+
+
+
2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)
+2014 Dreambot (Gozi ISFB variant)
+
+
+
In 2014, a variant of Gozi ISFB was developed. Mainly, the dropper performs additional anti-vm checks (vmware, vbox, qemu), while the actual bot-dll remains unchanged in most parts. New functionality, such as TOR support, was added though and often, the Fluxxy fast-flux network is used.
+
+
+
See win.gozi for additional historical information.
+
+
+
DreamBot is also known as:
+
+
+
+
+
+
A new form of ransomware named AlphaLocker that is built by cybercriminals for cybercriminals. Like all incarnations of Ransomware As A Service (RaaS), the AlphaLocker malware program can be purchased and launched by pretty much anyone who wants to get into the ransomware business. What makes AlphaLocker different from other forms of RaaS is its relatively cheap cost. The ransomware can be purchased for just $65 in bitcoin.
+
+
+
AlphaLocker, also known as Alpha Ransomware, is based on the EDA2 ransomware, an educational project open-sourced on GitHub last year by Turkish researcher Utku Sen. A Russian coder seems to have cloned this repository before it was taken down and used it to create his ransomware, a near-perfect clone of EDA2. The ransomware’s author, is said to be paying a great deal of attention to updating the ransomware with new features, so it would always stay ahead of antivirus engines, and evade detection.
+
+
+
AlphaLocker’s encryption process starts when the ransomware contacts its C&C server. The server generates a public and a private key via the RSA-2048 algorithm, sending the public key to the user’s computer and saving the private key to its server. On the infected computer, the ransomware generates an AES-256 key for each file it encrypts, and then encrypts this key with the public RSA key, and sent to the C&C server.
+
+
+
To decrypt their files, users have to get ahold of the private RSA key which can decrypt the AES-encrypted files found on their computers. Users have to pay around 0.35 Bitcoin (~$450) to get this key, packaged within a nice decrypter.
+
+
+
AlphaLocker is also known as:
+
+
+
+
+
+
Havex is a remote access trojan (RAT) that was discovered in 2013 as part of a widespread espionage campaign targeting industrial control systems (ICS) used across numerous industries and attributed to a hacking group referred to as "Dragonfly" and "Energetic Bear". Havex is estimated to have impacted thousands of infrastructure sites, a majority of which were located in Europe and the United States. Within the energy sector, Havex specifically targeted energy grid operators, major electricity generation firms, petroleum pipeline operators, and industrial equipment providers. Havex also impacted organizations in the aviation, defense, pharmaceutical, and petrochemical industries.
+
+
+
Once installed, Havex scanned the infected system to locate any Supervisory Control and Data Acquisition (SCADA) or ICS devices on the network and sent the data back to command and control servers. To do so, the malware leveraged the Open Platform Communications (OPC) standard, which is a universal communication protocol used by ICS components across many industries that facilitates open connectivity and vendor equipment interoperability. Havex used the Distributed Component Object Model (DCOM) to connect to OPC servers inside of an ICS network and collect information such as CLSID, server name, Program ID, OPC version, vendor information, running state, group count, and server bandwidth.
+
+
+
Havex was an intelligence-collection tool used for espionage and not for the disruption or destruction of industrial systems. However, the data collected by Havex would have aided efforts to design and develop attacks against specific targets or industries.
+
+
+
Havex RAT is also known as:
+
+
+
+
+
+
Catelites Bot (identified by Avast and SfyLabs in December 2017) is an Android trojan, with ties to CronBot. Once the malicious app is installed, attackers use social engineering tricks and window overlays to get credit card details from the victim.
+The distribution vector seems to be fake apps from third-party app stores (not Google Play) or via malvertisement. After installation and activation, the app creates fake Gmail, Google Play and Chrome icons. Furthermore, the malware sends a fake system notification, telling the victim that they need to re-authenticate with Google Services and ask for their credit card details to be entered.
+Currently the malware has overlays for over 2,200 apps of banks and financial institutions.
+
+
+
Catelites is also known as:
+
+
+
+
+
+
2006 Gozi v1.0, Gozi CRM, CRM, Papras
+2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)
+
+
+
In September 2010, the source code of a particular Gozi CRM dll version was leaked. This led to two main branches: one became known as Gozi Prinimalka, which was merge with Pony and became Vawtrak/Neverquest.
+
+
+
The other branch became known as Gozi ISFB, or ISFB in short. Webinject functionality was added to this version.
+
+
+
There is one panel which often was used in combination with ISFB: IAP. The panel’s login page comes with the title 'Login - IAP'. The body contains 'AUTHORIZATION', 'Name:', 'Password:' and a single button 'Sign in' in a minimal design. Often, the panel is directly accessible by entering the C2 IP address in a browser. But there are ISFB versions which are not directly using IAP. The bot accesses a gate, which is called the 'Dreambot' gate. See win.dreambot for further information.
+
+
+
ISFB often was protected by Rovnix. This led to a further complication in the naming scheme - many companies started to call ISFB Rovnix. Because the signatures started to look for Rovnix, other trojans protected by Rovnix (in particular ReactorBot and Rerdom) sometimes got wrongly labelled.
+
+
+
In April 2016 a combination of Gozi ISFB and Nymaim was detected. This breed became known as GozNym. The merge uses a shellcode-like version of Gozi ISFB, that needs Nymaim to run. The C2 communication is performed by Nymaim.
+
+
+
See win.gozi for additional historical information.
+
+
+
ISFB is also known as:
+
+
+
+-
+
Gozi ISFB
+
+-
+
IAP
+
+-
+
Pandemyia
+
+
+
+
+
+
+
+
RedPacket Security describes NJRat as "a remote access trojan (RAT) has capabilities to log keystrokes, access the victim’s camera, steal credentials stored in browsers, open a reverse shell, upload/download files, view the victim’s desktop, perform process, file, and registry manipulations, and capabilities to let the attacker update, uninstall, restart, close, disconnect the RAT and rename its campaign ID. Through the Command & Control (CnC) server software, the attacker has capabilities to create and configure the malware to spread through USB drives."
+
+
+
It is supposedly popular with actors in the Middle East. Similar to other RATs, many leaked builders may be backdoored.
+
+
+
NjRAT is also known as:
+
+
+
+
+
+
+
2000 Ursnif aka Snifula
+2006 Gozi v1.0, Gozi CRM, CRM, Papras
+2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)
+→ 2010 Gozi Prinimalka → Vawtrak/Neverquest
+
+
+
In 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.
+It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.
+
+
+
In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.
+
+
+
Gozi is also known as:
+
+
+
+-
+
Ursnif
+
+-
+
Snifula
+
+-
+
Gozi CRM
+
+-
+
Papras
+
+-
+
CRM
+
+
+
+
+
+
+
+
Reaver is a type of malware discovered by researchers at Palo Alto Networks in November 2017, but its activity dates back to at least late 2016. Researchers identified only ten unique samples of the malware, indicating limited use, and three different variants, noted as versions 1, 2, and 3. The malware is unique as its final payload masquerades as a control panel link (CPL) file. The intended targets of this activity are unknown as of this writing; however, it was used concurrently with the SunOrcal malware and the same C2 infrastructure used by threat actors who primarily target based on the "Five Poisons" - five perceived threats deemed dangerous to, and working against the interests of, the Chinese government.
+
+
+
Reaver is also known as:
+
+
+
+
+
+
According to checkpoint, Karius is a banking trojan in development, borrowing code from Ramnit, Vawtrack as well as Trickbot, currently implementing webinject attacks only.
+
+
+
It comes with an injector that loads an intermediate "proxy" component, which in turn loads the actual banker component.
+
+
+
Communication with the c2 are in json format and encrypted with RC4 with a hardcoded key.
+
+
+
In the initial version, observed in March 2018, the webinjects were hardcoded in the binary, while in subsequent versions, they were received by the c2.
+
+
+
Karius is also known as:
+
+
+
+
+
+
"Loki Bot is a commodity malware sold on underground sites which is designed to steal private data from infected machines, and then submit that info to a command and control host via HTTP POST. This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets." - PhishMe
+
+
+
Loki-Bot employs function hashing to obfuscate the libraries utilized. While not all functions are hashed, a vast majority of them are.
+
+
+
Loki-Bot accepts a single argument/switch of ‘-u’ that simply delays execution (sleeps) for 10 seconds. This is used when Loki-Bot is upgrading itself.
+
+
+
The Mutex generated is the result of MD5 hashing the Machine GUID and trimming to 24-characters. For example: “B7E1C2CC98066B250DDB2123“.
+
+
+
Loki-Bot creates a hidden folder within the %APPDATA% directory whose name is supplied by the 8th thru 13th characters of the Mutex. For example: “%APPDATA%\ C98066\”.
+
+
+
There can be four files within the hidden %APPDATA% directory at any given time: “.exe,” “.lck,” “.hdb” and “.kdb.” They will be named after characters 13 thru 18 of the Mutex. For example: “6B250D.” Below is the explanation of their purpose:
+
+
+
FILE EXTENSION FILE DESCRIPTION
+.exe A copy of the malware that will execute every time the user account is logged into
+.lck A lock file created when either decrypting Windows Credentials or Keylogging to prevent resource conflicts
+.hdb A database of hashes for data that has already been exfiltrated to the C2 server
+.kdb A database of keylogger data that has yet to be sent to the C2 server
+
+
+
If the user is privileged, Loki-Bot sets up persistence within the registry under HKEY_LOCAL_MACHINE. If not, it sets up persistence under HKEY_CURRENT_USER.
+
+
+
The first packet transmitted by Loki-Bot contains application data.
+
+
+
The second packet transmitted by Loki-Bot contains decrypted Windows credentials.
+
+
+
The third packet transmitted by Loki-Bot is the malware requesting C2 commands from the C2 server. By default, Loki-Bot will send this request out every 10 minutes after the initial packet it sent.
+
+
+
Communications to the C2 server from the compromised host contain information about the user and system including the username, hostname, domain, screen resolution, privilege level, system architecture, and Operating System.
+
+
+
The first WORD of the HTTP Payload represents the Loki-Bot version.
+
+
+
The second WORD of the HTTP Payload is the Payload Type. Below is the table of identified payload types:
+
+
+
BYTE PAYLOAD TYPE
+0x26 Stolen Cryptocurrency Wallet
+0x27 Stolen Application Data
+0x28 Get C2 Commands from C2 Server
+0x29 Stolen File
+0x2A POS (Point of Sale?)
+0x2B Keylogger Data
+0x2C Screenshot
+
+
+
The 11th byte of the HTTP Payload begins the Binary ID. This might be useful in tracking campaigns or specific threat actors. This value value is typically “ckav.ru”. If you come across a Binary ID that is different from this, take note!
+
+
+
Loki-Bot encrypts both the URL and the registry key used for persistence using Triple DES encryption.
+
+
+
The Content-Key HTTP Header value is the result of hashing the HTTP Header values that precede it. This is likely used as a protection against researchers who wish to poke and prod at Loki-Bot’s C2 infrastructure.
+
+
+
Loki-Bot can accept the following instructions from the C2 Server:
+
+
+
BYTE INSTRUCTION DESCRIPTION
+0x00 Download EXE & Execute
+0x01 Download DLL & Load #1
+0x02 Download DLL & Load #2
+0x08 Delete HDB File
+0x09 Start Keylogger
+0x0A Mine & Steal Data
+0x0E Exit Loki-Bot
+0x0F Upgrade Loki-Bot
+0x10 Change C2 Polling Frequency
+0x11 Delete Executables & Exit
+
+
+
Suricata Signatures
+RULE SID RULE NAME
+2024311 ET TROJAN Loki Bot Cryptocurrency Wallet Exfiltration Detected
+2024312 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M1
+2024313 ET TROJAN Loki Bot Request for C2 Commands Detected M1
+2024314 ET TROJAN Loki Bot File Exfiltration Detected
+2024315 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M1
+2024316 ET TROJAN Loki Bot Screenshot Exfiltration Detected
+2024317 ET TROJAN Loki Bot Application/Credential Data Exfiltration Detected M2
+2024318 ET TROJAN Loki Bot Request for C2 Commands Detected M2
+2024319 ET TROJAN Loki Bot Keylogger Data Exfiltration Detected M2
+
+
+
LokiBot is also known as:
+
+
+
+
+
+
The NJCCIC describes 7ev3n as a ransomware "that targets the Windows OS and spreads via spam emails containing malicious attachments, as well as file sharing networks. It installs multiple files in the LocalAppData folder, each of which controls different functions including disabling bootup recovery options, deleting the ransomware installation file, encrypting data, and gaining administrator privileges. This variant also adds registry keys that disables various Windows function keys such as F1, F3, F4, F10, Alt, Num Lock, Ctrl, Enter, Escape, Shift, and Tab. Files encrypted by 7ev3n are labeled with a .R5A extension. It also locks victims out of Windows recovery options making it challenging to repair the damage done by 7ev3n."
+
+
+
7ev3n is also known as:
+
+
+
+
+
+
Simple malware with proxy/RDP and download capabilities. It often comes bundled with installers, in particular in the Chinese realm.
+
+
+
PE timestamps suggest that it came into existence in the second half of 2014.
+
+
+
Some versions perform checks of the status of the internet connection (InternetGetConnectedState: MODEM, LAN, PROXY), some versions perform simple AV process-checks (CreateToolhelp32Snapshot).
+
+
+
YoungLotus is also known as:
+
+
+
+