesn't exist and its launch flag is set to false.
- The trjoan also uses a PowerShell script and Netstat to determine whether a connection to its C2 server is available.
Mode3non
This mode is similar to Mode3. However, different protection bypass techniques are used.
Handler
Although malicious modules are deployed in the same way as in Mode2, this mode’s infection method is somewhat less flexible and involves fewer modules. For example, here the trojan doesn't use configuration files and relies solely on its readily available hardcoded data. Perhaps Handler is legacy deployment method that the virus makers didn’t discard completely for some reason.
All these modes are primarily designed to launch three payload files. two BackDoor.AsyncRAT.115 files and Trojan.InjectNET.14.
BackDoor.AsyncRAT.115
This trojan ensures that attackers gain full access to the infected device. The content of two identical malicious files is injected into processes. Only the network ports being used are different—supposedly, this enables two malware operators to control a single device simultaneously.
Trojan.InjectNET.14
This trojan injects Trojan.Clipper.688’s code into the process regasm.exe to spoof crypto wallet addresses in the clipboard. While addresses are being replaced, it takes screenshots and relays them to attackers’ Telegram bot along with information about the clipper version, title of the active window, user login and the device's IP address.
Once the payload has been deployed, the trojan also unpacks JS.Stealer.191—a malicious application built with the Electron framework—from the Nexara/Nvdia.7z archive.
JS.Stealer.191
The stealer malware attempts to determine whether it is running in a sandbox or on a virtual machine, collects information about the infected PC and steals the following user data:
- Browser data;
- FileZilla's XML files;
- The MobaXterm file MobaXterm.ini;
- Total Commander’s wcx_ftp.ini file;
- VPN settings;
- Messenger files;
- Video game account information;
- Game platform account data;
- Discord tokens.
The stolen data is compressed and forwarded to attackers via the Telegram bot.
If an ESET, McAfee or Malwarebytes antivirus is installed on the infected device, the trojan will try to remove it.
Antivirus Removal Code
The trojan modifies the system32\drivers\etc\hosts file to ensure that certain domain names associated with antivirus vendors will remain inaccessible. To prevent the user from creating and using their backups, the malware also removes all of the files and folders found in system32\drivers\etc\, except those on its whitelist, which includes hosts, networks, protocol, services and lmhosts.sam.
Evolution prospects
Attackers are constantly updating the Trojans to introduce new features. For example, Doctor Web’s researchers discovered certain unused routines that facilitate downloading and decompressing yet another archive—Lodge.7z. It contains an Electron project that hasn't been completed yet. The executable file's name is WUDFHost.exe. Its code offers us a glimpse of some of the trojan’s future features. They may include.
- Using the sc.exe utility to create a service that will ensure Microsoft.exe's persistence in the system.
- Verifying that Microsoft.exe is present on disk and downloading it again if no copy of the file can be found.
- Controlling application startup.
- Updating.
This review clearly shows that this attack poses a serious threat even to experienced users, including information security professionals. To prevent your system from getting infected, update your antivirus databases regularly and scan all of the files you download from the Internet. Dr.Web Security Space and Dr.Web Desktop Security Suite detect the malware and promptly remove the infected files.
More details about Trojan.Loader.3261
More details about Trojan.Clipper.688
More details about JS.Stealer.191