Microsoft code-sign check bypassed to drop Zloader malware

[Gandalf_The_Grey]

Content source

https://www.bleepingcomputer.com/news/security/microsoft-code-sign-check-bypassed-to-drop-zloader-malware/

A new Zloader campaign exploits Microsoft's digital signature verification to deploy malware payloads and steal user credentials from thousands of victims from 111 countries.

The campaign orchestrated by a threat group known as MalSmoke appears to have started in November 2021, and it's still going strong, according to Check Point researchers who have spotted it.

Zloader (aka Terdot and DELoader) is a banking malware first spotted back in 2015 that can steal account credentials and various types of sensitive private information from infiltrated systems.

More recently, Zloader has been used to drop further payloads on infected devices, including ransomware payloads such as Ryuk and Egregor,

MalSmoke has explored various ways of distributing the info-stealing malware, ranging from spam mail and malvertising to using adult content lures.

 

[Andy Ful]

This attack includes a very interesting element. One of the DLLs is a modified legal DLL signed by Microsoft. Any digitally signed file can be slightly modified without breaking the certificate. The added code is inactive, so if the modified DLL is executed as a DLL library, then the added code is not executed. Such a method can be only used as a container to hide the malicious code.
In the case of this attack, the modified DLL is executed as the HTA script by the Mshta LOLBin (the script can have any file extension). In this way, the malicious script hidden in the DLL is run by the Mshta interpreter.

 

[South Park]

testing strict file authenticode verification by setting both on W11, will share how it turns out after some time passes

View attachment 263413

I'm doing the same on Windows 10, no problems noted so far.

 

[Vitali Ortzi]

This attack includes a very interesting element. One of the DLLs is a modified legal DLL signed by Microsoft. Any digitally signed file can be slightly modified without breaking the certificate. The added code is inactive, so if the modified DLL is executed as a DLL library, then the added code is not executed. Such a method can be only used as a container to hide the malicious code.
In the case of this attack, the modified DLL is executed as the HTA script by the Mshta LOLBin (the script can have any file extension). In this way, the malicious script hidden in the DLL is run by the Mshta interpreter.

Haven’t known this was even possible any white papers of such a dll modification ?

 

[ForgottenSeer 69673]

Would this stop this?

Added to Userspace = YES in Appguard? I have had this LOLBin added to Appguard for years.

c:\Windows\*\mshta.exe

Guess they are getting bored with using Powershell?

 

[Vitali Ortzi]

Would this stop this?

Added to Userspace = YES in Appguard? I have had this LOLBin added to Appguard for years.

c:\Windows\*\mshta.exe

this vulnerability in microsoft authenticode is old

see image 12:

Can You Trust a File’s Digital Signature? New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk - Check Point Research

Research by: Golan Cohen Introduction Last seen in August 2021, Zloader, a banking malware designed to steal user credentials and private information, is back with a simple yet sophisticated infection chain. Previous Zloader campaigns, which were seen in 2020, used malicious documents, adult...

research.checkpoint.com

the threat actors appended a vbs script to the end of the dll, and using mshta.exe to call the appContact.dll, only the vbs script is loaded

"This gap is apparently a known issue mentioned in the following CVEs: CVE-2020-1599, CVE-2013-3900, and CVE-2012-0151. Microsoft addressed the issue in 2013 with a Security Bulletin and pushed a fix."

Thanks a lot !

 

[Andy Ful]

Haven’t known this was even possible any white papers of such a dll modification ?

Another method is injecting shellcode into a PE file's [WIN_CERTIFICATE] certificate table. The digital signature is not broken but the file hashes are changed (except the AuthentiHash). This possibility follows directly from the Authenticode details:

https://download.microsoft.com/download/9/c/5/9c5b2167-8017-4bae-9fde-d599bac8184a/Authenticode_PE.docx

Normally, one has to use also a kind of loader that can read/execute the shellcode embedded in the PE file. The method from the OP is simpler because it uses Mshta LOLBin as a loader.